View | Details | Raw Unified | Return to bug 39055
Collapse All | Expand All

(-)a/Koha/App/Plugin/CSRF.pm (-2 / +11 lines)
Lines 73-90 sub register { Link Here
73
73
74
            my $method = $c->req->method;
74
            my $method = $c->req->method;
75
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
75
            if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
76
                my $op = $c->req->param('op');
76
                my $op       = $c->req->param('op');
77
                my $login_op = $c->req->param('login_op');
77
                if ( $op && $op =~ /^cud-/ ) {
78
                if ( $op && $op =~ /^cud-/ ) {
78
                    return $c->reply->exception(
79
                    return $c->reply->exception(
79
                        'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
80
                        'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
80
                        ->rendered(400);
81
                        ->rendered(400);
82
                } elsif ( defined $login_op ) {
83
                    return $c->reply->exception('Incorrect use of a safe HTTP method with a `login_op` parameter')
84
                        ->rendered(400);
81
                }
85
                }
82
            } else {
86
            } else {
83
                my $op = $c->req->param('op');
87
                my $op       = $c->req->param('op');
88
                my $login_op = $c->req->param('login_op');
84
                if ( $op && $op !~ /^cud-/ ) {
89
                if ( $op && $op !~ /^cud-/ ) {
85
                    return $c->reply->exception(
90
                    return $c->reply->exception(
86
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
91
                        'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
87
                        ->rendered(400);
92
                        ->rendered(400);
93
                } elsif ( defined $login_op && $login_op !~ /^cud-login$/ ) {
94
                    return $c->reply->exception(
95
                        'Incorrect use of an unsafe HTTP method with a `login_op` parameter that does not contain cud-login'
96
                    )->rendered(400);
88
                }
97
                }
89
98
90
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
99
                if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {
(-)a/t/db_dependent/mojo/csrf.t (-13 / +12 lines)
Lines 27-33 subtest 'CSRF - Intranet' => sub { Link Here
27
    subtest 'With a wrong CSRF token' => sub {
27
    subtest 'With a wrong CSRF token' => sub {
28
        plan tests => 3;
28
        plan tests => 3;
29
29
30
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )
30
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } )
31
            ->status_is(403)
31
            ->status_is(403)
32
            ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
32
            ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
33
    };
33
    };
Lines 39-45 subtest 'CSRF - Intranet' => sub { Link Here
39
39
40
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
40
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
41
41
42
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
42
        $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } )
43
            ->status_is(200)
43
            ->status_is(200)
44
            ->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
44
            ->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' );
45
    };
45
    };
Lines 47-54 subtest 'CSRF - Intranet' => sub { Link Here
47
    subtest 'GETting what should be POSTed should fail' => sub {
47
    subtest 'GETting what should be POSTed should fail' => sub {
48
        plan tests => 3;
48
        plan tests => 3;
49
49
50
        $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like(
50
        $t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like(
51
            qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,
51
            qr/Incorrect use of a safe HTTP method with a `login_op` parameter/,
52
            'Body contains correct error message'
52
            'Body contains correct error message'
53
        );
53
        );
54
    };
54
    };
Lines 56-63 subtest 'CSRF - Intranet' => sub { Link Here
56
    subtest 'POSTing what should be GET should fail' => sub {
56
    subtest 'POSTing what should be GET should fail' => sub {
57
        plan tests => 3;
57
        plan tests => 3;
58
58
59
        $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like(
59
        $t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like(
60
            qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,
60
            qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/,
61
            'Body contains correct error message'
61
            'Body contains correct error message'
62
        );
62
        );
63
    };
63
    };
Lines 82-88 subtest 'CSRF - OPAC' => sub { Link Here
82
    subtest 'With a wrong CSRF token' => sub {
82
    subtest 'With a wrong CSRF token' => sub {
83
        plan tests => 3;
83
        plan tests => 3;
84
84
85
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )
85
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } )
86
            ->status_is(403)
86
            ->status_is(403)
87
            ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
87
            ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' );
88
    };
88
    };
Lines 94-100 subtest 'CSRF - OPAC' => sub { Link Here
94
94
95
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
95
        my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first;
96
96
97
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } )
97
        $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } )
98
            ->status_is(200)
98
            ->status_is(200)
99
            ->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
99
            ->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' );
100
    };
100
    };
Lines 102-109 subtest 'CSRF - OPAC' => sub { Link Here
102
    subtest 'GETting what should be POSTed should fail' => sub {
102
    subtest 'GETting what should be POSTed should fail' => sub {
103
        plan tests => 3;
103
        plan tests => 3;
104
104
105
        $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like(
105
        $t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like(
106
            qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,
106
            qr/Incorrect use of a safe HTTP method with a `login_op` parameter/,
107
            'Body contains correct error message'
107
            'Body contains correct error message'
108
        );
108
        );
109
    };
109
    };
Lines 111-118 subtest 'CSRF - OPAC' => sub { Link Here
111
    subtest 'POSTing what should be GET should fail' => sub {
111
    subtest 'POSTing what should be GET should fail' => sub {
112
        plan tests => 3;
112
        plan tests => 3;
113
113
114
        $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like(
114
        $t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like(
115
            qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,
115
            qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/,
116
            'Body contains correct error message'
116
            'Body contains correct error message'
117
        );
117
        );
118
    };
118
    };
119
- 

Return to bug 39055