Attachment 169980 Details for Bug 37553 – Bug 37553: Use CSRF token for authenicated session for POSTing

[patch] Bug 37553: Use CSRF token for authenicated session for POSTing

Bug-37553-Use-CSRF-token-for-authenicated-session-.patch (text/plain), 1.73 KB, created by Marcel de Rooy on 2024-08-02 06:35:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2024-08-02 06:35:14 UTC

Size: 1.73 KB

patch

obsolete

>From aaa0249e050e1a6cedc1875fbf45d15a5f1c8b21 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Fri, 2 Aug 2024 01:37:40 +0000
>Subject: [PATCH] Bug 37553: Use CSRF token for authenicated session for
> POSTing
>Content-Type: text/plain; charset=utf-8
>
>This change fixes the Koha::SVC to store the CSRF token for
>the authenticated session for further POSTing.
>
>Test plan:
>0. Apply the patch
>1. perl ./misc/migration_tools/koha-svc.pl \
>    http://localhost:8081/cgi-bin/koha/svc koha koha 29 > bib-29.xml
>2. perl ./misc/migration_tools/koha-svc.pl \
>    http://localhost:8081/cgi-bin/koha/svc koha koha 29 bib-29.xml
>3. Note that the following appears in STDOUT and there is no 403 error:
>"update 29 from bib-29.xml"
>
>Signed-off-by: David Nind <david@davidnind.com>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> misc/migration_tools/koha-svc.pl | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/misc/migration_tools/koha-svc.pl b/misc/migration_tools/koha-svc.pl
>index 125b79ab43..83c72a99be 100755
>--- a/misc/migration_tools/koha-svc.pl
>+++ b/misc/migration_tools/koha-svc.pl
>@@ -107,7 +107,6 @@ sub new {
> 
>     my $get_resp   = $ua->get("$url/authentication");
>     my $csrf_token = $get_resp->header('CSRF-TOKEN');
>-    $self->{csrf_token} = $csrf_token;
> 
>     my $resp = $ua->post(
>         "$url/authentication",
>@@ -115,6 +114,10 @@ sub new {
>     );
>     die $resp->status_line unless $resp->is_success;
> 
>+    #NOTE: A successful authentication means we have a new CGISESSID and a new CSRF Token
>+    $csrf_token = $resp->header('CSRF-TOKEN');
>+    $self->{csrf_token} = $csrf_token;
>+
>     warn "# $user $url = ", $resp->decoded_content, "\n" if $self->{debug};
> 
>     $self->{ua} = $ua;
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 37553: 169968 | 169974 | 169976 | 169977 | 169978 | 169979 | 169980 | 169981 | 169982