Bugzilla – Attachment 173362 Details for
Bug 38258
Connecting without a proper CGI cookie can disconnect all sessions
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38258: Force scalar context for cookie calls (part 2)
Bug-38258-Force-scalar-context-for-cookie-calls-pa.patch (text/plain), 6.04 KB, created by
Baptiste Wojtkowski (bwoj)
on 2024-10-25 14:00:44 UTC
(
hide
)
Description:
Bug 38258: Force scalar context for cookie calls (part 2)
Filename:
MIME Type:
Creator:
Baptiste Wojtkowski (bwoj)
Created:
2024-10-25 14:00:44 UTC
Size:
6.04 KB
patch
obsolete
>From 65ffd4be92d3219f1da6895317427265640bebb1 Mon Sep 17 00:00:00 2001 >From: Baptiste <baptiste.wojtkowski@biblibre.com> >Date: Fri, 25 Oct 2024 15:32:56 +0200 >Subject: [PATCH] Bug 38258: Force scalar context for cookie calls (part 2) > >Correct all the calls for cookies extracted from $cgi->cookie('CGISESSID') >--- > labels/label-create-csv.pl | 3 ++- > labels/label-create-xml.pl | 3 ++- > opac/svc/club/cancel_enrollment | 3 ++- > opac/svc/club/enroll | 3 ++- > svc/article_request | 3 ++- > svc/club/cancel_enrollment | 3 ++- > svc/club/delete | 3 ++- > svc/club/enroll | 3 ++- > svc/club/template/delete | 3 ++- > svc/creator_batches | 3 ++- > 10 files changed, 20 insertions(+), 10 deletions(-) > >diff --git a/labels/label-create-csv.pl b/labels/label-create-csv.pl >index a6c6f943ee5..6d985cbb867 100755 >--- a/labels/label-create-csv.pl >+++ b/labels/label-create-csv.pl >@@ -27,8 +27,9 @@ use C4::Labels; > use C4::Auth qw( check_cookie_auth ); > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $cgi->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/labels/label-create-xml.pl b/labels/label-create-xml.pl >index 7d1e38e1b3d..c47fde70570 100755 >--- a/labels/label-create-xml.pl >+++ b/labels/label-create-xml.pl >@@ -27,8 +27,9 @@ use C4::Labels; > use C4::Auth qw( check_cookie_auth ); > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $cgi->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/opac/svc/club/cancel_enrollment b/opac/svc/club/cancel_enrollment >index e4f5dc5bf1a..fa0002dfbf7 100755 >--- a/opac/svc/club/cancel_enrollment >+++ b/opac/svc/club/cancel_enrollment >@@ -27,9 +27,10 @@ use C4::Auth qw(check_cookie_auth); > use Koha::Club::Enrollments; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > > my ( $auth_status ) = >- check_cookie_auth( $cgi->cookie('CGISESSID') ); >+ check_cookie_auth( $session_cookie ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/opac/svc/club/enroll b/opac/svc/club/enroll >index 33394f6ebe9..4ce73e02950 100755 >--- a/opac/svc/club/enroll >+++ b/opac/svc/club/enroll >@@ -29,9 +29,10 @@ use Koha::Club::Enrollment; > use Koha::Clubs; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > > my ($auth_status) = >- check_cookie_auth( $cgi->cookie('CGISESSID') ); >+ check_cookie_auth( $session_cookie ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/article_request b/svc/article_request >index 3a9d56d7318..f3e3fa4e8eb 100755 >--- a/svc/article_request >+++ b/svc/article_request >@@ -27,9 +27,10 @@ use C4::Auth qw(check_cookie_auth); > use Koha::ArticleRequests; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > > my ( $auth_status ) = >- check_cookie_auth( $cgi->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } ); >+ check_cookie_auth( $session_cookie, { circulate => 'circulate_remaining_permissions' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/club/cancel_enrollment b/svc/club/cancel_enrollment >index 1726fbe0b9a..0a3323ebc89 100755 >--- a/svc/club/cancel_enrollment >+++ b/svc/club/cancel_enrollment >@@ -28,9 +28,10 @@ use C4::Auth qw(check_cookie_auth); > use Koha::Club::Enrollments; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > > my ( $auth_status ) = >- check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } ); >+ check_cookie_auth( $session_cookie, { clubs => 'enroll' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/club/delete b/svc/club/delete >index 1fb491ab812..4eb154d11e6 100755 >--- a/svc/club/delete >+++ b/svc/club/delete >@@ -27,8 +27,9 @@ use C4::Auth qw(check_cookie_auth); > use Koha::Clubs; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > >-my ( $auth_status ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'edit_clubs' } ); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { clubs => 'edit_clubs' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/club/enroll b/svc/club/enroll >index d2754577e27..a0821eb3d94 100755 >--- a/svc/club/enroll >+++ b/svc/club/enroll >@@ -29,9 +29,10 @@ use Koha::Club::Enrollments; > use Koha::Clubs; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > > my ($auth_status) = >- check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } ); >+ check_cookie_auth( $session_cookie, { clubs => 'enroll' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/club/template/delete b/svc/club/template/delete >index 07a862ba0f3..74463c60e8a 100755 >--- a/svc/club/template/delete >+++ b/svc/club/template/delete >@@ -28,8 +28,9 @@ use C4::Auth qw(check_cookie_auth); > use Koha::Club::Templates; > > my $cgi = CGI->new; >+my $session_cookie = $cgi->cookie('CGISESSID'); > >-my ( $auth_status ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'edit_templates' } ); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { clubs => 'edit_templates' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/creator_batches b/svc/creator_batches >index 8db67423a76..0d72547e699 100755 >--- a/svc/creator_batches >+++ b/svc/creator_batches >@@ -39,7 +39,8 @@ svc/creator_batches - Web service for managing AJAX functionality for patroncard > # AJAX requests > my $is_ajax = is_ajax(); > my $cgi = CGI->new; >-my ( $auth_status ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } ); >+my $session_cookie = $cgi->cookie('CGISESSID'); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38258
:
173361
| 173362 |
173363
|
173364