View | Details | Raw Unified | Return to bug 36700
Collapse All | Expand All

(-)a/Koha/Middleware/CSRF.pm (-1 / +1 lines)
Lines 50-56 sub call { Link Here
50
    } elsif ( $stateful_methods{$request_method} ) {
50
    } elsif ( $stateful_methods{$request_method} ) {
51
51
52
        # Get the CSRF token from the param list or the header
52
        # Get the CSRF token from the param list or the header
53
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN');
53
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
54
54
55
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
55
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
56
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
56
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
(-)a/Koha/Template/Plugin/Koha.pm (-1 / +1 lines)
Lines 110-116 sub GenerateCSRF { Link Here
110
    my ($self) = @_;
110
    my ($self) = @_;
111
111
112
    my $memory_cache = Koha::Cache::Memory::Lite->get_instance;
112
    my $memory_cache = Koha::Cache::Memory::Lite->get_instance;
113
    my $cache_key    = "CSRF_TOKEN";
113
    my $cache_key    = "CSRF-TOKEN";
114
    my $cached       = $memory_cache->get_from_cache($cache_key);
114
    my $cached       = $memory_cache->get_from_cache($cache_key);
115
    return $cached if $cached;
115
    return $cached if $cached;
116
116
(-)a/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js (-3 / +3 lines)
Lines 86-92 class HttpClient { Link Here
86
                ? params.body
86
                ? params.body
87
                : JSON.stringify(params.body)
87
                : JSON.stringify(params.body)
88
            : undefined;
88
            : undefined;
89
        let csrf_token = { csrf_token: this.csrf_token };
89
        let csrf_token = { "CSRF-TOKEN": this.csrf_token };
90
        let headers = { ...csrf_token, ...params.headers };
90
        let headers = { ...csrf_token, ...params.headers };
91
        return this._fetchJSON(
91
        return this._fetchJSON(
92
            params.endpoint,
92
            params.endpoint,
Lines 107-113 class HttpClient { Link Here
107
                ? params.body
107
                ? params.body
108
                : JSON.stringify(params.body)
108
                : JSON.stringify(params.body)
109
            : undefined;
109
            : undefined;
110
        let csrf_token = { csrf_token: this.csrf_token };
110
        let csrf_token = { "CSRF-TOKEN": this.csrf_token };
111
        let headers = { ...csrf_token, ...params.headers };
111
        let headers = { ...csrf_token, ...params.headers };
112
        return this._fetchJSON(
112
        return this._fetchJSON(
113
            params.endpoint,
113
            params.endpoint,
Lines 123-129 class HttpClient { Link Here
123
    }
123
    }
124
124
125
    delete(params = {}) {
125
    delete(params = {}) {
126
        let csrf_token = { csrf_token: this.csrf_token };
126
        let csrf_token = { "CSRF-TOKEN": this.csrf_token };
127
        let headers = { ...csrf_token, ...params.headers };
127
        let headers = { ...csrf_token, ...params.headers };
128
        return this._fetchJSON(
128
        return this._fetchJSON(
129
            params.endpoint,
129
            params.endpoint,
(-)a/svc/authentication (-2 / +1 lines)
Lines 62-66 if ( $status eq "ok" ) { Link Here
62
    );
62
    );
63
    $csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } );
63
    $csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } );
64
}
64
}
65
print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF_TOKEN' => $csrf_token );
65
print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF-TOKEN' => $csrf_token );
66
print XMLout( { status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1 );
66
print XMLout( { status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1 );
67
- 

Return to bug 36700