Bugzilla – Attachment 192354 Details for
Bug 39055
Unauthenticated are not redirected properly in reports module after login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39055: Fix login condition when using op and login_op
Bug-39055-Fix-login-condition-when-using-op-and-lo.patch (text/plain), 1.76 KB, created by
David Cook
on 2026-02-03 05:53:39 UTC
(
hide
)
Description:
Bug 39055: Fix login condition when using op and login_op
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-03 05:53:39 UTC
Size:
1.76 KB
patch
obsolete
>From 69561c11c3c6b55a571e0d1dcfaff3249b07490a Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 3 Feb 2026 05:52:58 +0000 >Subject: [PATCH] Bug 39055: Fix login condition when using op and login_op > >--- > Koha/App/Plugin/CSRF.pm | 2 +- > Koha/Middleware/CSRF.pm | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm >index 071bff7b112..62b8d1fa542 100644 >--- a/Koha/App/Plugin/CSRF.pm >+++ b/Koha/App/Plugin/CSRF.pm >@@ -86,7 +86,7 @@ sub register { > } else { > my $op = $c->req->param('op'); > my $login_op = $c->req->param('login_op'); >- if ( $op && $op !~ /^cud-/ ) { >+ if ( ( $op && $op !~ /^cud-/ ) && !$login_op ) { > return $c->reply->exception( > 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') > ->rendered(400); >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index a0ffc984090..07740a64ed4 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -74,7 +74,7 @@ sub call { > # Get the CSRF token from the param list or the header > my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > >- if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { >+ if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, > $request_method, $uri, $referer; > } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39055
:
191568
|
191617
|
192121
|
192308
|
192350
|
192351
|
192352
|
192353
| 192354