Bug 42066: Prevent 403 after an expired OPAC session

If a session has expired, the login form will get an empty CSRF token
and the login form will return 403

To recreate:
hit /cgi-bin/koha/sco/sco-main.pl
then hit /cgi-bin/koha/opac-main.pl
login
=> 403
Apply this patch, try again
=> Success

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2026-05-04 14:58:32 +02:00 committed by Lucas Gass
parent 951245dbc6
commit ef43cee19b
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 4 additions and 1 deletions

View File

@ -275,15 +275,18 @@ sub get_template_and_user {
}
if ($kick_out) {
$session = get_session("");
$template = C4::Templates::gettemplate(
'opac-auth.tt', 'opac',
$in->{query}
);
$template->param( sessionID => $session->id );
$cookie = $cookie_mgr->replace_in_list(
$cookie,
$in->{query}->cookie(
-name => 'CGISESSID',
-value => '',
-value => $session->id,
-HttpOnly => 1,
-secure => ( C4::Context->https_enabled() ? 1 : 0 ),
-sameSite => 'Lax',