Koha-community/Koha - Koha - Koha: The world's first free and open source library system

Author	SHA1	Message	Date
Jonathan Druart	7d8b96803f	Bug 24545: Fix license statements Bug 9978 should have fixed them all, but some were missing. We want all the license statements part of Koha to be identical, and using the GPLv3 statement. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>	4 years ago
Josef Moravec	ee73d577ed	Bug 21998: Throw exception on bad pattern Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>	6 years ago
Marcel de Rooy	b794643bb0	Bug 21998: Add pattern parameter in Koha::Token Allow a pattern too in Koha::Token->generate. Only supported length. Does not affect CSRF calls. So tiny change without further impact. Test plan: Run t/Token.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>	6 years ago
Marcel de Rooy	7190593d9d	Bug 18124: [Follow-up] Handle default parameters in a sub Adds a internal routine to handle default values for the parameters id and secret. Also adds a parameter session_id for generate_csrf and check_csrf. This session parameter is combined with the id parameter when generating or checking a token. Test plan: Run t/Token.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	7 years ago
Jonathan Druart	3562816dd1	Bug 18124: Restrict CSRF token to user's session Currently the CSRF token generated is based on the borrowernumber, and is valid across user's session. We need to restrict the CSRF token to the current session. With this patch the CSRF token is generated concatenating the id (borrowernumber) and the CGISESSID cookie. Test plan: Run t/Token.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	7 years ago
Marcel de Rooy	6107e91f14	Bug 17110: Lower CSRF expiry in Koha::Token Default expiry in WWW:CSRF is one week. This patch sets it to 8 hours by default in Koha, and allows to change the expiry period individually by passing MaxAge. Test plan: [1] Put items in your cart. [2] Apply the example patch too. [3] Send the cart from opac within the allotted 10 seconds. [4] Send again, but wait some 10 seconds before submitting. Too late! Tested 3 patches together, works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	8 years ago
Marcel de Rooy	0fe7a4aa8e	Bug 16929: [QA Follow-up] Shortcut methods and use statements Resolves the following comments: I'd prefer to see a generate_csrf method than a CSRF flag. It'd be better to use instead of require the 2 modules. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Marc <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	8 years ago
Marcel de Rooy	523d0be9dc	Bug 16929: Prevent opac-memberentry waiting for random chars Move calls to WWW::CSRF to Koha::Token. Send a safe random string to WWW::CSRF instead of letting CSRF make a blocking call to Bytes::Random::Secure. If your server has not enough entropy, opac-memberentry will hang waiting for more characters in dev/random. Koha::Token uses Bytes::Random::Secure with the NonBlocking flag. Test plan: [1] Do not yet apply this patch. [2] If your server has not enough entropy, calling opac-memberentry may take a while. But this not may be the case for you (no worries). [3] Apply this patch. [4] Verify that opac-memberentry still works as expected. [5] Run t/Token.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Yes, my server had entropy trouble (reason for finding the problem). This patch resolves the delay. Tested all 3 patches together, works as expected. Signed-off-by: Marc <veron@veron.ch> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	8 years ago