Bugzilla – Attachment 162147 Details for
Bug 36084
Pass CSRF token to SVC scripts (1/2)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36084: Add cud-login to the login form
Bug-36084-Add-cud-login-to-the-login-form.patch (text/plain), 4.55 KB, created by
Jonathan Druart
on 2024-02-14 13:56:55 UTC
(
hide
)
Description:
Bug 36084: Add cud-login to the login form
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2024-02-14 13:56:55 UTC
Size:
4.55 KB
patch
obsolete
>From 1eda446cde9aaa07a04a427c4d822831d34bca54 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 14 Feb 2024 14:54:55 +0100 >Subject: [PATCH] Bug 36084: Add cud-login to the login form > >TODO This needs to be covered by tests. >--- > C4/Auth.pm | 20 ++++++++++++------- > .../intranet-tmpl/prog/en/modules/auth.tt | 1 + > .../bootstrap/en/includes/masthead.inc | 1 + > .../bootstrap/en/modules/opac-main.tt | 1 + > 4 files changed, 16 insertions(+), 7 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index cc5a7a3ac65..2e1b98f2af3 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -193,6 +193,16 @@ sub get_template_and_user { > { skip_csrf_check => 1 }, > ); > } >+ my $session = get_session($sessionID); >+ >+ # We have just logged in >+ # If we are not coming from the login form we empty the credential to reject the access >+ if ( !$session && $user ) { >+ if ( $in->{query}->param('op') ne 'cud-login' ) { >+ $in->{query}->param('userid', ''); >+ $in->{query}->param('password', ''); >+ } >+ } > > # If we enforce GDPR and the user did not consent, redirect > # Exceptions for consent page itself and SCI/SCO system >@@ -213,11 +223,8 @@ sub get_template_and_user { > > if ( $in->{type} eq 'opac' && $user ) { > my $is_sco_user; >- if ($sessionID){ >- my $session = get_session($sessionID); >- if ($session){ >- $is_sco_user = $session->param('sco_user'); >- } >+ if ($session){ >+ $is_sco_user = $session->param('sco_user'); > } > my $kick_out; > >@@ -537,8 +544,7 @@ sub get_template_and_user { > or $pagename =~ /^addbybiblionumber$/ > or $pagename =~ /^review$/ ) > { >- my $sessionSearch = get_session( $sessionID ); >- $sessionSearch->clear( ["busc"] ) if $sessionSearch; >+ $session->clear( ["busc"] ) if $session; > } > } > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index 42244d4a8bb..1bae90c9142 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -124,6 +124,7 @@ > > <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" class="validated"> > [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-login" /> > <input type="hidden" name="koha_login_context" value="intranet" /> > [% FOREACH INPUT IN INPUTS %] > <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" /> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >index 2a1e4f1a717..3ee5421e32d 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >@@ -434,6 +434,7 @@ > <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" autocomplete="off" /> > <label for="mpassword">Password:</label><input type="password" id="mpassword" name="password" autocomplete="off" /> > <fieldset class="action"> >+ <input type="hidden" name="op" value="cud-login" /> > <input type="submit" class="btn btn-primary" value="Log in" /> > </fieldset> > </div> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt >index 5452c660ae2..186426d49de 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt >@@ -203,6 +203,7 @@ > <label for="password">Password:</label> > <input class="form-control" type="password" id="password" name="password" autocomplete="off" /> > <fieldset class="action"> >+ <input type="hidden" name="op" value="cud-login" /> > <input type="submit" value="Log in" class="btn btn-primary" /> > </fieldset> > </div> >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36084
:
162108
|
162109
|
162110
|
162111
|
162112
|
162133
|
162147
|
162150
|
162712