|
Lines 60-76
sub call {
Link Here
|
| 60 |
} |
60 |
} |
| 61 |
|
61 |
|
| 62 |
my ($error); |
62 |
my ($error); |
| 63 |
if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { |
63 |
if ( $stateless_methods{$request_method} ) { |
| 64 |
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, |
64 |
if ( defined $original_op && $original_op =~ m{^cud-} ) { |
| 65 |
$request_method, $uri, $referer; |
65 |
$error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", |
|
|
66 |
$original_op, |
| 67 |
$request_method, $uri, $referer; |
| 68 |
} elsif ( defined $req->param('login_op') ) { |
| 69 |
$error = sprintf "Programming error - login_op not permitted for %s %s (referer: %s)", |
| 70 |
$request_method, $uri, $referer; |
| 71 |
} |
| 66 |
} elsif ( $stateful_methods{$request_method} ) { |
72 |
} elsif ( $stateful_methods{$request_method} ) { |
| 67 |
|
73 |
|
| 68 |
# Get the CSRF token from the param list or the header |
74 |
# Get the CSRF token from the param list or the header |
| 69 |
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); |
75 |
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); |
| 70 |
|
76 |
|
| 71 |
if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { |
77 |
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { |
| 72 |
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, |
78 |
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, |
| 73 |
$request_method, $uri, $referer; |
79 |
$request_method, $uri, $referer; |
|
|
80 |
} elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { |
| 81 |
$error = sprintf "Programming error - login_op must contain cud-login for %s %s (referer: %s)", |
| 82 |
$request_method, $uri, $referer; |
| 83 |
|
| 74 |
} elsif ( !$csrf_token ) { |
84 |
} elsif ( !$csrf_token ) { |
| 75 |
$error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method, |
85 |
$error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method, |
| 76 |
$uri, $referer; |
86 |
$uri, $referer; |
| 77 |
- |
|
|