From 5a64db78d5e868c27392b2bd3c9f0b9f391110d5 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 3 Feb 2026 00:15:27 +0000 Subject: [PATCH] Bug 39055: Add more login_op checks to middleware Signed-off-by: David Cook --- Koha/Middleware/CSRF.pm | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm index 6d084cefe1b..a0ffc984090 100644 --- a/Koha/Middleware/CSRF.pm +++ b/Koha/Middleware/CSRF.pm @@ -60,17 +60,27 @@ sub call { } my ($error); - if ( $stateless_methods{$request_method} && defined $original_op && $original_op =~ m{^cud-} ) { - $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", $original_op, - $request_method, $uri, $referer; + if ( $stateless_methods{$request_method} ) { + if ( defined $original_op && $original_op =~ m{^cud-} ) { + $error = sprintf "Programming error - op '%s' must not start with 'cud-' for %s %s (referer: %s)", + $original_op, + $request_method, $uri, $referer; + } elsif ( defined $req->param('login_op') ) { + $error = sprintf "Programming error - login_op not permitted for %s %s (referer: %s)", + $request_method, $uri, $referer; + } } elsif ( $stateful_methods{$request_method} ) { # Get the CSRF token from the param list or the header my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); - if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { + if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, $request_method, $uri, $referer; + } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { + $error = sprintf "Programming error - login_op must contain cud-login for %s %s (referer: %s)", + $request_method, $uri, $referer; + } elsif ( !$csrf_token ) { $error = sprintf "Programming error - No CSRF token passed for %s %s (referer: %s)", $request_method, $uri, $referer; -- 2.39.5