From f2bd17b1fb9cf9b38bf10ecdb87e800a36887356 Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Fri, 7 Jun 2024 17:14:53 +0000 Subject: [PATCH] Bug 37056: (Non-working POC) Attempt to preserve 403 response The former patch will prevent the issue, however, it makes svc/report return 200 when not authorized. I thought maybe the issue was that we were generating a new csrf token on the 403 page/template and tried to prevent that on this patch, however, it doesn't work. Looking for some help on this one --- errors/403.pl | 7 ++++--- .../intranet-tmpl/prog/en/includes/doc-head-close.inc | 4 +++- svc/report | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/errors/403.pl b/errors/403.pl index b83c014de81..a6c592c3586 100755 --- a/errors/403.pl +++ b/errors/403.pl @@ -33,9 +33,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( authnotrequired => 1, } ); -$template->param ( - admin => $admin, - errno => 403, +$template->param( + admin => $admin, + errno => 403, + nocsrf => 1, csrf_error => $ENV{'plack.middleware.Koha.CSRF'}, ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc index 60264eb4bb6..418fcc5c957 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc @@ -6,7 +6,9 @@ [% PROCESS 'html_helpers.inc' %] - +[% UNLESS nocsrf %] + +[% END %] [% IF logged_in_user %][% END %] [%# Prevent XFS attacks -%] [% UNLESS popup %] diff --git a/svc/report b/svc/report index 89e2259f358..575966ad104 100755 --- a/svc/report +++ b/svc/report @@ -46,7 +46,7 @@ my @param_names = $query->multi_param('param_names'); my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} ); unless ($status eq "ok") { - print $query->header(-type => 'application/json', -charset => 'UTF-8'); + print $query->header(-type => 'application/json', -status => '403 Forbidden'); print to_json({ auth_status => $status }); exit 0; } -- 2.39.2