gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 39055: Add more login_op checks to middleware 

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
David Cook 2026-02-03 00:15:27 +00:00 committed by Martin Renvoize
parent 9121cbd8a4
commit 1e504eb771
No known key found for this signature in database
GPG Key ID: 2D86E0EAEC83711B
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Koha/Middleware/CSRF.pm
View File

@ -60,17 +60,27 @@ sub call {
}
my ($error);
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op,
$request_method, $uri, $referer;
if ( $stateless_methods{$request_method} ) {
if ( defined $original_op && $original_op =~ m{^cud-} ) {
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)",
$original_op,
$request_method, $uri, $referer;
} elsif ( defined $req->param('login_op') ) {
$error = sprintf "Programming error - login_op not permitted for %s %s (referer: %s)",
$request_method, $uri, $referer;
}
} elsif ( $stateful_methods{$request_method} ) {
# Get the CSRF token from the param list or the header
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) {
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
$request_method, $uri, $referer;
} elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) {
$error = sprintf "Programming error - login_op must contain cud-login for %s %s (referer: %s)",
$request_method, $uri, $referer;
} elsif ( !$csrf_token ) {
$error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method,
$uri, $referer;