From 6f4539c19003721a0a60d12f12b7709101c38752 Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Fri, 7 Jun 2024 16:59:58 +0000 Subject: [PATCH] Bug 37056: Don't generate new CSRF token when fetching a report using the svc API To test: 1 - Create a report 2 - Add to IntranetUserJs: $(document).ready(function() { // Your report ID var reportId = '492'; // Fetch the report $.get('/cgi-bin/koha/svc/report?id=' + reportId, function(data) { console.log('Kaboom'); }); }); 3 - Log out 4 - Attempt to login 5 - KO 6 - Apply patch 7 - Restart all 8 - Repeat login 9 - Success! --- svc/report | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/svc/report b/svc/report index 5d91494f937..89e2259f358 100755 --- a/svc/report +++ b/svc/report @@ -20,10 +20,10 @@ use Modern::Perl; -use C4::Auth qw( get_template_and_user ); +use C4::Auth qw( check_api_auth ); use C4::Reports::Guided qw( execute_query ); use Koha::Reports; -use JSON qw( encode_json decode_json ); +use JSON qw( encode_json decode_json to_json ); use CGI qw ( -utf8 ); use Koha::Caches; @@ -44,14 +44,12 @@ $report_id = $report_rec->id; my @sql_params = $query->multi_param('sql_params'); my @param_names = $query->multi_param('param_names'); -my ( $template, $loggedinuser, $cookie ) = get_template_and_user( - { - template_name => "intranet-main.tt", - query => $query, - type => "intranet", - flagsrequired => { catalogue => 1, }, - } -); +my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} ); +unless ($status eq "ok") { + print $query->header(-type => 'application/json', -charset => 'UTF-8'); + print to_json({ auth_status => $status }); + exit 0; +} my $cache = Koha::Caches->get_instance(); my $cache_active = $cache->is_cache_active; -- 2.39.2