Bugzilla – Attachment 54313 Details for
Bug 17110
Lower CSRF expiry in Koha::Token
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17110: Lower CSRF expiry in Koha::Token
Bug-17110-Lower-CSRF-expiry-in-KohaToken.patch (text/plain), 1.25 KB, created by
Marcel de Rooy
on 2016-08-11 13:31:12 UTC
(
hide
)
Description:
Bug 17110: Lower CSRF expiry in Koha::Token
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2016-08-11 13:31:12 UTC
Size:
1.25 KB
patch
obsolete
>From d4911e4c2df934b9c751abe871193182d9be7d58 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 11 Aug 2016 15:25:44 +0200 >Subject: [PATCH] Bug 17110: Lower CSRF expiry in Koha::Token >Content-Type: text/plain; charset=utf-8 > >Default expiry in WWW:CSRF is one week. >This patch sets it to 8 hours by default in Koha, and allows to >change the expiry period individually by passing MaxAge. > >Test plan: >[1] Put items in your cart. >[2] Apply the example patch too. >[3] Send the cart from opac within the allotted 10 seconds. >[4] Send again, but wait some 10 seconds before submitting. Too late! >--- > Koha/Token.pm | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/Koha/Token.pm b/Koha/Token.pm >index 9e26800..e60ee1f 100644 >--- a/Koha/Token.pm >+++ b/Koha/Token.pm >@@ -53,6 +53,7 @@ use String::Random (); > use WWW::CSRF (); > use base qw(Class::Accessor); > use constant HMAC_SHA1_LENGTH => 20; >+use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days.. > > =head1 METHODS > >@@ -161,6 +162,7 @@ sub _chk_csrf { > $params->{id}, > $params->{secret}, > $params->{token}, >+ { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) }, > ); > return $csrf_status == WWW::CSRF::CSRF_OK(); > } >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17110
:
54313
|
54323
|
54324
|
54473
|
54474
|
54475
|
54806
|
54807