View | Details | Raw Unified | Return to bug 36148
Collapse All | Expand All

(-)a/Koha/Middleware/CSRF.pm (-7 / +9 lines)
Lines 18-25 package Koha::Middleware::CSRF; Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use parent qw(Plack::Middleware);
20
use parent qw(Plack::Middleware);
21
21
use Plack::Response;
22
use Koha::Logger;
23
22
24
sub call {
23
sub call {
25
    my ( $self, $env ) = @_;
24
    my ( $self, $env ) = @_;
Lines 41-47 sub call { Link Here
41
40
42
    my $original_op    = $req->param('op');
41
    my $original_op    = $req->param('op');
43
    my $request_method = $req->method // q{};
42
    my $request_method = $req->method // q{};
44
    my ( $error );
43
    my ($error);
45
    if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
44
    if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
46
        $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s", $original_op,
45
        $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s", $original_op,
47
            $request_method;
46
            $request_method;
Lines 70-79 sub call { Link Here
70
        }
69
        }
71
    }
70
    }
72
71
73
    if ( $error ) {
72
    if ( $error && !$env->{'plack.middleware.Koha.CSRF'} ) {
74
        Koha::Logger->get->warn( $error );
73
75
        $env->{KOHA_ERROR} = $error;
74
        #NOTE: Other Middleware will take care of logging to correct place, as Koha::Logger doesn't know where to go here
76
        $env->{PATH_INFO} = '/intranet/errors/403.pl';
75
        warn $error;
76
        $env->{'plack.middleware.Koha.CSRF'} = "BAD_CSRF";
77
        my $res = Plack::Response->new( 403, [ 'Content-Type' => 'text/plain' ], ["Bad CSRF"] );
78
        return $res->finalize;
77
    }
79
    }
78
80
79
    return $self->app->($env);
81
    return $self->app->($env);
(-)a/debian/templates/plack.psgi (-2 / +2 lines)
Lines 77-83 builder { Link Here
77
    enable "+Koha::Middleware::RealIP";
77
    enable "+Koha::Middleware::RealIP";
78
78
79
    mount '/opac'          => builder {
79
    mount '/opac'          => builder {
80
        enable "+Koha::Middleware::CSRF";
81
        #NOTE: it is important that these are relative links
80
        #NOTE: it is important that these are relative links
82
        enable 'ErrorDocument',
81
        enable 'ErrorDocument',
83
            400 => 'errors/400.pl',
82
            400 => 'errors/400.pl',
Lines 94-103 builder { Link Here
94
            enable 'Log4perl', category => 'plack-opac';
93
            enable 'Log4perl', category => 'plack-opac';
95
            enable 'LogWarn';
94
            enable 'LogWarn';
96
        }
95
        }
96
        enable "+Koha::Middleware::CSRF";
97
        $opac;
97
        $opac;
98
    };
98
    };
99
    mount '/intranet'      => builder {
99
    mount '/intranet'      => builder {
100
        enable "+Koha::Middleware::CSRF";
101
        #NOTE: it is important that these are relative links
100
        #NOTE: it is important that these are relative links
102
        enable 'ErrorDocument',
101
        enable 'ErrorDocument',
103
            400 => 'errors/400.pl',
102
            400 => 'errors/400.pl',
Lines 114-119 builder { Link Here
114
            enable 'Log4perl', category => 'plack-intranet';
113
            enable 'Log4perl', category => 'plack-intranet';
115
            enable 'LogWarn';
114
            enable 'LogWarn';
116
        }
115
        }
116
        enable "+Koha::Middleware::CSRF";
117
        $intranet;
117
        $intranet;
118
    };
118
    };
119
    mount '/api/v1/app.pl' => builder {
119
    mount '/api/v1/app.pl' => builder {
(-)a/errors/403.pl (+4 lines)
Lines 37-42 $template->param ( Link Here
37
    admin => $admin,
37
    admin => $admin,
38
    errno => 403,
38
    errno => 403,
39
);
39
);
40
my $csrf_error = $ENV{'plack.middleware.Koha.CSRF'};
41
if ($csrf_error) {
42
    $template->param( 'csrf_error' => 1 );
43
}
40
my $status = '403 Forbidden';
44
my $status = '403 Forbidden';
41
if ( C4::Context->is_internal_PSGI_request() ) {
45
if ( C4::Context->is_internal_PSGI_request() ) {
42
    $status = '200 OK';
46
    $status = '200 OK';
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/errors/errorpage.tt (+3 lines)
Lines 36-41 Link Here
36
            <li>You followed an outdated link e.g. from a search engine or a bookmark</li>
36
            <li>You followed an outdated link e.g. from a search engine or a bookmark</li>
37
            <li>You tried to access a page that needs authentication</li>
37
            <li>You tried to access a page that needs authentication</li>
38
            <li>An internal link in the client is broken and the page does not exist</li>
38
            <li>An internal link in the client is broken and the page does not exist</li>
39
            [% IF ( csrf_error ) %]
40
            <li>A missing CSRF token</li>
41
            [% END %]
39
        </ul>
42
        </ul>
40
        <h3>What's next?</h3>
43
        <h3>What's next?</h3>
41
        <ul style="margin-bottom: 1em; padding-bottom: 1em; border-bottom: 1px solid #CCC;">
44
        <ul style="margin-bottom: 1em; padding-bottom: 1em; border-bottom: 1px solid #CCC;">
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/errors/errorpage.tt (+3 lines)
Lines 48-53 Link Here
48
48
49
                            [% IF ( errno == 403 ) %]
49
                            [% IF ( errno == 403 ) %]
50
                                <li>You are forbidden to view this page.</li>
50
                                <li>You are forbidden to view this page.</li>
51
                                [% IF ( csrf_error ) %]
52
                                    <li>A missing CSRF token</li>
53
                                [% END %]
51
                            [% END %]
54
                            [% END %]
52
55
53
                            [% IF ( errno == 404 ) %]
56
                            [% IF ( errno == 404 ) %]
(-)a/opac/errors/403.pl (-1 / +4 lines)
Lines 37-42 $template->param ( Link Here
37
    admin => $admin,
37
    admin => $admin,
38
    errno => 403,
38
    errno => 403,
39
);
39
);
40
my $csrf_error = $ENV{'plack.middleware.Koha.CSRF'};
41
if ($csrf_error) {
42
    $template->param( 'csrf_error' => 1 );
43
}
40
my $status = '403 Forbidden';
44
my $status = '403 Forbidden';
41
if ( C4::Context->is_internal_PSGI_request() ) {
45
if ( C4::Context->is_internal_PSGI_request() ) {
42
    $status = '200 OK';
46
    $status = '200 OK';
43
- 

Return to bug 36148