|
Lines 60-65
use Koha::Exceptions::Token;
Link Here
|
| 60 |
use base qw(Class::Accessor); |
60 |
use base qw(Class::Accessor); |
| 61 |
use constant HMAC_SHA1_LENGTH => 20; |
61 |
use constant HMAC_SHA1_LENGTH => 20; |
| 62 |
use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days.. |
62 |
use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days.. |
|
|
63 |
use constant DEFA_SESSION_ID => 0; |
| 64 |
use constant DEFA_SESSION_USERID => 'anonymous'; |
| 63 |
|
65 |
|
| 64 |
=head1 METHODS |
66 |
=head1 METHODS |
| 65 |
|
67 |
|
|
Lines 212-228
sub decode_jwt {
Link Here
|
| 212 |
|
214 |
|
| 213 |
sub _add_default_csrf_params { |
215 |
sub _add_default_csrf_params { |
| 214 |
my ( $params ) = @_; |
216 |
my ( $params ) = @_; |
| 215 |
$params->{session_id} //= ''; |
217 |
$params->{session_id} //= DEFA_SESSION_ID; |
| 216 |
if( !$params->{id} ) { |
218 |
my $userenv = C4::Context->userenv // { id => DEFA_SESSION_USERID }; |
| 217 |
if( defined( C4::Context->userenv ) ) { |
219 |
$params->{id} //= Encode::encode( 'UTF-8', $userenv->{id} ); |
| 218 |
$params->{id} = Encode::encode( 'UTF-8', C4::Context->userenv->{id} . $params->{session_id} ); |
220 |
$params->{id} .= '_' . $params->{session_id}; |
| 219 |
} else { |
221 |
|
| 220 |
$params->{id} = Encode::encode( 'UTF-8', $params->{session_id} ); |
|
|
| 221 |
} |
| 222 |
} else { |
| 223 |
$params->{id} .= $params->{session_id}; |
| 224 |
} |
| 225 |
$params->{id} //= Encode::encode( 'UTF-8', C4::Context->userenv->{id} ); |
| 226 |
my $pw = C4::Context->config('pass'); |
222 |
my $pw = C4::Context->config('pass'); |
| 227 |
$params->{secret} //= md5_base64( Encode::encode( 'UTF-8', $pw ) ), |
223 |
$params->{secret} //= md5_base64( Encode::encode( 'UTF-8', $pw ) ), |
| 228 |
return $params; |
224 |
return $params; |