Bugzilla – Attachment 194984 Details for
Bug 39055
Unauthenticated are not redirected properly in reports module after login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39055: Fix login condition when using op and login_op
d7d218c.patch (text/plain), 1.88 KB, created by
Jonathan Druart
on 2026-03-09 10:07:46 UTC
(
hide
)
Description:
Bug 39055: Fix login condition when using op and login_op
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2026-03-09 10:07:46 UTC
Size:
1.88 KB
patch
obsolete
>From d7d218c9b1b5ed14da00b5fd5bfd28e5ad67663c Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 3 Feb 2026 05:52:58 +0000 >Subject: [PATCH] Bug 39055: Fix login condition when using op and login_op > >Signed-off-by: David Nind <david@davidnind.com> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > Koha/App/Plugin/CSRF.pm | 2 +- > Koha/Middleware/CSRF.pm | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm >index 071bff7b112..62b8d1fa542 100644 >--- a/Koha/App/Plugin/CSRF.pm >+++ b/Koha/App/Plugin/CSRF.pm >@@ -86,7 +86,7 @@ sub register { > } else { > my $op = $c->req->param('op'); > my $login_op = $c->req->param('login_op'); >- if ( $op && $op !~ /^cud-/ ) { >+ if ( ( $op && $op !~ /^cud-/ ) && !$login_op ) { > return $c->reply->exception( > 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') > ->rendered(400); >diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm >index a0ffc984090..07740a64ed4 100644 >--- a/Koha/Middleware/CSRF.pm >+++ b/Koha/Middleware/CSRF.pm >@@ -74,7 +74,7 @@ sub call { > # Get the CSRF token from the param list or the header > my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); > >- if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { >+ if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { > $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, > $request_method, $uri, $referer; > } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { >-- >2.43.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39055
:
191568
|
191617
|
192121
|
192308
|
192350
|
192351
|
192352
|
192353
|
192354
|
193674
|
193675
|
193676
|
193677
|
193678
|
193694
|
193695
|
193696
|
193697
|
193698
|
194980
|
194981
|
194982
|
194983
| 194984 |
195045