Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 34755: Backport Koha::Token change from bug 34478

Browse source 
This change includes the Koha::Token changes which uses
Koha::Session for generating and checking CSRF tokens.

0. Apply the patch and koha-plack --restart kohadev
1. Setup Keycloak OIDC SSO according to "Testing SSO"
wiki guide
2. In a regular window go to http://localhost:8080
3. In a private window go to http://localhost:8080 and click
the SSO "Log in with..." button, but don't log into Keycloak
4. In the regular window, login locally, and navigate to 5-6 pages
5. In the private window, log into Keycloak
6. Note that you are redirected back to Koha and logged in
successfully (no wrong_csrf_token error).

Signed-off-by: Olivier Hubert <olivier.hubert@inlibro.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This commit is contained in:
David Cook 2024-03-04 04:19:38 +00:00 committed by Fridolin Somers
parent 97026a069d
commit 46c0419a11
1 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
Koha/Token.pm
View file

@ -57,6 +57,8 @@ use Digest::MD5 qw( md5_base64 );
use Encode;
use C4::Context;
use Koha::Exceptions::Token;
use Koha::Session;
use base qw(Class::Accessor);
use constant HMAC_SHA1_LENGTH => 20;
use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days..
@ -215,11 +217,17 @@ sub decode_jwt {
sub _add_default_csrf_params {
my ( $params ) = @_;
$params->{session_id} //= DEFA_SESSION_ID;
my $userenv = C4::Context->userenv;
if ( ( !$userenv ) || !$userenv->{id} ) {
$userenv = { id => DEFA_SESSION_USERID };
my $id;
my $session = Koha::Session->get_session( { sessionID => $params->{session_id} } );
if ($session) {
$id = $session->param('id');
}
$params->{id} //= Encode::encode( 'UTF-8', $userenv->{id} );
if ( !$id ) {
$id = DEFA_SESSION_USERID;
}
$params->{id} //= Encode::encode( 'UTF-8', $id );
$params->{id} .= '_' . $params->{session_id};
my $pw = C4::Context->config('pass');