From a71d63d20b8e7955c576c5505916b69c04152785 Mon Sep 17 00:00:00 2001 From: Pedro Amorim Date: Tue, 2 Apr 2024 11:28:59 +0000 Subject: [PATCH] Bug 35106: CSRF fix The removal of 'cud-' from op needs to happen sooner because ill-requests.tt expects 'edit_action' op, not 'cud-edit_action'. Signed-off-by: Pedro Amorim Signed-off-by: Tomas Cohen Arazi --- ill/ill-requests.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl index 98d4e77c57a..0d8e7b186ea 100755 --- a/ill/ill-requests.pl +++ b/ill/ill-requests.pl @@ -216,6 +216,7 @@ if ( $backends_available ) { handle_commit_maybe($backend_result, $request); } elsif ( $op eq 'cud-edit_action' ) { + $op =~ s/^cud-//; # Handle edits to the Illrequest object. # (not the Illrequestattributes) # We simulate the API for backend requests for uniformity. @@ -225,7 +226,6 @@ if ( $backends_available ) { order_by => { -asc => 'name' } }); if ( !$params->{stage} ) { - $op =~ s/^cud-//; my $backend_result = { error => 0, status => '', -- 2.44.0