View | Details | Raw Unified | Return to bug 39055
Collapse All | Expand All

(-)a/Koha/App/Plugin/CSRF.pm (-1 / +1 lines)
Lines 86-92 sub register { Link Here
86
            } else {
86
            } else {
87
                my $op       = $c->req->param('op');
87
                my $op       = $c->req->param('op');
88
                my $login_op = $c->req->param('login_op');
88
                my $login_op = $c->req->param('login_op');
89
                if ( $op && $op !~ /^cud-/ ) {
89
                if ( ( $op && $op !~ /^cud-/ ) && !$login_op ) {
90
                    return $c->reply->exception(
90
                    return $c->reply->exception(
91
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
91
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
92
                        ->rendered(400);
92
                        ->rendered(400);
(-)a/Koha/Middleware/CSRF.pm (-2 / +1 lines)
Lines 74-80 sub call { Link Here
74
        # Get the CSRF token from the param list or the header
74
        # Get the CSRF token from the param list or the header
75
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
75
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
76
76
77
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
77
        if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) {
78
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
78
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
79
                $request_method, $uri, $referer;
79
                $request_method, $uri, $referer;
80
        } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) {
80
        } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) {
81
- 

Return to bug 39055