Bugzilla – Attachment 192350 Details for
Bug 39055
Unauthenticated are not redirected properly in reports module after login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through
Bug-39055-Change-op-to-loginop-when-logging-in-to-.patch (text/plain), 12.75 KB, created by
David Cook
on 2026-02-03 00:31:53 UTC
(
hide
)
Description:
Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-03 00:31:53 UTC
Size:
12.75 KB
patch
obsolete
>From acf0dbffe1c3e95f3a49a461fd36c08f901a0f3b Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Sun, 18 Jan 2026 23:54:13 +0000 >Subject: [PATCH] Bug 39055: Change "op" to "login_op" when logging in to allow > original op to flow through > >This patch changes "op" to "login_op" when logging in, so that the original op can >flow through to whichever controller is processing the login and subsequent op. > >Test plan: >0. apply the patch and koha-plack --restart kohadev >1. Without logging in, go to the following: >http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run >2. Log in and note that you can see the report >3. Try logging into the OPAC >4. Try logging into the self-checkout >5. Create a new self-reg account and try logging in with the auto-filled details >6. Test anything else you can think to test here > >Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > C4/Auth.pm | 3 ++- > C4/InstallAuth.pm | 2 +- > Koha/Middleware/CSRF.pm | 2 +- > catalogue/search.pl | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 6 ++---- > koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt | 3 +-- > koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt | 2 +- > .../bootstrap/en/modules/opac-registration-confirmation.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt | 2 +- > opac/opac-tags.pl | 2 +- > 12 files changed, 14 insertions(+), 16 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index c376d0e35c2..6043dcba385 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -195,7 +195,7 @@ sub get_template_and_user { > $in->{query}->param( -name => 'koha_login_context', -values => ['sco'] ); > } else { > my $request_method = $in->{query}->request_method // q{}; >- unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) { >+ unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) { > for my $v (qw( login_userid login_password )) { > $in->{query}->param( $v, '' ) > if $in->{query}->param($v); >@@ -1418,6 +1418,7 @@ sub checkauth { > $uri->query_param_delete('login_userid'); > $uri->query_param_delete('login_password'); > $uri->query_param_delete('koha_login_context'); >+ $uri->query_param_delete('login_op'); > $uri->query_param_delete('op'); > $uri->query_param_delete('csrf_token'); > unless ( $params->{do_not_print} ) { >diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm >index 7e3271dd2e4..9d8865cdd7b 100644 >--- a/C4/InstallAuth.pm >+++ b/C4/InstallAuth.pm >@@ -111,7 +111,7 @@ sub get_template_and_user { > my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query ); > > my $request_method = $in->{query}->request_method // q{}; >- unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) { >+ unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) { > $in->{query}->param( 'login_userid', '' ); > $in->{query}->param( 'login_password', '' ); > } >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index fd62c7c7c02..6d084cefe1b 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -68,7 +68,7 @@ sub call { > # Get the CSRF token from the param list or the header > my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > >- if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { >+ if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, > $request_method, $uri, $referer; > } elsif ( !$csrf_token ) { >diff --git a/catalogue/search.pl b/catalogue/search.pl >index 762d952ae7e..1fbbfbb5065 100755 >--- a/catalogue/search.pl >+++ b/catalogue/search.pl >@@ -264,7 +264,7 @@ $template->param( advancedsearchesloop => $advancedsearchesloop ); > $template->param( searchid => scalar $cgi->param('searchid'), ); > > my $default_sort_by = C4::Context->default_catalog_sort_by; >-my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op'); >+my @sanitized_operators = $cgi->multi_param('op'); #NOTE: No longer sanitized... > > # The following should only be loaded if we're bringing up the advanced search template > if ( $template_type eq 'advsearch' ) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index 4a0a2109049..81da6867e1c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -160,10 +160,9 @@ > > <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" class="validated"> > [% INCLUDE 'csrf-token.inc' %] >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > <input type="hidden" name="koha_login_context" value="intranet" /> > [% FOREACH INPUT IN INPUTS %] >- [% NEXT IF INPUT.name == "op" %] > [% NEXT IF INPUT.name == "csrf_token" %] > [% NEXT IF INPUT.name == "koha_login_context" %] > [% NEXT IF INPUT.name == "branch" %] >@@ -254,10 +253,9 @@ > [% ELSIF TwoFA_prompt %] > <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off"> > [% INCLUDE 'csrf-token.inc' %] >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > <input type="hidden" name="koha_login_context" value="intranet" /> > [% FOREACH INPUT IN INPUTS %] >- [% NEXT IF INPUT.name == "op" %] > [% NEXT IF INPUT.name == "csrf_token" %] > [% NEXT IF INPUT.name == "koha_login_context" %] > [% NEXT IF INPUT.name == "branch" %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt >index d609f9cdc89..96cd6c3cf49 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt >@@ -57,9 +57,8 @@ > > <form action="[% url | html %]" method="post" id="mainform"> > [% INCLUDE 'csrf-token.inc' %] >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > [% FOREACH INPUT IN INPUTS %] >- [% NEXT IF INPUT.name == "op" %] > [% NEXT IF INPUT.name == "csrf_token" %] > [% NEXT IF INPUT.name == "login_userid" %] > [% NEXT IF INPUT.name == "login_password" %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >index 2b6d4478d6d..72dcf038143 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >@@ -508,7 +508,7 @@ > [% PROCESS login_label for="muserid" %]<input type="text" id="muserid" name="login_userid" autocomplete="off" /> <label for="mpassword">Password:</label > ><input type="password" id="mpassword" name="login_password" autocomplete="off" /> > <fieldset class="action"> >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > <input type="submit" class="btn btn-primary" value="Log in" /> > </fieldset> > </div> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 6d6c135cc1a..97d0995fb5c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -236,7 +236,7 @@ > [% END %] > <form action="[% form_action | html %]" name="auth" id="auth" method="post" autocomplete="off"> > [% INCLUDE 'csrf-token.inc' %] >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > <input type="hidden" name="koha_login_context" value="opac" /> > > <div class="local-login"> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt >index c41dc43e9f3..edf4a116621 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt >@@ -202,7 +202,7 @@ > <label for="password">Password:</label> > <input class="form-control" type="password" id="password" name="login_password" autocomplete="off" /> > <fieldset class="action"> >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > <input type="submit" value="Log in" class="btn btn-primary" /> > </fieldset> > </div> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt >index 57764dc4a4f..83ccf1ec158 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt >@@ -110,7 +110,7 @@ > <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off"> > [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="koha_login_context" value="opac" /> >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > <fieldset class="brief"> > <legend>Log in to your account:</legend> > [% PROCESS login_label for="userid" %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >index ad3dc1ab1bf..281d5515edd 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >@@ -363,7 +363,7 @@ > [% FOREACH INPUT IN INPUTS %] > <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" /> > [% END %] >- <input type="hidden" name="op" value="cud-login" /> >+ <input type="hidden" name="login_op" value="cud-login" /> > </fieldset> > </form> > <!-- /#mainform --> >diff --git a/opac/opac-tags.pl b/opac/opac-tags.pl >index 70429fda57a..603e50b5098 100755 >--- a/opac/opac-tags.pl >+++ b/opac/opac-tags.pl >@@ -122,7 +122,7 @@ unless ( C4::Context->preference('TagsEnabled') ) { > > if ($add_op) { > unless ($loggedinuser) { >- push @errors, { +'cud-login' => 1 }; >+ push @errors, { +'login' => 1 }; > push @globalErrorIndexes, $#errors; > %newtags = (); # zero out any attempted additions > @deltags = (); # zero out any attempted deletions >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39055
:
191568
|
191617
|
192121
|
192308
| 192350 |
192351
|
192352
|
192353
|
192354