gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/Koha/REST/V1
History
Tomás Cohen Arazi 9eaeae69e5
Bug 42719: Handle missing CGISESSID in OAuth login (IdP-initiated flow) 
When a user initiates login from the IdP (e.g. Okta app tile), they
hit the OAuth endpoint without an existing session cookie. The code
crashed calling ->value on an undefined cookie object.

This patch:
- Removes the premature 'No user session found' guard that blocked
  IdP-initiated flows entirely
- Creates a session on-the-fly for the initial request when no
  cookie exists (IdP-initiated flow)
- On callback, redirects with wrong_csrf_token error instead of
  crashing when the cookie is missing

CSRF protection is preserved: the state token is bound to the
session created in the initial request, and the browser returns
the cookie on callback for validation.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
 		2026-09-25 12:08:45 +00:00
..
Acquisitions Bug 29668: Adapt to current guidelines 2026-01-21 15:28:16 -07:00
Auth Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Biblios Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
CashRegisters Bug 40445: Add configuration options and UI enhancements 2026-07-27 12:12:36 +00:00
Clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Config Bug 22639: Add GET /config/search_mappings endpoint 2026-04-15 11:37:17 -06:00
ERM Bug 42130: ERM - Index biblio when local title is created/updated 2026-06-05 14:25:54 +00:00
ILL Bug 37762: (QA follow-up): Warn and return 500 on schema validation failure in progress_request 2026-05-15 08:11:12 -06:00
OAuth Bug 42719: Handle missing CGISESSID in OAuth login (IdP-initiated flow) 2026-09-25 12:08:45 +00:00
Patrons Bug 39658: API: Add REST endpoints for patron account links 2026-09-09 12:07:27 +00:00
Preservation Bug 37622: Remove location from 2 preservation 'update' routes 2025-09-26 10:36:53 -06:00
SIP2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
StockRotation Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ActionLogs.pm Bug 29016: (QA follow-up) Document the action_logs list controller 2026-05-05 13:42:11 -06:00
AdditionalContents.pm Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
AdvancedEditorMacro.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ArticleRequests.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Auth.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
AuthorisedValueCategories.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
AuthorisedValues.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Authorities.pm Bug 41901: Allow duplicate check when adding authority via API 2026-04-29 09:09:12 -06:00
BackgroundJobs.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Biblios.pm Bug 39337: Add is_opac_suppressed helper to C4::Context 2026-08-25 08:56:25 +00:00
Bookings.pm Bug 41898: Introduce 'issued' status and update booking display/filtering 2026-07-27 15:53:33 +00:00
CSPReports.pm Bug 38365: Make swagger-cli happy 2026-03-16 11:57:37 +01:00
Checkouts.pm Bug 23909: Apply hold policy to OPAC REST self-checkout 2026-05-01 11:04:20 -06:00
CirculationRules.pm Bug 10190: (QA follow-up): fixes phase five 2026-09-21 16:07:39 +00:00
Cities.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
DeletedBiblios.pm Bug 17387: (follow-up) fix embed items on get deleted biblio 2026-04-15 14:10:28 -06:00
DeletedItems.pm Bug 17387: (follow-up) address review feedback 2026-04-15 14:10:27 -06:00
ERM.pm Bug 39320: Preparation: ERM counts API endpoint 2026-01-13 15:03:20 -07:00
ExtendedAttributeTypes.pm Bug 39438: (bug 38446 follow-up) Add agreement_period to /erm/extended_attribute_types 2026-01-30 10:54:11 -07:00
Holds.pm Bug 41801: (QA follow-up) Ensure toggling priority sets correct rank 2026-03-21 20:28:16 +00:00
ILL.pm Bug 42845: Add ILL config endpoint for Vue app 2026-07-27 15:53:48 +00:00
ImportBatchProfiles.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ImportRecordMatches.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ItemTypes.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Items.pm Bug 40154: prevent deletion of items with holds 2026-02-10 10:52:04 -07:00
Libraries.pm Bug 42310: (follow-up) Move Koha::Calendar tree under Koha::Library::Calendar 2026-09-15 16:14:02 +00:00
Lists.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
OAuth.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Patrons.pm Bug 42679: Add GET /patrons/{patron_id}/overdues_count endpoint 2026-09-11 16:05:56 +00:00
Preservation.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Quotes.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
RecordSources.pm Bug 35380: Change record sources to by systemdefined 2026-03-26 09:46:15 +01:00
ReturnClaims.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
SearchFilter.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Static.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Status.pm Bug 41107: Add /status/version API endpoint 2026-03-23 09:33:54 +01:00
Suggestions.pm Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
Sysprefs.pm Bug 41994: Implement /sysprefs route to list system preferences 2026-04-15 11:37:05 -06:00
Tickets.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TransferLimits.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Transfers.pm Bug 31391: (QA follow-up) Fix UseRecalls check in Transfers REST controller 2026-09-15 14:45:14 +00:00
TwoFactorAuth.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00