View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/C4/Auth.pm (-2 / +25 lines)
Lines 947-952 sub checkauth { Link Here
947
        }
947
        }
948
    }
948
    }
949
949
950
    my $request_method = $query->request_method // q{};
951
950
    if ( $auth_state eq 'failed' || $logout ) {
952
    if ( $auth_state eq 'failed' || $logout ) {
951
        $sessionID = undef;
953
        $sessionID = undef;
952
        $userid    = undef;
954
        $userid    = undef;
Lines 1089-1095 sub checkauth { Link Here
1089
                }
1091
                }
1090
                else {
1092
                else {
1091
                    my $retuserid;
1093
                    my $retuserid;
1092
                    my $request_method = $query->request_method // q{};
1093
1094
1094
                    if (
1095
                    if (
1095
                        $request_method eq 'POST'
1096
                        $request_method eq 'POST'
Lines 1468-1473 sub checkauth { Link Here
1468
        }
1469
        }
1469
    }
1470
    }
1470
1471
1472
    if ( $auth_state eq 'completed' && defined $query->param('op') ) {
1473
        die "Cannot use GET for this request"
1474
            if $request_method ne 'POST';
1475
1476
        print $query->header(
1477
            {
1478
                type              => 'text/html',
1479
                charset           => 'utf-8',
1480
                cookie            => $cookie,
1481
                'X-Frame-Options' => 'SAMEORIGIN',
1482
                -sameSite         => 'Lax'
1483
            }
1484
        );
1485
1486
        output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
1487
            unless Koha::Token->new->check_csrf(
1488
                {
1489
                    session_id => scalar $query->cookie('CGISESSID'),
1490
                    token      => scalar $query->param('csrf_token'),
1491
                }
1492
            );
1493
    }
1494
1471
    $template->param(
1495
    $template->param(
1472
        LibraryName => C4::Context->preference("LibraryName"),
1496
        LibraryName => C4::Context->preference("LibraryName"),
1473
    );
1497
    );
1474
- 

Return to bug 34478