https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43782
--- Comment #2 from David Nind <[email protected]> --- Created attachment 207788 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207788&action=edit Bug 43782: Fix GenerateCSRF cache key to be session-specific The GenerateCSRF template plugin (added by Bug 35955) cached the CSRF token under the global key 'CSRF-TOKEN', shared across all sessions served by the same Plack worker. Because Koha::Cache::Memory::Lite is a package-level in-process hash that persists across requests, the first session's token was returned to all subsequent sessions on the same worker, causing CSRF validation to fail with 403 errors. This patch: - Changes the cache key to 'CSRF-TOKEN-{session_id}' so each session gets its own cached token - Stores the token with a timestamp and rejects cached tokens with less than one hour of remaining lifetime (CSRF_EXPIRY_HOURS * 3600 - 3600 seconds) to prevent serving near-expired tokens Test plan: 1. Apply patch 2. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: Johan Larsson <[email protected]> Signed-off-by: David Nind <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
