Attachment #166673 for bug #36598

View | Details | Raw Unified | Return to bug 36598
Collapse All | Expand All

Lines 49-54 If the HTTP request method is safe (GET, HEAD, OPTIONS, TRACE) and the request Link Here

(-)a/Koha/App/Plugin/CSRF.pm (-1 / +10 lines)
49	contains an `op` parameter whose value starts with "cud-" (which means it's a	49	contains an `op` parameter whose value starts with "cud-" (which means it's a
50	Create, Update or Delete operation), it will immediately return a 400 response.	50	Create, Update or Delete operation), it will immediately return a 400 response.
51		51
		52	If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and
		53	the request contains an `op` parameter whose value does not start with "cud-",
		54	it will immediately return a 400 response.
		55
52	If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and	56	If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and
53	the CGISESSID cookie is set, the CSRF token is checked. A 403 response is	57	the CGISESSID cookie is set, the CSRF token is checked. A 403 response is
54	immediately returned if the CSRF token is missing or invalid.	58	immediately returned if the CSRF token is missing or invalid.
Lines 69-77 sub register { Link Here
69	if ( $method eq 'GET' \|\| $method eq 'HEAD' \|\| $method eq 'OPTIONS' \|\| $method eq 'TRACE' ) {	73	if ( $method eq 'GET' \|\| $method eq 'HEAD' \|\| $method eq 'OPTIONS' \|\| $method eq 'TRACE' ) {
70	my $op = $c->req->param('op');	74	my $op = $c->req->param('op');
71	if ( $op && $op =~ /^cud-/ ) {	75	if ( $op && $op =~ /^cud-/ ) {
72	return $c->reply->exception('Incorrect use of a safe HTTP method with a "cud-" op parameter')->rendered(400);	76	return $c->reply->exception('Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')->rendered(400);
73	}	77	}
74	} else {	78	} else {
		79	my $op = $c->req->param('op');
		80	if ( $op && $op !~ /^cud-/ ) {
		81	return $c->reply->exception('Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')->rendered(400);
		82	}
		83
75	if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {	84	if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
76	return $c->reply->exception('Wrong CSRF token')->rendered(403);	85	return $c->reply->exception('Wrong CSRF token')->rendered(403);
77	}	86	}




use Koha::Database;

subtest 'CSRF - Intranet' => sub {
    plan tests => 6;

    my $t = Test::Mojo->new('Koha::App::Intranet');


        plan tests => 3;

        $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)
            ->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/, 'Body contains correct error message' );
    };

    subtest 'POSTing what should be GET should fail' => sub {
        plan tests => 3;

        $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)
            ->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/, 'Body contains correct error message' );
    };
};

subtest 'CSRF - OPAC' => sub {
    plan tests => 6;

    my $t = Test::Mojo->new('Koha::App::Opac');


        plan tests => 3;

        $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)
            ->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/, 'Body contains correct error message' );
    };

    subtest 'POSTing what should be GET should fail' => sub {
        plan tests => 3;

        $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)
            ->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/, 'Body contains correct error message' );
    };
};
- 

Return to bug 36598

Lines 8-14 use Test::Mojo; Link Here

(-)a/t/db_dependent/mojo/csrf.t (-7 / +20 lines)
8	use Koha::Database;	8	use Koha::Database;
9		9
10	subtest 'CSRF - Intranet' => sub {	10	subtest 'CSRF - Intranet' => sub {
11	plan tests => 5;	11	plan tests => 6;
12		12
13	my $t = Test::Mojo->new('Koha::App::Intranet');	13	my $t = Test::Mojo->new('Koha::App::Intranet');
14		14
Lines 44-55 subtest 'CSRF - Intranet' => sub { Link Here
44	plan tests => 3;	44	plan tests => 3;
45		45
46	$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)	46	$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)
47	->content_like( qr/Incorrect use of a safe HTTP method with a/, 'Body contains correct error message' );	47	->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' );
48	}	48	};
		49
		50	subtest 'POSTing what should be GET should fail' => sub {
		51	plan tests => 3;
		52
		53	$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)
		54	->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' );
		55	};
49	};	56	};
50		57
51	subtest 'CSRF - OPAC' => sub {	58	subtest 'CSRF - OPAC' => sub {
52	plan tests => 5;	59	plan tests => 6;
53		60
54	my $t = Test::Mojo->new('Koha::App::Opac');	61	my $t = Test::Mojo->new('Koha::App::Opac');
55		62
Lines 85-90 subtest 'CSRF - OPAC' => sub { Link Here
85	plan tests => 3;	92	plan tests => 3;
86		93
87	$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)	94	$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)
88	->content_like( qr/Incorrect use of a safe HTTP method with a/, 'Body contains correct error message' );	95	->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' );
89	}	96	};
		97
		98	subtest 'POSTing what should be GET should fail' => sub {
		99	plan tests => 3;
		100
		101	$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)
		102	->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' );
		103	};
90	};	104	};
91	-