Bugzilla – Attachment 173361 Details for
Bug 38258
Connecting without a proper CGI cookie can disconnect all sessions
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38258: Force scalar context for cookie calls (part 1)
Bug-38258-Force-scalar-context-for-cookie-calls-pa.patch (text/plain), 21.51 KB, created by
Baptiste Wojtkowski (bwoj)
on 2024-10-25 14:00:42 UTC
(
hide
)
Description:
Bug 38258: Force scalar context for cookie calls (part 1)
Filename:
MIME Type:
Creator:
Baptiste Wojtkowski (bwoj)
Created:
2024-10-25 14:00:42 UTC
Size:
21.51 KB
patch
obsolete
>From 572af2979bea86d4914d7684924588e7f14dc9fb Mon Sep 17 00:00:00 2001 >From: Baptiste <baptiste.wojtkowski@biblibre.com> >Date: Fri, 25 Oct 2024 15:24:35 +0200 >Subject: [PATCH] Bug 38258: Force scalar context for cookie calls (part 1) > >To reproduce : > >1 - Log in to Koha intranet keep the browser open >2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' >Note: there is no need to have a valid thumbnail and biblionumber >3 - Go back to your browser and click any link: you have been disconnected > >I'm not sure about the exact mechanism leading to a disconnection, but this is due to : > >> check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); > >If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. > >This is true for all the results of: > >> git grep "check_cookie_auth.*cookie.*CGISESSID" > >Correct all the calls for cookies extracted from $input->cookie('CGISESSID') > >TEST PLAN: >1 - Log in to Koha intranet keep the browser open >2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' >Note: there is no need to have a valid thumbnail and biblionumber >3 - Go back to your browser and click any link: you have been disconnected >4 - Apply patch >5 - Repeat 1-3 and see you do not have been disconnected >--- > acqui/check_uniqueness.pl | 3 ++- > catalogue/image.pl | 3 ++- > cataloguing/plugin_launcher.pl | 3 ++- > cataloguing/value_builder/barcode.pl | 3 ++- > cataloguing/value_builder/barcode_manual.pl | 3 ++- > cataloguing/value_builder/dateaccessioned.pl | 3 ++- > cataloguing/value_builder/marc21_field_005.pl | 3 ++- > cataloguing/value_builder/marc21_field_245h.pl | 3 ++- > cataloguing/value_builder/marc21_field_260b.pl | 3 ++- > cataloguing/value_builder/marc21_orgcode.pl | 3 ++- > cataloguing/value_builder/stocknumber.pl | 3 ++- > cataloguing/value_builder/upload.pl | 3 ++- > cataloguing/ysearch.pl | 3 ++- > plugins/plugins-enable.pl | 3 ++- > serials/create-numberpattern.pl | 3 ++- > serials/subscription-frequency.pl | 3 ++- > serials/subscription-numberpattern.pl | 3 ++- > svc/barcode | 3 ++- > svc/cataloguing/automatic_linker.pl | 3 ++- > svc/checkin | 3 ++- > svc/checkouts | 3 ++- > svc/holds | 3 ++- > svc/mana/increment | 3 ++- > svc/mana/share | 3 ++- > svc/mana/use | 3 ++- > svc/recall | 3 ++- > svc/renew | 3 ++- > svc/return_claims | 3 ++- > tools/batch_records_ajax.pl | 3 ++- > 29 files changed, 58 insertions(+), 29 deletions(-) > >diff --git a/acqui/check_uniqueness.pl b/acqui/check_uniqueness.pl >index aece6aac55b..c6c52c0c64d 100755 >--- a/acqui/check_uniqueness.pl >+++ b/acqui/check_uniqueness.pl >@@ -38,8 +38,9 @@ use C4::Items qw( SearchItems ); > use C4::Auth qw( check_cookie_auth ); > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/catalogue/image.pl b/catalogue/image.pl >index af950a65346..f28750e2978 100755 >--- a/catalogue/image.pl >+++ b/catalogue/image.pl >@@ -34,8 +34,9 @@ use Koha::CoverImages; > $| = 1; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/plugin_launcher.pl b/cataloguing/plugin_launcher.pl >index b31ca52c893..33352960f7e 100755 >--- a/cataloguing/plugin_launcher.pl >+++ b/cataloguing/plugin_launcher.pl >@@ -24,8 +24,9 @@ use C4::Auth qw( check_cookie_auth ); > use Koha::FrameworkPlugin; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/barcode.pl b/cataloguing/value_builder/barcode.pl >index 5ec7dbece4b..79863332cad 100755 >--- a/cataloguing/value_builder/barcode.pl >+++ b/cataloguing/value_builder/barcode.pl >@@ -32,8 +32,9 @@ use Algorithm::CheckDigits qw( CheckDigits ); > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl >index 67891789e31..7fa558971aa 100755 >--- a/cataloguing/value_builder/barcode_manual.pl >+++ b/cataloguing/value_builder/barcode_manual.pl >@@ -30,8 +30,9 @@ use Koha::DateUtils qw( dt_from_string ); > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl >index 65c806b29c8..531d669f809 100755 >--- a/cataloguing/value_builder/dateaccessioned.pl >+++ b/cataloguing/value_builder/dateaccessioned.pl >@@ -24,8 +24,9 @@ use Modern::Perl; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl >index 6428bd61a99..e08956424c3 100755 >--- a/cataloguing/value_builder/marc21_field_005.pl >+++ b/cataloguing/value_builder/marc21_field_005.pl >@@ -24,8 +24,9 @@ use Modern::Perl; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl >index 4fe4a2f1e75..741252bbb3e 100755 >--- a/cataloguing/value_builder/marc21_field_245h.pl >+++ b/cataloguing/value_builder/marc21_field_245h.pl >@@ -24,8 +24,9 @@ use Modern::Perl; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl >index e9a74a07ba4..27c16051119 100755 >--- a/cataloguing/value_builder/marc21_field_260b.pl >+++ b/cataloguing/value_builder/marc21_field_260b.pl >@@ -30,8 +30,9 @@ use C4::Context; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl >index 0dd985803c9..d3ac8343959 100755 >--- a/cataloguing/value_builder/marc21_orgcode.pl >+++ b/cataloguing/value_builder/marc21_orgcode.pl >@@ -27,8 +27,9 @@ use Koha::Libraries; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl >index 61885d12b05..37acc705be4 100755 >--- a/cataloguing/value_builder/stocknumber.pl >+++ b/cataloguing/value_builder/stocknumber.pl >@@ -24,8 +24,9 @@ use C4::Context; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl >index eeb422d5258..571d2a578b1 100755 >--- a/cataloguing/value_builder/upload.pl >+++ b/cataloguing/value_builder/upload.pl >@@ -33,8 +33,9 @@ use Modern::Perl; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/ysearch.pl b/cataloguing/ysearch.pl >index 22cebedda3e..76e4fb094fd 100755 >--- a/cataloguing/ysearch.pl >+++ b/cataloguing/ysearch.pl >@@ -35,6 +35,7 @@ my $input = CGI->new; > my $query = $input->param('term'); > my $table = $input->param('table'); > my $field = $input->param('field'); >+my $session_cookie = $input->cookie('CGISESSID'); > > # Prevent from disclosing data > die() unless ( $table eq "biblioitems" ); >@@ -43,7 +44,7 @@ die() unless ( $field eq 'publishercode' || $field eq 'collectiontitle' ); > binmode STDOUT, ":encoding(UTF-8)"; > print $input->header( -type => 'text/plain', -charset => 'UTF-8' ); > >-my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { editcatalogue => '*' } ); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { editcatalogue => '*' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/plugins/plugins-enable.pl b/plugins/plugins-enable.pl >index 79cd88af880..2f631096e95 100755 >--- a/plugins/plugins-enable.pl >+++ b/plugins/plugins-enable.pl >@@ -26,8 +26,9 @@ use Koha::Plugins::Handler; > die("Koha plugins are disabled!") unless C4::Context->config("enable_plugins"); > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > >-my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } ); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { plugins => 'manage' } ); > if( $auth_status ne 'ok' ) { > print CGI::header( '-status' => '401' ); > exit 0; >diff --git a/serials/create-numberpattern.pl b/serials/create-numberpattern.pl >index a28ef0d4155..9f01403474d 100755 >--- a/serials/create-numberpattern.pl >+++ b/serials/create-numberpattern.pl >@@ -27,8 +27,9 @@ use C4::Serials::Numberpattern qw( > use C4::Auth qw( check_cookie_auth ); > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > >-my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' }); >+my ($auth_status) = check_cookie_auth( $session_cookie, { serials => '*' }); > if ($auth_status ne "ok") { > print $input->header(-type => 'text/plain', -status => '403 Forbidden'); > exit 0; >diff --git a/serials/subscription-frequency.pl b/serials/subscription-frequency.pl >index 4d5208e8981..da122c1501b 100755 >--- a/serials/subscription-frequency.pl >+++ b/serials/subscription-frequency.pl >@@ -25,8 +25,9 @@ use C4::Auth qw( check_cookie_auth ); > use JSON qw( to_json ); > > my $input=CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my $frqid=$input->param("frequency_id"); >-my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' }); >+my ($auth_status) = check_cookie_auth( $session_cookie, { serials => '*' }); > if ($auth_status ne "ok") { > exit 0; > } >diff --git a/serials/subscription-numberpattern.pl b/serials/subscription-numberpattern.pl >index 645f6af04d7..a3488e29ed2 100755 >--- a/serials/subscription-numberpattern.pl >+++ b/serials/subscription-numberpattern.pl >@@ -24,8 +24,9 @@ use C4::Auth qw( check_cookie_auth ); > use JSON qw( to_json ); > > my $input=CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > >-my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' }); >+my ($auth_status) = check_cookie_auth( $session_cookie, { serials => '*' } ); > if ($auth_status ne "ok") { > print $input->header(-type => 'text/plain', -status => '403 Forbidden'); > exit 0; >diff --git a/svc/barcode b/svc/barcode >index e54e6e6d17f..6e26f636bbf 100755 >--- a/svc/barcode >+++ b/svc/barcode >@@ -105,8 +105,9 @@ my %type_mapping = ( > ); > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > >-my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } ); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { catalogue => '*' } ); > > if ( $auth_status ne "ok" ) { > exit 0; >diff --git a/svc/cataloguing/automatic_linker.pl b/svc/cataloguing/automatic_linker.pl >index c132fe24736..935bea315d7 100755 >--- a/svc/cataloguing/automatic_linker.pl >+++ b/svc/cataloguing/automatic_linker.pl >@@ -25,11 +25,12 @@ use C4::Biblio qw( BiblioAutoLink TransformHtmlToMarc ); > use C4::Context; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > print $input->header('application/json'); > > # Check the user's permissions > my ( $auth_status ) = >- C4::Auth::check_cookie_auth( $input->cookie('CGISESSID'), { >+ C4::Auth::check_cookie_auth( $session_cookie, { > editauthorities => 1, > editcatalogue => 'edit_catalogue' > }); >diff --git a/svc/checkin b/svc/checkin >index 48fa7185432..7f93d1dcd4e 100755 >--- a/svc/checkin >+++ b/svc/checkin >@@ -30,9 +30,10 @@ use Koha::Checkouts; > use Koha::Items; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), >+ check_cookie_auth( $session_cookie, > { circulate => 'circulate_remaining_permissions' } ); > > my $op = $input->param('op') || q{}; >diff --git a/svc/checkouts b/svc/checkouts >index dd8d1d0f820..a669402c61f 100755 >--- a/svc/checkouts >+++ b/svc/checkouts >@@ -33,8 +33,9 @@ use Koha::Items; > use Koha::ItemTypes; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > >-my ( $auth_status, $session ) = check_cookie_auth( $input->cookie('CGISESSID')); >+my ( $auth_status, $session ) = check_cookie_auth( $session_cookie ); > if( $auth_status ne 'ok' ) { > print CGI::header( '-status' => '401' ); > exit 0; >diff --git a/svc/holds b/svc/holds >index eb40d2f2c70..73b9f29a3cf 100755 >--- a/svc/holds >+++ b/svc/holds >@@ -32,9 +32,10 @@ use Koha::ItemTypes; > use Koha::Libraries; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), >+ check_cookie_auth( $session_cookie, > { circulate => 'circulate_remaining_permissions' } ); > > if ( $auth_status ne "ok" ) { >diff --git a/svc/mana/increment b/svc/mana/increment >index ed7d401f2db..f8ec5db61e4 100755 >--- a/svc/mana/increment >+++ b/svc/mana/increment >@@ -28,11 +28,12 @@ use JSON; > > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > binmode STDOUT, ":encoding(UTF-8)"; > print $input->header( -type => 'application/json', -charset => 'UTF-8' ); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), >+ check_cookie_auth( $session_cookie, > { serials => 'create_subscription' } ); > > if ( $auth_status ne "ok" || $input->request_method ne "POST" ) { >diff --git a/svc/mana/share b/svc/mana/share >index 548a56797b0..266141125c9 100755 >--- a/svc/mana/share >+++ b/svc/mana/share >@@ -27,11 +27,12 @@ use CGI; > use JSON; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > binmode STDOUT, ":encoding(UTF-8)"; > print $input->header( -type => 'application/json', -charset => 'UTF-8' ); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), >+ check_cookie_auth( $session_cookie, > { serials => 'create_subscription' } ); > > if ( $auth_status ne "ok" || $input->request_method ne "POST" ) { >diff --git a/svc/mana/use b/svc/mana/use >index 3b405549d59..d06dd6af36e 100755 >--- a/svc/mana/use >+++ b/svc/mana/use >@@ -29,11 +29,12 @@ use JSON; > > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > binmode STDOUT, ":encoding(UTF-8)"; > print $input->header( -type => 'application/json', -charset => 'UTF-8' ); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), >+ check_cookie_auth( $session_cookie, > { serials => 'create_subscription' } ); > > if ( $auth_status ne "ok" || $input->request_method ne "POST" ) { >diff --git a/svc/recall b/svc/recall >index 02e2d8fa4b9..6ce7cf7b115 100755 >--- a/svc/recall >+++ b/svc/recall >@@ -28,9 +28,10 @@ use C4::Circulation qw(AddReturn); > use Koha::Recalls; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > my $json = encode_json({ success => 0 }); > >-my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'), { recall => 'manage_recalls' } ); >+my ( $auth_status, $sessionID ) = check_cookie_auth( $session_cookie, { recall => 'manage_recalls' } ); > > if ( $auth_status ne "ok" ) { > print $input->header(-type => 'application/json', -status => '403 Forbidden'); >diff --git a/svc/renew b/svc/renew >index 67a658b0703..b1e923123d7 100755 >--- a/svc/renew >+++ b/svc/renew >@@ -30,9 +30,10 @@ use C4::Auth qw(check_cookie_auth); > use Koha::DateUtils qw(output_pref dt_from_string); > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), >+ check_cookie_auth( $session_cookie, > { circulate => 'circulate_remaining_permissions' } ); > > if ( $auth_status ne "ok" ) { >diff --git a/svc/return_claims b/svc/return_claims >index 42e48c55d53..421645f8a58 100755 >--- a/svc/return_claims >+++ b/svc/return_claims >@@ -30,8 +30,9 @@ use Koha::DateUtils qw( dt_from_string output_pref ); > use Koha::Patrons; > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > >-my ( $auth_status, $session ) = check_cookie_auth( $input->cookie('CGISESSID') ); >+my ( $auth_status, $session ) = check_cookie_auth( $session_cookie ); > if( $auth_status ne 'ok' ) { > print CGI::header( '-status' => '401' ); > exit 0; >diff --git a/tools/batch_records_ajax.pl b/tools/batch_records_ajax.pl >index bcf97e06bd5..7d3d9a37d25 100755 >--- a/tools/batch_records_ajax.pl >+++ b/tools/batch_records_ajax.pl >@@ -39,6 +39,7 @@ use C4::Auth qw( check_cookie_auth ); > use C4::ImportBatch qw( GetImportBatch GetImportRecordsRange GetImportRecordMatches ); > > my $input = CGI->new; >+my $session_cookie = $input->cookie('CGISESSID'); > > my @sort_columns = > qw/import_record_id title status overlay_status overlay_status/; >@@ -56,7 +57,7 @@ binmode STDOUT, ":encoding(UTF-8)"; > print $input->header( -type => 'text/plain', -charset => 'UTF-8' ); > > my ( $auth_status ) = >- check_cookie_auth( $input->cookie('CGISESSID'), { tools => 'manage_staged_marc' } ); >+ check_cookie_auth( $session_cookie, { tools => 'manage_staged_marc' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38258
: 173361 |
173362
|
173363
|
173364