Bugzilla – Attachment 155989 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: op-cud - Trick CGI directly
Bug-34478-op-cud---Trick-CGI-directly.patch (text/plain), 3.44 KB, created by
Jonathan Druart
on 2023-09-21 10:05:41 UTC
(
hide
)
Description:
Bug 34478: op-cud - Trick CGI directly
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-09-21 10:05:41 UTC
Size:
3.44 KB
patch
obsolete
>From 80472536c53041db43411d8d40e7a45b1b4c2f25 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 21 Sep 2023 12:00:17 +0200 >Subject: [PATCH] Bug 34478: op-cud - Trick CGI directly > >--- > C4/Auth.pm | 39 +++++++++++++++++-------------------- > debian/templates/plack.psgi | 12 ++++++++++++ > 2 files changed, 30 insertions(+), 21 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 7bd2b5d2f26..0bfdf72e45a 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1322,35 +1322,32 @@ sub checkauth { > > track_login_daily( $userid ); > >- my $original_op_cud = $query->param('op-cud'); >- if ( $request_method eq 'GET' ) { >- $query->param('op-cud', undef); >- } elsif ( $request_method eq 'POST' ) { >- $query->param('op', undef); >- } >- >- if ( defined $original_op_cud ) { >+ if ( $query->param('op-cud') ) { > die "Cannot use GET for this request" > if $request_method ne 'POST'; > >- print $query->header( >- { >- type => 'text/html', >- charset => 'utf-8', >- cookie => $cookie, >- 'X-Frame-Options' => 'SAMEORIGIN', >- -sameSite => 'Lax' >- } >- ); >- >- my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); >- output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf( >+ unless ( >+ Koha::Token->new->check_csrf( > { > session_id => scalar $query->cookie('CGISESSID'), > token => scalar $query->param('csrf_token'), > } >+ ) >+ ) >+ { >+ my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); >+ print $query->header( >+ { >+ type => 'text/html', >+ charset => 'utf-8', >+ cookie => $cookie, >+ 'X-Frame-Options' => 'SAMEORIGIN', >+ -sameSite => 'Lax' >+ } > ); >+ >+ output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ); >+ } > } > > # In case, that this request was a login attempt, we want to prevent that users can repost the opac login >diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi >index 89cd6ef48fe..50d832606d7 100644 >--- a/debian/templates/plack.psgi >+++ b/debian/templates/plack.psgi >@@ -47,6 +47,18 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise > $CGI::PARAM_UTF8 = 1; > Koha::Caches->flush_L1_caches(); > Koha::Cache::Memory::Lite->flush(); >+ >+ $request_method = $q->request_method // q{}; >+ if ( $request_method eq 'GET' ) { >+ warn "Programming error - op-cud must not be passed with GET"; >+ $q->param( 'op-cud', undef ); >+ } elsif ( defined $q->param('op') ) { >+ warn "Programming error - op can only be passed with GET"; >+ $q->param( 'op', undef ); >+ } else { >+ $q->param( 'op', $q->param('op-cud') ); >+ } >+ > return $q; > }; > } >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630