Bug 36934

Summary: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: Staff interfaceAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: gmcharlt, nick
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 26176    
Bug Blocks: 36941    

Description Jonathan Druart 2024-05-23 07:14:09 UTC
Found when testing StaffLoginRestrictBranchByIP:

* Turn on StaffLoginRestrictBranchByIP
* Set CPL's IP to 1.2.3.4
* Go to the staff login screen and try to connect to CPL
=> Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK)
* Pick another library
=> 403 (KO)
Comment 1 Nick Clemens (kidclamp) 2024-05-23 10:38:24 UTC
I think I see the issue - we aren't getting a sessionID after the failure:

1224                             if ( $ip !~ /^$domain/ ) {
1225                                 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
1226                                     -name     => 'CGISESSID',
1227                                     -value    => '',
1228                                     -HttpOnly => 1,
1229                                     -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1230                                     -sameSite => 'Lax',
1231                                 ));
1232                                 $info{'wrongip'} = 1;
1233                                 $auth_state = "failed";
1234                             }

This correctly clears (without it I can log in to any branch on subsequent try) but does not create a new session ID, not sure how to fix this one