Re: [Koha-devel] Koha CSRF protection

2024-04-12 Thread Julian Maurice via Koha-devel
Hi, I'm a bit late on the topic but I had a look at the different bugs and patches during hackfest (mainly because it didn't work for me, I will open a new bug report for that). There is something in it that seems to cause bugs and I don't see a reason for it: it's the "cud-" thing. As I u

Re: [Koha-devel] Koha CSRF protection

2024-04-13 Thread Julian Maurice via Koha-devel
GET something that should be POSTed. I've tried to describe this change as best as I could on the wiki, please adjust if it's not clear enough. https://wiki.koha-community.org/wiki/Coding_Guidelines#CSRF_protection On Fri, 12 Apr 2024, 15:00 Julian Maurice via Koha-devel, < koha-devel

Re: [Koha-devel] Koha CSRF protection

2024-04-13 Thread Julian Maurice via Koha-devel
you missed something. Hope it clarifies. El sáb, 13 abr 2024 10:18, Julian Maurice via Koha-devel < koha-devel@lists.koha-community.org> escribió: My point is: since all POST (and other unsafe methods) requests are protected and require a CSRF token, why does Koha have a requirement on th