| Summary: | "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP) | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
| Component: | Staff interface | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | gmcharlt, nick |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36941 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37041 |
||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 26176 | ||
| Bug Blocks: | |||
|
Description
Jonathan Druart
2024-05-23 07:14:09 UTC
I think I see the issue - we aren't getting a sessionID after the failure:
1224 if ( $ip !~ /^$domain/ ) {
1225 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
1226 -name => 'CGISESSID',
1227 -value => '',
1228 -HttpOnly => 1,
1229 -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1230 -sameSite => 'Lax',
1231 ));
1232 $info{'wrongip'} = 1;
1233 $auth_state = "failed";
1234 }
This correctly clears (without it I can log in to any branch on subsequent try) but does not create a new session ID, not sure how to fix this one
|