[Bug 36934] New: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Bug ID: 36934 Summary: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP) Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs@lists.koha-community.org Reporter: jonathan.druart@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com Depends on: 36933 Found when testing StaffLoginRestrictBranchByIP: * Turn on StaffLoginRestrictBranchByIP * Set CPL's IP to 1.2.3.4 * Go to the staff login screen and try to connect to CPL => Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK) * Pick another library => 403 (KO) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|36933 |26176 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26176 [Bug 26176] AutoLocation is badly named -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |36941 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36941 [Bug 36941] Only list the available libraries at login when StaffLoginRestrictBranchByIP is enabled -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 --- Comment #1 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- I think I see the issue - we aren't getting a sessionID after the failure: 1224 if ( $ip !~ /^$domain/ ) { 1225 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( 1226 -name => 'CGISESSID', 1227 -value => '', 1228 -HttpOnly => 1, 1229 -secure => ( C4::Context->https_enabled() ? 1 : 0 ), 1230 -sameSite => 'Lax', 1231 )); 1232 $info{'wrongip'} = 1; 1233 $auth_state = "failed"; 1234 } This correctly clears (without it I can log in to any branch on subsequent try) but does not create a new session ID, not sure how to fix this one -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Bug 36934 depends on bug 26176, which changed state. Bug 26176 Summary: AutoLocation is badly named https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26176 What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36941 Blocks|36941 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36941 [Bug 36941] Highlight that some libraries should not be available at login when StaffLoginRestrictBranchByIP is enabled -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37041 --- Comment #2 from Jonathan Druart <jonathan.druart@gmail.com> --- Might be fixed if we store the session's id in userenv (see bug 37041). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=43037 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org