gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36102: If CSRF check fails, try with anonymous 

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2024-02-20 14:31:04 +01:00
parent 591646d090
commit 59470197c2
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Koha/Token.pm
View File

@ -182,7 +182,15 @@ sub check_csrf {
my ( $self, $params ) = @_;
return if !$params->{session_id};
$params = _add_default_csrf_params( $params );
return $self->check({ %$params, type => 'CSRF' });
my $c = $self->check({ %$params, type => 'CSRF' });
unless ( $c ) {
# If the check failed we need to test with the "anonymous" in case the token was generating without the user being logged in yet.
$params->{id} = DEFA_SESSION_USERID . '_' . $params->{session_id};
$c = $self->check({ %$params, type => 'CSRF' });
}
return $c;
}
=head2 check_jwt