Bugzilla – Attachment 173363 Details for
Bug 38258
Connecting without a proper CGI cookie can disconnect all sessions
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38258: Force scalar context for cookie calls (part 3)
Bug-38258-Force-scalar-context-for-cookie-calls-pa.patch (text/plain), 4.14 KB, created by
Baptiste Wojtkowski (bwoj)
on 2024-10-25 14:00:46 UTC
(
hide
)
Description:
Bug 38258: Force scalar context for cookie calls (part 3)
Filename:
MIME Type:
Creator:
Baptiste Wojtkowski (bwoj)
Created:
2024-10-25 14:00:46 UTC
Size:
4.14 KB
patch
obsolete
>From 81da36ed44110e2fcf1fa5361dc882d52b06daff Mon Sep 17 00:00:00 2001 >From: Baptiste <baptiste.wojtkowski@biblibre.com> >Date: Fri, 25 Oct 2024 15:38:09 +0200 >Subject: [PATCH] Bug 38258: Force scalar context for cookie calls (part 3) > >Correct all the calls for cookies extracted from $query->cookie('CGISESSID') >--- > authorities/ysearch.pl | 3 ++- > opac/opac-patron-image.pl | 3 ++- > opac/svc/checkout_notes | 3 ++- > serials/lateissues-export.pl | 3 ++- > svc/checkout_notes | 3 ++- > svc/problem_reports | 3 ++- > 6 files changed, 12 insertions(+), 6 deletions(-) > >diff --git a/authorities/ysearch.pl b/authorities/ysearch.pl >index 3a58fe97581..4a56faf7509 100755 >--- a/authorities/ysearch.pl >+++ b/authorities/ysearch.pl >@@ -39,8 +39,9 @@ use Koha::SearchEngine::Search; > use Koha::SearchEngine::QueryBuilder; > > my $query = CGI->new; >+my $session_cookie = $query->cookie('CGISESSID'); > >-my ( $auth_status) = check_cookie_auth( $query->cookie('CGISESSID'), { catalogue => 1 } ); >+my ( $auth_status) = check_cookie_auth( $session_cookie, { catalogue => 1 } ); > > if ( $auth_status ne "ok" ) { > # send empty response >diff --git a/opac/opac-patron-image.pl b/opac/opac-patron-image.pl >index dccba229eb2..36da22963d5 100755 >--- a/opac/opac-patron-image.pl >+++ b/opac/opac-patron-image.pl >@@ -26,13 +26,14 @@ use C4::Auth qw( check_cookie_auth ); > use Koha::Patron::Images; > > my $query = CGI->new; >+my $session_cookie = $query->cookie('CGISESSID'); > > unless (C4::Context->preference('OPACpatronimages')) { > print $query->header(status => '403 Forbidden - displaying patron images in the OPAC not enabled'); > exit; > } > >-my ($auth_status) = check_cookie_auth( $query->cookie('CGISESSID') ); >+my ($auth_status) = check_cookie_auth( $session_cookie ); > if( $auth_status ne 'ok' ) { > print CGI::header( '-status' => '401' ); > exit 0; >diff --git a/opac/svc/checkout_notes b/opac/svc/checkout_notes >index e8281d90fce..d3c2a023eb8 100755 >--- a/opac/svc/checkout_notes >+++ b/opac/svc/checkout_notes >@@ -43,7 +43,8 @@ svc/checkout_notes - Web service for setting patron notes on items > # AJAX requests > my $is_ajax = is_ajax(); > my $query = CGI->new; >-my ( $auth_status ) = check_cookie_auth( $query->cookie('CGISESSID'), {} ); >+my $session_cookie = $query->cookie('CGISESSID'); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, {} ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/serials/lateissues-export.pl b/serials/lateissues-export.pl >index dff0e5a7acd..a864ab33d1e 100755 >--- a/serials/lateissues-export.pl >+++ b/serials/lateissues-export.pl >@@ -28,8 +28,9 @@ use Koha::CsvProfiles; > use Text::CSV_XS; > > my $query = CGI->new; >+my $session_cookie = $query->cookie('CGISESSID'); > my ($auth_status) = >- check_cookie_auth( $query->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( $session_cookie, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $query->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/svc/checkout_notes b/svc/checkout_notes >index be0f80d2c88..cb24bf6af94 100755 >--- a/svc/checkout_notes >+++ b/svc/checkout_notes >@@ -36,7 +36,8 @@ svc/checkout_notes - Web service for managing patron notes set on issues > # AJAX requests > my $is_ajax = is_ajax(); > my $query = CGI->new; >-my ( $auth_status ) = check_cookie_auth( $query->cookie('CGISESSID'), { circulate => 'manage_checkout_notes' } ); >+my $session_cookie = $query->cookie('CGISESSID'); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { circulate => 'manage_checkout_notes' } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >diff --git a/svc/problem_reports b/svc/problem_reports >index f84bcf38e00..c5057ea840f 100755 >--- a/svc/problem_reports >+++ b/svc/problem_reports >@@ -36,7 +36,8 @@ svc/problem_reports - Web service for managing OPAC problem reports > # AJAX requests > my $is_ajax = is_ajax(); > my $query = CGI->new; >-my ( $auth_status ) = check_cookie_auth( $query->cookie('CGISESSID'), { problem_reports => 1 } ); >+my $session_cookie = $query->cookie('CGISESSID'); >+my ( $auth_status ) = check_cookie_auth( $session_cookie, { problem_reports => 1 } ); > if ( $auth_status ne "ok" ) { > exit 0; > } >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38258
:
173361
|
173362
| 173363 |
173364