View | Details | Raw Unified | Return to bug 36193
Collapse All | Expand All

(-)a/Koha/Middleware/CSRF.pm (-7 / +10 lines)
Lines 39-59 sub call { Link Here
39
    );
39
    );
40
40
41
    my $original_op    = $req->param('op');
41
    my $original_op    = $req->param('op');
42
    my $request_method = $req->method // q{};
42
    my $request_method = $req->method  // q{};
43
    my $uri            = $req->uri     // q{};
44
    my $referer        = $req->referer // q{No referer};
45
43
    my ($error);
46
    my ($error);
44
    if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
47
    if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
45
        $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s", $original_op,
48
        $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op,
46
            $request_method;
49
            $request_method, $uri, $referer;
47
    } elsif ( $stateful_methods{$request_method} ) {
50
    } elsif ( $stateful_methods{$request_method} ) {
48
51
49
        # Get the CSRF token from the param list or the header
52
        # Get the CSRF token from the param list or the header
50
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN');
53
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN');
51
54
52
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
55
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
53
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s", $original_op,
56
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
54
                $request_method;
57
                $request_method, $uri, $referer;
55
        } elsif ( !$csrf_token ) {
58
        } elsif ( !$csrf_token ) {
56
            $error = sprintf "Programming error - No CSRF token passed for %s", $request_method;
59
            $error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method,
60
                $uri, $referer;
57
        } else {
61
        } else {
58
            unless (
62
            unless (
59
                Koha::Token->new->check_csrf(
63
                Koha::Token->new->check_csrf(
60
- 

Return to bug 36193