<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Hi all,</div>
<div> </div>
<div>please remember to file security bugs in the non-public area of bugzilla and also be careful with the discussion here:</div>
<div>https://koha-community.org/security/ (we should probably update the list of names)</div>
<div> </div>
<div>Katrin</div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Montag, 20. März 2017 um 12:27 Uhr<br/>
<b>Von:</b> "Julian Maurice" <julian.maurice@biblibre.com><br/>
<b>An:</b> "koha-devel@lists.koha-community.org" <koha-devel@lists.koha-community.org><br/>
<b>Betreff:</b> [Koha-devel] CSRF token problem ?</div>
<div name="quoted-content">Hi,<br/>
<br/>
I think I found a problem with how we use CSRF tokens.<br/>
If a token is discovered by an attacker, and if the user leaves their<br/>
session open, the attacker can use the token to impersonate the user on<br/>
every CSRF-protected form during 8 hours (Koha::Token::CSRF_EXPIRY_HOURS).<br/>
<br/>
Is this a known issue ?<br/>
<br/>
Bug 18124 restricts token to a user's session. Maybe it would be good to<br/>
restrict to a particular form too.<br/>
To go further, I think we should have a way to invalidate tokens after<br/>
their use, so a token can never be used twice.<br/>
<br/>
Any thoughts ?<br/>
<br/>
--<br/>
Julian Maurice <julian.maurice@biblibre.com><br/>
BibLibre<br/>
_______________________________________________<br/>
Koha-devel mailing list<br/>
Koha-devel@lists.koha-community.org<br/>
<a href="http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel" target="_blank">http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel</a><br/>
website : <a href="http://www.koha-community.org/" target="_blank">http://www.koha-community.org/</a><br/>
git : <a href="http://git.koha-community.org/" target="_blank">http://git.koha-community.org/</a><br/>
bugs : <a href="http://bugs.koha-community.org/" target="_blank">http://bugs.koha-community.org/</a></div>
</div>
</div>
</div></div></body></html>