Bug 17110: Lower CSRF expiry in Koha::Token

Default expiry in WWW:CSRF is one week.
This patch sets it to 8 hours by default in Koha, and allows to
change the expiry period individually by passing MaxAge.

Test plan:
[1] Put items in your cart.
[2] Apply the example patch too.
[3] Send the cart from opac within the allotted 10 seconds.
[4] Send again, but wait some 10 seconds before submitting. Too late!

Tested 3 patches together, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

diff --git a/Koha/Token.pm b/Koha/Token.pm
index 9e26800..e60ee1f 100644 (file)
--- a/Koha/Token.pm
+++ b/Koha/Token.pm
@@ -53,6 +53,7 @@ use String::Random ();
 use WWW::CSRF ();
 use base qw(Class::Accessor);
 use constant HMAC_SHA1_LENGTH => 20;
+use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days..
 
 =head1 METHODS
 
@@ -161,6 +162,7 @@ sub _chk_csrf {
         $params->{id},
         $params->{secret},
         $params->{token},
+        { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) },
     );
     return $csrf_status == WWW::CSRF::CSRF_OK();
 }