As Michal Kula noted on Mattermost, trying to log into http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 in main will yield a bizarre HTTP response that includes headers for a 403 response and a 200 response... This is due to a bug in addbiblio.pl, but it's also causing the CSRF to fire for the ErrorDocument, so we need to fix that. I have an idea for it...
Created attachment 167521 [details] [review] Bug 37040: Prevent ErrorDocument subrequests from activating CSRF This change improves the mechanism for preventing the CSRF middleware being activated by ErrorDocument subrequests. This change was necessary due to a subtle issue identified by Bug 37041. Test plan: 0. Apply the patch 1. Restart Koha koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 3. Log in 4. Note that you get a pretty 403 and not an ugly plain text error 5. Go to http://localhost:8081 6. Fill in the login details, but use the HTML inspector to delete the csrf_token from the hidden inputs 7. Submit the login 8. Note a pretty 403 page
Created attachment 167560 [details] [review] Bug 37040: Prevent ErrorDocument subrequests from activating CSRF This change improves the mechanism for preventing the CSRF middleware being activated by ErrorDocument subrequests. This change was necessary due to a subtle issue identified by Bug 37041. Test plan: 0. Apply the patch 1. Restart Koha koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 3. Log in 4. Note that you get a pretty 403 and not an ugly plain text error 5. Go to http://localhost:8081 6. Fill in the login details, but use the HTML inspector to delete the csrf_token from the hidden inputs 7. Submit the login 8. Note a pretty 403 page Signed-off-by: David Nind <david@davidnind.com>
Created attachment 167571 [details] [review] Bug 37040: Prevent ErrorDocument subrequests from activating CSRF This change improves the mechanism for preventing the CSRF middleware being activated by ErrorDocument subrequests. This change was necessary due to a subtle issue identified by Bug 37041. Test plan: 0. Apply the patch 1. Restart Koha koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908 3. Log in 4. Note that you get a pretty 403 and not an ugly plain text error 5. Go to http://localhost:8081 6. Fill in the login details, but use the HTML inspector to delete the csrf_token from the hidden inputs 7. Submit the login 8. Note a pretty 403 page Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Created attachment 167572 [details] [review] Bug 37040: (QA follow-up) Tidy file QA tests were failing for tidyness so this patch addresses that Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Thanks for all the hard work! Pushed to main for the next 24.11.00 release as RM Assistant
I think this one causes the current failure in Jenkins regards cypress tests: https://jenkins.koha-community.org/job/Koha_Main/lastCompletedBuild/testReport/
(In reply to Martin Renvoize from comment #6) > I think this one causes the current failure in Jenkins regards cypress > tests: > https://jenkins.koha-community.org/job/Koha_Main/lastCompletedBuild/ > testReport/ Ah nuts. We should've grepped for "plack.middleware.Koha.CSRF" in the code. I can see it in ./errors/403.pl and ./opac/errors/403.pl Should be an easy fix...
Created attachment 167620 [details] [review] Bug 37040: (RMaint follow-up) Restore passing CSRF error This patch restores the plack.middleware.Koha.CSRF plack env setting to allow passing to the errorDocument. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Thanks, Martin. I meant to do that yesterday, but ran out of time.
*** Bug 37064 has been marked as a duplicate of this bug. ***
Backported to 24.05.x for upcoming 24.05.02
Needs rebased for 24.05.x
Bug 34478 not in 23.11.x
This looks like a bug fix, nothing to change/edit in the manual. Please reopen with more details if needed.