| Summary: | ErrorDocument accidentally setting off CSRF | ||
|---|---|---|---|
| Product: | Koha | Reporter: | David Cook <dcook> |
| Component: | Architecture, internals, and plumbing | Assignee: | David Cook <dcook> |
| Status: | RESOLVED FIXED | QA Contact: | Matt Blenkinsop <matt.blenkinsop> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | caroline.cyr-la-rose, david, fridolin.somers, lucas, matt.blenkinsop, nick |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37041 | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: |
This improves the mechanism for preventing the activation of CSRF middleware by ErrorDocument subrequests. For example, a properly formatted 403 error page is now displayed instead of a plain text error. (This is related to the CSRF changes added in Koha 24.05 to improve form security.)
|
Version(s) released in: |
24.11.00,24.05.02
|
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 34478, 36192 | ||
| Attachments: |
Bug 37040: Prevent ErrorDocument subrequests from activating CSRF
Bug 37040: Prevent ErrorDocument subrequests from activating CSRF Bug 37040: Prevent ErrorDocument subrequests from activating CSRF Bug 37040: (QA follow-up) Tidy file Bug 37040: (RMaint follow-up) Restore passing CSRF error |
||
|
Description
David Cook
2024-06-06 00:53:27 UTC
Created attachment 167521 [details] [review] Bug 37040: Prevent ErrorDocument subrequests from activating CSRF This change improves the mechanism for preventing the CSRF middleware being activated by ErrorDocument subrequests. This change was necessary due to a subtle issue identified by Bug 37041. Test plan: 0. Apply the patch 1. Restart Koha koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 3. Log in 4. Note that you get a pretty 403 and not an ugly plain text error 5. Go to http://localhost:8081 6. Fill in the login details, but use the HTML inspector to delete the csrf_token from the hidden inputs 7. Submit the login 8. Note a pretty 403 page Created attachment 167560 [details] [review] Bug 37040: Prevent ErrorDocument subrequests from activating CSRF This change improves the mechanism for preventing the CSRF middleware being activated by ErrorDocument subrequests. This change was necessary due to a subtle issue identified by Bug 37041. Test plan: 0. Apply the patch 1. Restart Koha koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 3. Log in 4. Note that you get a pretty 403 and not an ugly plain text error 5. Go to http://localhost:8081 6. Fill in the login details, but use the HTML inspector to delete the csrf_token from the hidden inputs 7. Submit the login 8. Note a pretty 403 page Signed-off-by: David Nind <david@davidnind.com> Created attachment 167571 [details] [review] Bug 37040: Prevent ErrorDocument subrequests from activating CSRF This change improves the mechanism for preventing the CSRF middleware being activated by ErrorDocument subrequests. This change was necessary due to a subtle issue identified by Bug 37041. Test plan: 0. Apply the patch 1. Restart Koha koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 3. Log in 4. Note that you get a pretty 403 and not an ugly plain text error 5. Go to http://localhost:8081 6. Fill in the login details, but use the HTML inspector to delete the csrf_token from the hidden inputs 7. Submit the login 8. Note a pretty 403 page Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Created attachment 167572 [details] [review] Bug 37040: (QA follow-up) Tidy file QA tests were failing for tidyness so this patch addresses that Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant I think this one causes the current failure in Jenkins regards cypress tests: https://jenkins.koha-community.org/job/Koha_Main/lastCompletedBuild/testReport/ (In reply to Martin Renvoize from comment #6) > I think this one causes the current failure in Jenkins regards cypress > tests: > https://jenkins.koha-community.org/job/Koha_Main/lastCompletedBuild/ > testReport/ Ah nuts. We should've grepped for "plack.middleware.Koha.CSRF" in the code. I can see it in ./errors/403.pl and ./opac/errors/403.pl Should be an easy fix... Created attachment 167620 [details] [review] Bug 37040: (RMaint follow-up) Restore passing CSRF error This patch restores the plack.middleware.Koha.CSRF plack env setting to allow passing to the errorDocument. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Thanks, Martin. I meant to do that yesterday, but ran out of time. *** Bug 37064 has been marked as a duplicate of this bug. *** Backported to 24.05.x for upcoming 24.05.02 Needs rebased for 24.05.x Bug 34478 not in 23.11.x This looks like a bug fix, nothing to change/edit in the manual. Please reopen with more details if needed. |