Attachment 155990 Details for Bug 34478 – Bug 34478: op-cud - Trick CGI directly

[patch] Bug 34478: op-cud - Trick CGI directly

Bug-34478-op-cud---Trick-CGI-directly.patch (text/plain), 5.91 KB, created by Jonathan Druart on 2023-09-21 12:03:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2023-09-21 12:03:44 UTC

Size: 5.91 KB

patch

obsolete

>From 3ff5f9d165b49ca650c09f80beb129922e171351 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 21 Sep 2023 12:00:17 +0200
>Subject: [PATCH] Bug 34478: op-cud - Trick CGI directly
>
>---
> C4/Auth.pm                  | 52 ++++++++++++++++++++-----------------
> Koha/Exceptions/Token.pm    |  5 ++++
> debian/templates/plack.psgi | 13 ++++++++++
> 3 files changed, 46 insertions(+), 24 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 7bd2b5d2f26..32feddbf322 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -26,11 +26,13 @@ use CGI::Session;
> use CGI::Session::ErrorHandler;
> use URI;
> use URI::QueryParam;
>+use Try::Tiny;
> 
> use C4::Context;
> use C4::Templates;    # to get the template
> use C4::Languages;
> use C4::Search::History;
>+use C4::Output qw( output_and_exit );
> use Koha;
> use Koha::Logger;
> use Koha::Caches;
>@@ -52,6 +54,7 @@ use C4::Log qw( logaction );
> use Koha::CookieManager;
> use Koha::Auth::Permissions;
> use Koha::Token;
>+use Koha::Exceptions::Token;
> 
> # use utf8;
> 
>@@ -187,6 +190,7 @@ sub get_template_and_user {
>             $in->{'type'},
>             undef,
>             $in->{template_name},
>+            { skip_csrf_check => 1 },
>         );
>     }
> 
>@@ -632,6 +636,16 @@ sub get_template_and_user {
>         $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
>     }
> 
>+    if ( $in->{query}->param('op-cud') ) {
>+        C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' )
>+            unless Koha::Token->new->check_csrf(
>+            {
>+                session_id => scalar $in->{query}->cookie('CGISESSID'),
>+                token      => scalar $in->{query}->param('csrf_token'),
>+            }
>+            );
>+    }
>+
>     return ( $template, $borrowernumber, $cookie, $flags );
> }
> 
>@@ -792,6 +806,9 @@ sub checkauth {
>     my $type            = shift;
>     my $emailaddress    = shift;
>     my $template_name   = shift;
>+    my $params          = shift;
>+
>+    my $skip_csrf_check = $params->{skip_csrf_check} || 0;
>     $type = 'opac' unless $type;
> 
>     if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
>@@ -1307,7 +1324,6 @@ sub checkauth {
>     }
> 
>     # finished authentification, now respond
>-    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
>     if ( $auth_state eq 'completed' || $authnotrequired ) {
>         # successful login
>         unless (@$cookie) {
>@@ -1322,35 +1338,22 @@ sub checkauth {
> 
>         track_login_daily( $userid );
> 
>-        my $original_op_cud = $query->param('op-cud');
>-        if ( $request_method eq 'GET' ) {
>-            $query->param('op-cud', undef);
>-        } elsif ( $request_method eq 'POST' ) {
>-            $query->param('op', undef);
>-        }
>-
>-        if ( defined $original_op_cud ) {
>+        if ( $query->param('op-cud') ) {
>             die "Cannot use GET for this request"
>-                if $request_method ne 'POST';
>-
>-            print $query->header(
>-                {
>-                    type              => 'text/html',
>-                    charset           => 'utf-8',
>-                    cookie            => $cookie,
>-                    'X-Frame-Options' => 'SAMEORIGIN',
>-                    -sameSite         => 'Lax'
>-                }
>-            );
>+                if $request_method eq 'GET';
> 
>-            my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
>-            output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
>-                unless Koha::Token->new->check_csrf(
>+            unless (
>+                $skip_csrf_check
>+                || Koha::Token->new->check_csrf(
>                     {
>                         session_id => scalar $query->cookie('CGISESSID'),
>                         token      => scalar $query->param('csrf_token'),
>                     }
>-                );
>+                )
>+                )
>+            {
>+                Koha::Exceptions::Token::WrongCSRFToken->throw;
>+            }
>         }
> 
>         # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
>@@ -1390,6 +1393,7 @@ sub checkauth {
>     $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
> 
>     my $auth_error = $query->param('auth_error');
>+    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
>     my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
>     $template->param(
>         login                                 => 1,
>diff --git a/Koha/Exceptions/Token.pm b/Koha/Exceptions/Token.pm
>index c7fe1473697..92701ebae82 100644
>--- a/Koha/Exceptions/Token.pm
>+++ b/Koha/Exceptions/Token.pm
>@@ -27,6 +27,11 @@ use Exception::Class (
>         isa => 'Koha::Exceptions::Token',
>         description => 'Bad pattern for random token generation'
>     },
>+    'Koha::Exceptions::Token::WrongCSRFToken' => {
>+        isa => 'Koha::Exceptions::Token',
>+        description => 'Invalid CSRF Token'
>+    },
>+
> );
> 
> =head1 NAME
>diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi
>index 89cd6ef48fe..577118148c9 100644
>--- a/debian/templates/plack.psgi
>+++ b/debian/templates/plack.psgi
>@@ -47,6 +47,19 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise
>         $CGI::PARAM_UTF8 = 1;
>         Koha::Caches->flush_L1_caches();
>         Koha::Cache::Memory::Lite->flush();
>+
>+        $original_op_cud = $q->param('op-cud');
>+        $request_method  = $q->request_method // q{};
>+        if ( $request_method eq 'GET' && defined $original_op_cud ) {
>+            warn "Programming error - op-cud must not be passed with GET";
>+            $q->param( 'op-cud', undef );
>+        } elsif ( $request_method ne 'GET' && defined $q->param('op') ) {
>+            warn "Programming error - op can only be passed with GET";
>+            $q->param( 'op', undef );
>+        } else {
>+            $q->param( 'op', $original_op_cud );
>+        }
>+
>         return $q;
>     };
> }
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 34478: 154241 | 154242 | 154243 | 154244 | 154245 | 154246 | 154247 | 154248 | 154249 | 154250 | 154251 | 154252 | 154253 | 154254 | 155971 | 155972 | 155973 | 155974 | 155975 | 155976 | 155977 | 155978 | 155979 | 155980 | 155981 | 155982 | 155983 | 155984 | 155985 | 155986 | 155987 | 155988 | 155989 | 155990 | 156070 | 156071 | 156072 | 156073 | 156074 | 162114 | 162165 | 162630