gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36598: Prohibit CUD operations with safe HTTP methods (GET/HEAD/...) 

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Julian Maurice 2024-04-15 09:08:48 +02:00 committed by Lucas Gass
parent 84054b932c
commit ed2873bf45
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Koha/App/Plugin/CSRF.pm
View File

@ -62,7 +62,12 @@ sub register {
my ( $next, $c, $action, $last ) = @_;
my $method = $c->req->method;
if ( $method eq 'POST' || $method eq 'PUT' || $method eq 'DELETE' || $method eq 'PATCH' ) {
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
my $op = $c->req->param('op');
if ( $op && $op =~ /^cud-/ ) {
return $c->reply->exception('Wrong HTTP method')->rendered(400);
}
} else {
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
return $c->reply->exception('Wrong CSRF token')->rendered(403);
}

18
t/db_dependent/mojo/csrf.t
View File

@ -8,7 +8,7 @@ use Test::Mojo;
use Koha::Database;
subtest 'CSRF - Intranet' => sub {
plan tests => 4;
plan tests => 5;
my $t = Test::Mojo->new('Koha::App::Intranet');
@ -39,10 +39,17 @@ subtest 'CSRF - Intranet' => sub {
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
};
subtest 'GETting what should be POSTed should fail' => sub {
plan tests => 3;
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)
->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' );
}
};
subtest 'CSRF - OPAC' => sub {
plan tests => 4;
plan tests => 5;
my $t = Test::Mojo->new('Koha::App::Opac');
@ -73,4 +80,11 @@ subtest 'CSRF - OPAC' => sub {
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
};
subtest 'GETting what should be POSTed should fail' => sub {
plan tests => 3;
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)
->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' );
}
};