View | Details | Raw Unified | Return to bug 36148
Collapse All | Expand All

(-)a/Koha/Middleware/CSRF.pm (-1 / +84 lines)
Line 0 Link Here
0
- 
1
package Koha::Middleware::CSRF;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use parent qw(Plack::Middleware);
21
22
use Koha::Logger;
23
24
sub call {
25
    my ( $self, $env ) = @_;
26
    my $req = Plack::Request->new($env);
27
28
    my %stateless_methods = (
29
        GET     => 1,
30
        HEAD    => 1,
31
        OPTIONS => 1,
32
        TRACE   => 1,
33
    );
34
35
    my %stateful_methods = (
36
        POST   => 1,
37
        PUT    => 1,
38
        DELETE => 1,
39
        PATCH  => 1,
40
    );
41
42
    #return $res unless $env->{REQUEST_METHOD} =~ /^(GET|HEAD)$/;
43
44
    my $original_op    = $req->param('op');
45
    my $request_method = $req->method // q{};
46
    my ( $error );
47
    if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
48
        $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s", $original_op,
49
            $request_method;
50
    } elsif ( $stateful_methods{$request_method} ) {
51
52
        # Get the CSRF token from the param list or the header
53
        my $csrf_token = $req->param('csrf_token') || $req->header('HTTP_CSRF_TOKEN');
54
55
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
56
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s", $original_op,
57
                $request_method;
58
        } elsif ( !$csrf_token ) {
59
            $error = sprintf "Programming error - No CSRF token passed for %s", $request_method;
60
        } else {
61
            unless (
62
                Koha::Token->new->check_csrf(
63
                    {
64
                        session_id => scalar $req->cookies->{CGISESSID},
65
                        token      => $csrf_token,
66
                    }
67
                )
68
                )
69
            {
70
                $error = "wrong_csrf_token";
71
            }
72
        }
73
    }
74
75
    if ( $error ) {
76
        Koha::Logger->get->warn( $error );
77
        $env->{KOHA_ERROR} = $error;
78
        $env->{PATH_INFO} = '/intranet/errors/403.pl';
79
    }
80
81
    return $self->app->($env);
82
}
83
84
1;

Return to bug 36148