gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36700: Fix underscore in CSRF header 

Also change the cache key in template plugin. And the X- header
that had an underscore in svc script.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This commit is contained in:
Marcel de Rooy 2024-04-26 08:32:52 +00:00 committed by Martin Renvoize
parent 643f139530
commit e4bb59683f
No known key found for this signature in database
GPG Key ID: 422B469130441A0F
4 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Koha/Middleware/CSRF.pm
View File

@ -50,7 +50,7 @@ sub call {
} elsif ( $stateful_methods{$request_method} ) {
# Get the CSRF token from the param list or the header
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN');
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,

2
Koha/Template/Plugin/Koha.pm
View File

@ -110,7 +110,7 @@ sub GenerateCSRF {
my ($self) = @_;
my $memory_cache = Koha::Cache::Memory::Lite->get_instance;
my $cache_key = "CSRF_TOKEN";
my $cache_key = "CSRF-TOKEN";
my $cached = $memory_cache->get_from_cache($cache_key);
return $cached if $cached;

6
koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js
View File

@ -86,7 +86,7 @@ class HttpClient {
? params.body
: JSON.stringify(params.body)
: undefined;
let csrf_token = { csrf_token: this.csrf_token };
let csrf_token = { "CSRF-TOKEN": this.csrf_token };
let headers = { ...csrf_token, ...params.headers };
return this._fetchJSON(
params.endpoint,
@ -107,7 +107,7 @@ class HttpClient {
? params.body
: JSON.stringify(params.body)
: undefined;
let csrf_token = { csrf_token: this.csrf_token };
let csrf_token = { "CSRF-TOKEN": this.csrf_token };
let headers = { ...csrf_token, ...params.headers };
return this._fetchJSON(
params.endpoint,
@ -123,7 +123,7 @@ class HttpClient {
}
delete(params = {}) {
let csrf_token = { csrf_token: this.csrf_token };
let csrf_token = { "CSRF-TOKEN": this.csrf_token };
let headers = { ...csrf_token, ...params.headers };
return this._fetchJSON(
params.endpoint,

2
svc/authentication
View File

@ -62,5 +62,5 @@ if ( $status eq "ok" ) {
);
$csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } );
}
print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF_TOKEN' => $csrf_token );
print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF-TOKEN' => $csrf_token );
print XMLout( { status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1 );