Bugzilla – Attachment 164445 Details for
Bug 36349
Login for SCO/SCI broken by CSRF
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36349: Fix AutoSelfCheckAllowed
Bug-36349-Fix-AutoSelfCheckAllowed.patch (text/plain), 2.77 KB, created by
David Cook
on 2024-04-05 05:55:41 UTC
(
hide
)
Description:
Bug 36349: Fix AutoSelfCheckAllowed
Filename:
MIME Type:
Creator:
David Cook
Created:
2024-04-05 05:55:41 UTC
Size:
2.77 KB
patch
obsolete
>From a74937c3d49d1928477d5d9b7e76db4d976cde6e Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 20 Mar 2024 10:08:16 +0100 >Subject: [PATCH] Bug 36349: Fix AutoSelfCheckAllowed > >Move the check to C4::Auth. > >Yes, it's not nice, I didn't expect to add exception to this code, and >it's adding more ugly code to get_template_and_user, but... Suggestions >welcome! > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > C4/Auth.pm | 18 +++++++++++++----- > opac/sco/sco-main.pl | 8 -------- > 2 files changed, 13 insertions(+), 13 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index a8c21740f00..86ddd3baf09 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -183,11 +183,19 @@ sub get_template_and_user { > $in->{'query'}, > ); > >- my $request_method = $in->{query}->request_method // q{}; >- unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) { >- for my $v ( qw( login_userid login_password ) ) { >- $in->{query}->param($v, '') >- if $in->{query}->param($v); >+ if ( C4::Context->preference('AutoSelfCheckAllowed') && $in->{template_name} =~ m|sco/| ) { >+ my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID'); >+ my $AutoSelfCheckPass = C4::Context->preference('AutoSelfCheckPass'); >+ $in->{query}->param( -name => 'login_userid', -values => [$AutoSelfCheckID] ); >+ $in->{query}->param( -name => 'login_password', -values => [$AutoSelfCheckPass] ); >+ $in->{query}->param( -name => 'koha_login_context', -values => ['sco'] ); >+ } else { >+ my $request_method = $in->{query}->request_method // q{}; >+ unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) { >+ for my $v (qw( login_userid login_password )) { >+ $in->{query}->param( $v, '' ) >+ if $in->{query}->param($v); >+ } > } > } > >diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl >index a4a05f793eb..a7fcb24d8f5 100755 >--- a/opac/sco/sco-main.pl >+++ b/opac/sco/sco-main.pl >@@ -61,14 +61,6 @@ unless ( in_iprange(C4::Context->preference('SelfCheckAllowByIPRanges')) ) { > exit; > } > >-if (C4::Context->preference('AutoSelfCheckAllowed')) >-{ >- my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID'); >- my $AutoSelfCheckPass = C4::Context->preference('AutoSelfCheckPass'); >- $query->param(-name=>'userid',-values=>[$AutoSelfCheckID]); >- $query->param(-name=>'password',-values=>[$AutoSelfCheckPass]); >- $query->param(-name=>'koha_login_context',-values=>['sco']); >-} > $query->param(-name=>'sco_user_login',-values=>[1]); > > my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36349
:
163356
|
163386
|
163514
|
163552
|
163553
|
164411
|
164412
|
164444
| 164445 |
164446
|
164447