Lines 1322-1356
sub checkauth {
Link Here
|
1322 |
|
1322 |
|
1323 |
track_login_daily( $userid ); |
1323 |
track_login_daily( $userid ); |
1324 |
|
1324 |
|
1325 |
my $original_op_cud = $query->param('op-cud'); |
1325 |
if ( $query->param('op-cud') ) { |
1326 |
if ( $request_method eq 'GET' ) { |
|
|
1327 |
$query->param('op-cud', undef); |
1328 |
} elsif ( $request_method eq 'POST' ) { |
1329 |
$query->param('op', undef); |
1330 |
} |
1331 |
|
1332 |
if ( defined $original_op_cud ) { |
1333 |
die "Cannot use GET for this request" |
1326 |
die "Cannot use GET for this request" |
1334 |
if $request_method ne 'POST'; |
1327 |
if $request_method ne 'POST'; |
1335 |
|
1328 |
|
1336 |
print $query->header( |
1329 |
unless ( |
1337 |
{ |
1330 |
Koha::Token->new->check_csrf( |
1338 |
type => 'text/html', |
|
|
1339 |
charset => 'utf-8', |
1340 |
cookie => $cookie, |
1341 |
'X-Frame-Options' => 'SAMEORIGIN', |
1342 |
-sameSite => 'Lax' |
1343 |
} |
1344 |
); |
1345 |
|
1346 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1347 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) |
1348 |
unless Koha::Token->new->check_csrf( |
1349 |
{ |
1331 |
{ |
1350 |
session_id => scalar $query->cookie('CGISESSID'), |
1332 |
session_id => scalar $query->cookie('CGISESSID'), |
1351 |
token => scalar $query->param('csrf_token'), |
1333 |
token => scalar $query->param('csrf_token'), |
1352 |
} |
1334 |
} |
|
|
1335 |
) |
1336 |
) |
1337 |
{ |
1338 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1339 |
print $query->header( |
1340 |
{ |
1341 |
type => 'text/html', |
1342 |
charset => 'utf-8', |
1343 |
cookie => $cookie, |
1344 |
'X-Frame-Options' => 'SAMEORIGIN', |
1345 |
-sameSite => 'Lax' |
1346 |
} |
1353 |
); |
1347 |
); |
|
|
1348 |
|
1349 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ); |
1350 |
} |
1354 |
} |
1351 |
} |
1355 |
|
1352 |
|
1356 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
1353 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |