From 69561c11c3c6b55a571e0d1dcfaff3249b07490a Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 3 Feb 2026 05:52:58 +0000 Subject: [PATCH] Bug 39055: Fix login condition when using op and login_op --- Koha/App/Plugin/CSRF.pm | 2 +- Koha/Middleware/CSRF.pm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm index 071bff7b112..62b8d1fa542 100644 --- a/Koha/App/Plugin/CSRF.pm +++ b/Koha/App/Plugin/CSRF.pm @@ -86,7 +86,7 @@ sub register { } else { my $op = $c->req->param('op'); my $login_op = $c->req->param('login_op'); - if ( $op && $op !~ /^cud-/ ) { + if ( ( $op && $op !~ /^cud-/ ) && !$login_op ) { return $c->reply->exception( 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') ->rendered(400); diff --git a/Koha/Middleware/CSRF.pm b/Koha/Middleware/CSRF.pm index a0ffc984090..07740a64ed4 100644 --- a/Koha/Middleware/CSRF.pm +++ b/Koha/Middleware/CSRF.pm @@ -74,7 +74,7 @@ sub call { # Get the CSRF token from the param list or the header my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN'); - if ( defined $req->param('op') && $original_op !~ m{^cud-} ) { + if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) { $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op, $request_method, $uri, $referer; } elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) { -- 2.39.5