From 80472536c53041db43411d8d40e7a45b1b4c2f25 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 21 Sep 2023 12:00:17 +0200 Subject: [PATCH] Bug 34478: op-cud - Trick CGI directly --- C4/Auth.pm | 39 +++++++++++++++++-------------------- debian/templates/plack.psgi | 12 ++++++++++++ 2 files changed, 30 insertions(+), 21 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 7bd2b5d2f26..0bfdf72e45a 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1322,35 +1322,32 @@ sub checkauth { track_login_daily( $userid ); - my $original_op_cud = $query->param('op-cud'); - if ( $request_method eq 'GET' ) { - $query->param('op-cud', undef); - } elsif ( $request_method eq 'POST' ) { - $query->param('op', undef); - } - - if ( defined $original_op_cud ) { + if ( $query->param('op-cud') ) { die "Cannot use GET for this request" if $request_method ne 'POST'; - print $query->header( - { - type => 'text/html', - charset => 'utf-8', - cookie => $cookie, - 'X-Frame-Options' => 'SAMEORIGIN', - -sameSite => 'Lax' - } - ); - - my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); - output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) - unless Koha::Token->new->check_csrf( + unless ( + Koha::Token->new->check_csrf( { session_id => scalar $query->cookie('CGISESSID'), token => scalar $query->param('csrf_token'), } + ) + ) + { + my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); + print $query->header( + { + type => 'text/html', + charset => 'utf-8', + cookie => $cookie, + 'X-Frame-Options' => 'SAMEORIGIN', + -sameSite => 'Lax' + } ); + + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ); + } } # In case, that this request was a login attempt, we want to prevent that users can repost the opac login diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi index 89cd6ef48fe..50d832606d7 100644 --- a/debian/templates/plack.psgi +++ b/debian/templates/plack.psgi @@ -47,6 +47,18 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise $CGI::PARAM_UTF8 = 1; Koha::Caches->flush_L1_caches(); Koha::Cache::Memory::Lite->flush(); + + $request_method = $q->request_method // q{}; + if ( $request_method eq 'GET' ) { + warn "Programming error - op-cud must not be passed with GET"; + $q->param( 'op-cud', undef ); + } elsif ( defined $q->param('op') ) { + warn "Programming error - op can only be passed with GET"; + $q->param( 'op', undef ); + } else { + $q->param( 'op', $q->param('op-cud') ); + } + return $q; }; } -- 2.25.1