|
Lines 643-662
sub get_template_and_user {
Link Here
|
| 643 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); |
643 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); |
| 644 |
} |
644 |
} |
| 645 |
|
645 |
|
| 646 |
my $op = $in->{query}->param('op'); |
646 |
if ( $in->{query}->param('invalid_csrf_token') ) { |
| 647 |
if ( defined $op && $op =~ m{^cud-} ) { |
647 |
Koha::Logger->get->debug("The form submission failed (Wrong CSRF token)."); |
| 648 |
unless ( |
648 |
C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' ); |
| 649 |
Koha::Token->new->check_csrf( |
|
|
| 650 |
{ |
| 651 |
session_id => scalar $in->{query}->cookie('CGISESSID'), |
| 652 |
token => scalar $in->{query}->param('csrf_token'), |
| 653 |
} |
| 654 |
) |
| 655 |
) |
| 656 |
{ |
| 657 |
Koha::Logger->get->debug("The form submission failed (Wrong CSRF token)."); |
| 658 |
C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' ); |
| 659 |
} |
| 660 |
} |
649 |
} |
| 661 |
|
650 |
|
| 662 |
return ( $template, $borrowernumber, $cookie, $flags ); |
651 |
return ( $template, $borrowernumber, $cookie, $flags ); |
|
Lines 1354-1376
sub checkauth {
Link Here
|
| 1354 |
my $patron = $userid ? Koha::Patrons->find({ userid => $userid }) : undef; |
1343 |
my $patron = $userid ? Koha::Patrons->find({ userid => $userid }) : undef; |
| 1355 |
$patron->update_lastseen('login') if $patron; |
1344 |
$patron->update_lastseen('login') if $patron; |
| 1356 |
|
1345 |
|
|
|
1346 |
# FIXME This is only needed for scripts not using plack |
| 1357 |
my $op = $query->param('op'); |
1347 |
my $op = $query->param('op'); |
| 1358 |
if ( defined $op && $op =~ m{^cud-} ) { |
1348 |
if ( defined $op && $op =~ m{^cud-} ) { |
| 1359 |
die "Cannot use GET for this request" |
1349 |
die "Cannot use GET for this request" |
| 1360 |
if $request_method eq 'GET'; |
1350 |
if $request_method eq 'GET'; |
|
|
1351 |
} |
| 1361 |
|
1352 |
|
| 1362 |
unless ( |
1353 |
|
| 1363 |
$skip_csrf_check |
1354 |
if ( !$skip_csrf_check && $query->param('invalid_csrf_token') ) { |
| 1364 |
|| Koha::Token->new->check_csrf( |
1355 |
Koha::Exceptions::Token::WrongCSRFToken->throw; |
| 1365 |
{ |
|
|
| 1366 |
session_id => scalar $query->cookie('CGISESSID'), |
| 1367 |
token => scalar $query->param('csrf_token'), |
| 1368 |
} |
| 1369 |
) |
| 1370 |
) |
| 1371 |
{ |
| 1372 |
Koha::Exceptions::Token::WrongCSRFToken->throw; |
| 1373 |
} |
| 1374 |
} |
1356 |
} |
| 1375 |
|
1357 |
|
| 1376 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
1358 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |