Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 37553: Use CSRF token for authenicated session for POSTing

Browse source 
This change fixes the Koha::SVC to store the CSRF token for
the authenticated session for further POSTing.

Test plan:
0. Apply the patch
1. perl ./misc/migration_tools/koha-svc.pl \
    http://localhost:8081/cgi-bin/koha/svc koha koha 29 > bib-29.xml
2. perl ./misc/migration_tools/koha-svc.pl \
    http://localhost:8081/cgi-bin/koha/svc koha koha 29 bib-29.xml
3. Note that the following appears in STDOUT and there is no 403 error:
"update 29 from bib-29.xml"

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
David Cook 2024-08-02 01:37:40 +00:00 committed by Katrin Fischer
parent 6c6982b983
commit eabd792ee9
Signed by: kfischer
GPG key ID: 0EF6E2C03357A834
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
misc/migration_tools/koha-svc.pl
View file

@ -107,7 +107,6 @@ sub new {
my $get_resp = $ua->get("$url/authentication");
my $csrf_token = $get_resp->header('CSRF-TOKEN');
$self->{csrf_token} = $csrf_token;
my $resp = $ua->post(
"$url/authentication",
@ -115,6 +114,10 @@ sub new {
);
die $resp->status_line unless $resp->is_success;
#NOTE: A successful authentication means we have a new CGISESSID and a new CSRF Token
$csrf_token = $resp->header('CSRF-TOKEN');
$self->{csrf_token} = $csrf_token;
warn "# $user $url = ", $resp->decoded_content, "\n" if $self->{debug};
$self->{ua} = $ua;