View | Details | Raw Unified | Return to bug 36598
Collapse All | Expand All

(-)a/Koha/App/Plugin/CSRF.pm (-1 / +6 lines)
Lines 62-68 sub register { Link Here
62
            my ( $next, $c, $action, $last ) = @_;
62
            my ( $next, $c, $action, $last ) = @_;
63
63
64
            my $method = $c->req->method;
64
            my $method = $c->req->method;
65
            if ( $method eq 'POST' || $method eq 'PUT' || $method eq 'DELETE' || $method eq 'PATCH' ) {
65
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
66
                my $op = $c->req->param('op');
67
                if ( $op && $op =~ /^cud-/ ) {
68
                    return $c->reply->exception('Wrong HTTP method')->rendered(400);
69
                }
70
            } else {
66
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
71
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
67
                    return $c->reply->exception('Wrong CSRF token')->rendered(403);
72
                    return $c->reply->exception('Wrong CSRF token')->rendered(403);
68
                }
73
                }
(-)a/t/db_dependent/mojo/csrf.t (-3 / +16 lines)
Lines 8-14 use Test::Mojo; Link Here
8
use Koha::Database;
8
use Koha::Database;
9
9
10
subtest 'CSRF - Intranet' => sub {
10
subtest 'CSRF - Intranet' => sub {
11
    plan tests => 4;
11
    plan tests => 5;
12
12
13
    my $t = Test::Mojo->new('Koha::App::Intranet');
13
    my $t = Test::Mojo->new('Koha::App::Intranet');
14
14
Lines 39-48 subtest 'CSRF - Intranet' => sub { Link Here
39
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
39
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
40
            ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
40
            ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
41
    };
41
    };
42
43
    subtest 'GETting what should be POSTed should fail' => sub {
44
        plan tests => 3;
45
46
        $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)
47
            ->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' );
48
    }
42
};
49
};
43
50
44
subtest 'CSRF - OPAC' => sub {
51
subtest 'CSRF - OPAC' => sub {
45
    plan tests => 4;
52
    plan tests => 5;
46
53
47
    my $t = Test::Mojo->new('Koha::App::Opac');
54
    my $t = Test::Mojo->new('Koha::App::Opac');
48
55
Lines 73-76 subtest 'CSRF - OPAC' => sub { Link Here
73
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
80
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
74
            ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
81
            ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
75
    };
82
    };
83
84
    subtest 'GETting what should be POSTed should fail' => sub {
85
        plan tests => 3;
86
87
        $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)
88
            ->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' );
89
    }
76
};
90
};
77
- 

Return to bug 36598