@@ -, +, @@ --- errors/403.pl | 7 ++++--- .../intranet-tmpl/prog/en/includes/doc-head-close.inc | 4 +++- svc/report | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) --- a/errors/403.pl +++ a/errors/403.pl @@ -33,9 +33,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( authnotrequired => 1, } ); -$template->param ( - admin => $admin, - errno => 403, +$template->param( + admin => $admin, + errno => 403, + nocsrf => 1, csrf_error => $ENV{'plack.middleware.Koha.CSRF'}, ); --- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc @@ -6,7 +6,9 @@ [% PROCESS 'html_helpers.inc' %] - +[% UNLESS nocsrf %] + +[% END %] [% IF logged_in_user %][% END %] [%# Prevent XFS attacks -%] [% UNLESS popup %] --- a/svc/report +++ a/svc/report @@ -46,7 +46,7 @@ my @param_names = $query->multi_param('param_names'); my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} ); unless ($status eq "ok") { - print $query->header(-type => 'application/json', -charset => 'UTF-8'); + print $query->header(-type => 'application/json', -status => '403 Forbidden'); print to_json({ auth_status => $status }); exit 0; } --