From 812ac7155d366b3190b3c019d1098287eaa6d363 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Tue, 18 Aug 2026 15:21:49 -0400 Subject: [PATCH] Bug 41197: Don't require a CSRF token for opac-account-pay-return.pl This page is intended for redirect/return from external payment vendors - they are not going to have/get a CSRF token from Koha for this. The payments are handled in a POST to the API, so this should not be a sensitive page, it just provides user confirmation. Some vendors use only a POST, we should not require CSRF on this page. Test Plan: 1) Apply the first patch 2) prove t/Koha/Middleware/CSRF.t 3) Note the tests fail! 4) Apply this patch 5) prove t/Koha/Middleware/CSRF.t 6) All tests pass! Signed-off-by: David Cook Signed-off-by: Pedro Amorim --- Koha/Middleware/CSRF.pm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm index 07740a64ed..f604f56161 100644 --- a/Koha/Middleware/CSRF.pm +++ b/Koha/Middleware/CSRF.pm @@ -47,7 +47,8 @@ sub call { my $request_path = $req->path // q{}; my %path_exceptions = ( - '/ilsdi.pl' => 1, + '/ilsdi.pl' => 1, + '/opac-account-pay-return.pl' => 1, ); #NOTE: Ignore ErrorDocument requests for CSRF