gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
David Cook 2e5d59d902 Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID 
This patch makes the sandboxing of the selfcheckout more robust by
adding a "sco_user" session variable which is turned on when
logging into the self-checkout (either by AutoSelfCheckAllowed or manually).

If a user with this session variable turned on tries to access
other parts of the system (like the rest of the OPAC), it will
"kick out", so that the browser user will lose the authenticated session.

Test plan:
1) Apply the patch
2) koha-plack --restart kohadev
3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
4) Note that you are logged into the self-checkout
     So you see the login screen specific to the self-checkout.
     To log with the actual patron. It's a nested auth.
5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
6) Note that you are not logged into the OPAC
7) Log into the staff interface and disable the
system preference AutoSelfCheckAllowed
8) Log out of the staff interface (this step is very important)
9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
10) Note that you are prompted to log into Koha
11) Login using the "koha" user (when using koha-testing-docker)
12) Note that you are logged into the self-checkout
13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
14) Note that you are not logged into the OPAC
      Without the patch you would still be logged as "koha"
15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
16) Note that you will need to log in again as you've lost your
session cookie
      Without the patch you will still be logged in the self-checkout
Voila!

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2022-02-02 21:05:29 -10:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 29689: (bug 28445 follow-up) Fix AutoBarcode=hbyymmincr 2022-01-03 21:37:40 -10:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Heading Bug 26852: subfield $e missing in X11 definition of MARC21 headings 2021-08-11 13:27:52 +02:00
ILSDI Bug 29562: Adjust CanItemBeReserved and checkHighHolds to take objects 2022-01-31 21:55:39 -10:00
Installer Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Labels Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Linker Bug 28676: Cache and retrieve match_count when searching a cached heading 2021-09-20 12:06:56 +02:00
Members Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
OAI Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 25459: Makes barcode position respect units in patron cards layout 2021-11-02 16:50:01 +01:00
Reports Bug 27884: Add html support for report mails 2021-11-02 16:50:01 +01:00
SIP Bug 29564: Use List::MoreUtils so SIP U16/Xenial does not break 2021-11-25 09:48:45 +01:00
Search Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Utils Bug 28959: Add virtualshelves.public as a boolean 2021-10-28 17:47:38 +02:00
Accounts.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Acquisition.pm Bug 27287: Make note fields from orders history searchable 2021-10-21 12:24:04 +02:00
Auth.pm Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID 2022-02-02 21:05:29 -10:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 28417: Don't require C4::Auth_with_cas from opac-user if not needed 2021-11-03 15:40:52 +01:00
Auth_with_ldap.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Auth_with_shibboleth.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AuthoritiesMarc.pm Bug 27173: Add plugin hooks for authority record changes 2021-11-03 15:40:52 +01:00
BackgroundJob.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 27266: Move GetMarcAuthors to Koha namespace 2021-12-15 12:15:03 -10:00
Breeding.pm Bug 29391: Improve output of reservoir search 2022-01-09 21:04:17 -10:00
Budgets.pm Bug 24190: (follow-up) Rename AcqLog 2021-09-21 20:22:57 +02:00
Calendar.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 29562: Adjust CanItemBeReserved and checkHighHolds to take objects 2022-01-31 21:55:39 -10:00
ClassSortRoutine.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSource.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Context.pm Bug 28306: Allow to query database with minimal memory footprint 2021-08-31 10:27:52 +02:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Heading.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
HoldsQueue.pm Bug 29015: Add options for itemtype, collection, and shelving location to view_holdsqueue.pl 2021-11-03 15:40:52 +01:00
ImportBatch.pm Bug 29788: Make Koha::Item->safe_to_delete use Koha::Result::Boolean 2022-01-11 12:38:35 -10:00
ImportExportFramework.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
InstallAuth.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Installer.pm Bug 26326: (follow-up) Add ability to check for existence of any primary key 2021-11-03 15:40:52 +01:00
ItemCirculationAlertPreference.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Items.pm Bug 29243: Correct call when adding items from staged records 2021-10-18 11:28:41 +02:00
Koha.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 15067: Follow up to fix sorting 2021-08-04 14:06:43 +02:00
Letters.pm Bug 29330: (QA follow-up) Change to message/rfc822 2021-11-15 12:38:39 +01:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 28692: (QA follow-up) Fix test for objects 2021-11-16 14:00:20 +01:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Members.pm Bug 28943: Lower the risk of accidental patron deletion 2022-01-21 21:34:51 -10:00
Message.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Output.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Overdues.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 29562: (follow-up) Fix API controller 2022-01-31 21:55:39 -10:00
Ris.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
RotatingCollections.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SMS.pm Bug 27673: Replace YAML with YAML::XS 2021-02-16 14:54:50 +01:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Search.pm Bug 28365: (Bug 19873 follow-up) Make it possible to search on value 0 2021-11-03 15:40:52 +01:00
Serials.pm Bug 6734: Show location in serials history table 2022-01-28 21:52:53 -10:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SocialData.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Stats.pm Bug 17600: Fix tests 2021-07-16 09:47:01 +02:00
Suggestions.pm Bug 28855: Purging suggestions test should not be on timestamp 2021-12-15 12:14:47 -10:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Templates.pm Bug 28303: Fix plugins system with multiple pluginsdir settings 2021-10-05 10:58:13 +02:00
TmplToken.pm
…
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
UsageStats.pm Bug 5229: Remove system preference 'OPACItemsResultsDisplay' 2021-11-19 15:23:27 +01:00
XISBN.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
XSLT.pm Bug 29669: fix uninitialized value warnings when XSLTParse4Display is called 2021-12-16 12:13:51 -10:00