From a902d4799fd7efe733489e29c6408ccd789a6fa6 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Fri, 2 Aug 2024 01:37:40 +0000
Subject: [PATCH] Bug 37553: Use CSRF token for authenicated session for
 POSTing

This change fixes the Koha::SVC to store the CSRF token for
the authenticated session for further POSTing.

Test plan:
0. Apply the patch
1. perl ./misc/migration_tools/koha-svc.pl \
    http://localhost:8081/cgi-bin/koha/svc koha koha 29 > bib-29.xml
2. perl ./misc/migration_tools/koha-svc.pl \
    http://localhost:8081/cgi-bin/koha/svc koha koha 29 bib-29.xml
3. Note that the following appears in STDOUT and there is no 403 error:
"update 29 from bib-29.xml"

Signed-off-by: David Nind <david@davidnind.com>
---
 misc/migration_tools/koha-svc.pl | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/misc/migration_tools/koha-svc.pl b/misc/migration_tools/koha-svc.pl
index 125b79ab43..83c72a99be 100755
--- a/misc/migration_tools/koha-svc.pl
+++ b/misc/migration_tools/koha-svc.pl
@@ -107,7 +107,6 @@ sub new {
 
     my $get_resp   = $ua->get("$url/authentication");
     my $csrf_token = $get_resp->header('CSRF-TOKEN');
-    $self->{csrf_token} = $csrf_token;
 
     my $resp = $ua->post(
         "$url/authentication",
@@ -115,6 +114,10 @@ sub new {
     );
     die $resp->status_line unless $resp->is_success;
 
+    #NOTE: A successful authentication means we have a new CGISESSID and a new CSRF Token
+    $csrf_token = $resp->header('CSRF-TOKEN');
+    $self->{csrf_token} = $csrf_token;
+
     warn "# $user $url = ", $resp->decoded_content, "\n" if $self->{debug};
 
     $self->{ua} = $ua;
-- 
2.39.2