View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/C4/Auth.pm (-25 / +25 lines)
Lines 1307-1312 sub checkauth { Link Here
1307
    }
1307
    }
1308
1308
1309
    # finished authentification, now respond
1309
    # finished authentification, now respond
1310
    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
1310
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1311
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1311
        # successful login
1312
        # successful login
1312
        unless (@$cookie) {
1313
        unless (@$cookie) {
Lines 1321-1326 sub checkauth { Link Here
1321
1322
1322
        track_login_daily( $userid );
1323
        track_login_daily( $userid );
1323
1324
1325
        if ( defined $query->param('op') ) {
1326
            die "Cannot use GET for this request"
1327
                if $request_method ne 'POST';
1328
1329
            print $query->header(
1330
                {
1331
                    type              => 'text/html',
1332
                    charset           => 'utf-8',
1333
                    cookie            => $cookie,
1334
                    'X-Frame-Options' => 'SAMEORIGIN',
1335
                    -sameSite         => 'Lax'
1336
                }
1337
            );
1338
1339
            my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1340
            output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
1341
                unless Koha::Token->new->check_csrf(
1342
                    {
1343
                        session_id => scalar $query->cookie('CGISESSID'),
1344
                        token      => scalar $query->param('csrf_token'),
1345
                    }
1346
                );
1347
        }
1348
1324
        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
1349
        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
1325
        # request. We therefore redirect the user to the requested page again without the login parameters.
1350
        # request. We therefore redirect the user to the requested page again without the login parameters.
1326
        # See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get
1351
        # See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get
Lines 1357-1363 sub checkauth { Link Here
1357
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1382
    $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1358
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1383
    $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1359
1384
1360
    my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt';
1361
    my $auth_error = $query->param('auth_error');
1385
    my $auth_error = $query->param('auth_error');
1362
    my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1386
    my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1363
    $template->param(
1387
    $template->param(
Lines 1469-1497 sub checkauth { Link Here
1469
        }
1493
        }
1470
    }
1494
    }
1471
1495
1472
    if ( $auth_state eq 'completed' && defined $query->param('op') ) {
1473
        die "Cannot use GET for this request"
1474
            if $request_method ne 'POST';
1475
1476
        print $query->header(
1477
            {
1478
                type              => 'text/html',
1479
                charset           => 'utf-8',
1480
                cookie            => $cookie,
1481
                'X-Frame-Options' => 'SAMEORIGIN',
1482
                -sameSite         => 'Lax'
1483
            }
1484
        );
1485
1486
        output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
1487
            unless Koha::Token->new->check_csrf(
1488
                {
1489
                    session_id => scalar $query->cookie('CGISESSID'),
1490
                    token      => scalar $query->param('csrf_token'),
1491
                }
1492
            );
1493
    }
1494
1495
    $template->param(
1496
    $template->param(
1496
        LibraryName => C4::Context->preference("LibraryName"),
1497
        LibraryName => C4::Context->preference("LibraryName"),
1497
    );
1498
    );
1498
- 

Return to bug 34478