View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/C4/Auth.pm (-21 / +18 lines)
Lines 1322-1356 sub checkauth { Link Here
1322
1322
1323
        track_login_daily( $userid );
1323
        track_login_daily( $userid );
1324
1324
1325
        my $original_op_cud = $query->param('op-cud');
1325
        if ( $query->param('op-cud') ) {
1326
        if ( $request_method eq 'GET' ) {
1327
            $query->param('op-cud', undef);
1328
        } elsif ( $request_method eq 'POST' ) {
1329
            $query->param('op', undef);
1330
        }
1331
1332
        if ( defined $original_op_cud ) {
1333
            die "Cannot use GET for this request"
1326
            die "Cannot use GET for this request"
1334
                if $request_method ne 'POST';
1327
                if $request_method ne 'POST';
1335
1328
1336
            print $query->header(
1329
            unless (
1337
                {
1330
                Koha::Token->new->check_csrf(
1338
                    type              => 'text/html',
1339
                    charset           => 'utf-8',
1340
                    cookie            => $cookie,
1341
                    'X-Frame-Options' => 'SAMEORIGIN',
1342
                    -sameSite         => 'Lax'
1343
                }
1344
            );
1345
1346
            my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1347
            output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
1348
                unless Koha::Token->new->check_csrf(
1349
                    {
1331
                    {
1350
                        session_id => scalar $query->cookie('CGISESSID'),
1332
                        session_id => scalar $query->cookie('CGISESSID'),
1351
                        token      => scalar $query->param('csrf_token'),
1333
                        token      => scalar $query->param('csrf_token'),
1352
                    }
1334
                    }
1335
                )
1336
                )
1337
            {
1338
                my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1339
                print $query->header(
1340
                    {
1341
                        type              => 'text/html',
1342
                        charset           => 'utf-8',
1343
                        cookie            => $cookie,
1344
                        'X-Frame-Options' => 'SAMEORIGIN',
1345
                        -sameSite         => 'Lax'
1346
                    }
1353
                );
1347
                );
1348
1349
                output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' );
1350
            }
1354
        }
1351
        }
1355
1352
1356
        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
1353
        # In case, that this request was a login attempt, we want to prevent that users can repost the opac login
(-)a/debian/templates/plack.psgi (-1 / +12 lines)
Lines 47-52 use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise Link Here
47
        $CGI::PARAM_UTF8 = 1;
47
        $CGI::PARAM_UTF8 = 1;
48
        Koha::Caches->flush_L1_caches();
48
        Koha::Caches->flush_L1_caches();
49
        Koha::Cache::Memory::Lite->flush();
49
        Koha::Cache::Memory::Lite->flush();
50
51
        $request_method = $q->request_method // q{};
52
        if ( $request_method eq 'GET' ) {
53
            warn "Programming error - op-cud must not be passed with GET";
54
            $q->param( 'op-cud', undef );
55
        } elsif ( defined $q->param('op') ) {
56
            warn "Programming error - op can only be passed with GET";
57
            $q->param( 'op', undef );
58
        } else {
59
            $q->param( 'op', $q->param('op-cud') );
60
        }
61
50
        return $q;
62
        return $q;
51
    };
63
    };
52
}
64
}
53
- 

Return to bug 34478