Bugzilla – Attachment 162114 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Do not allow absence of token
Bug-34478-Do-not-allow-absence-of-token.patch (text/plain), 2.32 KB, created by
Jonathan Druart
on 2024-02-13 15:33:25 UTC
(
hide
)
Description:
Bug 34478: Do not allow absence of token
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2024-02-13 15:33:25 UTC
Size:
2.32 KB
patch
obsolete
>From 7820a5d00f004ea0de4b118eace63eb33703a9d8 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 13 Feb 2024 16:32:35 +0100 >Subject: [PATCH] Bug 34478: Do not allow absence of token > >Well, this test was silly, I was focussed on propagating an error to the >UI, but we really need to explode in this case. > >Note that this requires more work as login is now broken. >--- > debian/templates/plack.psgi | 31 ++++++++++++++----------------- > 1 file changed, 14 insertions(+), 17 deletions(-) > >diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi >index 108a1aa5e46..317f278cfd4 100644 >--- a/debian/templates/plack.psgi >+++ b/debian/templates/plack.psgi >@@ -64,24 +64,21 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise > $q->param( 'debug_programming_error', "'$original_op' must start with 'cud-' for $request_method" ); > } > >- if ( $csrf_token ) { >- unless ( >- Koha::Token->new->check_csrf( >- { >- session_id => scalar $q->cookie('CGISESSID'), >- token => $csrf_token, >- } >- ) >- ) >- { >- Koha::Logger->get->debug("The form submission failed (Wrong CSRF token)."); >- $q->param( 'op', '' ); >- $q->param( 'invalid_csrf_token', 1); >- } >- } else { >- Koha::Logger->get->warn("Programming error - No CSRF token passed for $request_method"); >+ die "Programming error - No CSRF token passed for $request_method" >+ unless $csrf_token; >+ >+ unless ( >+ Koha::Token->new->check_csrf( >+ { >+ session_id => scalar $q->cookie('CGISESSID'), >+ token => $csrf_token, >+ } >+ ) >+ ) >+ { >+ Koha::Logger->get->debug("The form submission failed (Wrong CSRF token)."); > $q->param( 'op', '' ); >- $q->param( 'debug_programming_error', "No CSRF token passed for $request_method" ); >+ $q->param( 'invalid_csrf_token', 1); > } > } > >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630