Bugzilla – Attachment 167610 Details for
Bug 37056
CSRF error on login when user js contains a fetch of svc/report
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37056: Mount a new intranet_svc api to avoid redirects
Bug-37056-Mount-a-new-intranetsvc-api-to-avoid-red.patch (text/plain), 4.97 KB, created by
Nick Clemens (kidclamp)
on 2024-06-10 17:54:22 UTC
(
hide
)
Description:
Bug 37056: Mount a new intranet_svc api to avoid redirects
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2024-06-10 17:54:22 UTC
Size:
4.97 KB
patch
obsolete
>From 1baa7cb6193c8cb03ade6fd228ccc577f6341361 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Fri, 7 Jun 2024 16:59:58 +0000 >Subject: [PATCH] Bug 37056: Mount a new intranet_svc api to avoid redirects > >When an unauthroized call to svc is made, we use the ErrorDocument middleware to respond with an HTML >page. The API doens't do this, it simply returns its status. We should mount the svc as it own app to avoid >the redirect to HTML for unauthroized responses > >To test: >1 - Create a report >2 - Add to IntranetUserJs: > $(document).ready(function() { > // Your report ID > var reportId = '492'; > > // Fetch the report > $.get('/cgi-bin/koha/svc/report?id=' + reportId, function(data) { > console.log('Kaboom'); > }); > }); >3 - Log out >4 - Attempt to login >5 - KO >6 - Apply patch >7 - Reset all (or copy the necessary changes to your plack/apache files) >8 - Generate report and update user js again >8 - Logout, login >9 - Success! >--- > .../apache-shared-intranet-plack.conf | 3 +++ > debian/templates/plack.psgi | 12 ++++++++++++ > errors/403.pl | 6 +++--- > svc/report | 18 ++++++++---------- > 4 files changed, 26 insertions(+), 13 deletions(-) > >diff --git a/debian/templates/apache-shared-intranet-plack.conf b/debian/templates/apache-shared-intranet-plack.conf >index 7f9f47e1e13..bcee3994439 100644 >--- a/debian/templates/apache-shared-intranet-plack.conf >+++ b/debian/templates/apache-shared-intranet-plack.conf >@@ -22,6 +22,9 @@ > #Â Point the intranet site to Plack > ProxyPass /index.html "unix:/var/run/koha/${instance}/plack.sock|http://localhost/intranet/mainpage.pl" > ProxyPassReverse /index.html "unix:/var/run/koha/${instance}/plack.sock|http://localhost/intranet/mainpage.pl" >+ ProxyPass /cgi-bin/koha/svc "unix:/var/run/koha/${instance}/plack.sock|http://localhost/intranet_svc" >+ ProxyPassReverse /cgi-bin/koha/svc "unix:/var/run/koha/${instance}/plack.sock|http://localhost/intranet_svc" >+ > ProxyPass /cgi-bin/koha "unix:/var/run/koha/${instance}/plack.sock|http://localhost/intranet" > ProxyPassReverse /cgi-bin/koha "unix:/var/run/koha/${instance}/plack.sock|http://localhost/intranet" > >diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi >index bf31ecf152f..eff36bf3abb 100644 >--- a/debian/templates/plack.psgi >+++ b/debian/templates/plack.psgi >@@ -56,6 +56,10 @@ my $intranet = Plack::App::CGIBin->new( > root => $ENV{DEV_INSTALL}? $home: "$home/intranet/cgi-bin" > )->to_app; > >+my $intranet_svc = Plack::App::CGIBin->new( >+ root => $ENV{DEV_INSTALL}? "$home/svc": "$home/svc/cgi-bin" >+)->to_app; >+ > my $opac = Plack::App::CGIBin->new( > root => $ENV{DEV_INSTALL}? "$home/opac": "$home/opac/cgi-bin/opac" > )->to_app; >@@ -117,6 +121,14 @@ builder { > enable "+Koha::Middleware::CSRF"; > $intranet; > }; >+ mount '/intranet_svc' => builder { >+ if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){ >+ enable 'Log4perl', category => 'plack-intranet'; >+ enable 'LogWarn'; >+ } >+ enable "+Koha::Middleware::CSRF"; >+ $intranet_svc; >+ }; > mount '/api/v1/app.pl' => builder { > if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){ > enable 'Log4perl', category => 'plack-api'; >diff --git a/errors/403.pl b/errors/403.pl >index b83c014de81..71e68211a28 100755 >--- a/errors/403.pl >+++ b/errors/403.pl >@@ -33,9 +33,9 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > authnotrequired => 1, > } > ); >-$template->param ( >- admin => $admin, >- errno => 403, >+$template->param( >+ admin => $admin, >+ errno => 403, > csrf_error => $ENV{'plack.middleware.Koha.CSRF'}, > ); > >diff --git a/svc/report b/svc/report >index 5d91494f937..e36e9132809 100755 >--- a/svc/report >+++ b/svc/report >@@ -20,10 +20,10 @@ > > use Modern::Perl; > >-use C4::Auth qw( get_template_and_user ); >+use C4::Auth qw( check_api_auth ); > use C4::Reports::Guided qw( execute_query ); > use Koha::Reports; >-use JSON qw( encode_json decode_json ); >+use JSON qw( encode_json decode_json to_json ); > use CGI qw ( -utf8 ); > > use Koha::Caches; >@@ -44,14 +44,12 @@ $report_id = $report_rec->id; > my @sql_params = $query->multi_param('sql_params'); > my @param_names = $query->multi_param('param_names'); > >-my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >- { >- template_name => "intranet-main.tt", >- query => $query, >- type => "intranet", >- flagsrequired => { catalogue => 1, }, >- } >-); >+my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} ); >+unless ($status eq "ok") { >+ print $query->header(-type => 'application/json', -status => '401 Unauthorized'); >+ print to_json({ auth_status => $status }); >+ exit 0; >+} > > my $cache = Koha::Caches->get_instance(); > my $cache_active = $cache->is_cache_active; >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37056
:
167580
|
167581
|
167610
|
167611
|
167617
|
167692
|
168342