Attachment 155985 Details for Bug 34478 – Bug 34478: Move C4::Auth check

[patch] Bug 34478: Move C4::Auth check

Bug-34478-Move-C4Auth-check.patch (text/plain), 3.42 KB, created by Jonathan Druart on 2023-09-21 10:05:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2023-09-21 10:05:26 UTC

Size: 3.42 KB

patch

obsolete

>From e0ac03094999e2bd413389684d1a878923df0c58 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 21 Sep 2023 09:59:09 +0200
>Subject: [PATCH] Bug 34478: Move C4::Auth check
>
>---
> C4/Auth.pm | 49 +++++++++++++++++++++++++------------------------
> 1 file changed, 25 insertions(+), 24 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 1158da4fa84..755651e078a 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1307,6 +1307,7 @@ sub checkauth {
>     }
> 
>     # finished authentification, now respond
>+    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
>     if ( $auth_state eq 'completed' || $authnotrequired ) {
>         # successful login
>         unless (@$cookie) {
>@@ -1321,6 +1322,30 @@ sub checkauth {
> 
>         track_login_daily( $userid );
> 
>+        if ( defined $query->param('op') ) {
>+            die "Cannot use GET for this request"
>+                if $request_method ne 'POST';
>+
>+            print $query->header(
>+                {
>+                    type              => 'text/html',
>+                    charset           => 'utf-8',
>+                    cookie            => $cookie,
>+                    'X-Frame-Options' => 'SAMEORIGIN',
>+                    -sameSite         => 'Lax'
>+                }
>+            );
>+
>+            my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
>+            output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
>+                unless Koha::Token->new->check_csrf(
>+                    {
>+                        session_id => scalar $query->cookie('CGISESSID'),
>+                        token      => scalar $query->param('csrf_token'),
>+                    }
>+                );
>+        }
>+
>         # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
>         # request. We therefore redirect the user to the requested page again without the login parameters.
>         # See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get
>@@ -1357,7 +1382,6 @@ sub checkauth {
>     $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
>     $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
> 
>-    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
>     my $auth_error = $query->param('auth_error');
>     my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
>     $template->param(
>@@ -1469,29 +1493,6 @@ sub checkauth {
>         }
>     }
> 
>-    if ( $auth_state eq 'completed' && defined $query->param('op') ) {
>-        die "Cannot use GET for this request"
>-            if $request_method ne 'POST';
>-
>-        print $query->header(
>-            {
>-                type              => 'text/html',
>-                charset           => 'utf-8',
>-                cookie            => $cookie,
>-                'X-Frame-Options' => 'SAMEORIGIN',
>-                -sameSite         => 'Lax'
>-            }
>-        );
>-
>-        output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
>-            unless Koha::Token->new->check_csrf(
>-                {
>-                    session_id => scalar $query->cookie('CGISESSID'),
>-                    token      => scalar $query->param('csrf_token'),
>-                }
>-            );
>-    }
>-
>     $template->param(
>         LibraryName => C4::Context->preference("LibraryName"),
>     );
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 34478: 154241 | 154242 | 154243 | 154244 | 154245 | 154246 | 154247 | 154248 | 154249 | 154250 | 154251 | 154252 | 154253 | 154254 | 155971 | 155972 | 155973 | 155974 | 155975 | 155976 | 155977 | 155978 | 155979 | 155980 | 155981 | 155982 | 155983 | 155984 | 155985 | 155986 | 155987 | 155988 | 155989 | 155990 | 156070 | 156071 | 156072 | 156073 | 156074 | 162114 | 162165 | 162630