From a32e7b8a9664ac8914a668e4bdb61df47bd8dcad Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 11 Mar 2025 15:29:10 +0100 Subject: [PATCH] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome. Signed-off-by: David Nind --- koha-tmpl/intranet-tmpl/prog/en/modules/about.tt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt index 904b37f372..0232760a6f 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ -118,12 +118,14 @@ Apache version: [% apacheVersion | html %] - [% IF (is_psgi) %] - - PSGI: + + PSGI: + [% IF is_psgi %] [% psgi_server | html %] - - [% END %] + [% ELSE %] + Koha is running in CGI mode. This is a security issue! Use koha-plack --help + [% END %] + [% IF Koha.Preference('SearchEngine') == 'Elasticsearch' %] Elasticsearch: -- 2.39.5