gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 39055: Fix login condition when using op and login_op 

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
David Cook 2026-02-03 05:52:58 +00:00 committed by Martin Renvoize
parent 137b41c510
commit 2691d566ed
No known key found for this signature in database
GPG Key ID: 2D86E0EAEC83711B
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Koha/App/Plugin/CSRF.pm
View File

@ -86,7 +86,7 @@ sub register {
} else {
my $op = $c->req->param('op');
my $login_op = $c->req->param('login_op');
if ( $op && $op !~ /^cud-/ ) {
if ( ( $op && $op !~ /^cud-/ ) && !$login_op ) {
return $c->reply->exception(
'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
->rendered(400);

2
Koha/Middleware/CSRF.pm
View File

@ -74,7 +74,7 @@ sub call {
# Get the CSRF token from the param list or the header
my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) {
$error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
$request_method, $uri, $referer;
} elsif ( defined $req->param('login_op') && $req->param('login_op') !~ m/^cud-login$/ ) {