https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43304
Bug ID: 43304
Summary: Add global CSRF header injection for legacy
jQuery.ajax API calls
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Architecture, internals, and plumbing
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Depends on: 34451
Target Milestone: ---
Bug 34451 adds CSRF protection for cookie-authenticated REST API requests. The
http-client.js already sends the CSRF-TOKEN header automatically, but several
templates still use raw jQuery.ajax() calls to the API without the header.
Affected templates include:
- members/two_factor_auth.tt (POST to /api/v1/auth/two-factor/registration and
/verification)
- tools/manage-marc-import.tt
- tools/quotes.tt, quotes-upload.tt
- tools/batch_modify_holds.tt
- tools/stage-marc-import.tt
These calls will fail with 403 when CSRF protection is active because they send
the CGISESSID cookie (browser sends it automatically) but no CSRF-TOKEN header.
Proposed fix: add a global jQuery.ajaxSetup that injects the CSRF-TOKEN header
from the meta tag on every state-changing request:
$.ajaxSetup({
beforeSend: function(xhr, settings) {
if (!/^(GET|HEAD|OPTIONS)$/i.test(settings.type)) {
var token = $('meta[name="csrf-token"]').attr('content');
if (token) xhr.setRequestHeader('CSRF-TOKEN', token);
}
}
});
This fixes all legacy callers in one shot without requiring individual template
changes. It should live in a globally included JS file (e.g., js/global.js or
staff-global.js).
Alternatively, individual templates could be migrated to http-client.js but
that is a larger effort.
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
