Lines 26-36
use CGI::Session;
Link Here
|
26 |
use CGI::Session::ErrorHandler; |
26 |
use CGI::Session::ErrorHandler; |
27 |
use URI; |
27 |
use URI; |
28 |
use URI::QueryParam; |
28 |
use URI::QueryParam; |
|
|
29 |
use Try::Tiny; |
29 |
|
30 |
|
30 |
use C4::Context; |
31 |
use C4::Context; |
31 |
use C4::Templates; # to get the template |
32 |
use C4::Templates; # to get the template |
32 |
use C4::Languages; |
33 |
use C4::Languages; |
33 |
use C4::Search::History; |
34 |
use C4::Search::History; |
|
|
35 |
use C4::Output qw( output_and_exit ); |
34 |
use Koha; |
36 |
use Koha; |
35 |
use Koha::Logger; |
37 |
use Koha::Logger; |
36 |
use Koha::Caches; |
38 |
use Koha::Caches; |
Lines 52-57
use C4::Log qw( logaction );
Link Here
|
52 |
use Koha::CookieManager; |
54 |
use Koha::CookieManager; |
53 |
use Koha::Auth::Permissions; |
55 |
use Koha::Auth::Permissions; |
54 |
use Koha::Token; |
56 |
use Koha::Token; |
|
|
57 |
use Koha::Exceptions::Token; |
55 |
|
58 |
|
56 |
# use utf8; |
59 |
# use utf8; |
57 |
|
60 |
|
Lines 187-192
sub get_template_and_user {
Link Here
|
187 |
$in->{'type'}, |
190 |
$in->{'type'}, |
188 |
undef, |
191 |
undef, |
189 |
$in->{template_name}, |
192 |
$in->{template_name}, |
|
|
193 |
{ skip_csrf_check => 1 }, |
190 |
); |
194 |
); |
191 |
} |
195 |
} |
192 |
|
196 |
|
Lines 632-637
sub get_template_and_user {
Link Here
|
632 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); |
636 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); |
633 |
} |
637 |
} |
634 |
|
638 |
|
|
|
639 |
if ( $in->{query}->param('op-cud') ) { |
640 |
C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' ) |
641 |
unless Koha::Token->new->check_csrf( |
642 |
{ |
643 |
session_id => scalar $in->{query}->cookie('CGISESSID'), |
644 |
token => scalar $in->{query}->param('csrf_token'), |
645 |
} |
646 |
); |
647 |
} |
648 |
|
635 |
return ( $template, $borrowernumber, $cookie, $flags ); |
649 |
return ( $template, $borrowernumber, $cookie, $flags ); |
636 |
} |
650 |
} |
637 |
|
651 |
|
Lines 792-797
sub checkauth {
Link Here
|
792 |
my $type = shift; |
806 |
my $type = shift; |
793 |
my $emailaddress = shift; |
807 |
my $emailaddress = shift; |
794 |
my $template_name = shift; |
808 |
my $template_name = shift; |
|
|
809 |
my $params = shift; |
810 |
|
811 |
my $skip_csrf_check = $params->{skip_csrf_check} || 0; |
795 |
$type = 'opac' unless $type; |
812 |
$type = 'opac' unless $type; |
796 |
|
813 |
|
797 |
if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) { |
814 |
if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) { |
Lines 1307-1313
sub checkauth {
Link Here
|
1307 |
} |
1324 |
} |
1308 |
|
1325 |
|
1309 |
# finished authentification, now respond |
1326 |
# finished authentification, now respond |
1310 |
my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt'; |
|
|
1311 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
1327 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
1312 |
# successful login |
1328 |
# successful login |
1313 |
unless (@$cookie) { |
1329 |
unless (@$cookie) { |
Lines 1322-1356
sub checkauth {
Link Here
|
1322 |
|
1338 |
|
1323 |
track_login_daily( $userid ); |
1339 |
track_login_daily( $userid ); |
1324 |
|
1340 |
|
1325 |
my $original_op_cud = $query->param('op-cud'); |
1341 |
if ( $query->param('op-cud') ) { |
1326 |
if ( $request_method eq 'GET' ) { |
|
|
1327 |
$query->param('op-cud', undef); |
1328 |
} elsif ( $request_method eq 'POST' ) { |
1329 |
$query->param('op', undef); |
1330 |
} |
1331 |
|
1332 |
if ( defined $original_op_cud ) { |
1333 |
die "Cannot use GET for this request" |
1342 |
die "Cannot use GET for this request" |
1334 |
if $request_method ne 'POST'; |
1343 |
if $request_method eq 'GET'; |
1335 |
|
|
|
1336 |
print $query->header( |
1337 |
{ |
1338 |
type => 'text/html', |
1339 |
charset => 'utf-8', |
1340 |
cookie => $cookie, |
1341 |
'X-Frame-Options' => 'SAMEORIGIN', |
1342 |
-sameSite => 'Lax' |
1343 |
} |
1344 |
); |
1345 |
|
1344 |
|
1346 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1345 |
unless ( |
1347 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) |
1346 |
$skip_csrf_check |
1348 |
unless Koha::Token->new->check_csrf( |
1347 |
|| Koha::Token->new->check_csrf( |
1349 |
{ |
1348 |
{ |
1350 |
session_id => scalar $query->cookie('CGISESSID'), |
1349 |
session_id => scalar $query->cookie('CGISESSID'), |
1351 |
token => scalar $query->param('csrf_token'), |
1350 |
token => scalar $query->param('csrf_token'), |
1352 |
} |
1351 |
} |
1353 |
); |
1352 |
) |
|
|
1353 |
) |
1354 |
{ |
1355 |
Koha::Exceptions::Token::WrongCSRFToken->throw; |
1356 |
} |
1354 |
} |
1357 |
} |
1355 |
|
1358 |
|
1356 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
1359 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
Lines 1390-1395
sub checkauth {
Link Here
|
1390 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
1393 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
1391 |
|
1394 |
|
1392 |
my $auth_error = $query->param('auth_error'); |
1395 |
my $auth_error = $query->param('auth_error'); |
|
|
1396 |
my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt'; |
1393 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1397 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1394 |
$template->param( |
1398 |
$template->param( |
1395 |
login => 1, |
1399 |
login => 1, |