Bugzilla – Attachment 192353 Details for
Bug 39055
Unauthenticated are not redirected properly in reports module after login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test
Bug-39055-Add-change-to-KohaAppPluginCSRF-and-fix-.patch (text/plain), 6.86 KB, created by
David Cook
on 2026-02-03 00:32:03 UTC
(
hide
)
Description:
Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-03 00:32:03 UTC
Size:
6.86 KB
patch
obsolete
>From c96aa99406c076a0345c4225d09a29b1e9819382 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 3 Feb 2026 00:30:56 +0000 >Subject: [PATCH] Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit > test > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > Koha/App/Plugin/CSRF.pm | 13 +++++++++++-- > t/db_dependent/mojo/csrf.t | 28 ++++++++++++++-------------- > 2 files changed, 25 insertions(+), 16 deletions(-) > >diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm >index 7a59b312f52..071bff7b112 100644 >--- a/Koha/App/Plugin/CSRF.pm >+++ b/Koha/App/Plugin/CSRF.pm >@@ -73,18 +73,27 @@ sub register { > > my $method = $c->req->method; > if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { >- my $op = $c->req->param('op'); >+ my $op = $c->req->param('op'); >+ my $login_op = $c->req->param('login_op'); > if ( $op && $op =~ /^cud-/ ) { > return $c->reply->exception( > 'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"') > ->rendered(400); >+ } elsif ( defined $login_op ) { >+ return $c->reply->exception('Incorrect use of a safe HTTP method with a `login_op` parameter') >+ ->rendered(400); > } > } else { >- my $op = $c->req->param('op'); >+ my $op = $c->req->param('op'); >+ my $login_op = $c->req->param('login_op'); > if ( $op && $op !~ /^cud-/ ) { > return $c->reply->exception( > 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') > ->rendered(400); >+ } elsif ( defined $login_op && $login_op !~ /^cud-login$/ ) { >+ return $c->reply->exception( >+ 'Incorrect use of an unsafe HTTP method with a `login_op` parameter that does not contain cud-login' >+ )->rendered(400); > } > > if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { >diff --git a/t/db_dependent/mojo/csrf.t b/t/db_dependent/mojo/csrf.t >index 9fc953c95fe..09d0e13bd87 100755 >--- a/t/db_dependent/mojo/csrf.t >+++ b/t/db_dependent/mojo/csrf.t >@@ -26,8 +26,8 @@ subtest 'CSRF - Intranet' => sub { > subtest 'With a wrong CSRF token' => sub { > plan tests => 3; > >- $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403) >- ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); >+ $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) >+ ->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); > }; > > subtest 'With a good CSRF token' => sub { >@@ -37,15 +37,15 @@ subtest 'CSRF - Intranet' => sub { > > my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; > >- $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) >+ $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) > ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); > }; > > subtest 'GETting what should be POSTed should fail' => sub { > plan tests => 3; > >- $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( >- qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, >+ $t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like( >+ qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, > 'Body contains correct error message' > ); > }; >@@ -53,8 +53,8 @@ subtest 'CSRF - Intranet' => sub { > subtest 'POSTing what should be GET should fail' => sub { > plan tests => 3; > >- $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( >- qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, >+ $t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like( >+ qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, > 'Body contains correct error message' > ); > }; >@@ -78,8 +78,8 @@ subtest 'CSRF - OPAC' => sub { > subtest 'With a wrong CSRF token' => sub { > plan tests => 3; > >- $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403) >- ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); >+ $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) >+ ->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); > }; > > subtest 'With a good CSRF token' => sub { >@@ -89,15 +89,15 @@ subtest 'CSRF - OPAC' => sub { > > my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; > >- $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) >+ $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) > ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); > }; > > subtest 'GETting what should be POSTed should fail' => sub { > plan tests => 3; > >- $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( >- qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, >+ $t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like( >+ qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, > 'Body contains correct error message' > ); > }; >@@ -105,8 +105,8 @@ subtest 'CSRF - OPAC' => sub { > subtest 'POSTing what should be GET should fail' => sub { > plan tests => 3; > >- $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( >- qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, >+ $t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like( >+ qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, > 'Body contains correct error message' > ); > }; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39055
:
191568
|
191617
|
192121
|
192308
|
192350
|
192351
|
192352
| 192353 |
192354