From 7ccd4d5da080c7ad0390c1470b087216a6a939b5 Mon Sep 17 00:00:00 2001 From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Date: Tue, 11 Mar 2025 15:29:10 +0100 Subject: [PATCH] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome. --- koha-tmpl/intranet-tmpl/prog/en/modules/about.tt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt index 904b37f372e..0232760a6fe 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ -118,12 +118,14 @@ <th scope="row">Apache version: </th> <td>[% apacheVersion | html %]</td> </tr> - [% IF (is_psgi) %] - <tr> - <th scope="row">PSGI: </th> + <tr> + <th scope="row">PSGI: </th> + [% IF is_psgi %] <td>[% psgi_server | html %]</td> - </tr> - [% END %] + [% ELSE %] + <td class="error">Koha is running in CGI mode. This is a security issue! Use <code>koha-plack --help</code></td> + [% END %] + </tr> [% IF Koha.Preference('SearchEngine') == 'Elasticsearch' %] <tr> <th scope="row">Elasticsearch: </th> -- 2.34.1