gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
David Cook 15535f9fd5 Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID 
This patch makes the sandboxing of the selfcheckout more robust by
adding a "sco_user" session variable which is turned on when
logging into the self-checkout (either by AutoSelfCheckAllowed or manually).

If a user with this session variable turned on tries to access
other parts of the system (like the rest of the OPAC), it will
"kick out", so that the browser user will lose the authenticated session.

Test plan:
1) Apply the patch
2) koha-plack --restart kohadev
3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
4) Note that you are logged into the self-checkout
     So you see the login screen specific to the self-checkout.
     To log with the actual patron. It's a nested auth.
5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
6) Note that you are not logged into the OPAC
7) Log into the staff interface and disable the
system preference AutoSelfCheckAllowed
8) Log out of the staff interface (this step is very important)
9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
10) Note that you are prompted to log into Koha
11) Login using the "koha" user (when using koha-testing-docker)
12) Note that you are logged into the self-checkout
13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
14) Note that you are not logged into the OPAC
      Without the patch you would still be logged as "koha"
15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
16) Note that you will need to log in again as you've lost your
session cookie
      Without the patch you will still be logged in the self-checkout
Voila!

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6d022889a2)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
 		2022-01-31 19:15:44 +01:00
..
AuthoritiesMarc Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
Barcodes Bug 26673: Fix perlcritic complains 2020-11-02 08:42:20 +01:00
ClassSortRoutine
…
ClassSplitRoutine Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Creators Bug 25852: Improve C4::Creators::Lib reliability under plack 2020-07-31 10:03:26 +02:00
External Bug 22010: Check preferences for ebook integration 2019-04-30 11:42:51 +00:00
Form
…
Heading Bug 26852: subfield $e missing in X11 definition of MARC21 headings 2021-08-27 08:54:34 -10:00
ILSDI Bug 28630: Add track_login_daily to ILSDI::AuthenticatePatron 2021-08-11 10:08:50 -10:00
Installer Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
Labels Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Linker Bug 28676: Cache and retrieve match_count when searching a cached heading 2021-10-06 10:06:19 -10:00
Members Bug 24447: Changing 'DUE' to example in database that exists. 2021-01-29 14:19:18 +01:00
OAI Bug 25460: Update OAI sets when adding/editing/deleting item records 2020-10-15 12:56:30 +02:00
Output
…
Patroncards Bug 25459: Makes barcode position respect units in patron cards layout 2021-11-10 15:35:45 -10:00
Reports Bug 27884: Add html support for report mails 2021-11-10 15:38:19 -10:00
SIP Bug 29564: Use List::MoreUtils so SIP U16/Xenial does not break 2021-11-29 20:16:50 -10:00
Search Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
Serials
…
Utils Bug 29134: (follow-up) Specify which borrowernumber 2021-10-25 20:09:40 -10:00
Accounts.pm Bug 22394: Remove C4::Accounts::manualinvoice 2020-11-04 12:59:33 +01:00
Acquisition.pm Bug 27203: Calculate tax based on ecost if unitprice not set 2021-05-12 17:09:55 +02:00
Auth.pm Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID 2022-01-31 19:15:44 +01:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 20854: (QA follow-up) Improve readability 2021-04-29 13:57:51 +02:00
Auth_with_ldap.pm Bug 28276: Do not fetch config ($KOHA_CONF) from memcached 2021-05-12 16:32:32 +02:00
Auth_with_shibboleth.pm Bug 28367: (follow-up) Fix plack condition in C4/Auth_with_shibboleth.pm 2021-05-18 12:28:31 +02:00
AuthoritiesMarc.pm Bug 27173: Add plugin hooks for authority record changes 2021-11-12 12:36:22 -10:00
BackgroundJob.pm Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
Barcodes.pm
…
Biblio.pm Bug 27837: Always pass permanent location from items editor if it was defined 2021-05-20 14:50:15 +02:00
Boolean.pm
…
Breeding.pm Bug 29437: Search reservoir for term as title, author, or variations of ISBN 2022-01-31 01:09:39 +01:00
Budgets.pm Bug 23195: Always count shipping costs as 'spent' 2021-04-29 16:06:22 +02:00
Calendar.pm Bug 25723: (QA follow-up) Handle holiday and exception on same day 2020-07-20 17:45:31 +02:00
Charset.pm Bug 22721: Remove frameworkcode parameter in GetMarcFromKohaField calls 2019-07-15 11:28:08 +01:00
Circulation.pm Bug 28472: handle items with NULL shelving location 2021-10-06 10:11:06 -10:00
ClassSortRoutine.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
ClassSource.pm Bug 15836: Remove deprecated subroutines 2018-11-13 18:56:18 +00:00
ClassSplitRoutine.pm Bug 15836: Add the ability to defined custom methods to split call number in labels 2018-11-13 15:18:22 +00:00
Context.pm Bug 28276: Do not fetch config ($KOHA_CONF) from memcached 2021-05-12 16:32:32 +02:00
Contract.pm Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
CourseReserves.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Creators.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Debug.pm
…
HTML5Media.pm Bug 27422: YouTube videos are HTTPS only 2021-02-12 15:27:50 +01:00
Heading.pm Bug 24269: Adjust C4::Heading to generate headings from auth tags 2020-02-19 13:33:32 +00:00
HoldsQueue.pm Bug 28510: Remove marking of closed branches as 'disable_transfer' 2021-10-20 17:08:48 -10:00
ImportBatch.pm Bug 24469: Move the new queries to a dedicated ImportBatch subroutine 2021-02-22 11:11:53 +01:00
ImportExportFramework.pm Bug 27968: Fix framework import if isurl has an incorrect value 2021-04-29 16:30:57 +02:00
InstallAuth.pm Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
Installer.pm Bug 23895: Move installer file into the mandatory directory 2020-10-14 14:50:07 +02:00
ItemCirculationAlertPreference.pm
…
Items.pm Bug 28776: Warns from GetItemsInfo when biblio marked as serial 2021-08-27 09:02:15 -10:00
Koha.pm Bug 27746: prevent regexp undefined warning when checking subfield contents ($oclc) 2021-04-19 14:55:45 +02:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
Letters.pm Bug 29330: (QA follow-up) Change to message/rfc822 2021-12-21 16:03:26 +01:00
Linker.pm
…
Log.pm Bug 23632: Remove C4::Logs::GetLogs 2020-08-18 15:45:48 +02:00
MarcModificationTemplates.pm Bug 24840: Replace DateTime->now with dt_from_string 2020-04-08 11:54:23 +01:00
Matcher.pm Bug 26199: Include LDR for match check/match point 2021-03-19 14:38:49 +01:00
Members.pm Bug 28053: Squash warning in C4::Members 2021-04-15 12:23:14 +02:00
Message.pm Bug 21206: Replace C4::Items::GetItem 2019-02-26 13:24:07 +00:00
NewsChannels.pm Bug 28698: Fix news for all displays in all locations 2022-01-31 18:08:17 +01:00
Output.pm Bug 11994: OpenSearch plugins needs to be delivered with Content-Type application/opensearchdescription+xml 2020-06-24 14:31:37 +02:00
Overdues.pm Bug 28144: Check if issue_id defined 2021-04-30 10:44:14 +02:00
Patroncards.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Record.pm Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
Reports.pm Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
Reserves.pm Bug 25619: Adjust POD and move date check before logging 2021-09-08 10:25:49 -10:00
Ris.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
RotatingCollections.pm Bug 12556: (QA follow-up) Fix QA Script failures 2020-10-14 14:50:07 +02:00
SMS.pm
…
Scheduler.pm Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
Scrubber.pm
…
Search.pm Bug 28365: (Bug 19873 follow-up) Make it possible to search on value 0 2021-11-10 15:46:17 -10:00
Serials.pm Bug 27842: Update serial.biblionumber when a subscription is linked with another record 2021-05-12 15:58:29 +02:00
Service.pm Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
ShelfBrowser.pm Bug 26673: Remove shebangs from Perl modules 2020-10-26 00:14:42 +01:00
SocialData.pm
…
Stats.pm Bug 24151: Copy info to the pseudonymized table when a transaction is done 2020-07-20 15:17:42 +02:00
Suggestions.pm Bug 7806: Fix remaining occurrences of 0000-00-00 2021-03-04 10:24:48 +01:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 23084: Replace grep {^$var$} with grep {$_ eq $var} 2020-02-17 10:44:45 +00:00
Templates.pm Bug 28303: Fix plugins system with multiple pluginsdir settings 2021-10-20 19:57:47 -10:00
TmplToken.pm
…
TmplTokenType.pm Bug 24217: use Modern::Perl for modules when strict is missing 2020-01-03 10:45:46 +00:00
UsageStats.pm Bug 23420: (QA follow-up) Remove more AllowPurchaseSuggestionBranchChoice code 2020-10-09 12:22:01 +02:00
XISBN.pm Bug 26364: Don't skip records that match the isbn we passed 2021-01-08 07:38:05 +01:00
XSLT.pm Bug 23406: Don't translate suppressed authorised values 2021-05-12 17:19:05 +02:00