gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 22483: (QA follow-up) Corrections to logic in check_cookie_auth 

check_cookie_auth needs to allow for cases where we wish to check for
ANY permission and cases where we wish to skip the permissions check
entirely and just authenticate the session.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This commit is contained in:
Martin Renvoize 2019-03-08 14:20:41 +00:00 committed by Tomas Cohen Arazi
parent 32551fffdb
commit 6b457885cd
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
C4/Auth.pm
View File

@ -1606,7 +1606,11 @@ sub check_api_auth {
($status, $sessionId) = check_api_auth($cookie, $userflags);
Given a CGISESSID cookie set during a previous login to Koha, determine
if the user has the privileges specified by C<$userflags>.
if the user has the privileges specified by C<$userflags>. C<$userflags>
is passed unaltered into C<haspermission> and as such accepts all options
avaiable to that routine with the one caveat that C<check_api_auth> will
also allow 'undef' to be passed and in such a case the permissions check
will be skipped altogether.
C<check_cookie_auth> is meant for authenticating special services
such as tools/upload-file.pl that are invoked by other pages that
@ -1701,7 +1705,7 @@ sub check_cookie_auth {
return ( "expired", undef );
} else {
$session->param( 'lasttime', time() );
my $flags = haspermission( $userid, $flagsrequired );
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
if ($flags) {
return ( "ok", $sessionID );
} else {

2
Koha/REST/V1/Auth.pm
View File

@ -189,7 +189,7 @@ sub authenticate_api_request {
# Manually pass the remote_address to check_auth_cookie
my $remote_addr = $c->tx->remote_address;
my ($status, $sessionID) = check_cookie_auth(
$cookie, '*',
$cookie, undef,
{ remote_addr => $remote_addr });
if ($status eq "ok") {
my $session = get_session($sessionID);