From acf0dbffe1c3e95f3a49a461fd36c08f901a0f3b Mon Sep 17 00:00:00 2001 From: David Cook Date: Sun, 18 Jan 2026 23:54:13 +0000 Subject: [PATCH] Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through This patch changes "op" to "login_op" when logging in, so that the original op can flow through to whichever controller is processing the login and subsequent op. Test plan: 0. apply the patch and koha-plack --restart kohadev 1. Without logging in, go to the following: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run 2. Log in and note that you can see the report 3. Try logging into the OPAC 4. Try logging into the self-checkout 5. Create a new self-reg account and try logging in with the auto-filled details 6. Test anything else you can think to test here Signed-off-by: Brendan Lawlor Signed-off-by: David Cook --- C4/Auth.pm | 3 ++- C4/InstallAuth.pm | 2 +- Koha/Middleware/CSRF.pm | 2 +- catalogue/search.pl | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 6 ++---- koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt | 3 +-- koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc | 2 +- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 2 +- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt | 2 +- .../bootstrap/en/modules/opac-registration-confirmation.tt | 2 +- koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt | 2 +- opac/opac-tags.pl | 2 +- 12 files changed, 14 insertions(+), 16 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index c376d0e35c2..6043dcba385 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -195,7 +195,7 @@ sub get_template_and_user { $in->{query}->param( -name => 'koha_login_context', -values => ['sco'] ); } else { my $request_method = $in->{query}->request_method // q{}; - unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) { + unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) { for my $v (qw( login_userid login_password )) { $in->{query}->param( $v, '' ) if $in->{query}->param($v); @@ -1418,6 +1418,7 @@ sub checkauth { $uri->query_param_delete('login_userid'); $uri->query_param_delete('login_password'); $uri->query_param_delete('koha_login_context'); + $uri->query_param_delete('login_op'); $uri->query_param_delete('op'); $uri->query_param_delete('csrf_token'); unless ( $params->{do_not_print} ) { diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 7e3271dd2e4..9d8865cdd7b 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -111,7 +111,7 @@ sub get_template_and_user { my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query ); my $request_method = $in->{query}->request_method // q{}; - unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) { + unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) { $in->{query}->param( 'login_userid', '' ); $in->{query}->param( 'login_password', '' ); } diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm index fd62c7c7c02..6d084cefe1b 100644 --- a/Koha/Middleware/CSRF.pm +++ b/Koha/Middleware/CSRF.pm @@ -68,7 +68,7 @@ sub call { # Get the CSRF token from the param list or the header my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); - if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { + if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, $request_method, $uri, $referer; } elsif ( !$csrf_token ) { diff --git a/catalogue/search.pl b/catalogue/search.pl index 762d952ae7e..1fbbfbb5065 100755 --- a/catalogue/search.pl +++ b/catalogue/search.pl @@ -264,7 +264,7 @@ $template->param( advancedsearchesloop => $advancedsearchesloop ); $template->param( searchid => scalar $cgi->param('searchid'), ); my $default_sort_by = C4::Context->default_catalog_sort_by; -my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op'); +my @sanitized_operators = $cgi->multi_param('op'); #NOTE: No longer sanitized... # The following should only be loaded if we're bringing up the advanced search template if ( $template_type eq 'advsearch' ) { diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt index 4a0a2109049..81da6867e1c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt @@ -160,10 +160,9 @@
[% INCLUDE 'csrf-token.inc' %] - + [% FOREACH INPUT IN INPUTS %] - [% NEXT IF INPUT.name == "op" %] [% NEXT IF INPUT.name == "csrf_token" %] [% NEXT IF INPUT.name == "koha_login_context" %] [% NEXT IF INPUT.name == "branch" %] @@ -254,10 +253,9 @@ [% ELSIF TwoFA_prompt %] [% INCLUDE 'csrf-token.inc' %] - + [% FOREACH INPUT IN INPUTS %] - [% NEXT IF INPUT.name == "op" %] [% NEXT IF INPUT.name == "csrf_token" %] [% NEXT IF INPUT.name == "koha_login_context" %] [% NEXT IF INPUT.name == "branch" %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt index d609f9cdc89..96cd6c3cf49 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt @@ -57,9 +57,8 @@ [% INCLUDE 'csrf-token.inc' %] - + [% FOREACH INPUT IN INPUTS %] - [% NEXT IF INPUT.name == "op" %] [% NEXT IF INPUT.name == "csrf_token" %] [% NEXT IF INPUT.name == "login_userid" %] [% NEXT IF INPUT.name == "login_password" %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc index 2b6d4478d6d..72dcf038143 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -508,7 +508,7 @@ [% PROCESS login_label for="muserid" %]
- +
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt index 6d6c135cc1a..97d0995fb5c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -236,7 +236,7 @@ [% END %] [% INCLUDE 'csrf-token.inc' %] - + diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt index 57764dc4a4f..83ccf1ec158 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt @@ -110,7 +110,7 @@ [% INCLUDE 'csrf-token.inc' %] - +
Log in to your account: [% PROCESS login_label for="userid" %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt index ad3dc1ab1bf..281d5515edd 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt @@ -363,7 +363,7 @@ [% FOREACH INPUT IN INPUTS %] [% END %] - +
diff --git a/opac/opac-tags.pl b/opac/opac-tags.pl index 70429fda57a..603e50b5098 100755 --- a/opac/opac-tags.pl +++ b/opac/opac-tags.pl @@ -122,7 +122,7 @@ unless ( C4::Context->preference('TagsEnabled') ) { if ($add_op) { unless ($loggedinuser) { - push @errors, { +'cud-login' => 1 }; + push @errors, { +'login' => 1 }; push @globalErrorIndexes, $#errors; %newtags = (); # zero out any attempted additions @deltags = (); # zero out any attempted deletions -- 2.39.5