From b50d25cf4f6f0aa5d332b966932890423a85b775 Mon Sep 17 00:00:00 2001 From: Pedro Amorim Date: Fri, 11 Apr 2025 14:12:18 +0000 Subject: [PATCH] Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern Upon submitting the unauthenticated request, the user is now redirected to a different page and the request details are passed through a session variable. This is to prevent the user from being able to resubmit the same unauthenticated request multiple times (see security bug 39611) Signed-off-by: Tomas Cohen Arazi --- .../bootstrap/en/modules/opac-illrequests.tt | 74 ----------- .../opac-illrequests_unauthenticated.tt | 115 ++++++++++++++++++ opac/opac-illrequests-unauthenticated.pl | 30 +++++ opac/opac-illrequests.pl | 26 +++- 4 files changed, 170 insertions(+), 75 deletions(-) create mode 100644 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests_unauthenticated.tt create mode 100755 opac/opac-illrequests-unauthenticated.pl diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt index d531a48b9d4..8fb64a571b8 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt @@ -64,10 +64,6 @@
- [% ELSIF (!logged_in_user) %] -
- -
[% END %] [% SET column_class = "col order-first order-md-first order-lg-2" %] @@ -252,76 +248,6 @@ [% END %] - [% ELSIF op == 'unauth_view' %] - -

View interlibrary loan request

- [% INCLUDE messages %] - [% status = request.status %] -
- Details from library -
    - [% type = request.get_type %] -
  1. - - [% request.id | html %] -
  2. -
  3. - - [% request.backend | html %] -
  4. - [% IF request.biblio_id %] -
  5. - - View the requested item -
  6. - [% END %] -
  7. - - [% Branches.GetName(request.branchcode) | html %] -
  8. -
  9. - - [% request.status_alias ? request.statusalias.lib_opac : request.capabilities.$status.name | html %] -
  10. -
  11. - - [% IF type %][% type | html %][% ELSE %]N/A[% END %] -
  12. -
  13. - - [% request.placed | $KohaDates %] -
  14. -
  15. - - [% request.updated | $KohaDates %] -
  16. -
  17. - - [% request.extended_attributes.find({'type'=>'unauthenticated_first_name'}).value | html %] -
  18. -
  19. - - [% request.extended_attributes.find({'type'=>'unauthenticated_last_name'}).value | html %] -
  20. -
  21. - - [% request.extended_attributes.find({'type'=>'unauthenticated_email'}).value | html %] -
  22. -
  23. - - [% request.notesopac | html %] -
  24. -
-
-
- Details from [% request.backend | html %] - [% FOREACH meta IN request.metadata %] -
- [% meta.key | html %]: - [% IF meta.value %][% meta.value | html %][% ELSE %]N/A[% END %] -
- [% END %] -
[% ELSIF op == 'availability' %]

Interlibrary loan item availability

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests_unauthenticated.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests_unauthenticated.tt new file mode 100644 index 00000000000..87d419ec963 --- /dev/null +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests_unauthenticated.tt @@ -0,0 +1,115 @@ +[% USE raw %] +[% USE KohaDates %] +[% USE Branches %] +[% USE AdditionalContents %] +[% SET OpacNav = AdditionalContents.get( location => "OpacNav", lang => lang, library => logged_in_user.branchcode || default_branch, blocktitle => 0 ) %] +[% INCLUDE 'doc-head-open.inc' %] +ILL requests +[% INCLUDE 'doc-head-close.inc' %] +[% BLOCK cssinclude %] +[% END %] +[% INCLUDE 'bodytag.inc' bodyid='opac-illrequests' %] + +[% INCLUDE 'masthead.inc' %] +
+ [% WRAPPER breadcrumbs %] + [% IF op != 'list' %] + [% WRAPPER breadcrumb_item %] + Interlibrary loan requests + [% END %] + [% END %] + [% END #/ WRAPPER breadcrumbs %] + +
+
+
+ [% IF op == 'list' %] +

Interlibrary loan requests

+ [% ELSIF op == 'view' %] +

View interlibrary loan request

+ [% ELSIF op == 'unauth_view' %] +

View interlibrary loan request

+ [% ELSIF op == 'availability' %] +

Interlibrary loan item availability

+ [% ELSIF op == 'typedisclaimer' %] +

ILL request disclaimer

+ [% ELSIF op == 'confirmautoill' %] +

Confirming request

+ [% END %] +
+ [% SET column_class = "col order-first order-md-first order-lg-2" %] + [% IF ( OpacNav||loggedinusername ) %] + [% column_class = "col-lg-10 order-first order-md-first order-lg-2" %] + [% END %] +
+
+ +

View interlibrary loan request

+ [% status = request.status %] +
+ Details from library +
    + [% type = request.get_type %] +
  1. + + [% request.illrequest_id | html %] +
  2. +
  3. + + [% request.backend | html %] +
  4. +
  5. + + [% Branches.GetName(request.branchcode) | html %] +
  6. +
  7. + + [% request.status | html %] +
  8. +
  9. + + [% IF type %][% type | html %][% ELSE %]N/A[% END %] +
  10. +
  11. + + [% request.placed | $KohaDates %] +
  12. +
  13. + + [% request.updated | $KohaDates %] +
  14. +
  15. + + [% request.unauthenticated_first_name | html %] +
  16. +
  17. + + [% request.unauthenticated_last_name | html %] +
  18. +
  19. + + [% request.unauthenticated_email| html %] +
  20. +
+
+
+ Request details + [% FOREACH meta IN request.metadata %] + [% IF meta.value %] +
+ [% meta.key | html %]: + [% meta.value | html %] +
+ [% END %] + [% END %] +
+
+
+
+
+
+ +[% INCLUDE 'opac-bottom.inc' %] + +[% BLOCK jsinclude %] +[% END %] diff --git a/opac/opac-illrequests-unauthenticated.pl b/opac/opac-illrequests-unauthenticated.pl new file mode 100755 index 00000000000..ea49119d8d6 --- /dev/null +++ b/opac/opac-illrequests-unauthenticated.pl @@ -0,0 +1,30 @@ +#!/usr/bin/perl + +use Modern::Perl; + +use JSON qw( decode_json ); + +use CGI qw ( -utf8 ); +use C4::Auth qw( get_template_and_user ); +use C4::Output qw( output_html_with_http_headers ); +use URI::Escape qw( uri_unescape ); + +my $query = CGI->new; + +my $sessionID = $query->cookie('CGISESSID'); +my $session = C4::Auth::get_session($sessionID); +my $request = + eval { decode_json( uri_unescape( $session->param('ill_request_unauthenticated') ) ) }; + +my ( $template, $loggedinuser, $cookie ) = get_template_and_user( + { + template_name => "opac-illrequests_unauthenticated.tt", + query => $query, + type => "opac", + authnotrequired => 1, + } +); + +$template->param( request => $request ); + +output_html_with_http_headers $query, $cookie, $template->output; diff --git a/opac/opac-illrequests.pl b/opac/opac-illrequests.pl index 6db3c3ab7d4..a5f5e3ac893 100755 --- a/opac/opac-illrequests.pl +++ b/opac/opac-illrequests.pl @@ -28,6 +28,7 @@ use C4::Output qw( output_html_with_http_headers ); use Digest::MD5 qw( md5_base64 ); use POSIX qw( strftime ); use String::Random qw( random_string ); +use URI::Escape qw( uri_escape ); use Koha::ILL::Request::Config; use Koha::ILL::Requests; @@ -197,7 +198,30 @@ if ( $op eq 'list' ) { $type_disclaimer->after_request_created( $params, $request ); } if ( C4::Context->preference('ILLOpacUnauthenticatedRequest') && !$patron ) { - $op = 'unauth_view'; + my $sessionID = $query->cookie('CGISESSID'); + my $session = C4::Auth::get_session($sessionID); + + my $request_unblessed = $request->unblessed; + $request_unblessed->{updated} = $request_unblessed->{updated}->ymd; + $request_unblessed->{placed} = $request_unblessed->{placed}->ymd; + $request_unblessed->{unauthenticated_first_name} = + $request->extended_attributes->find( { 'type' => 'unauthenticated_first_name' } )->value; + $request_unblessed->{unauthenticated_last_name} = + $request->extended_attributes->find( { 'type' => 'unauthenticated_last_name' } )->value; + $request_unblessed->{unauthenticated_email} = + $request->extended_attributes->find( { 'type' => 'unauthenticated_email' } )->value; + $request_unblessed->{metadata} = $request->metadata; + + my $capabilities = $request->capabilities; + $request_unblessed->{status} = $capabilities->{ $request->status }->{name}; + $request_unblessed->{type} = $request->get_type; + + $session->param( + 'ill_request_unauthenticated', + uri_escape( encode_json($request_unblessed) ) + ); + $session->flush; + print $query->redirect('/cgi-bin/koha/opac-illrequests-unauthenticated.pl'); } else { print $query->redirect('/cgi-bin/koha/opac-illrequests.pl?message=2'); exit; -- 2.49.0