Bugzilla – Attachment 192352 Details for
Bug 39055
Unauthenticated are not redirected properly in reports module after login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39055: Add more login_op checks to middleware
Bug-39055-Add-more-loginop-checks-to-middleware.patch (text/plain), 2.34 KB, created by
David Cook
on 2026-02-03 00:32:00 UTC
(
hide
)
Description:
Bug 39055: Add more login_op checks to middleware
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-03 00:32:00 UTC
Size:
2.34 KB
patch
obsolete
>From 5a64db78d5e868c27392b2bd3c9f0b9f391110d5 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 3 Feb 2026 00:15:27 +0000 >Subject: [PATCH] Bug 39055: Add more login_op checks to middleware > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > Koha/Middleware/CSRF.pm | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) > >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index 6d084cefe1b..a0ffc984090 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -60,17 +60,27 @@ sub call { > } > > my ($error); >- if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { >- $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, >- $request_method, $uri, $referer; >+ if ( $stateless_methods{$request_method} ) { >+ if ( defined $original_op && $original_op =~ m{^cud-} ) { >+ $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", >+ $original_op, >+ $request_method, $uri, $referer; >+ } elsif ( defined $req->param('login_op') ) { >+ $error = sprintf "Programming error - login_op not permitted for %s %s (referer: %s)", >+ $request_method, $uri, $referer; >+ } > } elsif ( $stateful_methods{$request_method} ) { > > # Get the CSRF token from the param list or the header > my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > >- if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { >+ if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, > $request_method, $uri, $referer; >+ } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { >+ $error = sprintf "Programming error - login_op must contain cud-login for %s %s (referer: %s)", >+ $request_method, $uri, $referer; >+ > } elsif ( !$csrf_token ) { > $error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method, > $uri, $referer; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39055
:
191568
|
191617
|
192121
|
192308
|
192350
|
192351
| 192352 |
192353
|
192354