Attachment #162108 for bug #36084

View | Details | Raw Unified | Return to bug 36084
Collapse All | Expand All




        $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
    }

    if ( $in->{query}->param('invalid_csrf_token') ) {
        Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
        C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' );
            Koha::Token->new->check_csrf(
                {
                    session_id => scalar $in->{query}->cookie('CGISESSID'),
                    token      => scalar $in->{query}->param('csrf_token'),
                }
            )
            )
        {
            Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
            C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' );
        }
    }

    return ( $template, $borrowernumber, $cookie, $flags );

        my $patron = $userid ? Koha::Patrons->find({ userid => $userid }) : undef;
        $patron->update_lastseen('login') if $patron;

        # FIXME This is only needed for scripts not using plack
        my $op = $query->param('op');
        if ( defined $op && $op =~ m{^cud-} ) {
            die "Cannot use GET for this request"
                if $request_method eq 'GET';
        }


        if ( !$skip_csrf_check && $query->param('invalid_csrf_token') ) {
            Koha::Exceptions::Token::WrongCSRFToken->throw;
                    {
                        session_id => scalar $query->cookie('CGISESSID'),
                        token      => scalar $query->param('csrf_token'),
                    }
                )
                )
            {
                Koha::Exceptions::Token::WrongCSRFToken->throw;
            }
        }

        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login




        my $original_op    = $q->param('op');
        my $request_method = $q->request_method // q{};
        if ( $request_method eq 'GET' && defined $original_op && $original_op =~ m{^cud-} ) {
            Koha::Logger->get->warn("Programming error - op '$original_op' must not start with 'cud-' for GET");
            $q->param( 'op', '' );
            $q->param( 'debug_programming_error', "'$original_op' must not start with 'cud-' for GET" );
        } elsif ( $request_method ne 'GET' ) {
            # Get the CSRF token from the param list or the header
            my $csrf_token = $q->param('csrf_token') || $q->http('HTTP_CSRF_TOKEN');

            if ( defined $q->param('op') && $original_op !~ m{^cud-} ) {
                Koha::Logger->get->warn("Programming error - op '$original_op' must start with 'cud-' for $request_method");
                $q->param( 'op', '' );
                $q->param( 'debug_programming_error', "'$original_op' must start with 'cud-' for $request_method" );
            }

            if ( $csrf_token ) {
                unless (
                    Koha::Token->new->check_csrf(
                        {
                            session_id => scalar $q->cookie('CGISESSID'),
                            token      => $csrf_token,
                        }
                    )
                    )
                {
                    Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
                    $q->param( 'op', '' );
                    $q->param( 'invalid_csrf_token', 1);
                }
            } else {
                Koha::Logger->get->warn("Programming error - No CSRF token passed for $request_method");
                $q->param( 'op', '' );
                $q->param( 'debug_programming_error', "No CSRF token passed for $request_method" );
            }
        }

        return $q;
- 

Return to bug 36084

Lines 643-662 sub get_template_and_user { Link Here

(-)a/C4/Auth.pm (-26 / +8 lines)
643	$cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );	643	$cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
644	}	644	}
645		645
646	my $op = $in->{query}->param('op');	646	if ( $in->{query}->param('invalid_csrf_token') ) {
647	if ( defined $op && $op =~ m{^cud-} ) {	647	Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
648	unless (	648	C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' );
649	Koha::Token->new->check_csrf(
650	{
651	session_id => scalar $in->{query}->cookie('CGISESSID'),
652	token => scalar $in->{query}->param('csrf_token'),
653	}
654	)
655	)
656	{
657	Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
658	C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' );
659	}
660	}	649	}
661		650
662	return ( $template, $borrowernumber, $cookie, $flags );	651	return ( $template, $borrowernumber, $cookie, $flags );
Lines 1354-1376 sub checkauth { Link Here
1354	my $patron = $userid ? Koha::Patrons->find({ userid => $userid }) : undef;	1343	my $patron = $userid ? Koha::Patrons->find({ userid => $userid }) : undef;
1355	$patron->update_lastseen('login') if $patron;	1344	$patron->update_lastseen('login') if $patron;
1356		1345
		1346	# FIXME This is only needed for scripts not using plack
1357	my $op = $query->param('op');	1347	my $op = $query->param('op');
1358	if ( defined $op && $op =~ m{^cud-} ) {	1348	if ( defined $op && $op =~ m{^cud-} ) {
1359	die "Cannot use GET for this request"	1349	die "Cannot use GET for this request"
1360	if $request_method eq 'GET';	1350	if $request_method eq 'GET';
		1351	}
1361		1352
1362	unless (	1353
1363	$skip_csrf_check	1354	if ( !$skip_csrf_check && $query->param('invalid_csrf_token') ) {
1364	\|\| Koha::Token->new->check_csrf(	1355	Koha::Exceptions::Token::WrongCSRFToken->throw;
1365	{
1366	session_id => scalar $query->cookie('CGISESSID'),
1367	token => scalar $query->param('csrf_token'),
1368	}
1369	)
1370	)
1371	{
1372	Koha::Exceptions::Token::WrongCSRFToken->throw;
1373	}
1374	}	1356	}
1375		1357
1376	# In case, that this request was a login attempt, we want to prevent that users can repost the opac login	1358	# In case, that this request was a login attempt, we want to prevent that users can repost the opac login

Lines 51-63 use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise Link Here

(-)a/debian/templates/plack.psgi (-6 / +30 lines)
51	my $original_op = $q->param('op');	51	my $original_op = $q->param('op');
52	my $request_method = $q->request_method // q{};	52	my $request_method = $q->request_method // q{};
53	if ( $request_method eq 'GET' && defined $original_op && $original_op =~ m{^cud-} ) {	53	if ( $request_method eq 'GET' && defined $original_op && $original_op =~ m{^cud-} ) {
54	warn "Programming error - op '$original_op' must not start with 'cud-' for GET";	54	Koha::Logger->get->warn("Programming error - op '$original_op' must not start with 'cud-' for GET");
55	$q->param( 'op', '' );	55	$q->param( 'op', '' );
56	$q->param( 'debug_programming_error', "'$original_op' must not start with 'cud-' for GET" );	56	$q->param( 'debug_programming_error', "'$original_op' must not start with 'cud-' for GET" );
57	} elsif ( $request_method ne 'GET' && defined $q->param('op') && $original_op !~ m{^cud-} ) {	57	} elsif ( $request_method ne 'GET' ) {
58	warn "Programming error - op '$original_op' must start with 'cud-' for $request_method";	58	# Get the CSRF token from the param list or the header
59	$q->param( 'op', '' );	59	my $csrf_token = $q->param('csrf_token') \|\| $q->http('HTTP_CSRF_TOKEN');
60	$q->param( 'debug_programming_error', "'$original_op' must start with 'cud-' for $request_method" );	60
		61	if ( defined $q->param('op') && $original_op !~ m{^cud-} ) {
		62	Koha::Logger->get->warn("Programming error - op '$original_op' must start with 'cud-' for $request_method");
		63	$q->param( 'op', '' );
		64	$q->param( 'debug_programming_error', "'$original_op' must start with 'cud-' for $request_method" );
		65	}
		66
		67	if ( $csrf_token ) {
		68	unless (
		69	Koha::Token->new->check_csrf(
		70	{
		71	session_id => scalar $q->cookie('CGISESSID'),
		72	token => $csrf_token,
		73	}
		74	)
		75	)
		76	{
		77	Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
		78	$q->param( 'op', '' );
		79	$q->param( 'invalid_csrf_token', 1);
		80	}
		81	} else {
		82	Koha::Logger->get->warn("Programming error - No CSRF token passed for $request_method");
		83	$q->param( 'op', '' );
		84	$q->param( 'debug_programming_error', "No CSRF token passed for $request_method" );
		85	}
61	}	86	}
62		87
63	return $q;	88	return $q;
64	-