From d5a352d55705cd7ba4f24adaeca008124c7ea936 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 13 Feb 2024 16:32:35 +0100 Subject: [PATCH] Bug 36084: Do not allow absence of token Well, this test was silly, I was focussed on propagating an error to the UI, but we really need to explode in this case. Note that this requires more work as login is now broken. --- debian/templates/plack.psgi | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi index 108a1aa5e46..317f278cfd4 100644 --- a/debian/templates/plack.psgi +++ b/debian/templates/plack.psgi @@ -64,24 +64,21 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise $q->param( 'debug_programming_error', "'$original_op' must start with 'cud-' for $request_method" ); } - if ( $csrf_token ) { - unless ( - Koha::Token->new->check_csrf( - { - session_id => scalar $q->cookie('CGISESSID'), - token => $csrf_token, - } - ) - ) - { - Koha::Logger->get->debug("The form submission failed (Wrong CSRF token)."); - $q->param( 'op', '' ); - $q->param( 'invalid_csrf_token', 1); - } - } else { - Koha::Logger->get->warn("Programming error - No CSRF token passed for $request_method"); + die "Programming error - No CSRF token passed for $request_method" + unless $csrf_token; + + unless ( + Koha::Token->new->check_csrf( + { + session_id => scalar $q->cookie('CGISESSID'), + token => $csrf_token, + } + ) + ) + { + Koha::Logger->get->debug("The form submission failed (Wrong CSRF token)."); $q->param( 'op', '' ); - $q->param( 'debug_programming_error', "No CSRF token passed for $request_method" ); + $q->param( 'invalid_csrf_token', 1); } } -- 2.34.1