gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 5995 : MT2892: Fix security issue in CAS intranet login 

Users could log in intranet using their cardnumber, with superlibrarian
rights.

Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Chris Nighswonger <chris.nighswonger@gmail.com>
This commit is contained in:
Matthias Meusburger 2010-02-05 12:00:15 +01:00 committed by Chris Nighswonger
parent 01d01b02a2
commit 07ce7d8d3b
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
C4/Auth.pm
View File

@ -750,7 +750,7 @@ sub checkauth {
$info{'invalidCasLogin'} = 1 unless ($return);
} else {
my $retuserid;
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
( $return, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
$userid = $retuserid if ($retuserid ne '');
}
if ($return) {
@ -1452,7 +1452,7 @@ sub checkpw {
C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
$firstname, $surname, $branchcode, $flags );
return 1, $cardnumber, $userid;
return 1, $userid;
}
}
$sth =