Attachment 129662 Details for Bug 28786 – Bug 28786: (QA follow-up) Check the returned CSRF token

[patch] Bug 28786: (QA follow-up) Check the returned CSRF token

Bug-28786-QA-follow-up-Check-the-returned-CSRF-tok.patch (text/plain), 1.96 KB, created by Jonathan Druart on 2022-01-20 14:11:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2022-01-20 14:11:25 UTC

Size: 1.96 KB

patch

obsolete

>From 92f2b8e9331133841e4d517a02ad1c96f0afc751 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Tue, 18 Jan 2022 12:45:17 +0000
>Subject: [PATCH] Bug 28786: (QA follow-up) Check the returned CSRF token
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>We're doing this in the registering stage and at disabling.
>
>Test plan:
>Ãnable two-factor auth but logout/login on another tab. You should
>get the Wrong CSRF token when submitting.
>Do similar thing while disabling.
>Verify that you can register / disable when in the same session.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> members/two_factor_auth.pl | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
>diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
>index 3d763d23f3c..d5157dfd8ab 100755
>--- a/members/two_factor_auth.pl
>+++ b/members/two_factor_auth.pl
>@@ -24,6 +24,7 @@ use C4::Output qw( output_and_exit output_html_with_http_headers );
> 
> use Koha::Patrons;
> use Koha::Auth::TwoFactorAuth;
>+use Koha::Token;
> 
> my $cgi = CGI->new;
> 
>@@ -44,8 +45,15 @@ unless ( C4::Context->preference('TwoFactorAuthentication') ) {
> my $logged_in_user = Koha::Patrons->find($loggedinuser);
> 
> my $op = $cgi->param('op') // '';
>+my $csrf_pars = {
>+    session_id => scalar $cgi->cookie('CGISESSID'),
>+    token  => scalar $cgi->param('csrf_token'),
>+};
> 
> if ( $op eq 'register-2FA' ) {
>+    output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
>+        unless Koha::Token->new->check_csrf($csrf_pars);
>+
>     my $pin_code = $cgi->param('pin_code');
>     my $secret32 = $cgi->param('secret32');
>     my $auth     = Koha::Auth::TwoFactorAuth->new(
>@@ -91,6 +99,8 @@ if ( $op eq 'enable-2FA' ) {
>     $op = 'register';
> }
> elsif ( $op eq 'disable-2FA' ) {
>+    output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
>+        unless Koha::Token->new->check_csrf($csrf_pars);
>     $logged_in_user->auth_method('password')->store;
> }
> 
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 28786: 123375 | 123376 | 123377 | 123378 | 123379 | 123380 | 123381 | 123397 | 123398 | 123399 | 123400 | 123401 | 123402 | 123403 | 124569 | 124770 | 124771 | 124844 | 124845 | 124846 | 124847 | 128841 | 128842 | 129383 | 129384 | 129474 | 129521 | 129557 | 129558 | 129559 | 129560 | 129561 | 129562 | 129563 | 129564 | 129565 | 129566 | 129567 | 129568 | 129569 | 129654 | 129655 | 129656 | 129657 | 129658 | 129659 | 129660 | 129661 | 129662 | 129665 | 131940 | 131941 | 131942 | 131943 | 131944 | 131945 | 131946 | 131947 | 131948 | 131949 | 131950 | 131951 | 131952 | 131953 | 131954 | 131955 | 131956 | 131957 | 131958 | 132142 | 132143 | 132144 | 132145 | 132146 | 132147 | 132148 | 132149 | 132150 | 132153 | 132154 | 132155 | 132156 | 132157 | 133222 | 133516 | 133522 | 133531 | 133533 | 133541 | 133548 | 133643 | 133686