Summary: | "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP) | ||
---|---|---|---|
Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
Component: | Staff interface | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | gmcharlt, nick |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36941 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37041 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 26176 | ||
Bug Blocks: |
Description
Jonathan Druart
2024-05-23 07:14:09 UTC
I think I see the issue - we aren't getting a sessionID after the failure: 1224 if ( $ip !~ /^$domain/ ) { 1225 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( 1226 -name => 'CGISESSID', 1227 -value => '', 1228 -HttpOnly => 1, 1229 -secure => ( C4::Context->https_enabled() ? 1 : 0 ), 1230 -sameSite => 'Lax', 1231 )); 1232 $info{'wrongip'} = 1; 1233 $auth_state = "failed"; 1234 } This correctly clears (without it I can log in to any branch on subsequent try) but does not create a new session ID, not sure how to fix this one |