https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38258
Bug ID: 38258
Summary: Connecting to koha without the proper CGI cookie can
disconnect every session
Change sponsored?: ---
Product: Koha
Version: 24.05
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
To reproduce :
1 - Log in to Koha intranet keep the browser open
2 - Run in a terminal: curl --verbose
'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730'
-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101
Firefox/130.0' -H 'Accept:
image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H
'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip,
deflate, br, zstd'
Note: there is no need to have a valid thumbnail and biblionumber
3 - Go back to your browser and click any link: you have been disconnected
I'm not sure about the exact mechanism leading to a disconnection, but this is
due to :
> check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
If cookie is empty, the scalar context cannot be deduced properly and it
results in a disconnection of opened sessions. Forcing a scalar context solves
the issue.
This is true for all the results of:
> git grep "check_cookie_auth.*cookie.*CGISESSID"
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list
[email protected]
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
