Attachment 173114 Details for Bug 36560 – Bug 36560: Add a CSRF exception for ILS-DI API

[patch] Bug 36560: Add a CSRF exception for ILS-DI API

Bug-36560-Add-a-CSRF-exception-for-ILS-DI-API.patch (text/plain), 1.73 KB, created by David Cook on 2024-10-22 02:11:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2024-10-22 02:11:23 UTC

Size: 1.73 KB

patch

obsolete

>From 50ad0f6b6842829a4fd6ac93835137b76479dd6a Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Tue, 22 Oct 2024 02:06:18 +0000
>Subject: [PATCH] Bug 36560: Add a CSRF exception for ILS-DI API
>
>This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token
>for the ILS-DI API.
>
>1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI
>2. Enable "ILS-DI"
>3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
>4. Note the 403 response
>
>5. Apply the patch
>6. sudo koha-plack --restart kohadev
>
>7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
>8. Note the 200 response
>---
> Koha/Middleware/CSRF.pm | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm
>index 58e75c948e..a41da53054 100644
>--- a/Koha/Middleware/CSRF.pm
>+++ b/Koha/Middleware/CSRF.pm
>@@ -44,11 +44,20 @@ sub call {
>     my $request_method = $req->method  // q{};
>     my $uri            = $req->uri     // q{};
>     my $referer        = $req->referer // q{No referer};
>+    my $request_path   = $req->path // q{};
>+
>+    my %path_exceptions = (
>+        '/ilsdi.pl' => 1,
>+    );
> 
>     #NOTE: Ignore ErrorDocument requests for CSRF
>     if ( $env->{'psgix.errordocument.SCRIPT_NAME'} ) {
>         return $self->app->($env);
>     }
>+    elsif ( $path_exceptions{$request_path} ){
>+        #NOTE: Ignore path exceptions for CSRF
>+        return $self->app->($env);
>+    }
> 
>     my ($error);
>     if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) {
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 36560: 173114 | 173182 | 173349 | 173350