| Summary: | Koha ILSDI endpoints expect a CSRF token - so ILSDI requests fail | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Alex Buckley <alexbuckley> |
| Component: | Web services | Assignee: | Bugs List <koha-bugs> |
| Status: | RESOLVED DUPLICATE | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dcook, fridolin.somers, jonathan.druart |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36560 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Alex Buckley
2024-09-12 03:31:29 UTC
I am not very familiar with this code, but it seems that we have not touch ILSDI when requiring a CSRF token (which means it is still vulnerable). So the "routes" are still accessible via GET and will work (even for stateful requests). This crazy stuff gives access to a lot of data without any authentication (I always forget that). Is this maybe a duplicate to Bug 36560 - ILS-DI API doesn't have mechanism to provide CSRF tokens for POSTs ? Arf this is a problem for Bokeh portal |