From b264623e48c8bc9741df6697a39468947b89cbac Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 11 Mar 2025 15:29:10 +0100 Subject: [PATCH] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome. Signed-off-by: David Nind Signed-off-by: Baptiste Wojtkowski Signed-off-by: Jesse Maseto --- koha-tmpl/intranet-tmpl/prog/en/modules/about.tt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt index ab24a8ad83..14bc1f822a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ -98,12 +98,14 @@ Apache version: [% apacheVersion | html %] - [% IF (is_psgi) %] - - PSGI: + + PSGI: + [% IF is_psgi %] [% psgi_server | html %] - - [% END %] + [% ELSE %] + Koha is running in CGI mode. This is a security issue! Use koha-plack --help + [% END %] + [% IF Koha.Preference('SearchEngine') == 'Elasticsearch' %] Elasticsearch: