e00a821a26
After a SIP terminal logs in successfully, a later connection handled by the
same worker could bypass authentication entirely. login_core() stores the account
in the session before calling api_auth(), and left it in place when authentication
failed. The check in raw_transport() that is meant to drop unauthenticated connections
only looks at $self->{account}->{id}, which is now populated straight from the SIP config,
so the connection is treated as logged in.
Test Plan:
1) Create a SIP user with the username and password "term1"
2) Restart the SIP server
3) Apply the first patch
4) prove t/db_dependent/SIP/MsgType.t
5) Note the new test fails
6) Telnet to the SIP server port ( 6001 for ktd )
5) Send a successful login: 9300CNterm1|COterm1
6) Note you get a 941 back
7) Disconnect, then telnet to localhost 6001 again
8) Send a bad login: 9300CNterm1|COterm2
9) Note you get a 940 back, but the connection stays open
10) Send a patron information request, using a real patron cardnumber:
6300120260615 110310 AOCPL|AA23529001000463
11) Note you get a 64 patron information response with the patron's data back,
even though the login failed!
12) Apply the second patch
13) prove t/db_dependent/SIP/MsgType.t
14) Note the subtest now passes!
15) Restart all the things!
16) Repeat steps 4 to 10
17) Note the the patron info request returns no patron data and the connection is dropped!
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b1f8256ab97913678aacd80c7d53deec72868876)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
|
||
|---|---|---|
| .. | ||
| ILS | ||
| Sip | ||
| ILS.pm | ||
| Logger.pm | ||
| Makefile | ||
| README | ||
| SIPServer.pm | ||
| Sip.pm | ||
| Trapper.pm | ||
README
README for Open NSIP 3M-SIP Server
DEPENDENCIES
SIPServer is written entirely in Perl, but it require these CPAN
perl modules to run:
Net::Server - The SIP server is a Net::Server::Prefork server
XML::LibXML
XML::Parser
XML::Simple - for parsing the config file
UNIVERSAL::require - for loading the correct ILS interface module
Clone - for running the test cases
LOGGING
SIPServer uses Koha::Logger for status and debugging messages.