Bugzilla – Attachment 163552 Details for
Bug 36349
Login for SCO/SCI broken by CSRF
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36349: Make sure CSRF token is included for all login scenarios
Bug-36349-Make-sure-CSRF-token-is-included-for-all.patch (text/plain), 1.81 KB, created by
Owen Leonard
on 2024-03-20 15:06:32 UTC
(
hide
)
Description:
Bug 36349: Make sure CSRF token is included for all login scenarios
Filename:
MIME Type:
Creator:
Owen Leonard
Created:
2024-03-20 15:06:32 UTC
Size:
1.81 KB
patch
obsolete
>From c103f33d67490935489d8d6bea41a0ea0218637b Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Mon, 18 Mar 2024 16:27:58 +0000 >Subject: [PATCH] Bug 36349: Make sure CSRF token is included for all login > scenarios > >To test: >1 - In KTD visit: > http://localhost:8080/cgi-bin/koha/sci/sci-main.pl >2 - Everything should be set for auto self check user etc, just login > as a patron > If not (or not using KTD) setup a self check user, enable SCO and > SCI, set self check patron system preferences, then login with > patron >3 - 403 Error >4 - Repeat with sco: > http://localhost:8080/cgi-bin/koha/sco/sco-main.pl >5 - Apply patch, restart all >6 - Try again, both should be successful > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 0092e20b12..52a59027c9 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -208,8 +208,8 @@ > <form action="/cgi-bin/koha/sci/sci-main.pl" name="auth" id="auth" method="post" autocomplete="off"> > [% ELSE %] > <form action="[% script_name | html %]" name="auth" id="auth" method="post" autocomplete="off"> >- [% INCLUDE 'csrf-token.inc' %] > [% END %] >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="op" value="cud-login" /> > <input type="hidden" name="koha_login_context" value="opac" /> > >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36349
:
163356
|
163386
|
163514
|
163552
|
163553
|
164411
|
164412
|
164444
|
164445
|
164446
|
164447