6164380b08
This patch makes the sandboxing of the selfcheckout more robust by adding a "sco_user" session variable which is turned on when logging into the self-checkout (either by AutoSelfCheckAllowed or manually). If a user with this session variable turned on tries to access other parts of the system (like the rest of the OPAC), it will "kick out", so that the browser user will lose the authenticated session. Test plan: 1) Apply the patch 2) koha-plack --restart kohadev 3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4) Note that you are logged into the self-checkout So you see the login screen specific to the self-checkout. To log with the actual patron. It's a nested auth. 5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 6) Note that you are not logged into the OPAC 7) Log into the staff interface and disable the system preference AutoSelfCheckAllowed 8) Log out of the staff interface (this step is very important) 9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 10) Note that you are prompted to log into Koha 11) Login using the "koha" user (when using koha-testing-docker) 12) Note that you are logged into the self-checkout 13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 14) Note that you are not logged into the OPAC Without the patch you would still be logged as "koha" 15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 16) Note that you will need to log in again as you've lost your session cookie Without the patch you will still be logged in the self-checkout Voila! Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> |
||
|---|---|---|
| C4 | ||
| Koha | ||
| OpenILS | ||
| acqui | ||
| admin | ||
| api | ||
| authorities | ||
| basket | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| errors | ||
| etc | ||
| ill | ||
| installer | ||
| koha-tmpl | ||
| labels | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| skel | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| tmp/modified_authorities | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .editorconfig | ||
| .eslintrc.json | ||
| .gitignore | ||
| .htaccess | ||
| .mailmap | ||
| .scss-lint.yml | ||
| INSTALL | ||
| Koha.pm | ||
| LICENSE | ||
| MANIFEST.SKIP | ||
| Makefile.PL | ||
| README | ||
| README.md | ||
| README.robots | ||
| about.pl | ||
| changelanguage.pl | ||
| fix-perl-path.PL | ||
| gulpfile.js | ||
| help.pl | ||
| koha_perl_deps.pl | ||
| kohaversion.pl | ||
| mainpage.pl | ||
| package.json | ||
| rewrite-config.PL | ||
| yarn.lock | ||
README.md
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
