gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test 

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
David Cook 2026-02-03 00:30:56 +00:00 committed by Martin Renvoize
parent 1e504eb771
commit 137b41c510
No known key found for this signature in database
GPG Key ID: 2D86E0EAEC83711B
2 changed files with 23 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Koha/App/Plugin/CSRF.pm
View File

@ -73,18 +73,27 @@ sub register {
my $method = $c->req->method;
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
my $op = $c->req->param('op');
my $op = $c->req->param('op');
my $login_op = $c->req->param('login_op');
if ( $op && $op =~ /^cud-/ ) {
return $c->reply->exception(
'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
->rendered(400);
} elsif ( defined $login_op ) {
return $c->reply->exception('Incorrect use of a safe HTTP method with a `login_op` parameter')
->rendered(400);
}
} else {
my $op = $c->req->param('op');
my $op = $c->req->param('op');
my $login_op = $c->req->param('login_op');
if ( $op && $op !~ /^cud-/ ) {
return $c->reply->exception(
'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
->rendered(400);
} elsif ( defined $login_op && $login_op !~ /^cud-login$/ ) {
return $c->reply->exception(
'Incorrect use of an unsafe HTTP method with a `login_op` parameter that does not contain cud-login'
)->rendered(400);
}
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {

24
t/db_dependent/mojo/csrf.t
View File

@ -27,7 +27,7 @@ subtest 'CSRF - Intranet' => sub {
subtest 'With a wrong CSRF token' => sub {
plan tests => 3;
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } )
->status_is(403)
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
};
@ -39,7 +39,7 @@ subtest 'CSRF - Intranet' => sub {
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } )
->status_is(200)
->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
};
@ -47,8 +47,8 @@ subtest 'CSRF - Intranet' => sub {
subtest 'GETting what should be POSTed should fail' => sub {
plan tests => 3;
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like(
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/,
$t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like(
qr/Incorrect use of a safe HTTP method with a `login_op` parameter/,
'Body contains correct error message'
);
};
@ -56,8 +56,8 @@ subtest 'CSRF - Intranet' => sub {
subtest 'POSTing what should be GET should fail' => sub {
plan tests => 3;
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like(
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/,
$t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like(
qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/,
'Body contains correct error message'
);
};
@ -82,7 +82,7 @@ subtest 'CSRF - OPAC' => sub {
subtest 'With a wrong CSRF token' => sub {
plan tests => 3;
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } )
->status_is(403)
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
};
@ -94,7 +94,7 @@ subtest 'CSRF - OPAC' => sub {
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } )
->status_is(200)
->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
};
@ -102,8 +102,8 @@ subtest 'CSRF - OPAC' => sub {
subtest 'GETting what should be POSTed should fail' => sub {
plan tests => 3;
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like(
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/,
$t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like(
qr/Incorrect use of a safe HTTP method with a `login_op` parameter/,
'Body contains correct error message'
);
};
@ -111,8 +111,8 @@ subtest 'CSRF - OPAC' => sub {
subtest 'POSTing what should be GET should fail' => sub {
plan tests => 3;
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like(
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/,
$t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like(
qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/,
'Body contains correct error message'
);
};