Bugzilla – Attachment 193698 Details for
Bug 39055
Unauthenticated are not redirected properly in reports module after login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39055: Fix login condition when using op and login_op
34a190c.patch (text/plain), 1.80 KB, created by
David Nind
on 2026-02-24 08:18:13 UTC
(
hide
)
Description:
Bug 39055: Fix login condition when using op and login_op
Filename:
MIME Type:
Creator:
David Nind
Created:
2026-02-24 08:18:13 UTC
Size:
1.80 KB
patch
obsolete
>From 34a190ca21f545be5e82723ebeb7ff5fb474775d Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 3 Feb 2026 05:52:58 +0000 >Subject: [PATCH] Bug 39055: Fix login condition when using op and login_op > >Signed-off-by: David Nind <david@davidnind.com> >--- > Koha/App/Plugin/CSRF.pm | 2 +- > Koha/Middleware/CSRF.pm | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm >index 071bff7b11..62b8d1fa54 100644 >--- a/Koha/App/Plugin/CSRF.pm >+++ b/Koha/App/Plugin/CSRF.pm >@@ -86,7 +86,7 @@ sub register { > } else { > my $op = $c->req->param('op'); > my $login_op = $c->req->param('login_op'); >- if ( $op && $op !~ /^cud-/ ) { >+ if ( ( $op && $op !~ /^cud-/ ) && !$login_op ) { > return $c->reply->exception( > 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') > ->rendered(400); >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index a0ffc98409..07740a64ed 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -74,7 +74,7 @@ sub call { > # Get the CSRF token from the param list or the header > my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > >- if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { >+ if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, > $request_method, $uri, $referer; > } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { >-- >2.39.5 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39055
:
191568
|
191617
|
192121
|
192308
|
192350
|
192351
|
192352
|
192353
|
192354
|
193674
|
193675
|
193676
|
193677
|
193678
|
193694
|
193695
|
193696
|
193697
| 193698