|
Lines 43-56
use Koha::Token;
Link Here
|
| 43 |
|
43 |
|
| 44 |
Called by Mojolicious when the plugin is loaded. |
44 |
Called by Mojolicious when the plugin is loaded. |
| 45 |
|
45 |
|
| 46 |
Defines an `around_action` hook that will return a 403 response if CSRF token |
46 |
Defines an `around_action` hook that will prevent CSRF attacks. |
| 47 |
is missing or invalid. |
|
|
| 48 |
|
47 |
|
| 49 |
This verification occurs only for HTTP methods POST, PUT, DELETE and PATCH. |
48 |
If the HTTP request method is safe (GET, HEAD, OPTIONS, TRACE) and the request |
|
|
49 |
contains an `op` parameter whose value starts with "cud-" (which means it's a |
| 50 |
Create, Update or Delete operation), it will immediately return a 400 response. |
| 50 |
|
51 |
|
| 51 |
If CGISESSID cookie is missing, it means that we are not authenticated or we |
52 |
If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and |
| 52 |
are authenticated to the API by another method (HTTP basic or OAuth2). In this |
53 |
the CGISESSID cookie is set, the CSRF token is checked. A 403 response is |
| 53 |
case, no verification is done. |
54 |
immediately returned if the CSRF token is missing or invalid. |
|
|
55 |
If the CGISESSID cookie is missing, it means that we are not authenticated or |
| 56 |
we are authenticated to the API by another method (HTTP basic or OAuth2). In |
| 57 |
this case, no verification is done. |
| 54 |
|
58 |
|
| 55 |
=cut |
59 |
=cut |
| 56 |
|
60 |
|
|
Lines 65-71
sub register {
Link Here
|
| 65 |
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { |
69 |
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { |
| 66 |
my $op = $c->req->param('op'); |
70 |
my $op = $c->req->param('op'); |
| 67 |
if ( $op && $op =~ /^cud-/ ) { |
71 |
if ( $op && $op =~ /^cud-/ ) { |
| 68 |
return $c->reply->exception('Wrong HTTP method')->rendered(400); |
72 |
return $c->reply->exception('Incorrect use of a safe HTTP method with a "cud-" op parameter')->rendered(400); |
| 69 |
} |
73 |
} |
| 70 |
} else { |
74 |
} else { |
| 71 |
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { |
75 |
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { |