Summary: | Koha ILSDI endpoints expect a CSRF token - so ILSDI requests fail | ||
---|---|---|---|
Product: | Koha | Reporter: | Alex Buckley <alexbuckley> |
Component: | Web services | Assignee: | Bugs List <koha-bugs> |
Status: | RESOLVED DUPLICATE | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook, fridolin.somers, jonathan.druart |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36560 | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Alex Buckley
2024-09-12 03:31:29 UTC
I am not very familiar with this code, but it seems that we have not touch ILSDI when requiring a CSRF token (which means it is still vulnerable). So the "routes" are still accessible via GET and will work (even for stateful requests). This crazy stuff gives access to a lot of data without any authentication (I always forget that). Is this maybe a duplicate to Bug 36560 - ILS-DI API doesn't have mechanism to provide CSRF tokens for POSTs ? Arf this is a problem for Bokeh portal |