Bugzilla – Attachment 155983 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Check CSRF in get_template_and_user
Bug-34478-Check-CSRF-in-gettemplateanduser.patch (text/plain), 1.95 KB, created by
Jonathan Druart
on 2023-09-21 10:05:19 UTC
(
hide
)
Description:
Bug 34478: Check CSRF in get_template_and_user
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-09-21 10:05:19 UTC
Size:
1.95 KB
patch
obsolete
>From 24d060485c67ed2277ac9a7e6ce8ba4653e0a349 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 11:32:27 +0200 >Subject: [PATCH] Bug 34478: Check CSRF in get_template_and_user > >Not sure this is the right place in get_template_and_user >Will have to test login and 2FA >--- > C4/Auth.pm | 26 +++++++++++++++++++++++++- > 1 file changed, 25 insertions(+), 1 deletion(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 9b298eed878..1158da4fa84 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -947,6 +947,8 @@ sub checkauth { > } > } > >+ my $request_method = $query->request_method // q{}; >+ > if ( $auth_state eq 'failed' || $logout ) { > $sessionID = undef; > $userid = undef; >@@ -1089,7 +1091,6 @@ sub checkauth { > } > else { > my $retuserid; >- my $request_method = $query->request_method // q{}; > > if ( > $request_method eq 'POST' >@@ -1468,6 +1469,29 @@ sub checkauth { > } > } > >+ if ( $auth_state eq 'completed' && defined $query->param('op') ) { >+ die "Cannot use GET for this request" >+ if $request_method ne 'POST'; >+ >+ print $query->header( >+ { >+ type => 'text/html', >+ charset => 'utf-8', >+ cookie => $cookie, >+ 'X-Frame-Options' => 'SAMEORIGIN', >+ -sameSite => 'Lax' >+ } >+ ); >+ >+ output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) >+ unless Koha::Token->new->check_csrf( >+ { >+ session_id => scalar $query->cookie('CGISESSID'), >+ token => scalar $query->param('csrf_token'), >+ } >+ ); >+ } >+ > $template->param( > LibraryName => C4::Context->preference("LibraryName"), > ); >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630