Bug 39305 - About page must warn if Plack is not running
Summary: About page must warn if Plack is not running
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Baptiste Wojtkowski (bwoj)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-11 14:27 UTC by Jonathan Druart
Modified: 2025-03-13 09:30 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00
Circulation function:


Attachments
Bug 39305: Display a warning on the about page if Plack is not running (2.00 KB, patch)
2025-03-11 14:32 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 39305: Display a warning on the about page if Plack is not running (2.05 KB, patch)
2025-03-11 20:26 UTC, David Nind
Details | Diff | Splinter Review
Bug 39305: Adjust wording (1.18 KB, patch)
2025-03-12 08:20 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 39305: Adjust wording (1.24 KB, patch)
2025-03-12 15:11 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 39305: Display a warning on the about page if Plack is not running (2.11 KB, patch)
2025-03-12 15:11 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review
Bug 39305: Adjust wording (1.24 KB, patch)
2025-03-12 15:11 UTC, Baptiste Wojtkowski (bwoj)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2025-03-11 14:27:59 UTC
CSRF protection is only working if Koha is running under Plack.

The about page is not showing any errors if plack is not running.
Comment 1 Jonathan Druart 2025-03-11 14:32:50 UTC
Created attachment 179168 [details] [review]
Bug 39305: Display a warning on the about page if Plack is not running

CSRF protection is only working if Koha is running under Plack.

The about page is not showing any errors if plack is not running.

Test plan:
0. Do not apply this patch
1. Go to the about page
=> Notice the "PSGI" entry in the "Server information" tab
2. Disable plack
koha-plack --disable kohadev && restart_all
3. Go to the about page
=> Notice that the "PSGI" entry is not displayed, and nothing indicates
that plack is not running
4. Apply this patch
=> "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help"

Better wording idea welcome.
Comment 2 David Nind 2025-03-11 20:26:38 UTC
Created attachment 179188 [details] [review]
Bug 39305: Display a warning on the about page if Plack is not running

CSRF protection is only working if Koha is running under Plack.

The about page is not showing any errors if plack is not running.

Test plan:
0. Do not apply this patch
1. Go to the about page
=> Notice the "PSGI" entry in the "Server information" tab
2. Disable plack
koha-plack --disable kohadev && restart_all
3. Go to the about page
=> Notice that the "PSGI" entry is not displayed, and nothing indicates
that plack is not running
4. Apply this patch
=> "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help"

Better wording idea welcome.

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 David Nind 2025-03-11 20:40:21 UTC
Testing notes (Using KTD):

1. For step 2, sudo koha-plack --disable kohadev && restart_all

Wording suggestion - an attempt, not great, but I think we should try and explain what the security issue is:

Koha is running in CGI mode. This is a security issue! Run Koha using Plack for CSRF (cross-site request forgery) protection. More information: koha-plack --help
Comment 4 David Cook 2025-03-11 23:01:54 UTC
I think that this is a step in the right direction, although I've been wondering if we should disable CGI all together (with the exception of the scripts that have to have it for now).

That is, detecting its in CGI mode, and then throwing up a page that says Maintenance Mode or something with an error in the logs to say that they need to enable Plack.
Comment 5 Jonathan Druart 2025-03-12 08:17:49 UTC
(In reply to David Cook from comment #4)
> I think that this is a step in the right direction, although I've been
> wondering if we should disable CGI all together (with the exception of the
> scripts that have to have it for now).
> 
> That is, detecting its in CGI mode, and then throwing up a page that says
> Maintenance Mode or something with an error in the logs to say that they
> need to enable Plack.

Yes, that was the first idea. But it was not that trivial, and I was sure we already had a red warning on the about page: we don't!

This is an easy one to backport, and we can adjust the behaviour on a separate bug for a major release.
Comment 6 Jonathan Druart 2025-03-12 08:20:31 UTC
Created attachment 179194 [details] [review]
Bug 39305: Adjust wording
Comment 7 Baptiste Wojtkowski (bwoj) 2025-03-12 10:37:47 UTC
Works perfectly fine, qa tools pass.

Shouldn't we add a sentence like: "please contact your system administrator" and a link toward the CSRF bugzilla page ?
Comment 8 Jonathan Druart 2025-03-12 13:53:08 UTC
(In reply to Baptiste Wojtkowski (bwoj) from comment #7)
> Works perfectly fine, qa tools pass.
> 
> Shouldn't we add a sentence like: "please contact your system administrator"
> and a link toward the CSRF bugzilla page ?

Letting that to QA and RM but for me it's good as it.
Comment 9 Baptiste Wojtkowski (bwoj) 2025-03-12 15:11:36 UTC
Created attachment 179211 [details] [review]
Bug 39305: Adjust wording

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 10 Baptiste Wojtkowski (bwoj) 2025-03-12 15:11:55 UTC
Created attachment 179212 [details] [review]
Bug 39305: Display a warning on the about page if Plack is not running

CSRF protection is only working if Koha is running under Plack.

The about page is not showing any errors if plack is not running.

Test plan:
0. Do not apply this patch
1. Go to the about page
=> Notice the "PSGI" entry in the "Server information" tab
2. Disable plack
koha-plack --disable kohadev && restart_all
3. Go to the about page
=> Notice that the "PSGI" entry is not displayed, and nothing indicates
that plack is not running
4. Apply this patch
=> "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help"

Better wording idea welcome.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 11 Baptiste Wojtkowski (bwoj) 2025-03-12 15:11:58 UTC
Created attachment 179213 [details] [review]
Bug 39305: Adjust wording

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 12 Katrin Fischer 2025-03-13 09:16:35 UTC
Wording seems OK to me. Thanks!
Comment 13 Katrin Fischer 2025-03-13 09:30:27 UTC
Pushed for 25.05!

Well done everyone, thank you!