From 2ea4093087ead7ab120dd534fb0aed81349e1e9d Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 11 Mar 2025 15:29:10 +0100 Subject: [PATCH] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome. Signed-off-by: David Nind Signed-off-by: Baptiste Wojtkowski --- koha-tmpl/intranet-tmpl/prog/en/modules/about.tt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt index 904b37f3..0232760a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ -118,12 +118,14 @@ Apache version: [% apacheVersion | html %] - [% IF (is_psgi) %] - - PSGI: + + PSGI: + [% IF is_psgi %] [% psgi_server | html %] - - [% END %] + [% ELSE %] + Koha is running in CGI mode. This is a security issue! Use koha-plack --help + [% END %] + [% IF Koha.Preference('SearchEngine') == 'Elasticsearch' %] Elasticsearch: -- 2.30.2