Attachment 174098 Details for Bug 38382 – Bug 38382: Fresh connection when connexion CSRF token expires

[patch] Bug 38382: Fresh connection when connexion CSRF token expires

Bug-38382-Fresh-connection-when-connexion-CSRF-tok.patch (text/plain), 2.32 KB, created by Brendan Lawlor on 2024-11-06 21:45:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Brendan Lawlor

Created: 2024-11-06 21:45:55 UTC

Size: 2.32 KB

patch

obsolete

>From 8ce4ab886b1c306e6b4c85d24322dbd94a0d2e6d Mon Sep 17 00:00:00 2001
>From: Nick Clemens <nick@bywatersolutions.com>
>Date: Wed, 6 Nov 2024 20:24:48 +0000
>Subject: [PATCH] Bug 38382: Fresh connection when connexion CSRF token expires
>
>This patch simply generates a new user agent when reauthenticating when the CSRF token
>for the session has expired.
>
>To test:
>1 - Edit Koha/Token.pm, line 275
>from:    { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) },
>to:      { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) },
>2 - This will make your CSRF tokens expire after 8 seconds
>3 - vim /etc/koha/sites/kohadev/connexion.cnf
>4 - Set content:
>    host:
>    port: 8888
>    koha:http://localhost:8081
>    log:/var/log/koha/kohadev/connexion.log
>    match:ISBN
>    user:kohauser
>    password:kohapass
>    overlay_action:replace
>    nomatch_action:create_new
>    item_action:always_add
>    import_mode:direct
>    framework:BKS
>    overlay_framework:
>    debug:1
>5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach)
>6 - On the command line:
>    perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf
>7 - In another terminal:
>    cat bug_33418.test  | nc -v localhost 8888
>8 - Successful request
>9 - Wait 10 seconds (more than 8 anyways)
>10 - Repeat 7
>11 - Unsuccessful request - Invalid CSRF token
>12 - Ctrl+C to stop the connexion daemon
>13 - Apply patch
>14 - repeat 6
>15 - repeat 7, success
>16 - Wait more than 8 seconds
>17 - repeat 7, success!
>18 - repeat again until you are satisfied
>19 - Sign off!
>
>Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
>---
> misc/bin/connexion_import_daemon.pl | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/misc/bin/connexion_import_daemon.pl b/misc/bin/connexion_import_daemon.pl
>index 0ab2da42ab..67f7bfec7d 100755
>--- a/misc/bin/connexion_import_daemon.pl
>+++ b/misc/bin/connexion_import_daemon.pl
>@@ -407,6 +407,8 @@ exit;
>         if ( $status == HTTP_UNAUTHORIZED || $status == HTTP_FORBIDDEN ) {
> 
>             # Our token might have expired. Re-authenticate and post again.
>+            $ua = _ua();    # fresh one, needs to authenticate
>+            $self->{ua} = $ua;
>             $self->{csrf_token} = $self->authenticate;
>             $resp = $ua->post(
>                 $base_url . IMPORT_SVC_URI,
>-- 
>2.39.5

Actions: View | Diff | Splinter Review

Attachments on bug 38382: 174096 | 174097 | 174098