|
Lines 947-952
sub checkauth {
Link Here
|
| 947 |
} |
947 |
} |
| 948 |
} |
948 |
} |
| 949 |
|
949 |
|
|
|
950 |
my $request_method = $query->request_method // q{}; |
| 951 |
|
| 950 |
if ( $auth_state eq 'failed' || $logout ) { |
952 |
if ( $auth_state eq 'failed' || $logout ) { |
| 951 |
$sessionID = undef; |
953 |
$sessionID = undef; |
| 952 |
$userid = undef; |
954 |
$userid = undef; |
|
Lines 1089-1095
sub checkauth {
Link Here
|
| 1089 |
} |
1091 |
} |
| 1090 |
else { |
1092 |
else { |
| 1091 |
my $retuserid; |
1093 |
my $retuserid; |
| 1092 |
my $request_method = $query->request_method // q{}; |
|
|
| 1093 |
|
1094 |
|
| 1094 |
if ( |
1095 |
if ( |
| 1095 |
$request_method eq 'POST' |
1096 |
$request_method eq 'POST' |
|
Lines 1468-1473
sub checkauth {
Link Here
|
| 1468 |
} |
1469 |
} |
| 1469 |
} |
1470 |
} |
| 1470 |
|
1471 |
|
|
|
1472 |
if ( $auth_state eq 'completed' && defined $query->param('op') ) { |
| 1473 |
die "Cannot use GET for this request" |
| 1474 |
if $request_method ne 'POST'; |
| 1475 |
|
| 1476 |
print $query->header( |
| 1477 |
{ |
| 1478 |
type => 'text/html', |
| 1479 |
charset => 'utf-8', |
| 1480 |
cookie => $cookie, |
| 1481 |
'X-Frame-Options' => 'SAMEORIGIN', |
| 1482 |
-sameSite => 'Lax' |
| 1483 |
} |
| 1484 |
); |
| 1485 |
|
| 1486 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) |
| 1487 |
unless Koha::Token->new->check_csrf( |
| 1488 |
{ |
| 1489 |
session_id => scalar $query->cookie('CGISESSID'), |
| 1490 |
token => scalar $query->param('csrf_token'), |
| 1491 |
} |
| 1492 |
); |
| 1493 |
} |
| 1494 |
|
| 1471 |
$template->param( |
1495 |
$template->param( |
| 1472 |
LibraryName => C4::Context->preference("LibraryName"), |
1496 |
LibraryName => C4::Context->preference("LibraryName"), |
| 1473 |
); |
1497 |
); |
| 1474 |
- |
|
|