View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/C4/Auth.pm (-24 / +28 lines)
Lines 26-36 use CGI::Session; Link Here
26
use CGI::Session::ErrorHandler;
26
use CGI::Session::ErrorHandler;
27
use URI;
27
use URI;
28
use URI::QueryParam;
28
use URI::QueryParam;
29
use Try::Tiny;
29
30
30
use C4::Context;
31
use C4::Context;
31
use C4::Templates;    # to get the template
32
use C4::Templates;    # to get the template
32
use C4::Languages;
33
use C4::Languages;
33
use C4::Search::History;
34
use C4::Search::History;
35
use C4::Output qw( output_and_exit );
34
use Koha;
36
use Koha;
35
use Koha::Logger;
37
use Koha::Logger;
36
use Koha::Caches;
38
use Koha::Caches;
Lines 52-57 use C4::Log qw( logaction ); Link Here
52
use Koha::CookieManager;
54
use Koha::CookieManager;
53
use Koha::Auth::Permissions;
55
use Koha::Auth::Permissions;
54
use Koha::Token;
56
use Koha::Token;
57
use Koha::Exceptions::Token;
55
58
56
# use utf8;
59
# use utf8;
57
60
Lines 187-192 sub get_template_and_user { Link Here
187
            $in->{'type'},
190
            $in->{'type'},
188
            undef,
191
            undef,
189
            $in->{template_name},
192
            $in->{template_name},
193
            { skip_csrf_check => 1 },
190
        );
194
        );
191
    }
195
    }
192
196
Lines 632-637 sub get_template_and_user { Link Here
632
        $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
636
        $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
633
    }
637
    }
634
638
639
    if ( $in->{query}->param('op-cud') ) {
640
        C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' )
641
            unless Koha::Token->new->check_csrf(
642
            {
643
                session_id => scalar $in->{query}->cookie('CGISESSID'),
644
                token      => scalar $in->{query}->param('csrf_token'),
645
            }
646
            );
647
    }
648
635
    return ( $template, $borrowernumber, $cookie, $flags );
649
    return ( $template, $borrowernumber, $cookie, $flags );
636
}
650
}
637
651
Lines 792-797 sub checkauth { Link Here
792
    my $type            = shift;
806
    my $type            = shift;
793
    my $emailaddress    = shift;
807
    my $emailaddress    = shift;
794
    my $template_name   = shift;
808
    my $template_name   = shift;
809
    my $params          = shift;
810
811
    my $skip_csrf_check = $params->{skip_csrf_check} || 0;
795
    $type = 'opac' unless $type;
812
    $type = 'opac' unless $type;
796
813
797
    if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
814
    if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
Lines 1307-1313 sub checkauth { Link Here
1307
    }
1324
    }
1308
1325
1309
    # finished authentification, now respond
1326
    # finished authentification, now respond
1310
    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
1311
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1327
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1312
        # successful login
1328
        # successful login
1313
        unless (@$cookie) {
1329
        unless (@$cookie) {
Lines 1322-1356 sub checkauth { Link Here
1322
1338
1323
        track_login_daily( $userid );
1339
        track_login_daily( $userid );
1324
1340
1325
        my $original_op_cud = $query->param('op-cud');
1341
        if ( $query->param('op-cud') ) {
1326
        if ( $request_method eq 'GET' ) {
1327
            $query->param('op-cud', undef);
1328
        } elsif ( $request_method eq 'POST' ) {
1329
            $query->param('op', undef);
1330
        }
1331
1332
        if ( defined $original_op_cud ) {
1333
            die "Cannot use GET for this request"
1342
            die "Cannot use GET for this request"
1334
                if $request_method ne 'POST';
1343
                if $request_method eq 'GET';
1335
1336
            print $query->header(
1337
                {
1338
                    type              => 'text/html',
1339
                    charset           => 'utf-8',
1340
                    cookie            => $cookie,
1341
                    'X-Frame-Options' => 'SAMEORIGIN',
1342
                    -sameSite         => 'Lax'
1343
                }
1344
            );
1345
1344
1346
            my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1345
            unless (
1347
            output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
1346
                $skip_csrf_check
1348
                unless Koha::Token->new->check_csrf(
1347
                || Koha::Token->new->check_csrf(
1349
                    {
1348
                    {
1350
                        session_id => scalar $query->cookie('CGISESSID'),
1349
                        session_id => scalar $query->cookie('CGISESSID'),
1351
                        token      => scalar $query->param('csrf_token'),
1350
                        token      => scalar $query->param('csrf_token'),
1352
                    }
1351
                    }
1353
                );
1352
                )
1353
                )
1354
            {
1355
                Koha::Exceptions::Token::WrongCSRFToken->throw;
1356
            }
1354
        }
1357
        }
1355
1358
1356
        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
1359
        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
Lines 1390-1395 sub checkauth { Link Here
1390
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1393
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1391
1394
1392
    my $auth_error = $query->param('auth_error');
1395
    my $auth_error = $query->param('auth_error');
1396
    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
1393
    my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1397
    my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1394
    $template->param(
1398
    $template->param(
1395
        login                                 => 1,
1399
        login                                 => 1,
(-)a/Koha/Exceptions/Token.pm (+5 lines)
Lines 27-32 use Exception::Class ( Link Here
27
        isa => 'Koha::Exceptions::Token',
27
        isa => 'Koha::Exceptions::Token',
28
        description => 'Bad pattern for random token generation'
28
        description => 'Bad pattern for random token generation'
29
    },
29
    },
30
    'Koha::Exceptions::Token::WrongCSRFToken' => {
31
        isa => 'Koha::Exceptions::Token',
32
        description => 'Invalid CSRF Token'
33
    },
34
30
);
35
);
31
36
32
=head1 NAME
37
=head1 NAME
(-)a/debian/templates/plack.psgi (-1 / +13 lines)
Lines 47-52 use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise Link Here
47
        $CGI::PARAM_UTF8 = 1;
47
        $CGI::PARAM_UTF8 = 1;
48
        Koha::Caches->flush_L1_caches();
48
        Koha::Caches->flush_L1_caches();
49
        Koha::Cache::Memory::Lite->flush();
49
        Koha::Cache::Memory::Lite->flush();
50
51
        $original_op_cud = $q->param('op-cud');
52
        $request_method  = $q->request_method // q{};
53
        if ( $request_method eq 'GET' && defined $original_op_cud ) {
54
            warn "Programming error - op-cud must not be passed with GET";
55
            $q->param( 'op-cud', undef );
56
        } elsif ( $request_method ne 'GET' && defined $q->param('op') ) {
57
            warn "Programming error - op can only be passed with GET";
58
            $q->param( 'op', undef );
59
        } else {
60
            $q->param( 'op', $original_op_cud );
61
        }
62
50
        return $q;
63
        return $q;
51
    };
64
    };
52
}
65
}
53
- 

Return to bug 34478