Attachment 162133 Details for Bug 36084 – Bug 36084: Do not allow absence of token

[patch] Bug 36084: Do not allow absence of token

Bug-36084-Do-not-allow-absence-of-token.patch (text/plain), 2.32 KB, created by Jonathan Druart on 2024-02-14 08:36:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2024-02-14 08:36:13 UTC

Size: 2.32 KB

patch

obsolete

>From d5a352d55705cd7ba4f24adaeca008124c7ea936 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 13 Feb 2024 16:32:35 +0100
>Subject: [PATCH] Bug 36084: Do not allow absence of token
>
>Well, this test was silly, I was focussed on propagating an error to the
>UI, but we really need to explode in this case.
>
>Note that this requires more work as login is now broken.
>---
> debian/templates/plack.psgi | 31 ++++++++++++++-----------------
> 1 file changed, 14 insertions(+), 17 deletions(-)
>
>diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi
>index 108a1aa5e46..317f278cfd4 100644
>--- a/debian/templates/plack.psgi
>+++ b/debian/templates/plack.psgi
>@@ -64,24 +64,21 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise
>                 $q->param( 'debug_programming_error', "'$original_op' must start with 'cud-' for $request_method" );
>             }
> 
>-            if ( $csrf_token ) {
>-                unless (
>-                    Koha::Token->new->check_csrf(
>-                        {
>-                            session_id => scalar $q->cookie('CGISESSID'),
>-                            token      => $csrf_token,
>-                        }
>-                    )
>-                    )
>-                {
>-                    Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
>-                    $q->param( 'op', '' );
>-                    $q->param( 'invalid_csrf_token', 1);
>-                }
>-            } else {
>-                Koha::Logger->get->warn("Programming error - No CSRF token passed for $request_method");
>+            die "Programming error - No CSRF token passed for $request_method"
>+                unless $csrf_token;
>+
>+            unless (
>+                Koha::Token->new->check_csrf(
>+                    {
>+                        session_id => scalar $q->cookie('CGISESSID'),
>+                        token      => $csrf_token,
>+                    }
>+                )
>+                )
>+            {
>+                Koha::Logger->get->debug("The form submission failed (Wrong CSRF token).");
>                 $q->param( 'op', '' );
>-                $q->param( 'debug_programming_error', "No CSRF token passed for $request_method" );
>+                $q->param( 'invalid_csrf_token', 1);
>             }
>         }
> 
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 36084: 162108 | 162109 | 162110 | 162111 | 162112 | 162133 | 162147 | 162150 | 162712