gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Magnus Enger 1d27831bcc Bug 22543: Prevent "back and refresh attack" 
To reproduce and test:
- Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click "Back", you are taken to /cgi-bin/koha/opac-user.pl
- Reload the page, you see an error like "Confirm new submission
  of form"
- Reload the page again and confirm the submission of the form
- You are now logged in to the OPAC again!
- Log out again
- Apply this patch
- Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click back, you are taken to /cgi-bin/koha/opac-user.pl
- No matter how many times you reload /cgi-bin/koha/opac-user.pl,
  you should not see anything other than the login form.
- Check that Self Check Out still works as it should, by making
  sure you have a user with self_check permissions, then setting
  WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and
  AutoSelfCheckPass appropriately. Then visit
  /cgi-bin/koha/sco/sco-main.pl and verify everything works as
  expected.

The messages and errors pages you see related to resubmitting the
form might differ from the ones described here, depending on what
browser you use. I tested in Chromium 76.0.x.

This fix was originally proposed by LMSCloud:
74a7fe0f0c

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2019-11-22 17:32:02 +00:00
..
AuthoritiesMarc Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Barcodes Bug 21937: Syspref autoBarcode annual doesn't increment properly barcode 2019-04-26 15:33:18 +01:00
ClassSortRoutine Bug 16011: $VERSION - Remove use vars qw(); 2016-03-24 17:20:39 +00:00
ClassSplitRoutine Bug 15836: Add the ability to defined custom methods to split call number in labels 2018-11-13 15:18:22 +00:00
Creators Bug 22878: Do not pass layout_id on creating a layout 2019-05-30 08:11:10 +01:00
External Bug 22010: Check preferences for ebook integration 2019-05-08 15:11:06 +01:00
Form Bug 16259: Replace CGI->param with CGI->multi_param in list context - part 2 2016-05-16 17:28:06 +00:00
Heading Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
ILSDI Bug 23156: [18.11] Add pagination to checkouts in ILS-DI GetPatronInfo service 2019-07-25 20:43:05 +00:00
Installer Bug 22474: Clone field config before adding fields to it 2019-04-25 15:04:38 +01:00
Labels Bug 15836: Add the ability to defined custom methods to split call number in labels 2018-11-13 15:18:22 +00:00
Linker Bug 21450: Cache authorities search using term and auth_type 2019-05-30 21:24:27 +01:00
Members Bug 20444: Remove sub GetAttributes 2018-05-03 13:26:49 -03:00
OAI Bug 18601: OAI/Sets.t mangles data due to truncate in ModOAISetsBiblios 2017-06-13 16:18:59 -03:00
Output Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Patroncards Bug 22429: Infinite loop in patron card printing 2019-03-19 09:33:49 +00:00
Reports Bug 23624: (QA follow-up) Test error cases 2019-10-17 22:29:40 +00:00
SIP Bug 22037: (QA follow-up) Correct misleading comment 2019-10-17 00:14:45 +00:00
Search Bug 17323: Column search_history.time cannot be null 2016-11-18 13:51:37 +00:00
Serials Bug 20144: [sql_modes] Add default value for subscription_numberpatterns.description in tests 2018-02-13 13:58:53 -03:00
Utils Bug 20514: Use streetnumber when searching for patrons by address 2019-05-30 08:22:28 +01:00
Accounts.pm Bug 18677: Remove new issue_id param from charlostitem 2018-11-16 12:43:11 +00:00
Acquisition.pm Bug 22541: Invoice adjustments should show invoice number and include link on ordered.pl and spent.pl 2019-04-15 13:07:34 +01:00
Auth.pm Bug 22543: Prevent "back and refresh attack" 2019-11-22 17:32:02 +00:00
Auth_cas_servers.yaml.sample Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig 2016-08-08 13:16:36 +00:00
Auth_with_cas.pm Bug 19160: Add POD 2018-03-23 11:45:38 -03:00
Auth_with_ldap.pm Bug 22461: (follow-up) Use `exists` not `defined` 2019-04-26 14:40:37 +01:00
Auth_with_shibboleth.pm Bug 23526: Don't use encoded question mark in shib_login_url 2019-10-17 00:35:22 +00:00
AuthoritiesMarc.pm Bug 21036: Remove odd number of elements warnings from AuthoritiesMarc.pm 2019-05-08 16:48:46 +01:00
BackgroundJob.pm Bug 16011: $VERSION - Remove empty BEGIN block 2016-03-24 17:20:41 +00:00
Barcodes.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Biblio.pm Bug 21036: Fix warnings from C4/Biblio 2019-05-08 16:48:31 +01:00
Bookseller.pm Bug 14535: Update the supplier filter too 2017-03-31 12:38:44 +00:00
Boolean.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Breeding.pm Bug 12747: (QA follow-up) Treat 010 according to marcflavour 2018-10-01 13:56:26 +00:00
Budgets.pm Bug 18736: (follow-up) Remove duplicate code and adjust tests 2019-03-25 14:29:30 +00:00
Calendar.pm Bug 14572 - insert_single_holiday() forces a value on an AUTO_INCREMENT column, during an INSERT 2017-07-06 14:29:04 -03:00
Charset.pm Bug 18910: Revert "Bug 18152 : fix unimarc label in SetMarcUnicodeFlag" 2017-07-26 14:01:51 -03:00
Circulation.pm Bug 23679: fix software error when trying to transfer an unknown barcode 2019-11-13 22:34:51 +00:00
ClassSortRoutine.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
ClassSource.pm Bug 15836: Remove deprecated subroutines 2018-11-13 18:56:18 +00:00
ClassSplitRoutine.pm Bug 15836: Add the ability to defined custom methods to split call number in labels 2018-11-13 15:18:22 +00:00
Context.pm Bug 14302: (follow-up) Remove traces in C4::Search and C4::Context 2018-08-31 11:24:22 +00:00
Contract.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
CourseReserves.pm Bug 22142: Do not revert data if 'unchanged' was set 2019-08-28 00:37:31 +00:00
Creators.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Debug.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
HTML5Media.pm Bug 21742: Fix YouTube variable propagation 2018-11-01 18:59:33 +00:00
Heading.pm Bug 19365: (QA follow-up) Ensure we use a modern enough perl 2018-11-26 16:11:03 +00:00
HoldsQueue.pm Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
Images.pm Bug 21987: Do not generate true color thumbnails if not needed 2019-03-19 09:54:47 +00:00
ImportBatch.pm Bug 21183: Replace C4::Items::GetItemnumberFromBarcode calls 2018-08-30 13:40:35 +00:00
ImportExportFramework.pm Bug 18143: Silence ods MARC framework export flood 2019-02-26 09:08:30 +00:00
InstallAuth.pm Bug 21137: Replace USER_INFO with logged_in_user 2018-08-14 12:43:10 +00:00
Installer.pm Bug 21651: Always insert notice templates related tables 2019-05-30 20:23:15 +01:00
ItemCirculationAlertPreference.pm Bug 15407: Koha::Patron::Categories - replace C4::Category->all 2016-09-08 13:29:03 +00:00
Items.pm Bug 22899: (QA follow-up) Change accessor name 2019-05-24 14:36:41 +01:00
Koha.pm Bug 23324: (QA follow-up) Typo and remove unneeded use statement 2019-09-21 09:00:29 +00:00
Labels.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Languages.pm Bug 20115: Set the languages order with the pref values 2018-04-04 15:45:43 -03:00
Letters.pm Bug 21829: Correctly format dateexpiry in notices (date only) 2019-02-12 13:17:09 +00:00
Linker.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Log.pm Bug 19528: Fix a few typos like corrosponding 2017-10-27 14:09:04 -03:00
MarcModificationTemplates.pm Bug 21831: Allow move all fields even if destination field is different 2019-05-30 20:51:54 +01:00
Matcher.pm Bug 23324: Add an ISBN normalization routine 2019-09-21 08:59:46 +00:00
Members.pm Bug 19920: Removed unnecessary code from C4/Members.pm 2019-01-31 16:37:44 +00:00
Message.pm Bug 19743: Update header and footer on each item for checkin / checkout / renewal notices 2018-08-14 11:55:07 +00:00
NewsChannels.pm Bug 19528: Fix a few typos like corrosponding 2017-10-27 14:09:04 -03:00
Output.pm Bug 22478: Prevent XSS vulnerabilities when pagination appears 2019-04-29 10:43:11 +01:00
Overdues.pm Bug 21196: Use replacement cost from the item type if not set at item level 2018-09-26 16:00:30 +00:00
Patroncards.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Print.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Record.pm Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
Reports.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Reserves.pm Bug 17978: Circ rules will not limit holds 2019-04-15 11:59:19 +01:00
Ris.pm Bug 10306: Core module changes for multiple mappings 2017-12-07 14:44:15 -03:00
RotatingCollections.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
SMS.pm Bug 19134: C4::SMS falils on long driver name 2017-08-25 10:51:24 -03:00
Scheduler.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Scrubber.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Search.pm Bug 11677: Use zebra not-onloan-count index for availability limit 2019-09-05 21:52:49 +00:00
Serials.pm Bug 10215: Increase the size of opacnote and librariannote for table subscriptionhistory 2019-06-12 22:21:05 +00:00
Service.pm Bug 7550: [QA Follow-up] Resolve param warning from sco-patron-image 2017-05-08 09:00:26 -04:00
ShelfBrowser.pm Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
SocialData.pm Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
Stats.pm Bug 20510: Remove unused sub TotalPaid from C4::Stats 2018-04-05 14:17:36 -03:00
Suggestions.pm Bug 22907: Add missing use statement 2019-05-30 21:36:56 +01:00
TTParser.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
Tags.pm Bug 16637: Dependency for C4::Tags not listed 2016-06-10 18:05:10 +00:00
Templates.pm Bug 20538: Remove the need of writing [% KOHA_VERSION %] everywhere 2018-04-13 11:49:44 -03:00
TmplToken.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
TmplTokenType.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
UsageStats.pm Bug 21226: Remove xISBN services 2018-08-16 13:20:22 +00:00
XISBN.pm Bug 12537: Don't retrieve XISBN results for the same biblionumber 2019-08-06 04:35:29 +00:00
XSLT.pm Bug 22899: (QA follow-up) Change accessor name 2019-05-24 14:36:41 +01:00