gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29931: [21.05.x] Check cookie status before continuing 

Test plan:
Logout from staff.
Try to run plugins-enable (you should have some active plugin).
Like: https://yourserver:staffport/cgi-bin/koha/plugins/plugins-enable.pl?class=Koha::Plugin::Test&method=enable
Replace class and method as appropriate.
Verify that with this patch, you will be redirected to 401 page.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 29931: (follow-up) Similar thing in opac-patron-image.pl

Although less harmful indeed. No borrowernumber, no image.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested: logged in, logged out, prefs toggled. All fine.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 29931: (follow-up) Fix svc/checkouts and return_claims too

Adding the same auth_status check here too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Marcel de Rooy 2022-01-24 10:24:08 +00:00 committed by Wainui Witika-Park
parent 54f287f018
commit ab2774aaab
4 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
opac/opac-patron-image.pl
View File

@ -32,13 +32,14 @@ unless (C4::Context->preference('OPACpatronimages')) {
exit;
}
my $needed_flags;
my %cookies = CGI::Cookie->fetch;
my $sessid = $cookies{'CGISESSID'}->value;
my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags);
my $borrowernumber = C4::Context->userenv->{'number'};
my ($auth_status) = check_cookie_auth( $query->cookie('CGISESSID') );
if( $auth_status ne 'ok' ) {
print CGI::header( '-status' => '401' );
exit 0;
}
my $patron_image = Koha::Patron::Images->find($borrowernumber);
my $userenv = C4::Context->userenv;
my $patron_image = $userenv ? Koha::Patron::Images->find( $userenv->{number} ) : undef;
if ($patron_image) {
print $query->header(

7
plugins/plugins-enable.pl
View File

@ -28,8 +28,11 @@ die("Koha plugins are disabled!")
my $input = new CGI;
my ( $auth_status, $sessionID ) =
check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } );
my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } );
if( $auth_status ne 'ok' ) {
print CGI::header( '-status' => '401' );
exit 0;
}
my $class = $input->param('class');
my $method = $input->param('method');

7
svc/checkouts
View File

@ -33,8 +33,11 @@ use Koha::ItemTypes;
my $input = new CGI;
my ( $auth_status, $sessionID ) =
check_cookie_auth( $input->cookie('CGISESSID'));
my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'));
if( $auth_status ne 'ok' ) {
print CGI::header( '-status' => '401' );
exit 0;
}
my $session = get_session($sessionID);
my $userid = $session->param('id');

7
svc/return_claims
View File

@ -31,8 +31,11 @@ use Koha::Patrons;
my $input = new CGI;
my ( $auth_status, $sessionID ) =
check_cookie_auth( $input->cookie('CGISESSID') );
my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID') );
if( $auth_status ne 'ok' ) {
print CGI::header( '-status' => '401' );
exit 0;
}
my $session = get_session($sessionID);
my $userid = $session->param('id');