gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29914: Make check_cookie_auth compare the userid 

check_cookie_auth is assuming that the user is authenticated if a cookie exists
and that the login/username exists in the DB.

So basically if you hit the login page, fill the login input with a
valid username, click "login"
=> A cookie will be generated, and the sessions table will contain a
line with this session id.
On the second hit, if the username is in the DB, it will be enough to be
considered authenticated.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7114dc2fb1)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This commit is contained in:
Jonathan Druart 2022-01-20 10:10:05 +01:00 committed by Victor Grousset/tuxayo
parent 18a88ae463
commit c986bd983b
2 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
C4/Auth.pm
View File

@ -1747,6 +1747,8 @@ Possible return values in C<$status> are:
=item "ok" -- user authenticated; C<$sessionID> have valid values.
=item "anon" -- user not authenticated but valid for anonymous session.
=item "failed" -- credentials are not correct; C<$sessionid> are undef
=item "maintenance" -- DB is in maintenance mode; no login possible at the moment
@ -1831,20 +1833,21 @@ sub check_cookie_auth {
$userid = undef;
$sessionID = undef;
return ( "expired", undef );
} else {
} elsif ( $userid ) {
$session->param( 'lasttime', time() );
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
if ($flags) {
return ( "ok", $sessionID );
} else {
$session->delete();
$session->flush;
C4::Context->_unset_userenv($sessionID);
$userid = undef;
$sessionID = undef;
return ( "failed", undef );
}
} else {
return ( "anon", $session );
}
$session->delete();
$session->flush;
C4::Context->_unset_userenv($sessionID);
$userid = undef;
$sessionID = undef;
return ( "failed", undef );
} else {
return ( "expired", undef );
}

7
Koha/REST/V1/Auth.pm
View File

@ -218,9 +218,10 @@ sub authenticate_api_request {
{ remote_addr => $remote_addr });
if ($status eq "ok") {
my $session = get_session($sessionID);
$user = Koha::Patrons->find( $session->param('number') )
unless $session->param('sessiontype')
and $session->param('sessiontype') eq 'anon';
$user = Koha::Patrons->find( $session->param('number') );
$cookie_auth = 1;
}
elsif ($status eq "anon") {
$cookie_auth = 1;
}
elsif ($status eq "maintenance") {