From f5013896bd9ca166c07e0ce5442723c526888cd1 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Tue, 10 Feb 2026 21:12:49 +0200 Subject: [PATCH] Bug 38365: Disable the endpoint when CSP is disabled in KOHA_CONF To test: 1. prove t/db_dependent/api/v1/public/csp_reports.t --- Koha/REST/V1/CSPReports.pm | 10 +++++++ t/db_dependent/api/v1/public/csp_reports.t | 32 ++++++++++++++++++++-- 2 files changed, 40 insertions(+), 2 deletions(-) diff --git a/Koha/REST/V1/CSPReports.pm b/Koha/REST/V1/CSPReports.pm index c88f431ea9a..81676344f29 100644 --- a/Koha/REST/V1/CSPReports.pm +++ b/Koha/REST/V1/CSPReports.pm @@ -21,6 +21,7 @@ use Modern::Perl; use Mojo::Base 'Mojolicious::Controller'; +use Koha::ContentSecurityPolicy; use Koha::Logger; =head1 NAME @@ -46,6 +47,15 @@ is violated. This endpoint logs those reports for administrator review. sub add { my $c = shift->openapi->valid_input or return; + # Return HTTP 204 if CSP is disabled. + # We could return 4xx, but clients do not need to be aware of the configured + # status of this endpoint + my $csp = Koha::ContentSecurityPolicy->new; + return $c->render( + status => 204, + openapi => undef + ) if !$csp->is_enabled( { interface => 'opac' } ) && !$csp->is_enabled( { interface => 'intranet' } ); + my $logger = Koha::Logger->get( { interface => 'csp' } ); my @reports = (); diff --git a/t/db_dependent/api/v1/public/csp_reports.t b/t/db_dependent/api/v1/public/csp_reports.t index 5d290bbb8f8..9928d723d49 100755 --- a/t/db_dependent/api/v1/public/csp_reports.t +++ b/t/db_dependent/api/v1/public/csp_reports.t @@ -42,7 +42,7 @@ subtest 'add() tests' => sub { foreach my $csp_report_type ( 'report-uri', 'report-to' ) { subtest "Test $csp_report_type" => sub { - plan tests => 15; + plan tests => 17; my $content_type = $csp_report_type eq 'report-to' ? 'application/csp-report' : 'application/reports+json'; # Test with standard CSP report-uri format @@ -104,6 +104,18 @@ subtest 'add() tests' => sub { $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) ->status_is( 204, 'CSP report accepted' ); + # Correct status code should be returned if the feature is disabled + t::lib::Mocks::mock_config( + 'content_security_policy', + { opac => { csp_mode => '' } } + ); + $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) + ->status_is( 204, 'CSP report accepted' ); + t::lib::Mocks::mock_config( + 'content_security_policy', + { opac => { csp_mode => 'enabled' } } + ); + # Test with application/json content type (also valid) $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) ->status_is( 204, 'CSP report accepted with application/json content type' ); @@ -123,7 +135,7 @@ subtest 'add() tests' => sub { ->status_is( 204, 'Minimal CSP report accepted' ); subtest 'make sure log entries are being written' => sub { - plan tests => 18; + plan tests => 22; my $log4perl_conf_file = C4::Context->config('intranetdir') . '/etc/log4perl.conf'; open my $fh, '<:encoding(UTF-8)', $log4perl_conf_file or do { @@ -159,6 +171,22 @@ subtest 'add() tests' => sub { is( $appender->buffer, '', 'Nothing in log buffer yet' ); is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet' ); + # Correct status code should be returned if the feature is disabled + t::lib::Mocks::mock_config( + 'content_security_policy', + { opac => { csp_mode => '' } } + ); + $t->post_ok( + '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) + ->status_is( 204, 'CSP report accepted' ); + + is( $appender->buffer, '', 'Nothing in log buffer yet, because the feature is disabled' ); + is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet, because the feature is disabled' ); + t::lib::Mocks::mock_config( + 'content_security_policy', + { opac => { csp_mode => 'enabled' } } + ); + $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) ->status_is( 204, 'CSP report accepted' ); -- 2.39.5