From c96aa99406c076a0345c4225d09a29b1e9819382 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 3 Feb 2026 00:30:56 +0000 Subject: [PATCH] Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test Signed-off-by: David Cook --- Koha/App/Plugin/CSRF.pm | 13 +++++++++++-- t/db_dependent/mojo/csrf.t | 28 ++++++++++++++-------------- 2 files changed, 25 insertions(+), 16 deletions(-) diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm index 7a59b312f52..071bff7b112 100644 --- a/Koha/App/Plugin/CSRF.pm +++ b/Koha/App/Plugin/CSRF.pm @@ -73,18 +73,27 @@ sub register { my $method = $c->req->method; if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { - my $op = $c->req->param('op'); + my $op = $c->req->param('op'); + my $login_op = $c->req->param('login_op'); if ( $op && $op =~ /^cud-/ ) { return $c->reply->exception( 'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"') ->rendered(400); + } elsif ( defined $login_op ) { + return $c->reply->exception('Incorrect use of a safe HTTP method with a `login_op` parameter') + ->rendered(400); } } else { - my $op = $c->req->param('op'); + my $op = $c->req->param('op'); + my $login_op = $c->req->param('login_op'); if ( $op && $op !~ /^cud-/ ) { return $c->reply->exception( 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') ->rendered(400); + } elsif ( defined $login_op && $login_op !~ /^cud-login$/ ) { + return $c->reply->exception( + 'Incorrect use of an unsafe HTTP method with a `login_op` parameter that does not contain cud-login' + )->rendered(400); } if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { diff --git a/t/db_dependent/mojo/csrf.t b/t/db_dependent/mojo/csrf.t index 9fc953c95fe..09d0e13bd87 100755 --- a/t/db_dependent/mojo/csrf.t +++ b/t/db_dependent/mojo/csrf.t @@ -26,8 +26,8 @@ subtest 'CSRF - Intranet' => sub { subtest 'With a wrong CSRF token' => sub { plan tests => 3; - $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403) - ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); + $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) + ->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); }; subtest 'With a good CSRF token' => sub { @@ -37,15 +37,15 @@ subtest 'CSRF - Intranet' => sub { my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; - $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) + $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); }; subtest 'GETting what should be POSTed should fail' => sub { plan tests => 3; - $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( - qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, + $t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like( + qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; @@ -53,8 +53,8 @@ subtest 'CSRF - Intranet' => sub { subtest 'POSTing what should be GET should fail' => sub { plan tests => 3; - $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( - qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, + $t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like( + qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; @@ -78,8 +78,8 @@ subtest 'CSRF - OPAC' => sub { subtest 'With a wrong CSRF token' => sub { plan tests => 3; - $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403) - ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); + $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) + ->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); }; subtest 'With a good CSRF token' => sub { @@ -89,15 +89,15 @@ subtest 'CSRF - OPAC' => sub { my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; - $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) + $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); }; subtest 'GETting what should be POSTed should fail' => sub { plan tests => 3; - $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( - qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, + $t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like( + qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; @@ -105,8 +105,8 @@ subtest 'CSRF - OPAC' => sub { subtest 'POSTing what should be GET should fail' => sub { plan tests => 3; - $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( - qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, + $t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like( + qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; -- 2.39.5