View | Details | Raw Unified | Return to bug 39055
Collapse All | Expand All

(-)a/Koha/App/Plugin/CSRF.pm (-2 / +11 lines)
Lines 73-90 sub register { Link Here
73
73
74
            my $method = $c->req->method;
74
            my $method = $c->req->method;
75
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
75
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
76
                my $op = $c->req->param('op');
76
                my $op       = $c->req->param('op');
77
                my $login_op = $c->req->param('login_op');
77
                if ( $op && $op =~ /^cud-/ ) {
78
                if ( $op && $op =~ /^cud-/ ) {
78
                    return $c->reply->exception(
79
                    return $c->reply->exception(
79
                        'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
80
                        'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
80
                        ->rendered(400);
81
                        ->rendered(400);
82
                } elsif ( defined $login_op ) {
83
                    return $c->reply->exception('Incorrect use of a safe HTTP method with a `login_op` parameter')
84
                        ->rendered(400);
81
                }
85
                }
82
            } else {
86
            } else {
83
                my $op = $c->req->param('op');
87
                my $op       = $c->req->param('op');
88
                my $login_op = $c->req->param('login_op');
84
                if ( $op && $op !~ /^cud-/ ) {
89
                if ( $op && $op !~ /^cud-/ ) {
85
                    return $c->reply->exception(
90
                    return $c->reply->exception(
86
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
91
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
87
                        ->rendered(400);
92
                        ->rendered(400);
93
                } elsif ( defined $login_op && $login_op !~ /^cud-login$/ ) {
94
                    return $c->reply->exception(
95
                        'Incorrect use of an unsafe HTTP method with a `login_op` parameter that does not contain cud-login'
96
                    )->rendered(400);
88
                }
97
                }
89
98
90
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
99
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
(-)a/t/db_dependent/mojo/csrf.t (-15 / +14 lines)
Lines 26-33 subtest 'CSRF - Intranet' => sub { Link Here
26
    subtest 'With a wrong CSRF token' => sub {
26
    subtest 'With a wrong CSRF token' => sub {
27
        plan tests => 3;
27
        plan tests => 3;
28
28
29
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403)
29
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } )
30
            ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
30
            ->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
31
    };
31
    };
32
32
33
    subtest 'With a good CSRF token' => sub {
33
    subtest 'With a good CSRF token' => sub {
Lines 37-51 subtest 'CSRF - Intranet' => sub { Link Here
37
37
38
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
38
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
39
39
40
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
40
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } )
41
            ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
41
            ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
42
    };
42
    };
43
43
44
    subtest 'GETting what should be POSTed should fail' => sub {
44
    subtest 'GETting what should be POSTed should fail' => sub {
45
        plan tests => 3;
45
        plan tests => 3;
46
46
47
        $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like(
47
        $t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like(
48
            qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,
48
            qr/Incorrect use of a safe HTTP method with a `login_op` parameter/,
49
            'Body contains correct error message'
49
            'Body contains correct error message'
50
        );
50
        );
51
    };
51
    };
Lines 53-60 subtest 'CSRF - Intranet' => sub { Link Here
53
    subtest 'POSTing what should be GET should fail' => sub {
53
    subtest 'POSTing what should be GET should fail' => sub {
54
        plan tests => 3;
54
        plan tests => 3;
55
55
56
        $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like(
56
        $t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like(
57
            qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,
57
            qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/,
58
            'Body contains correct error message'
58
            'Body contains correct error message'
59
        );
59
        );
60
    };
60
    };
Lines 78-85 subtest 'CSRF - OPAC' => sub { Link Here
78
    subtest 'With a wrong CSRF token' => sub {
78
    subtest 'With a wrong CSRF token' => sub {
79
        plan tests => 3;
79
        plan tests => 3;
80
80
81
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403)
81
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } )
82
            ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
82
            ->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
83
    };
83
    };
84
84
85
    subtest 'With a good CSRF token' => sub {
85
    subtest 'With a good CSRF token' => sub {
Lines 89-103 subtest 'CSRF - OPAC' => sub { Link Here
89
89
90
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
90
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
91
91
92
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
92
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } )
93
            ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
93
            ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
94
    };
94
    };
95
95
96
    subtest 'GETting what should be POSTed should fail' => sub {
96
    subtest 'GETting what should be POSTed should fail' => sub {
97
        plan tests => 3;
97
        plan tests => 3;
98
98
99
        $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like(
99
        $t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like(
100
            qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,
100
            qr/Incorrect use of a safe HTTP method with a `login_op` parameter/,
101
            'Body contains correct error message'
101
            'Body contains correct error message'
102
        );
102
        );
103
    };
103
    };
Lines 105-112 subtest 'CSRF - OPAC' => sub { Link Here
105
    subtest 'POSTing what should be GET should fail' => sub {
105
    subtest 'POSTing what should be GET should fail' => sub {
106
        plan tests => 3;
106
        plan tests => 3;
107
107
108
        $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like(
108
        $t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like(
109
            qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,
109
            qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/,
110
            'Body contains correct error message'
110
            'Body contains correct error message'
111
        );
111
        );
112
    };
112
    };
113
- 

Return to bug 39055