View | Details | Raw Unified | Return to bug 39055
Collapse All | Expand All

(-)a/Koha/Middleware/CSRF.pm (-5 / +14 lines)
Lines 60-76 sub call { Link Here
60
    }
60
    }
61
61
62
    my ($error);
62
    my ($error);
63
    if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
63
    if ( $stateless_methods{$request_method} ) {
64
        $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op,
64
        if ( defined $original_op && $original_op =~ m{^cud-} ) {
65
            $request_method, $uri, $referer;
65
            $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)",
66
                $original_op,
67
                $request_method, $uri, $referer;
68
        } elsif ( defined $req->param('login_op') ) {
69
            $error = sprintf "Programming error - login_op not permitted for %s %s (referer: %s)",
70
                $request_method, $uri, $referer;
71
        }
66
    } elsif ( $stateful_methods{$request_method} ) {
72
    } elsif ( $stateful_methods{$request_method} ) {
67
73
68
        # Get the CSRF token from the param list or the header
74
        # Get the CSRF token from the param list or the header
69
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
75
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
70
76
71
        if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) {
77
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
72
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
78
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
73
                $request_method, $uri, $referer;
79
                $request_method, $uri, $referer;
80
        } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) {
81
            $error = sprintf "Programming error - login_op must contain cud-login for %s %s (referer: %s)",
82
                $request_method, $uri, $referer;
83
74
        } elsif ( !$csrf_token ) {
84
        } elsif ( !$csrf_token ) {
75
            $error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method,
85
            $error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method,
76
                $uri, $referer;
86
                $uri, $referer;
77
- 

Return to bug 39055