From 1761a76f4b8ef350f1762581ecb49337c57f1926 Mon Sep 17 00:00:00 2001 From: Magnus Enger Date: Fri, 6 Sep 2019 09:54:04 +0200 Subject: [PATCH] Bug 22543 - Prevent "back and refresh attack" To reproduce and test: - Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl - Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1 - Click "Back", you are taken to /cgi-bin/koha/opac-user.pl - Reload the page, you see an error like "Confirm new submission of form" - Reload the page again and confirm the submission of the form - You are now logged in to the OPAC again! - Log out again - Apply this patch - Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl - Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1 - Click back, you are taken to /cgi-bin/koha/opac-user.pl - No matter how many times you reload /cgi-bin/koha/opac-user.pl, you should not see anything other than the login form. The messages and errors pages you see related to resubmitting the form might differ from the ones described here, depending on what browser you use. I tested in Chromium 76.0.x. This fix was originally proposed by LMSCloud: https://github.com/LMSCloud/Koha-LMSCloud/commit/74a7fe0f0c5b2ce0d65bd26452c6dcaf0a7f65ad --- C4/Auth.pm | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/C4/Auth.pm b/C4/Auth.pm index a7ef5fe253..f89be377f3 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1208,6 +1208,18 @@ sub checkauth { ); } + # In case, that this request was a login attempt, we want to prevent that users can repost the opac login + # request. We therefore redirect the user to the requested page again without the login parameters. + # See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get + if ( $type eq "opac" && $query->param('koha_login_context') && $query->param('password') && $query->param('userid') ) { + my $uri = URI->new($query->url(-relative=>1, -query_string=>1)); + $uri->query_param_delete('userid'); + $uri->query_param_delete('password'); + $uri->query_param_delete('koha_login_context'); + print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other'); + exit; + } + track_login_daily( $userid ); return ( $userid, $cookie, $sessionID, $flags ); -- 2.11.0