Bugzilla – Attachment 162684 Details for
Bug 36193
CSRF - Code review missed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36193: Add more request information on Koha::Middleware::CSRF output
Bug-36193-Add-more-request-information-on-KohaMidd.patch (text/plain), 2.19 KB, created by
Tomás Cohen Arazi (tcohen)
on 2024-03-01 18:24:54 UTC
(
hide
)
Description:
Bug 36193: Add more request information on Koha::Middleware::CSRF output
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2024-03-01 18:24:54 UTC
Size:
2.19 KB
patch
obsolete
>From 1e58e5eb693c317345f0439efe82f86ad6847f80 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 1 Mar 2024 15:24:25 -0300 >Subject: [PATCH] Bug 36193: Add more request information on > Koha::Middleware::CSRF output > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/Middleware/CSRF.pm | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index 41fd1438c2e..afa581fa380 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -39,21 +39,25 @@ sub call { > ); > > my $original_op = $req->param('op'); >- my $request_method = $req->method // q{}; >+ my $request_method = $req->method // q{}; >+ my $uri = $req->uri // q{}; >+ my $referer = $req->referer // q{No referer}; >+ > my ($error); > if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { >- $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s", $original_op, >- $request_method; >+ $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, >+ $request_method, $uri, $referer; > } elsif ( $stateful_methods{$request_method} ) { > > # Get the CSRF token from the param list or the header > my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN'); > > if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { >- $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s", $original_op, >- $request_method; >+ $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, >+ $request_method, $uri, $referer; > } elsif ( !$csrf_token ) { >- $error = sprintf "Programming error - No CSRF token passed for %s", $request_method; >+ $error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method, >+ $uri, $referer; > } else { > unless ( > Koha::Token->new->check_csrf( >-- >2.44.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36193
:
162684
|
162733
|
162734
|
162749
|
162750
|
162751
|
162752
|
162755
|
162769
|
162770
|
162771
|
162772
|
162773
|
162774
|
162775
|
162776
|
162777
|
162784
|
162830
|
162831
|
162837