Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/C4
History
Magnus Enger d20c9ff588
Bug 22543: Prevent "back and refresh attack" 
To reproduce and test:
- Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click "Back", you are taken to /cgi-bin/koha/opac-user.pl
- Reload the page, you see an error like "Confirm new submission
  of form"
- Reload the page again and confirm the submission of the form
- You are now logged in to the OPAC again!
- Log out again
- Apply this patch
- Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click back, you are taken to /cgi-bin/koha/opac-user.pl
- No matter how many times you reload /cgi-bin/koha/opac-user.pl,
  you should not see anything other than the login form.
- Check that Self Check Out still works as it should, by making
  sure you have a user with self_check permissions, then setting
  WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and
  AutoSelfCheckPass appropriately. Then visit
  /cgi-bin/koha/sco/sco-main.pl and verify everything works as
  expected.

The messages and errors pages you see related to resubmitting the
form might differ from the ones described here, depending on what
browser you use. I tested in Chromium 76.0.x.

This fix was originally proposed by LMSCloud:
74a7fe0f0c

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
..
AuthoritiesMarc
Barcodes Bug 21937: Syspref autoBarcode annual doesn't increment properly barcode 2019-04-19 14:32:36 +00:00
ClassSortRoutine
ClassSplitRoutine Bug 15836: Add the ability to defined custom methods to split call number in labels 2018-11-13 15:18:22 +00:00
Creators Bug 23289: Quote new 'rows' MariaDB reserved word 2019-09-06 13:17:48 +01:00
External Bug 22010: Check preferences for ebook integration 2019-04-30 11:42:51 +00:00
Form
Heading
ILSDI Bug 17247: (follow-up) Terminology fix: Use Restricted instead of debarred 2019-10-15 14:11:03 +01:00
Installer Bug 23068: (RM follow-up) Make Net::Netmask required 2019-11-06 12:12:09 +00:00
Labels Bug 22721: Remove frameworkcode parameter in GetMarcFromKohaField calls 2019-07-15 11:28:08 +01:00
Linker Bug 21450: Cache authorities search using term and auth_type 2019-05-30 10:13:38 +00:00
Members
OAI Bug 18601: OAI/Sets.t mangles data due to truncate in ModOAISetsBiblios 2017-06-13 16:18:59 -03:00
Output
Patroncards Bug 22429: Infinite loop in patron card printing 2019-03-15 11:59:28 +00:00
Reports Bug 23982: Fix the failing test 2019-11-20 09:00:17 +00:00
Search Bug 17323: Column search_history.time cannot be null 2016-11-18 13:51:37 +00:00
Serials
SIP Bug 23805: Update 'W' to 'WRITEOFF' for consistency 2019-10-24 17:35:20 +01:00
Utils
Accounts.pm Bug 23049: Capitalise type passed to add_debit for lost_item 2019-10-24 17:24:33 +01:00
Acquisition.pm Bug 24002: Incorrect DATE value: '' in C4/Acquisition.pm 2019-11-12 13:50:23 +00:00
Auth.pm Bug 22543: Prevent "back and refresh attack" 2019-11-27 11:30:18 +00:00
Auth_cas_servers.yaml.sample Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig 2016-08-08 13:16:36 +00:00
Auth_with_cas.pm Bug 19160: Add POD 2018-03-23 11:45:38 -03:00
Auth_with_ldap.pm Bug 14570: Make it possible to add multiple guarantors to a record 2019-08-20 16:04:48 +01:00
Auth_with_shibboleth.pm Bug 24065: Fail shib login if multiple users matched 2019-11-21 11:33:11 +00:00
AuthoritiesMarc.pm Bug 23933: (bug 10132 follow-up) Fix commit_file.pl 2019-11-08 12:55:03 +00:00
BackgroundJob.pm Bug 16011: $VERSION - Remove empty BEGIN block 2016-03-24 17:20:41 +00:00
Barcodes.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Biblio.pm Bug 24002: One more occurrence of datecancellationprinted 2019-11-12 13:50:27 +00:00
Bookseller.pm Bug 24002: Incorrect DATE value: '' in C4/Bookseller.pm 2019-11-12 13:50:06 +00:00
Boolean.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Breeding.pm
Budgets.pm Bug 10577: (QA follow-up) Remove tab chars 2019-03-28 12:46:14 +00:00
Calendar.pm Bug 14572 - insert_single_holiday() forces a value on an AUTO_INCREMENT column, during an INSERT 2017-07-06 14:29:04 -03:00
Charset.pm Bug 22721: Remove frameworkcode parameter in GetMarcFromKohaField calls 2019-07-15 11:28:08 +01:00
Circulation.pm Bug 24013: Fix transferbook if item is checked out 2019-11-25 08:38:10 +00:00
ClassSortRoutine.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
ClassSource.pm Bug 15836: Remove deprecated subroutines 2018-11-13 18:56:18 +00:00
ClassSplitRoutine.pm Bug 15836: Add the ability to defined custom methods to split call number in labels 2018-11-13 15:18:22 +00:00
Context.pm Bug 23068: Add ability for Koha to handle X-Forwarded-For headers so REMOTE_ADDR features work behind a proxy 2019-10-31 16:10:17 +00:00
Contract.pm
CourseReserves.pm Bug 22142: Do not revert data if 'unchanged' was set 2019-08-13 11:22:13 +01:00
Creators.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Debug.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Heading.pm Bug 21826: Remove strict and warning from Heading.pm 2019-01-25 20:13:41 +00:00
HoldsQueue.pm Bug 11529: (RM follow-up) Fix missing comma in query 2019-08-05 17:25:08 +01:00
HTML5Media.pm Bug 21742: Fix YouTube variable propagation 2018-11-01 18:59:33 +00:00
Images.pm Revert "Bug 21987: Do not generate true color thumbnails if not needed" 2019-11-04 13:21:53 +00:00
ImportBatch.pm Bug 18757: Problem when importing only items in MARC records 2019-10-29 12:17:38 +00:00
ImportExportFramework.pm Bug 18143: Silence ods MARC framework export flood 2019-02-19 13:52:15 +00:00
InstallAuth.pm Bug 21137: Replace USER_INFO with logged_in_user 2018-08-14 12:43:10 +00:00
Installer.pm Bug 23805: Add account_credit_types tables 2019-10-24 17:35:19 +01:00
ItemCirculationAlertPreference.pm
Items.pm Bug 24030: Fix GetItemsForInventory under MySQL 8 2019-11-13 13:25:28 +00:00
Koha.pm Bug 23768: Return invalid ISBN when searching with variations 2019-11-07 13:02:47 +00:00
Labels.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Languages.pm
Letters.pm Bug 23765: Do not display localized templates if TranslateNotices is off 2019-11-13 13:36:45 +00:00
Linker.pm Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Log.pm Bug 22600: Add 'interface' to accountlines 2019-04-10 19:43:11 +00:00
MarcModificationTemplates.pm Bug 21831: Allow move all fields even if destination field is different 2019-05-23 14:50:57 +00:00
Matcher.pm Bug 23324: Add an ISBN normalization routine 2019-08-16 12:26:48 +01:00
Members.pm Bug 14570: Make it possible to add multiple guarantors to a record 2019-08-20 16:04:48 +01:00
Message.pm Bug 21206: Replace C4::Items::GetItem 2019-02-26 13:24:07 +00:00
NewsChannels.pm Bug 24002: Incorrect DATE value: '00-00-0000' in NewsChannels.pm 2019-11-12 13:49:58 +00:00
Output.pm Bug 23117: Shortcut additem.pl on nonexistent biblionumber 2019-06-15 08:01:37 +01:00
Overdues.pm Bug 24075: Backdating a return to the exact due date and time results in the fine not being refunded 2019-11-22 15:08:21 +00:00
Patroncards.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Print.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Record.pm
Reports.pm
Reserves.pm Bug 23964: (follow-up) We should check for only active holds when determining to set waiting 2019-11-25 16:38:16 +00:00
Ris.pm
RotatingCollections.pm Bug 16011: $VERSION - Remove comments 2016-03-24 17:20:29 +00:00
Scheduler.pm
Scrubber.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
Search.pm Bug 23663: Only process itemtype summary if using non-xslt opac results 2019-10-29 12:17:43 +00:00
Serials.pm Bug 24002: Incorrect DATE value: '00-00-0000' in C4/Serials.pm 2019-11-12 13:50:17 +00:00
Service.pm
ShelfBrowser.pm Bug 22445: Custom cover images - opac shelfbrowser 2019-10-22 15:02:48 +01:00
SMS.pm
SocialData.pm Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
Stats.pm Bug 21683: Remove accountlines.accountno 2019-03-21 18:19:22 +00:00
Suggestions.pm Bug 18743: Correct number of pending suggestions (acq home page) 2019-10-25 13:16:49 +01:00
Tags.pm
Templates.pm Bug 20538: Remove the need of writing [% KOHA_VERSION %] everywhere 2018-04-13 11:49:44 -03:00
TmplToken.pm
TmplTokenType.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
TTParser.pm Bug 14383: C4: Fix some typos (mostly in comments and documentation) 2015-06-22 17:34:45 -03:00
UsageStats.pm Bug 23697: (QA follow-up) Rename PatronAutocompletion to PatronAutoComplete 2019-10-08 14:51:12 +01:00
XISBN.pm Bug 12537: Don't retrieve XISBN results for the same biblionumber 2019-07-15 11:27:59 +01:00
XSLT.pm Bug 23414: Use effective_itemtype 2019-11-06 17:14:32 +00:00