Bugzilla – Attachment 92718 Details for
Bug 22543
Patron might be logged in again using browser back button
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22543: Prevent "back and refresh attack"
Bug-22543-Prevent-back-and-refresh-attack.patch (text/plain), 2.90 KB, created by
Marcel de Rooy
on 2019-09-12 13:32:05 UTC
(
hide
)
Description:
Bug 22543: Prevent "back and refresh attack"
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2019-09-12 13:32:05 UTC
Size:
2.90 KB
patch
obsolete
>From 72c8f4ef6e2d9befc290687da4fedda8dd16f650 Mon Sep 17 00:00:00 2001 >From: Magnus Enger <magnus@libriotech.no> >Date: Fri, 6 Sep 2019 09:54:04 +0200 >Subject: [PATCH] Bug 22543: Prevent "back and refresh attack" >Content-Type: text/plain; charset=utf-8 > >To reproduce and test: >- Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl >- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1 >- Click "Back", you are taken to /cgi-bin/koha/opac-user.pl >- Reload the page, you see an error like "Confirm new submission > of form" >- Reload the page again and confirm the submission of the form >- You are now logged in to the OPAC again! >- Log out again >- Apply this patch >- Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl >- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1 >- Click back, you are taken to /cgi-bin/koha/opac-user.pl >- No matter how many times you reload /cgi-bin/koha/opac-user.pl, > you should not see anything other than the login form. >- Check that Self Check Out still works as it should, by making > sure you have a user with self_check permissions, then setting > WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and > AutoSelfCheckPass appropriately. Then visit > /cgi-bin/koha/sco/sco-main.pl and verify everything works as > expected. > >The messages and errors pages you see related to resubmitting the >form might differ from the ones described here, depending on what >browser you use. I tested in Chromium 76.0.x. > >This fix was originally proposed by LMSCloud: >https://github.com/LMSCloud/Koha-LMSCloud/commit/74a7fe0f0c5b2ce0d65bd26452c6dcaf0a7f65ad > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Auth.pm | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 24296c5996..d1f99e6efb 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1209,6 +1209,18 @@ sub checkauth { > ); > } > >+ # In case, that this request was a login attempt, we want to prevent that users can repost the opac login >+ # request. We therefore redirect the user to the requested page again without the login parameters. >+ # See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get >+ if ( $type eq "opac" && $query->param('koha_login_context') && $query->param('koha_login_context') ne 'sco' && $query->param('password') && $query->param('userid') ) { >+ my $uri = URI->new($query->url(-relative=>1, -query_string=>1)); >+ $uri->query_param_delete('userid'); >+ $uri->query_param_delete('password'); >+ $uri->query_param_delete('koha_login_context'); >+ print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other'); >+ exit; >+ } >+ > track_login_daily( $userid ); > > return ( $userid, $cookie, $sessionID, $flags ); >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22543
:
92615
|
92679
|
92698
| 92718