Bugzilla – Attachment 167581 Details for
Bug 37056
CSRF error on login when user js contains a fetch of svc/report
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37056: (Non-working POC) Attempt to preserve 403 response
Bug-37056-Non-working-POC-Attempt-to-preserve-403-.patch (text/plain), 2.56 KB, created by
Nick Clemens (kidclamp)
on 2024-06-07 17:16:44 UTC
(
hide
)
Description:
Bug 37056: (Non-working POC) Attempt to preserve 403 response
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2024-06-07 17:16:44 UTC
Size:
2.56 KB
patch
obsolete
>From f2bd17b1fb9cf9b38bf10ecdb87e800a36887356 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Fri, 7 Jun 2024 17:14:53 +0000 >Subject: [PATCH] Bug 37056: (Non-working POC) Attempt to preserve 403 response > >The former patch will prevent the issue, however, it makes svc/report return 200 when not authorized. > >I thought maybe the issue was that we were generating a new csrf token on the 403 page/template and tried to >prevent that on this patch, however, it doesn't work. > >Looking for some help on this one >--- > errors/403.pl | 7 ++++--- > .../intranet-tmpl/prog/en/includes/doc-head-close.inc | 4 +++- > svc/report | 2 +- > 3 files changed, 8 insertions(+), 5 deletions(-) > >diff --git a/errors/403.pl b/errors/403.pl >index b83c014de81..a6c592c3586 100755 >--- a/errors/403.pl >+++ b/errors/403.pl >@@ -33,9 +33,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > authnotrequired => 1, > } > ); >-$template->param ( >- admin => $admin, >- errno => 403, >+$template->param( >+ admin => $admin, >+ errno => 403, >+ nocsrf => 1, > csrf_error => $ENV{'plack.middleware.Koha.CSRF'}, > ); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >index 60264eb4bb6..418fcc5c957 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >@@ -6,7 +6,9 @@ > [% PROCESS 'html_helpers.inc' %] > <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> > <meta name="viewport" content="width=device-width, initial-scale=1" /> >-<meta name="csrf-token" content="[% Koha.GenerateCSRF | $raw %]"> >+[% UNLESS nocsrf %] >+ <meta name="csrf-token" content="[% Koha.GenerateCSRF | $raw %]"> >+[% END %] > [% IF logged_in_user %]<meta name="generator" content="Koha [% Koha.Version.maintenance | html %]" />[% END %] > [%# Prevent XFS attacks -%] > [% UNLESS popup %] >diff --git a/svc/report b/svc/report >index 89e2259f358..575966ad104 100755 >--- a/svc/report >+++ b/svc/report >@@ -46,7 +46,7 @@ my @param_names = $query->multi_param('param_names'); > > my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} ); > unless ($status eq "ok") { >- print $query->header(-type => 'application/json', -charset => 'UTF-8'); >+ print $query->header(-type => 'application/json', -status => '403 Forbidden'); > print to_json({ auth_status => $status }); > exit 0; > } >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37056
:
167580
|
167581
|
167610
|
167611
|
167617
|
167692
|
168342