Bug 41197

Summary: opac/opac-account-pay-return.pl should not require CSRF
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: dcook
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Nick Clemens (kidclamp) 2025-11-05 20:57:30 UTC
This page is intended for redirect/return from external payment vendors - they are not going to have/get a CSRF token from Koha for this.

The payments are handled in a POST to the API, so this should not be a sensitive page, it just provides user confirmation.

Some vendors use only a POST, we should not require CSRF on this page.
Comment 1 David Cook 2025-11-05 22:51:38 UTC
Can you run us through how this should work?

I see a reference to opac-account-pay-return.pl in "opac_online_payment_begin.tt" in dev-koha-plugin-kitchen-sink, but it looks like it is an update so it should have a CSRF token (although it's missing in the plugin version I'm looking at).