https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #3 from David Nind <david@davidnind.com> --- Testing notes (Using KTD): 1. For step 2, sudo koha-plack --disable kohadev && restart_all Wording suggestion - an attempt, not great, but I think we should try and explain what the security issue is: Koha is running in CGI mode. This is a security issue! Run Koha using Plack for CSRF (cross-site request forgery) protection. More information: koha-plack --help -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 --- Comment #5 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to David Cook from comment #4)

I think that this is a step in the right direction, although I've been wondering if we should disable CGI all together (with the exception of the scripts that have to have it for now).

That is, detecting its in CGI mode, and then throwing up a page that says Maintenance Mode or something with an error in the logs to say that they need to enable Plack.

Yes, that was the first idea. But it was not that trivial, and I was sure we already had a red warning on the about page: we don't! This is an easy one to backport, and we can adjust the behaviour on a separate bug for a major release. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |baptiste.wojtkowski@biblibr | |e.com QA Contact|testopia@bugs.koha-communit |baptiste.wojtkowski@biblibr |y.org |e.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 --- Comment #8 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to Baptiste Wojtkowski (bwoj) from comment #7)

Works perfectly fine, qa tools pass.

Shouldn't we add a sentence like: "please contact your system administrator" and a link toward the CSRF bugzilla page ?

Letting that to QA and RM but for me it's good as it. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179194|0 |1 is obsolete| | --- Comment #9 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179211 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179211&action=edit Bug 39305: Adjust wording Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #179211|0 |1 is obsolete| | --- Comment #11 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Created attachment 179213 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179213&action=edit Bug 39305: Adjust wording Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00 |25.05.00,24.11.06 released in| | Status|Pushed to main |Pushed to stable CC| |fridolin.somers@biblibre.co | |m --- Comment #14 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.06 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 --- Comment #16 from David Cook <dcook@prosentient.com.au> --- (In reply to Fridolin Somers from comment #15)

Not needed for < 24.11.x since they dont have CSRF via plack

Didn't the anti-CSRF get added in 24.05? I could be mistaken but that's what I thought? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |Pushed to stable --- Comment #18 from Fridolin Somers <fridolin.somers@biblibre.com> --- Ohhh correct, my mistake ;) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz Version(s)|25.05.00,24.11.06 |25.05.00,24.11.06,24.05.12 released in| | Status|Pushed to oldstable |Needs documenting --- Comment #20 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11.x -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 --- Comment #22 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to Alan from comment #21)

Is this working correctly? I see the error on my page (in 25.05) Koha is running in CGI mode. This is a security issue! Run Koha using Plack for CSRF (cross-site request forgery) protection. More information: koha-plack --help

However, When I check if Plack is running, it says it is for my instance - from the command line. Maybe it is a false message?

koha-plack --status eunc * Plack running for eunc [ OK ]

Try to restart koha-common (services need to be restarted in the correct order). -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 Oleg Vasylenko <synapse.ova@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |synapse.ova@gmail.com --- Comment #24 from Oleg Vasylenko <synapse.ova@gmail.com> --- I have the same problem on freshly installed Koha 24.11.10.000 on Debian 12.2. Plack is enabled and started. sudo koha-plack --status lib Plack running for lib:. Yet I get this message in About page: Koha is running in CGI mode. This is a security issue! Run Koha using Plack for CSRF (cross-site request forgery) protection. More information: koha-plack --help Restarting and reloading the plack daemon does not help. Rebooting the whole system does not help as well sudo koha-plack --restart lib Stopping Plack daemon for lib:. Starting Plack daemon for lib:. sudo koha-plack --reload lib Reloading Plack daemon for lib:. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 --- Comment #26 from Alan <aschrock@eunc.edu> --- Just to note, I ended up doing a full reinstall from scratch on a fully new box, pulling in my database. After that, it showed it correctly in the about page as well as running faster. I don't know why, it just magically worked so maybe there was a step I missed somewhere. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39305 --- Comment #28 from Saiful Amin <saiful@semanticconsulting.com> --- I spent some time investigating this issue and here's what I found. When you run: `koha-plack --start <instance>` it only starts the Plack (Starman) process for that instance. It does NOT switch Apache from CGI to Plack. Apache will continue using CGI unless explicitly configured otherwise. The switch between CGI and Plack in Apache is controlled by this command: `koha-plack --enable <instance>` This command modifies the Apache configuration for that Koha instance, ensuring these lines are active: For OPAC: Include /etc/koha/apache-shared-opac-plack.conf For Intranet: Include /etc/koha/apache-shared-intranet-plack.conf When you run: `koha-plack --disable <instance>` those Include lines are disabled again, causing Apache to fall back to CGI. I tested this behavior on multiple Koha versions and the behavior was consistent. In my case, the issue was related to SSL, i.e, Let's Encrypt creating another copy of VirtualHost configuration, in which the `koha-plack --enable` had no effect. The fix was to manually update the SSL VirtualHost configuration. If anyone is still experiencing this issue after running: koha-plack --enable <instance> systemctl reload apache2 then it's worth checking: 1. Whether both port 80 and 443 VirtualHosts contain the Plack include lines 2. Whether Apache was reloaded successfully 3. Whether the Plack process is actually running (`koha-plack --status <instance>`) If all of the above are correct and it still serves CGI, then it is worth filing a bug report for that specific Koha version. -- You are receiving this mail because: You are watching all bug changes.