From 0fe82b601b4b06ce0e9fcc5ca677810886f26717 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Wed, 21 Feb 2024 06:17:50 +0000
Subject: [PATCH] Bug 36084: Add CSRF token support to svc/authentication

GET svc/authentication will return a CSRF token in a response header

POST svc/authentication requires a CSRF token which can be sourced
from the response header of GET svc/authentication or some other
place like the meta element on a HTML page

Note: misc/migration_tools/koha-svc.pl is a simple script which
can be used to practically evaluate svc/authentication and svc/bib

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 C4/Auth.pm                       |  2 +-
 misc/migration_tools/koha-svc.pl | 16 ++++++++++++++--
 svc/authentication               | 30 ++++++++++++++++++++++--------
 3 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 156626e488..d1a8235b56 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1602,7 +1602,7 @@ sub check_api_auth {
     }
 
     my ( $sessionID, $session );
-    unless ( $query->param('userid') ) {
+    unless ( $query->param('login_userid') ) {
         $sessionID = $query->cookie("CGISESSID");
     }
     if ( $sessionID && not( $cas && $query->param('PT') ) ) {
diff --git a/misc/migration_tools/koha-svc.pl b/misc/migration_tools/koha-svc.pl
index 36e275d112..1b749d9559 100755
--- a/misc/migration_tools/koha-svc.pl
+++ b/misc/migration_tools/koha-svc.pl
@@ -104,7 +104,15 @@ sub new {
 
     my $ua = LWP::UserAgent->new();
     $ua->cookie_jar({});
-    my $resp = $ua->post( "$url/authentication", {userid =>$user, password => $password} );
+
+    my $get_resp   = $ua->get("$url/authentication");
+    my $csrf_token = $get_resp->header('X-CSRF-TOKEN');
+    $self->{csrf_token} = $csrf_token;
+
+    my $resp = $ua->post(
+        "$url/authentication",
+        { login_userid => $user, login_password => $password, csrf_token => $csrf_token }
+    );
     die $resp->status_line unless $resp->is_success;
 
     warn "# $user $url = ", $resp->decoded_content, "\n" if $self->{debug};
@@ -140,7 +148,11 @@ sub post {
     my ($self,$biblionumber,$marcxml) = @_;
     my $url = $self->{url};
     warn "# post $url/bib/$biblionumber\n" if $self->{debug};
-    my $resp = $self->{ua}->post( "$url/bib/$biblionumber", 'Content_type' => 'text/xml', Content => $marcxml );
+    my $csrf_token = $self->{csrf_token};
+    my $resp       = $self->{ua}->post(
+        "$url/bib/$biblionumber", 'Content_type' => 'text/xml', Content => $marcxml,
+        csrf_token => $csrf_token
+    );
     die $resp->status_line unless $resp->is_success;
     return $resp->decoded_content;
 }
diff --git a/svc/authentication b/svc/authentication
index d375a11b01..409c2832c1 100755
--- a/svc/authentication
+++ b/svc/authentication
@@ -21,7 +21,7 @@
 use Modern::Perl;
 
 use CGI qw ( -utf8 );
-use C4::Auth qw/check_api_auth/;
+use C4::Auth qw/check_api_auth get_session/;
 use XML::Simple;
 
 my $query = CGI->new;
@@ -41,12 +41,26 @@ my $query = CGI->new;
 # 3. The session cookie should not be (directly) sent back to the user's
 # web browser, but instead should be stored and submitted by biblios.
 
-
-my ($status, $cookie, $sessionID) = check_api_auth($query, { editcatalogue => 'edit_catalogue'} );
-
-if ($status eq "ok") {
-    print $query->header(-type => 'text/xml', cookie => $cookie);
+my $csrf_token;
+my ( $status, $cookie, $sessionID ) = check_api_auth( $query, { editcatalogue => 'edit_catalogue' } );
+if ( $status eq "ok" ) {
+    $csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } );
 } else {
-    print $query->header(-type => 'text/xml');
+    my $session = C4::Auth::get_session("");
+    $session->param( 'ip',          $session->remote_addr() );
+    $session->param( 'lasttime',    time() );
+    $session->param( 'sessiontype', 'anon' );
+    $session->param( 'interface',   'api' );
+    $session->flush();
+    $sessionID = $session->id();
+    $cookie    = $query->cookie(
+        -name     => 'CGISESSID',
+        -value    => $sessionID,
+        -HttpOnly => 1,
+        -secure   => ( C4::Context->https_enabled() ? 1 : 0 ),
+        -sameSite => 'Lax'
+    );
+    $csrf_token = Koha::Token->new->generate_csrf( { session_id => scalar $sessionID } );
 }
-print XMLout({ status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1);
+print $query->header( -type => 'text/xml', cookie => $cookie, -'X-CSRF_TOKEN' => $csrf_token );
+print XMLout( { status => $status }, NoAttr => 1, RootName => 'response', XMLDecl => 1 );
-- 
2.20.1