View | Details | Raw Unified | Return to bug 36598
Collapse All | Expand All

(-)a/Koha/App/Plugin/CSRF.pm (-2 / +6 lines)
Lines 75-86 sub register { Link Here
75
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
75
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
76
                my $op = $c->req->param('op');
76
                my $op = $c->req->param('op');
77
                if ( $op && $op =~ /^cud-/ ) {
77
                if ( $op && $op =~ /^cud-/ ) {
78
                    return $c->reply->exception('Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')->rendered(400);
78
                    return $c->reply->exception(
79
                        'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
80
                        ->rendered(400);
79
                }
81
                }
80
            } else {
82
            } else {
81
                my $op = $c->req->param('op');
83
                my $op = $c->req->param('op');
82
                if ( $op && $op !~ /^cud-/ ) {
84
                if ( $op && $op !~ /^cud-/ ) {
83
                    return $c->reply->exception('Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')->rendered(400);
85
                    return $c->reply->exception(
86
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
87
                        ->rendered(400);
84
                }
88
                }
85
89
86
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
90
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
(-)a/t/db_dependent/mojo/csrf.t (-9 / +16 lines)
Lines 43-57 subtest 'CSRF - Intranet' => sub { Link Here
43
    subtest 'GETting what should be POSTed should fail' => sub {
43
    subtest 'GETting what should be POSTed should fail' => sub {
44
        plan tests => 3;
44
        plan tests => 3;
45
45
46
        $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)
46
        $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like(
47
            ->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' );
47
            qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,
48
            'Body contains correct error message'
49
        );
48
    };
50
    };
49
51
50
    subtest 'POSTing what should be GET should fail' => sub {
52
    subtest 'POSTing what should be GET should fail' => sub {
51
        plan tests => 3;
53
        plan tests => 3;
52
54
53
        $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)
55
        $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like(
54
            ->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' );
56
            qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,
57
            'Body contains correct error message'
58
        );
55
    };
59
    };
56
};
60
};
57
61
Lines 91-104 subtest 'CSRF - OPAC' => sub { Link Here
91
    subtest 'GETting what should be POSTed should fail' => sub {
95
    subtest 'GETting what should be POSTed should fail' => sub {
92
        plan tests => 3;
96
        plan tests => 3;
93
97
94
        $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)
98
        $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like(
95
            ->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' );
99
            qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,
100
            'Body contains correct error message'
101
        );
96
    };
102
    };
97
103
98
    subtest 'POSTing what should be GET should fail' => sub {
104
    subtest 'POSTing what should be GET should fail' => sub {
99
        plan tests => 3;
105
        plan tests => 3;
100
106
101
        $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)
107
        $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like(
102
            ->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' );
108
            qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,
109
            'Body contains correct error message'
110
        );
103
    };
111
    };
104
};
112
};
105
- 

Return to bug 36598