Bugzilla – Attachment 165618 Details for
Bug 36700
CSRF: Cannot save a systempreference (when nginx drops the CSRF header with an underscore)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36700: [ALTERNATIVE] Fix underscore in CSRF header
Bug-36700-ALTERNATIVE-Fix-underscore-in-CSRF-heade.patch (text/plain), 3.69 KB, created by
Marcel de Rooy
on 2024-04-26 08:43:56 UTC
(
hide
)
Description:
Bug 36700: [ALTERNATIVE] Fix underscore in CSRF header
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-04-26 08:43:56 UTC
Size:
3.69 KB
patch
obsolete
>From cadf3a29eb4db8b2566e9be6e9ac9066a7b4beed Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Fri, 26 Apr 2024 08:32:52 +0000 >Subject: [PATCH] Bug 36700: [ALTERNATIVE] Fix underscore in CSRF header >Content-Type: text/plain; charset=utf-8 > >Also change the cache key in template plugin. And the X- header >that had an underscore in svc script. >--- > Koha/Middleware/CSRF.pm | 2 +- > Koha/Template/Plugin/Koha.pm | 2 +- > koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js | 6 +++--- > svc/authentication | 2 +- > 4 files changed, 6 insertions(+), 6 deletions(-) > >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index afa581fa38..b34208ec6c 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -50,7 +50,7 @@ sub call { > } elsif ( $stateful_methods{$request_method} ) { > > # Get the CSRF token from the param list or the header >- my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN'); >+ my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > > if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, >diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm >index 55671d2199..0b69249779 100644 >--- a/Koha/Template/Plugin/Koha.pm >+++ b/Koha/Template/Plugin/Koha.pm >@@ -110,7 +110,7 @@ sub GenerateCSRF { > my ($self) = @_; > > my $memory_cache = Koha::Cache::Memory::Lite->get_instance; >- my $cache_key = "CSRF_TOKEN"; >+ my $cache_key = "CSRF-TOKEN"; > my $cached = $memory_cache->get_from_cache($cache_key); > return $cached if $cached; > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js b/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js >index a379a1f867..2e1fe0fd03 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js >@@ -82,7 +82,7 @@ class HttpClient { > ? params.body > : JSON.stringify(params.body) > : undefined; >- let csrf_token = { csrf_token: this.csrf_token }; >+ let csrf_token = { 'CSRF-TOKEN': this.csrf_token }; > let headers = { ...csrf_token, ...params.headers }; > return this._fetchJSON( > params.endpoint, >@@ -103,7 +103,7 @@ class HttpClient { > ? params.body > : JSON.stringify(params.body) > : undefined; >- let csrf_token = { csrf_token: this.csrf_token }; >+ let csrf_token = { 'CSRF-TOKEN': this.csrf_token }; > let headers = { ...csrf_token, ...params.headers }; > return this._fetchJSON( > params.endpoint, >@@ -119,7 +119,7 @@ class HttpClient { > } > > delete(params = {}) { >- let csrf_token = { csrf_token: this.csrf_token }; >+ let csrf_token = { 'CSRF-TOKEN': this.csrf_token }; > let headers = { ...csrf_token, ...params.headers }; > return this._fetchJSON( > params.endpoint, >diff --git a/svc/authentication b/svc/authentication >index 409c2832c1..6d8fc571ac 100755 >--- a/svc/authentication >+++ b/svc/authentication >@@ -62,5 +62,5 @@ if ( $status eq "ok" ) { > ); > $csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } ); > } >-print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF_TOKEN' => $csrf_token ); >+print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF-TOKEN' => $csrf_token ); > print XMLout( { status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1 ); >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36700
:
165537
|
165618
|
165715
|
165716
|
165744
|
165745
|
165962
|
165963
|
165964