gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through 

This patch changes "op" to "login_op" when logging in, so that the original op can
flow through to whichever controller is processing the login and subsequent op.

Test plan:
0. apply the patch and koha-plack --restart kohadev
1. Without logging in, go to the following:
http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run
2. Log in and note that you can see the report
3. Try logging into the OPAC
4. Try logging into the self-checkout
5. Create a new self-reg account and try logging in with the auto-filled details
6. Test anything else you can think to test here

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
David Cook 2026-01-18 23:54:13 +00:00 committed by Martin Renvoize
parent e838b70be7
commit 16c8d0d9a4
No known key found for this signature in database
GPG Key ID: 2D86E0EAEC83711B
12 changed files with 14 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
C4/Auth.pm
View File

@ -195,7 +195,7 @@ sub get_template_and_user {
$in->{query}->param( -name => 'koha_login_context', -values => ['sco'] );
} else {
my $request_method = $in->{query}->request_method // q{};
unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) {
unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) {
for my $v (qw( login_userid login_password )) {
$in->{query}->param( $v, '' )
if $in->{query}->param($v);
@ -1415,6 +1415,7 @@ sub checkauth {
$uri->query_param_delete('login_userid');
$uri->query_param_delete('login_password');
$uri->query_param_delete('koha_login_context');
$uri->query_param_delete('login_op');
$uri->query_param_delete('op');
$uri->query_param_delete('csrf_token');
unless ( $params->{do_not_print} ) {

2
C4/InstallAuth.pm
View File

@ -111,7 +111,7 @@ sub get_template_and_user {
my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query );
my $request_method = $in->{query}->request_method // q{};
unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) {
unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) {
$in->{query}->param( 'login_userid', '' );
$in->{query}->param( 'login_password', '' );
}

2
Koha/Middleware/CSRF.pm
View File

@ -68,7 +68,7 @@ sub call {
# Get the CSRF token from the param list or the header
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) {
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
$request_method, $uri, $referer;
} elsif ( !$csrf_token ) {

2
catalogue/search.pl
View File

@ -264,7 +264,7 @@ $template->param( advancedsearchesloop => $advancedsearchesloop );
$template->param( searchid => scalar $cgi->param('searchid'), );
my $default_sort_by = C4::Context->default_catalog_sort_by;
my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op');
my @sanitized_operators = $cgi->multi_param('op'); #NOTE: No longer sanitized...
# The following should only be loaded if we're bringing up the advanced search template
if ( $template_type eq 'advsearch' ) {

6
koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
View File

@ -160,10 +160,9 @@
<form action="[% script_name | html %]" method="post" name="loginform" id="loginform" class="validated">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
<input type="hidden" name="koha_login_context" value="intranet" />
[% FOREACH INPUT IN INPUTS %]
[% NEXT IF INPUT.name == "op" %]
[% NEXT IF INPUT.name == "csrf_token" %]
[% NEXT IF INPUT.name == "koha_login_context" %]
[% NEXT IF INPUT.name == "branch" %]
@ -254,10 +253,9 @@
[% ELSIF TwoFA_prompt %]
<form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
<input type="hidden" name="koha_login_context" value="intranet" />
[% FOREACH INPUT IN INPUTS %]
[% NEXT IF INPUT.name == "op" %]
[% NEXT IF INPUT.name == "csrf_token" %]
[% NEXT IF INPUT.name == "koha_login_context" %]
[% NEXT IF INPUT.name == "branch" %]

3
koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
View File

@ -57,9 +57,8 @@
<form action="[% url | html %]" method="post" id="mainform">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
[% FOREACH INPUT IN INPUTS %]
[% NEXT IF INPUT.name == "op" %]
[% NEXT IF INPUT.name == "csrf_token" %]
[% NEXT IF INPUT.name == "login_userid" %]
[% NEXT IF INPUT.name == "login_password" %]

2
koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
View File

@ -508,7 +508,7 @@
[% PROCESS login_label for="muserid" %]<input type="text" id="muserid" name="login_userid" autocomplete="off" /> <label for="mpassword">Password:</label
><input type="password" id="mpassword" name="login_password" autocomplete="off" />
<fieldset class="action">
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
<input type="submit" class="btn btn-primary" value="Log in" />
</fieldset>
</div>

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
View File

@ -236,7 +236,7 @@
[% END %]
<form action="[% form_action | html %]" name="auth" id="auth" method="post" autocomplete="off">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
<input type="hidden" name="koha_login_context" value="opac" />
<div class="local-login">

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
View File

@ -202,7 +202,7 @@
<label for="password">Password:</label>
<input class="form-control" type="password" id="password" name="login_password" autocomplete="off" />
<fieldset class="action">
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
<input type="submit" value="Log in" class="btn btn-primary" />
</fieldset>
</div>

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
View File

@ -110,7 +110,7 @@
<form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="koha_login_context" value="opac" />
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
<fieldset class="brief">
<legend>Log in to your account:</legend>
[% PROCESS login_label for="userid" %]

2
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
View File

@ -372,7 +372,7 @@
[% FOREACH INPUT IN INPUTS %]
<input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
[% END %]
<input type="hidden" name="op" value="cud-login" />
<input type="hidden" name="login_op" value="cud-login" />
</fieldset>
</form>
<!-- /#mainform -->

2
opac/opac-tags.pl
View File

@ -122,7 +122,7 @@ unless ( C4::Context->preference('TagsEnabled') ) {
if ($add_op) {
unless ($loggedinuser) {
push @errors, { +'cud-login' => 1 };
push @errors, { +'login' => 1 };
push @globalErrorIndexes, $#errors;
%newtags = (); # zero out any attempted additions
@deltags = (); # zero out any attempted deletions