Lines 39-59
sub call {
Link Here
|
39 |
); |
39 |
); |
40 |
|
40 |
|
41 |
my $original_op = $req->param('op'); |
41 |
my $original_op = $req->param('op'); |
42 |
my $request_method = $req->method // q{}; |
42 |
my $request_method = $req->method // q{}; |
|
|
43 |
my $uri = $req->uri // q{}; |
44 |
my $referer = $req->referer // q{No referer}; |
45 |
|
43 |
my ($error); |
46 |
my ($error); |
44 |
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { |
47 |
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { |
45 |
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s", $original_op, |
48 |
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, |
46 |
$request_method; |
49 |
$request_method, $uri, $referer; |
47 |
} elsif ( $stateful_methods{$request_method} ) { |
50 |
} elsif ( $stateful_methods{$request_method} ) { |
48 |
|
51 |
|
49 |
# Get the CSRF token from the param list or the header |
52 |
# Get the CSRF token from the param list or the header |
50 |
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN'); |
53 |
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN'); |
51 |
|
54 |
|
52 |
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { |
55 |
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { |
53 |
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s", $original_op, |
56 |
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, |
54 |
$request_method; |
57 |
$request_method, $uri, $referer; |
55 |
} elsif ( !$csrf_token ) { |
58 |
} elsif ( !$csrf_token ) { |
56 |
$error = sprintf "Programming error - No CSRF token passed for %s", $request_method; |
59 |
$error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method, |
|
|
60 |
$uri, $referer; |
57 |
} else { |
61 |
} else { |
58 |
unless ( |
62 |
unless ( |
59 |
Koha::Token->new->check_csrf( |
63 |
Koha::Token->new->check_csrf( |
60 |
- |
|
|