Bugzilla – Attachment 169981 Details for
Bug 37553
Fix CSRF handling in koha-svc.pl script
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37553: Consistently send Csrf-Token in request header
Bug-37553-Consistently-send-Csrf-Token-in-request-.patch (text/plain), 2.21 KB, created by
Marcel de Rooy
on 2024-08-02 06:35:17 UTC
(
hide
)
Description:
Bug 37553: Consistently send Csrf-Token in request header
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-08-02 06:35:17 UTC
Size:
2.21 KB
patch
obsolete
>From 1e4ea3fe23e3df28928f32c5738aabde6950e13e Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Fri, 2 Aug 2024 01:49:06 +0000 >Subject: [PATCH] Bug 37553: Consistently send Csrf-Token in request header >Content-Type: text/plain; charset=utf-8 > >This change consistently sends the Csrf-Token in the request header. >Previously, one POST sent it in the request body, while the other POST >sent it in the request header. Since we're using an API, it's best >for us to always send it in the request header > >Test plan: >0. Apply the patch >1. perl ./misc/migration_tools/koha-svc.pl \ > http://localhost:8081/cgi-bin/koha/svc koha koha 29 > bib-29.xml >2. perl ./misc/migration_tools/koha-svc.pl \ > http://localhost:8081/cgi-bin/koha/svc koha koha 29 bib-29.xml >3. Note that the following appears in STDOUT and there is no 403 error: >"update 29 from bib-29.xml" > >Signed-off-by: David Nind <david@davidnind.com> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > misc/migration_tools/koha-svc.pl | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > >diff --git a/misc/migration_tools/koha-svc.pl b/misc/migration_tools/koha-svc.pl >index 83c72a99be..929380fa87 100755 >--- a/misc/migration_tools/koha-svc.pl >+++ b/misc/migration_tools/koha-svc.pl >@@ -110,7 +110,8 @@ sub new { > > my $resp = $ua->post( > "$url/authentication", >- { login_userid => $user, login_password => $password, csrf_token => $csrf_token } >+ 'Csrf-Token' => $csrf_token, >+ 'Content' => { login_userid => $user, login_password => $password } > ); > die $resp->status_line unless $resp->is_success; > >@@ -152,9 +153,11 @@ sub post { > my $url = $self->{url}; > warn "# post $url/bib/$biblionumber\n" if $self->{debug}; > my $csrf_token = $self->{csrf_token}; >- my $resp = $self->{ua}->post( >- "$url/bib/$biblionumber", 'Content_type' => 'text/xml', Content => $marcxml, >- csrf_token => $csrf_token >+ my $resp = $self->{ua}->post( >+ "$url/bib/$biblionumber", >+ 'Content_type' => 'text/xml', >+ 'Csrf_Token' => $csrf_token, >+ 'Content' => $marcxml, > ); > die $resp->status_line unless $resp->is_success; > return $resp->decoded_content; >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37553
:
169968
|
169974
|
169976
|
169977
|
169978
|
169979
|
169980
| 169981 |
169982