@@ -, +, @@
---
errors/403.pl | 7 ++++---
.../intranet-tmpl/prog/en/includes/doc-head-close.inc | 4 +++-
svc/report | 2 +-
3 files changed, 8 insertions(+), 5 deletions(-)
--- a/errors/403.pl
+++ a/errors/403.pl
@@ -33,9 +33,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
authnotrequired => 1,
}
);
-$template->param (
- admin => $admin,
- errno => 403,
+$template->param(
+ admin => $admin,
+ errno => 403,
+ nocsrf => 1,
csrf_error => $ENV{'plack.middleware.Koha.CSRF'},
);
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
+++ a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
@@ -6,7 +6,9 @@
[% PROCESS 'html_helpers.inc' %]
-
+[% UNLESS nocsrf %]
+
+[% END %]
[% IF logged_in_user %][% END %]
[%# Prevent XFS attacks -%]
[% UNLESS popup %]
--- a/svc/report
+++ a/svc/report
@@ -46,7 +46,7 @@ my @param_names = $query->multi_param('param_names');
my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => '1'} );
unless ($status eq "ok") {
- print $query->header(-type => 'application/json', -charset => 'UTF-8');
+ print $query->header(-type => 'application/json', -status => '403 Forbidden');
print to_json({ auth_status => $status });
exit 0;
}
--