Bugzilla – Attachment 167580 Details for
Bug 37056
CSRF error on login when user js contains a fetch of svc/report
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37056: Don't generate new CSRF token when fetching a report using the svc API
Bug-37056-Dont-generate-new-CSRF-token-when-fetchi.patch (text/plain), 1.90 KB, created by
Nick Clemens (kidclamp)
on 2024-06-07 17:16:42 UTC
(
hide
)
Description:
Bug 37056: Don't generate new CSRF token when fetching a report using the svc API
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2024-06-07 17:16:42 UTC
Size:
1.90 KB
patch
obsolete
>From 6f4539c19003721a0a60d12f12b7709101c38752 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Fri, 7 Jun 2024 16:59:58 +0000 >Subject: [PATCH] Bug 37056: Don't generate new CSRF token when fetching a > report using the svc API > >To test: >1 - Create a report >2 - Add to IntranetUserJs: > $(document).ready(function() { > // Your report ID > var reportId = '492'; > > // Fetch the report > $.get('/cgi-bin/koha/svc/report?id=' + reportId, function(data) { > console.log('Kaboom'); > }); > }); >3 - Log out >4 - Attempt to login >5 - KO >6 - Apply patch >7 - Restart all >8 - Repeat login >9 - Success! >--- > svc/report | 18 ++++++++---------- > 1 file changed, 8 insertions(+), 10 deletions(-) > >diff --git a/svc/report b/svc/report >index 5d91494f937..89e2259f358 100755 >--- a/svc/report >+++ b/svc/report >@@ -20,10 +20,10 @@ > > use Modern::Perl; > >-use C4::Auth qw( get_template_and_user ); >+use C4::Auth qw( check_api_auth ); > use C4::Reports::Guided qw( execute_query ); > use Koha::Reports; >-use JSON qw( encode_json decode_json ); >+use JSON qw( encode_json decode_json to_json ); > use CGI qw ( -utf8 ); > > use Koha::Caches; >@@ -44,14 +44,12 @@ $report_id = $report_rec->id; > my @sql_params = $query->multi_param('sql_params'); > my @param_names = $query->multi_param('param_names'); > >-my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >- { >- template_name => "intranet-main.tt", >- query => $query, >- type => "intranet", >- flagsrequired => { catalogue => 1, }, >- } >-); >+my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} ); >+unless ($status eq "ok") { >+ print $query->header(-type => 'application/json', -charset => 'UTF-8'); >+ print to_json({ auth_status => $status }); >+ exit 0; >+} > > my $cache = Koha::Caches->get_instance(); > my $cache_active = $cache->is_cache_active; >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37056
:
167580
|
167581
|
167610
|
167611
|
167617
|
167692
|
168342