]> git.koha-community.org Git - koha.git/commit
Bug 21325: Prevent authentication when sending userid and password in querystring
authorDavid Cook <dcook@prosentient.com.au>
Thu, 24 Dec 2020 01:24:08 +0000 (01:24 +0000)
committerJonathan Druart <jonathan.druart@bugs.koha-community.org>
Fri, 16 Apr 2021 11:56:46 +0000 (13:56 +0200)
commitda9006b20dc7439259043822902e05d392df7351
treee03470afb016788264fb0474a9b3587a2992046c
parent99c3b9ae1f55066f4fd2bd0e37ba336f18592780
Bug 21325: Prevent authentication when sending userid and password in querystring

This patch permits authentication via userid/password only when the
HTTP method is POST when using C4::Auth::checkauth().

The goal is to stop people from supplying userid and password in querystrings
in order to log into web pages.

Test plan:
0. Do not apply patch yet
1. Open a new browser (ie we don't want any existing CGISESSID cookies
available - opening a new tab/window isn't enough. It must be a
new instance or you can clear your cookies)
2. Go to http://localhost:8080/cgi-bin/koha/opac-reserve.pl?biblionumber=29&userid=koha&password=koha
3. Note the user has been logged in and is being asked to confirm hold.

4. Apply the patch

5. Go to http://localhost:8080/cgi-bin/koha/opac-reserve.pl?biblionumber=29&userid=koha&password=koha
6. Note the user is not logged in and the user is presented with a login screen

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
C4/Auth.pm