@@ -, +, @@ --- C4/Auth.pm | 39 +++++++++++++++++-------------------- debian/templates/plack.psgi | 12 ++++++++++++ 2 files changed, 30 insertions(+), 21 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -1322,35 +1322,32 @@ sub checkauth { track_login_daily( $userid ); - my $original_op_cud = $query->param('op-cud'); - if ( $request_method eq 'GET' ) { - $query->param('op-cud', undef); - } elsif ( $request_method eq 'POST' ) { - $query->param('op', undef); - } - - if ( defined $original_op_cud ) { + if ( $query->param('op-cud') ) { die "Cannot use GET for this request" if $request_method ne 'POST'; - print $query->header( - { - type => 'text/html', - charset => 'utf-8', - cookie => $cookie, - 'X-Frame-Options' => 'SAMEORIGIN', - -sameSite => 'Lax' - } - ); - - my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); - output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) - unless Koha::Token->new->check_csrf( + unless ( + Koha::Token->new->check_csrf( { session_id => scalar $query->cookie('CGISESSID'), token => scalar $query->param('csrf_token'), } + ) + ) + { + my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); + print $query->header( + { + type => 'text/html', + charset => 'utf-8', + cookie => $cookie, + 'X-Frame-Options' => 'SAMEORIGIN', + -sameSite => 'Lax' + } ); + + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ); + } } # In case, that this request was a login attempt, we want to prevent that users can repost the opac login --- a/debian/templates/plack.psgi +++ a/debian/templates/plack.psgi @@ -47,6 +47,18 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise $CGI::PARAM_UTF8 = 1; Koha::Caches->flush_L1_caches(); Koha::Cache::Memory::Lite->flush(); + + $request_method = $q->request_method // q{}; + if ( $request_method eq 'GET' ) { + warn "Programming error - op-cud must not be passed with GET"; + $q->param( 'op-cud', undef ); + } elsif ( defined $q->param('op') ) { + warn "Programming error - op can only be passed with GET"; + $q->param( 'op', undef ); + } else { + $q->param( 'op', $q->param('op-cud') ); + } + return $q; }; } --