Bugzilla – Attachment 165962 Details for
Bug 36700
CSRF: Cannot save a systempreference (when nginx drops the CSRF header with an underscore)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36700: Fix underscore in CSRF header
Bug-36700-Fix-underscore-in-CSRF-header.patch (text/plain), 3.71 KB, created by
Martin Renvoize (ashimema)
on 2024-05-01 12:34:11 UTC
(
hide
)
Description:
Bug 36700: Fix underscore in CSRF header
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2024-05-01 12:34:11 UTC
Size:
3.71 KB
patch
obsolete
>From 0a6f34e6f970fbbac740364f472e0175e25b3d29 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Fri, 26 Apr 2024 08:32:52 +0000 >Subject: [PATCH] Bug 36700: Fix underscore in CSRF header > >Also change the cache key in template plugin. And the X- header >that had an underscore in svc script. > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > Koha/Middleware/CSRF.pm | 2 +- > Koha/Template/Plugin/Koha.pm | 2 +- > koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js | 6 +++--- > svc/authentication | 2 +- > 4 files changed, 6 insertions(+), 6 deletions(-) > >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index afa581fa380..b34208ec6c4 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -50,7 +50,7 @@ sub call { > } elsif ( $stateful_methods{$request_method} ) { > > # Get the CSRF token from the param list or the header >- my $csrf_token = $req->param('csrf_token') || $req->header('CSRF_TOKEN'); >+ my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > > if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, >diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm >index 55671d2199d..0b69249779d 100644 >--- a/Koha/Template/Plugin/Koha.pm >+++ b/Koha/Template/Plugin/Koha.pm >@@ -110,7 +110,7 @@ sub GenerateCSRF { > my ($self) = @_; > > my $memory_cache = Koha::Cache::Memory::Lite->get_instance; >- my $cache_key = "CSRF_TOKEN"; >+ my $cache_key = "CSRF-TOKEN"; > my $cached = $memory_cache->get_from_cache($cache_key); > return $cached if $cached; > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js b/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js >index 385d0e11a92..2403b035c7f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/fetch/http-client.js >@@ -86,7 +86,7 @@ class HttpClient { > ? params.body > : JSON.stringify(params.body) > : undefined; >- let csrf_token = { csrf_token: this.csrf_token }; >+ let csrf_token = { "CSRF-TOKEN": this.csrf_token }; > let headers = { ...csrf_token, ...params.headers }; > return this._fetchJSON( > params.endpoint, >@@ -107,7 +107,7 @@ class HttpClient { > ? params.body > : JSON.stringify(params.body) > : undefined; >- let csrf_token = { csrf_token: this.csrf_token }; >+ let csrf_token = { "CSRF-TOKEN": this.csrf_token }; > let headers = { ...csrf_token, ...params.headers }; > return this._fetchJSON( > params.endpoint, >@@ -123,7 +123,7 @@ class HttpClient { > } > > delete(params = {}) { >- let csrf_token = { csrf_token: this.csrf_token }; >+ let csrf_token = { "CSRF-TOKEN": this.csrf_token }; > let headers = { ...csrf_token, ...params.headers }; > return this._fetchJSON( > params.endpoint, >diff --git a/svc/authentication b/svc/authentication >index 409c2832c1c..6d8fc571ac5 100755 >--- a/svc/authentication >+++ b/svc/authentication >@@ -62,5 +62,5 @@ if ( $status eq "ok" ) { > ); > $csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } ); > } >-print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF_TOKEN' => $csrf_token ); >+print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF-TOKEN' => $csrf_token ); > print XMLout( { status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1 ); >-- >2.44.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36700
:
165537
|
165618
|
165715
|
165716
|
165744
|
165745
| 165962 |
165963
|
165964