View | Details | Raw Unified | Return to bug 36148
Collapse All | Expand All

(-)a/C4/Auth.pm (-2 / +2 lines)
Lines 640-647 sub get_template_and_user { Link Here
640
    $template->param( logged_in_user     => $patron );
640
    $template->param( logged_in_user     => $patron );
641
    $template->param( sessionID          => $sessionID );
641
    $template->param( sessionID          => $sessionID );
642
642
643
    if ( $ENV{KOHA_ERROR} ) {
643
    if ( $ENV{'plack.middleware.Koha.CSRF'} ) {
644
        C4::Output::output_and_exit( $in->{query}, $cookie, $template, $ENV{KOHA_ERROR} );
644
        C4::Output::output_and_exit( $in->{query}, $cookie, $template, $ENV{'plack.middleware.Koha.CSRF'} );
645
    }
645
    }
646
646
647
    return ( $template, $borrowernumber, $cookie, $flags );
647
    return ( $template, $borrowernumber, $cookie, $flags );
(-)a/Koha/Middleware/CSRF.pm (-2 / +2 lines)
Lines 76-83 sub call { Link Here
76
76
77
        #NOTE: Other Middleware will take care of logging to correct place, as Koha::Logger doesn't know where to go here
77
        #NOTE: Other Middleware will take care of logging to correct place, as Koha::Logger doesn't know where to go here
78
        warn $error;
78
        warn $error;
79
        $env->{'plack.middleware.Koha.CSRF'} = "BAD_CSRF";
79
        $env->{'plack.middleware.Koha.CSRF'} = $error;
80
        my $res = Plack::Response->new( 403, [ 'Content-Type' => 'text/plain' ], ["Bad CSRF"] );
80
        my $res = Plack::Response->new( 403, [ 'Content-Type' => 'text/plain' ], ["Wrong CSRF token"] );
81
        return $res->finalize;
81
        return $res->finalize;
82
    }
82
    }
83
83
(-)a/errors/403.pl (-4 / +2 lines)
Lines 36-46 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
36
$template->param (
36
$template->param (
37
    admin => $admin,
37
    admin => $admin,
38
    errno => 403,
38
    errno => 403,
39
    csrf_error => $ENV{'plack.middleware.Koha.CSRF'},
39
);
40
);
40
my $csrf_error = $ENV{'plack.middleware.Koha.CSRF'};
41
41
if ($csrf_error) {
42
    $template->param( 'csrf_error' => 1 );
43
}
44
my $status = '403 Forbidden';
42
my $status = '403 Forbidden';
45
if ( C4::Context->is_internal_PSGI_request() ) {
43
if ( C4::Context->is_internal_PSGI_request() ) {
46
    $status = '200 OK';
44
    $status = '200 OK';
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc (-2 / +3 lines)
Lines 18-31 Link Here
18
    [% CASE 'order_cannot_be_edited' %]
18
    [% CASE 'order_cannot_be_edited' %]
19
        <div class="dialog message">This order cannot be edited, the basket is closed or the order was already received.</div>
19
        <div class="dialog message">This order cannot be edited, the basket is closed or the order was already received.</div>
20
    [% CASE 'wrong_csrf_token' %]
20
    [% CASE 'wrong_csrf_token' %]
21
        <div class="dialog message">The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</div>
21
        <div class="dialog alert">The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</div>
22
    [% CASE 'budget_is_locked' %]
22
    [% CASE 'budget_is_locked' %]
23
        <div class="dialog message">The budget is locked, fund creation is not possible.</div>
23
        <div class="dialog message">The budget is locked, fund creation is not possible.</div>
24
    [% CASE 'missing_es_modules' %]
24
    [% CASE 'missing_es_modules' %]
25
        <div class="dialog message">Necessary Elasticsearch packages are not installed on your server. Please contact your server admin if you wish to configure Elasticsearch</div>
25
        <div class="dialog message">Necessary Elasticsearch packages are not installed on your server. Please contact your server admin if you wish to configure Elasticsearch</div>
26
    [% CASE 'insufficient_permission' %]
26
    [% CASE 'insufficient_permission' %]
27
        <div class="dialog message">You do not have sufficient permission to continue.</div>
27
        <div class="dialog message">You do not have sufficient permission to continue.</div>
28
    [% CASE %][% blocking_error | html %]
28
    [% CASE %]
29
        <div class="dialog alert">[% blocking_error | html %]</div>
29
    [% END %]
30
    [% END %]
30
31
31
    [% INCLUDE 'intranet-bottom.inc' %]
32
    [% INCLUDE 'intranet-bottom.inc' %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/errors/errorpage.tt (-10 / +11 lines)
Lines 30-45 Link Here
30
30
31
    <h1>An error has occurred!</h1>
31
    <h1>An error has occurred!</h1>
32
    <h2><em>[% tx("Error {error_number}", {error_number = errno }) | html %]</em></h2>
32
    <h2><em>[% tx("Error {error_number}", {error_number = errno }) | html %]</em></h2>
33
        <h3>This message may have been caused by any of the following reasons:</h3>
33
        [% IF ( csrf_error ) %]
34
        <ul style="padding-bottom: 0.5em;">
34
            [% INCLUDE 'blocking_errors.inc' blocking_error => csrf_error %]
35
            <li>You made use of an external link to an item that is no longer available</li>
35
        [% ELSE %]
36
            <li>You followed an outdated link e.g. from a search engine or a bookmark</li>
36
            <h3>This message may have been caused by any of the following reasons:</h3>
37
            <li>You tried to access a page that needs authentication</li>
37
            <ul style="padding-bottom: 0.5em;">
38
            <li>An internal link in the client is broken and the page does not exist</li>
38
                <li>You made use of an external link to an item that is no longer available</li>
39
            [% IF ( csrf_error ) %]
39
                <li>You followed an outdated link e.g. from a search engine or a bookmark</li>
40
            <li>A missing CSRF token</li>
40
                <li>You tried to access a page that needs authentication</li>
41
            [% END %]
41
                <li>An internal link in the client is broken and the page does not exist</li>
42
        </ul>
42
            </ul>
43
        [% END %]
43
        <h3>What's next?</h3>
44
        <h3>What's next?</h3>
44
        <ul style="margin-bottom: 1em; padding-bottom: 1em; border-bottom: 1px solid #CCC;">
45
        <ul style="margin-bottom: 1em; padding-bottom: 1em; border-bottom: 1px solid #CCC;">
45
            <li>Use top menu bar to navigate to another part of Koha.</li>
46
            <li>Use top menu bar to navigate to another part of Koha.</li>
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/errors/errorpage.tt (-2 / +8 lines)
Lines 47-55 Link Here
47
                            [% END %]
47
                            [% END %]
48
48
49
                            [% IF ( errno == 403 ) %]
49
                            [% IF ( errno == 403 ) %]
50
                                <li>You are forbidden to view this page.</li>
51
                                [% IF ( csrf_error ) %]
50
                                [% IF ( csrf_error ) %]
52
                                    <li>A missing CSRF token</li>
51
                                    [% IF csrf_error == 'wrong_csrf_token' %]
52
                                        <li>The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</li>
53
                                    [% ELSE %]
54
                                        [%# Programming errors, we do not want to display them at the OPAC %]
55
                                        <li>An unexpected error occurred while processing your requets.</li>
56
                                    [% END %]
57
                                [% ELSE %]
58
                                    <li>You are forbidden to view this page.</li>
53
                                [% END %]
59
                                [% END %]
54
                            [% END %]
60
                            [% END %]
55
61
(-)a/opac/errors/403.pl (-5 / +2 lines)
Lines 36-46 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
36
$template->param (
36
$template->param (
37
    admin => $admin,
37
    admin => $admin,
38
    errno => 403,
38
    errno => 403,
39
    csrf_error => $ENV{'plack.middleware.Koha.CSRF'},
39
);
40
);
40
my $csrf_error = $ENV{'plack.middleware.Koha.CSRF'};
41
41
if ($csrf_error) {
42
    $template->param( 'csrf_error' => 1 );
43
}
44
my $status = '403 Forbidden';
42
my $status = '403 Forbidden';
45
if ( C4::Context->is_internal_PSGI_request() ) {
43
if ( C4::Context->is_internal_PSGI_request() ) {
46
    $status = '200 OK';
44
    $status = '200 OK';
47
- 

Return to bug 36148