|
Lines 43-48
sub call {
Link Here
|
| 43 |
my $uri = $req->uri // q{}; |
43 |
my $uri = $req->uri // q{}; |
| 44 |
my $referer = $req->referer // q{No referer}; |
44 |
my $referer = $req->referer // q{No referer}; |
| 45 |
|
45 |
|
|
|
46 |
#NOTE: Ignore ErrorDocument requests for CSRF |
| 47 |
if ( $env->{'psgix.errordocument.SCRIPT_NAME'} ) { |
| 48 |
return $self->app->($env); |
| 49 |
} |
| 50 |
|
| 46 |
my ($error); |
51 |
my ($error); |
| 47 |
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { |
52 |
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { |
| 48 |
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, |
53 |
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, |
|
Lines 73-86
sub call {
Link Here
|
| 73 |
} |
78 |
} |
| 74 |
} |
79 |
} |
| 75 |
|
80 |
|
| 76 |
#NOTE: It is essential to check for this environmental variable. |
81 |
if ( $error ) { |
| 77 |
#NOTE: If we don't check for it, then we'll also throw an error for the "subrequest" that ErrorDocument uses to |
|
|
| 78 |
#fetch the error page document. Then we'll wind up with a very ugly error page and not our pretty one. |
| 79 |
if ( $error && !$env->{'plack.middleware.Koha.CSRF'} ) { |
| 80 |
|
| 81 |
#NOTE: Other Middleware will take care of logging to correct place, as Koha::Logger doesn't know where to go here |
82 |
#NOTE: Other Middleware will take care of logging to correct place, as Koha::Logger doesn't know where to go here |
| 82 |
warn $error; |
83 |
warn $error; |
| 83 |
$env->{'plack.middleware.Koha.CSRF'} = $error; |
|
|
| 84 |
my $res = Plack::Response->new( 403, [ 'Content-Type' => 'text/plain' ], ["Wrong CSRF token"] ); |
84 |
my $res = Plack::Response->new( 403, [ 'Content-Type' => 'text/plain' ], ["Wrong CSRF token"] ); |
| 85 |
return $res->finalize; |
85 |
return $res->finalize; |
| 86 |
} |
86 |
} |
| 87 |
- |
|
|