gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36560: Add a CSRF exception for ILS-DI API 

This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token
for the ILS-DI API.

1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI
2. Enable "ILS-DI"
3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
4. Note the 403 response

5. Apply the patch
6. sudo koha-plack --restart kohadev

7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
8. Note the 200 response

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8472279d5c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2024-10-22 02:06:18 +00:00 committed by Lucas Gass
parent be478eeb66
commit b8214ffb4a
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Koha/Middleware/CSRF.pm
View File

@ -44,11 +44,20 @@ sub call {
my $request_method = $req->method // q{};
my $uri = $req->uri // q{};
my $referer = $req->referer // q{No referer};
my $request_path = $req->path // q{};
my %path_exceptions = (
'/ilsdi.pl' => 1,
);
#NOTE: Ignore ErrorDocument requests for CSRF
if ( $env->{'psgix.errordocument.SCRIPT_NAME'} ) {
return $self->app->($env);
}
elsif ( $path_exceptions{$request_path} ){
#NOTE: Ignore path exceptions for CSRF
return $self->app->($env);
}
my ($error);
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {