@@ -, +, @@ --- C4/Auth.pm | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -947,6 +947,8 @@ sub checkauth { } } + my $request_method = $query->request_method // q{}; + if ( $auth_state eq 'failed' || $logout ) { $sessionID = undef; $userid = undef; @@ -1089,7 +1091,6 @@ sub checkauth { } else { my $retuserid; - my $request_method = $query->request_method // q{}; if ( $request_method eq 'POST' @@ -1468,6 +1469,29 @@ sub checkauth { } } + if ( $auth_state eq 'completed' && defined $query->param('op') ) { + die "Cannot use GET for this request" + if $request_method ne 'POST'; + + print $query->header( + { + type => 'text/html', + charset => 'utf-8', + cookie => $cookie, + 'X-Frame-Options' => 'SAMEORIGIN', + -sameSite => 'Lax' + } + ); + + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) + unless Koha::Token->new->check_csrf( + { + session_id => scalar $query->cookie('CGISESSID'), + token => scalar $query->param('csrf_token'), + } + ); + } + $template->param( LibraryName => C4::Context->preference("LibraryName"), ); --