From 1aabe666d615a00c11e9b5421df081079e940dad Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 22 Oct 2024 02:06:18 +0000 Subject: [PATCH] Bug 36560: Add a CSRF exception for ILS-DI API This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token for the ILS-DI API. 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI 2. Enable "ILS-DI" 3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 4. Note the 403 response 5. Apply the patch 6. sudo koha-plack --restart kohadev 7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 8. Note the 200 response Signed-off-by: David Nind Signed-off-by: Kyle M Hall --- Koha/Middleware/CSRF.pm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm index 58e75c948eb..a41da530544 100644 --- a/Koha/Middleware/CSRF.pm +++ b/Koha/Middleware/CSRF.pm @@ -44,11 +44,20 @@ sub call { my $request_method = $req->method // q{}; my $uri = $req->uri // q{}; my $referer = $req->referer // q{No referer}; + my $request_path = $req->path // q{}; + + my %path_exceptions = ( + '/ilsdi.pl' => 1, + ); #NOTE: Ignore ErrorDocument requests for CSRF if ( $env->{'psgix.errordocument.SCRIPT_NAME'} ) { return $self->app->($env); } + elsif ( $path_exceptions{$request_path} ){ + #NOTE: Ignore path exceptions for CSRF + return $self->app->($env); + } my ($error); if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { -- 2.39.5 (Apple Git-154)