|
Lines 1322-1356
sub checkauth {
Link Here
|
| 1322 |
|
1322 |
|
| 1323 |
track_login_daily( $userid ); |
1323 |
track_login_daily( $userid ); |
| 1324 |
|
1324 |
|
| 1325 |
my $original_op_cud = $query->param('op-cud'); |
1325 |
if ( $query->param('op-cud') ) { |
| 1326 |
if ( $request_method eq 'GET' ) { |
|
|
| 1327 |
$query->param('op-cud', undef); |
| 1328 |
} elsif ( $request_method eq 'POST' ) { |
| 1329 |
$query->param('op', undef); |
| 1330 |
} |
| 1331 |
|
| 1332 |
if ( defined $original_op_cud ) { |
| 1333 |
die "Cannot use GET for this request" |
1326 |
die "Cannot use GET for this request" |
| 1334 |
if $request_method ne 'POST'; |
1327 |
if $request_method ne 'POST'; |
| 1335 |
|
1328 |
|
| 1336 |
print $query->header( |
1329 |
unless ( |
| 1337 |
{ |
1330 |
Koha::Token->new->check_csrf( |
| 1338 |
type => 'text/html', |
|
|
| 1339 |
charset => 'utf-8', |
| 1340 |
cookie => $cookie, |
| 1341 |
'X-Frame-Options' => 'SAMEORIGIN', |
| 1342 |
-sameSite => 'Lax' |
| 1343 |
} |
| 1344 |
); |
| 1345 |
|
| 1346 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
| 1347 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) |
| 1348 |
unless Koha::Token->new->check_csrf( |
| 1349 |
{ |
1331 |
{ |
| 1350 |
session_id => scalar $query->cookie('CGISESSID'), |
1332 |
session_id => scalar $query->cookie('CGISESSID'), |
| 1351 |
token => scalar $query->param('csrf_token'), |
1333 |
token => scalar $query->param('csrf_token'), |
| 1352 |
} |
1334 |
} |
|
|
1335 |
) |
| 1336 |
) |
| 1337 |
{ |
| 1338 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
| 1339 |
print $query->header( |
| 1340 |
{ |
| 1341 |
type => 'text/html', |
| 1342 |
charset => 'utf-8', |
| 1343 |
cookie => $cookie, |
| 1344 |
'X-Frame-Options' => 'SAMEORIGIN', |
| 1345 |
-sameSite => 'Lax' |
| 1346 |
} |
| 1353 |
); |
1347 |
); |
|
|
1348 |
|
| 1349 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ); |
| 1350 |
} |
| 1354 |
} |
1351 |
} |
| 1355 |
|
1352 |
|
| 1356 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
1353 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |