Bug 36934 - "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
Summary: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 26176
Blocks: 36941
  Show dependency treegraph
 
Reported: 2024-05-23 07:14 UTC by Jonathan Druart
Modified: 2024-05-23 10:38 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2024-05-23 07:14:09 UTC
Found when testing StaffLoginRestrictBranchByIP:

* Turn on StaffLoginRestrictBranchByIP
* Set CPL's IP to 1.2.3.4
* Go to the staff login screen and try to connect to CPL
=> Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK)
* Pick another library
=> 403 (KO)
Comment 1 Nick Clemens (kidclamp) 2024-05-23 10:38:24 UTC
I think I see the issue - we aren't getting a sessionID after the failure:

1224                             if ( $ip !~ /^$domain/ ) {
1225                                 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
1226                                     -name     => 'CGISESSID',
1227                                     -value    => '',
1228                                     -HttpOnly => 1,
1229                                     -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1230                                     -sameSite => 'Lax',
1231                                 ));
1232                                 $info{'wrongip'} = 1;
1233                                 $auth_state = "failed";
1234                             }

This correctly clears (without it I can log in to any branch on subsequent try) but does not create a new session ID, not sure how to fix this one