gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29957: Clear cookies on logout 

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended: Reverted the change to $cookies to minimize changes.
Fixed Auth.t where checkauth is being mocked.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Jonathan Druart 2022-01-27 12:33:57 +01:00 committed by Fridolin Somers
parent 1684821b61
commit ed8a9cff24
2 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
C4/Auth.pm
View File

@ -154,6 +154,7 @@ sub get_template_and_user {
my $in = shift;
my ( $user, $cookie, $sessionID, $flags );
$cookie = [];
# Get shibboleth login attribute
my $shib = C4::Context->config('useshibboleth') && shib_ok();
@ -243,7 +244,7 @@ sub get_template_and_user {
if ($kick_out) {
$template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac',
$in->{query} );
$cookie = $in->{query}->cookie(
push @$cookie, $in->{query}->cookie(
-name => 'CGISESSID',
-value => '',
-expires => '',
@ -654,11 +655,7 @@ sub get_template_and_user {
# what to do
my $language = C4::Languages::getlanguage( $in->{'query'} );
my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language );
if ( ref $cookie eq 'ARRAY' ) {
push @{$cookie}, $languagecookie;
} else {
$cookie = [ $cookie, $languagecookie ];
}
push @{$cookie}, $languagecookie;
}
return ( $template, $borrowernumber, $cookie, $flags );
@ -808,6 +805,15 @@ sub _timeout_syspref {
return $timeout;
}
sub clear_all_cookies {
my ( $query ) = shift;
my @cookies;
for my $cookie_name ( $query->cookie ) {
push @cookies, $query->cookie( -name => $cookie_name, -value => '', -expires => '', -HttpOnly => 1 );
}
return \@cookies;
}
sub checkauth {
my $query = shift;
@ -844,6 +850,7 @@ sub checkauth {
my $loggedin = 0;
my %info;
my ( $userid, $cookie, $sessionID, $flags );
$cookie = [];
my $logout = $query->param('logout.x');
my $anon_search_history;
@ -867,7 +874,7 @@ sub checkauth {
if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) {
# Using Basic Authentication, no cookies required
$cookie = $query->cookie(
push @$cookie, $query->cookie(
-name => 'CGISESSID',
-value => '',
-expires => '',
@ -912,6 +919,7 @@ sub checkauth {
my $shibSuccess = C4::Context->userenv->{'shibboleth'};
$session->delete();
$session->flush;
$cookie = clear_all_cookies($query);
C4::Context::_unset_userenv($sessionID);
$sessionID = undef;
@ -925,7 +933,7 @@ sub checkauth {
}
} else {
$cookie = $query->cookie(
push @$cookie, $query->cookie(
-name => 'CGISESSID',
-value => $session->id,
-HttpOnly => 1,
@ -969,7 +977,7 @@ sub checkauth {
$sessionID = $session->id;
C4::Context->_new_userenv($sessionID);
$cookie = $query->cookie(
push @$cookie, $query->cookie(
-name => 'CGISESSID',
-value => $sessionID,
-HttpOnly => 1,
@ -1169,7 +1177,7 @@ sub checkauth {
$domain =~ s|\.\*||g;
if ( $ip !~ /^$domain/ ) {
$loggedin = 0;
$cookie = $query->cookie(
push @$cookie, $query->cookie(
-name => 'CGISESSID',
-value => '',
-HttpOnly => 1,
@ -1257,8 +1265,8 @@ sub checkauth {
if ( $loggedin || $authnotrequired )
{
# successful login
unless ($cookie) {
$cookie = $query->cookie(
unless (@$cookie) {
push @$cookie, $query->cookie(
-name => 'CGISESSID',
-value => '',
-HttpOnly => 1,

2
t/db_dependent/Auth.t
View File

@ -229,7 +229,7 @@ subtest 'get_template_and_user' => sub { # Tests for the language URL paramete
-HttpOnly => 1
);
return ( $userid, $session_cookie, $sessionID, $flags );
return ( $userid, [ $session_cookie ], $sessionID, $flags );
}
# Mock checkauth, build the scenario