CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running.
Created attachment 179168 [details] [review] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome.
Created attachment 179188 [details] [review] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome. Signed-off-by: David Nind <david@davidnind.com>
Testing notes (Using KTD): 1. For step 2, sudo koha-plack --disable kohadev && restart_all Wording suggestion - an attempt, not great, but I think we should try and explain what the security issue is: Koha is running in CGI mode. This is a security issue! Run Koha using Plack for CSRF (cross-site request forgery) protection. More information: koha-plack --help
I think that this is a step in the right direction, although I've been wondering if we should disable CGI all together (with the exception of the scripts that have to have it for now). That is, detecting its in CGI mode, and then throwing up a page that says Maintenance Mode or something with an error in the logs to say that they need to enable Plack.
(In reply to David Cook from comment #4) > I think that this is a step in the right direction, although I've been > wondering if we should disable CGI all together (with the exception of the > scripts that have to have it for now). > > That is, detecting its in CGI mode, and then throwing up a page that says > Maintenance Mode or something with an error in the logs to say that they > need to enable Plack. Yes, that was the first idea. But it was not that trivial, and I was sure we already had a red warning on the about page: we don't! This is an easy one to backport, and we can adjust the behaviour on a separate bug for a major release.
Created attachment 179194 [details] [review] Bug 39305: Adjust wording
Works perfectly fine, qa tools pass. Shouldn't we add a sentence like: "please contact your system administrator" and a link toward the CSRF bugzilla page ?
(In reply to Baptiste Wojtkowski (bwoj) from comment #7) > Works perfectly fine, qa tools pass. > > Shouldn't we add a sentence like: "please contact your system administrator" > and a link toward the CSRF bugzilla page ? Letting that to QA and RM but for me it's good as it.
Created attachment 179211 [details] [review] Bug 39305: Adjust wording Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Created attachment 179212 [details] [review] Bug 39305: Display a warning on the about page if Plack is not running CSRF protection is only working if Koha is running under Plack. The about page is not showing any errors if plack is not running. Test plan: 0. Do not apply this patch 1. Go to the about page => Notice the "PSGI" entry in the "Server information" tab 2. Disable plack koha-plack --disable kohadev && restart_all 3. Go to the about page => Notice that the "PSGI" entry is not displayed, and nothing indicates that plack is not running 4. Apply this patch => "PSGI" now shows "Koha is running in CGI mode. This is a security issue! Use koha-plack --help" Better wording idea welcome. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Created attachment 179213 [details] [review] Bug 39305: Adjust wording Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Wording seems OK to me. Thanks!
Pushed for 25.05! Well done everyone, thank you!