From 990f9123a08f0627bc020184f67393b3b00e3056 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 3 Feb 2026 00:30:56 +0000 Subject: [PATCH] Bug 39055: Add change to Koha::App::Plugin::CSRF and fix unit test Signed-off-by: David Cook Signed-off-by: David Nind --- Koha/App/Plugin/CSRF.pm | 13 +++++++++++-- t/db_dependent/mojo/csrf.t | 24 ++++++++++++------------ 2 files changed, 23 insertions(+), 14 deletions(-) diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm index 7a59b312f5..071bff7b11 100644 --- a/Koha/App/Plugin/CSRF.pm +++ b/Koha/App/Plugin/CSRF.pm @@ -73,18 +73,27 @@ sub register { my $method = $c->req->method; if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { - my $op = $c->req->param('op'); + my $op = $c->req->param('op'); + my $login_op = $c->req->param('login_op'); if ( $op && $op =~ /^cud-/ ) { return $c->reply->exception( 'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"') ->rendered(400); + } elsif ( defined $login_op ) { + return $c->reply->exception('Incorrect use of a safe HTTP method with a `login_op` parameter') + ->rendered(400); } } else { - my $op = $c->req->param('op'); + my $op = $c->req->param('op'); + my $login_op = $c->req->param('login_op'); if ( $op && $op !~ /^cud-/ ) { return $c->reply->exception( 'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"') ->rendered(400); + } elsif ( defined $login_op && $login_op !~ /^cud-login$/ ) { + return $c->reply->exception( + 'Incorrect use of an unsafe HTTP method with a `login_op` parameter that does not contain cud-login' + )->rendered(400); } if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { diff --git a/t/db_dependent/mojo/csrf.t b/t/db_dependent/mojo/csrf.t index 4716c3fe13..cb1ba239bb 100755 --- a/t/db_dependent/mojo/csrf.t +++ b/t/db_dependent/mojo/csrf.t @@ -27,7 +27,7 @@ subtest 'CSRF - Intranet' => sub { subtest 'With a wrong CSRF token' => sub { plan tests => 3; - $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } ) + $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) ->status_is(403) ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); }; @@ -39,7 +39,7 @@ subtest 'CSRF - Intranet' => sub { my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; - $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) + $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) ->status_is(200) ->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); }; @@ -47,8 +47,8 @@ subtest 'CSRF - Intranet' => sub { subtest 'GETting what should be POSTed should fail' => sub { plan tests => 3; - $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( - qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, + $t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like( + qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; @@ -56,8 +56,8 @@ subtest 'CSRF - Intranet' => sub { subtest 'POSTing what should be GET should fail' => sub { plan tests => 3; - $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( - qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, + $t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like( + qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; @@ -82,7 +82,7 @@ subtest 'CSRF - OPAC' => sub { subtest 'With a wrong CSRF token' => sub { plan tests => 3; - $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } ) + $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) ->status_is(403) ->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); }; @@ -94,7 +94,7 @@ subtest 'CSRF - OPAC' => sub { my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; - $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) + $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) ->status_is(200) ->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); }; @@ -102,8 +102,8 @@ subtest 'CSRF - OPAC' => sub { subtest 'GETting what should be POSTed should fail' => sub { plan tests => 3; - $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( - qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, + $t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like( + qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; @@ -111,8 +111,8 @@ subtest 'CSRF - OPAC' => sub { subtest 'POSTing what should be GET should fail' => sub { plan tests => 3; - $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( - qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, + $t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like( + qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, 'Body contains correct error message' ); }; -- 2.39.5