gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 23075: (follow-up) Dissallow transparent redirects 

GET request redirects were causing the http URL to 'pass' our 'good url'
test for http => https redirected mana servers. However, on the
subsquent POST request to get a mana security token we would fail as the
POST was not transparently redirected.

This patch changes the request to be a simple_request so we will catch
bad urls earlier and it also prevents submissions for security tokens if
the configured URL is identified as bad.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This commit is contained in:
Martin Renvoize 2019-11-04 13:13:16 +00:00
parent a1161ced1d
commit 1e47e5a849
No known key found for this signature in database
GPG Key ID: 422B469130441A0F
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Koha/SharedContent.pm
View File

@ -58,8 +58,7 @@ sub process_request {
$mana_request->content( to_json($content) );
}
my $response = $userAgent->request($mana_request);
my $response = $userAgent->simple_request($mana_request);
eval { $result = from_json( $response->decoded_content, { utf8 => 1} ); };
$result->{code} = $response->code;
if ( $@ ){

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt
View File

@ -46,6 +46,7 @@
<p>Learn more about Mana KB on the <a href="https://wiki.koha-community.org/wiki/Mana_central_database">official Mana KB documentation</a>.</p>
[% IF mana_url && !bad_url %]
[% IF (mana_url) %]
<p>Your Mana KB server is currently: <strong>[% mana_url | url %]</strong></p>
[% END %]
@ -136,6 +137,7 @@
</fieldset>
</form>
[% END %]
[% END # /IF mana_url && !bad_url %]
</div>
</div> <!-- /.col-sm-10.col-sm-push-2 -->