gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41197: Don't require a CSRF token for opac-account-pay-return.pl 

This page is intended for redirect/return from external payment vendors - they are not going to have/get a CSRF token from Koha for this.
The payments are handled in a POST to the API, so this should not be a sensitive page, it just provides user confirmation.
Some vendors use only a POST, we should not require CSRF on this page.

Test Plan:
1) Apply the first patch
2) prove t/Koha/Middleware/CSRF.t
3) Note the tests fail!
4) Apply this patch
5) prove t/Koha/Middleware/CSRF.t
6) All tests pass!

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
Kyle M Hall 2026-08-18 15:21:49 -04:00 committed by Pedro Amorim
parent 3e87d13e67
commit 812ac7155d
No known key found for this signature in database
GPG Key ID: 06B75BA7F3894D55
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Koha/Middleware/CSRF.pm
View File

@ -47,7 +47,8 @@ sub call {
my $request_path = $req->path // q{}; my $request_path = $req->path // q{};
my %path_exceptions = ( my %path_exceptions = (
'/ilsdi.pl' => 1, '/ilsdi.pl' => 1,
'/opac-account-pay-return.pl' => 1,
); );
#NOTE: Ignore ErrorDocument requests for CSRF #NOTE: Ignore ErrorDocument requests for CSRF