gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Kyle M Hall 6aaa9d2264
Bug 42847: Prevent previously authenticated user 
After a SIP terminal logs in successfully, a later connection handled by the
same worker could bypass authentication entirely. login_core() stores the account
in the session before calling api_auth(), and left it in place when authentication
failed. The check in raw_transport() that is meant to drop unauthenticated connections
only looks at $self->{account}->{id}, which is now populated straight from the SIP config,
so the connection is treated as logged in.

Test Plan:
1) Create a SIP user with the username and password "term1"
2) Restart the SIP server
3) Apply the first patch
4) prove t/db_dependent/SIP/MsgType.t
5) Note the new test fails
6) Telnet to the SIP server port ( 6001 for ktd )
5) Send a successful login: 9300CNterm1|COterm1
6) Note you get a 941 back
7) Disconnect, then telnet to localhost 6001 again
8) Send a bad login: 9300CNterm1|COterm2
9) Note you get a 940 back, but the connection stays open
10) Send a patron information request, using a real patron cardnumber:
    6300120260615    110310          AOCPL|AA23529001000463
11) Note you get a 64 patron information response with the patron's data back,
    even though the login failed!
12) Apply the second patch
13) prove t/db_dependent/SIP/MsgType.t
14) Note the subtest now passes!
15) Restart all the things!
16) Repeat steps 4 to 10
17) Note the the patron info request returns no patron data and the connection is dropped!

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
 		2026-07-30 08:22:22 +00:00
..
AuthoritiesMarc Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Barcodes Bug 42221: Fix EAN-13 autoBarcode not incrementing 2026-05-24 13:42:19 +01:00
ClassSortRoutine Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ClassSplitRoutine Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Creators Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
External Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Form Bug 28308: Remove 0 from "days in advance" for "Advance notice" 2026-03-14 12:21:06 +00:00
Heading Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ILSDI Bug 40622: Add missing interface parameter 2025-10-06 09:15:27 -06:00
Installer Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Labels Bug 40473: Use better algorithm for calculating Code39 barcode length 2025-09-26 10:36:41 -06:00
Linker Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Members Bug 28308: Remove 0 from "days in advance" for "Advance notice" 2026-03-14 12:21:06 +00:00
OAI Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Output Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Patroncards Bug 40680: Fix C4/Patroncards/Patroncard.pm 2025-12-01 08:33:57 -07:00
Reports Bug 39164: Add max_statement_time to SQL report queries 2026-05-24 13:42:19 +01:00
SIP Bug 42847: Prevent previously authenticated user 2026-07-30 08:22:22 +00:00
Search Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Serials Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Utils/DataTables Bug 41042: default_save_state is enabled by default 2025-10-23 11:33:32 -06:00
Accounts.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Acquisition.pm Bug 39721: Remove GetSuggestion from C4/Suggestions.pm 2026-04-13 08:38:33 +01:00
Auth.pm Bug 42222: Use of uninitialized string in string eq in Auth.pm 2026-05-24 13:42:17 +01:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Auth_with_ldap.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Auth_with_shibboleth.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
AuthoritiesMarc.pm Bug 41962: Add comment to SearchAuthorities, change POD 2026-05-24 13:42:25 +01:00
Barcodes.pm Bug 18584: Remove trailing spaces in Barcodes.pm 2025-11-18 06:56:42 -07:00
Biblio.pm Bug 41454: Remove unused dbh calls 2026-05-24 13:42:17 +01:00
Breeding.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Budgets.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Calendar.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Charset.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Circulation.pm Bug 37966: (follow-up) Make empty string handling more explicit in Circulation.pm 2026-05-24 13:42:22 +01:00
ClassSortRoutine.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
ClassSource.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
ClassSplitRoutine.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Context.pm Bug 42360: [25.11] Move separator validation to C4::Context::csv_delimiter 2026-06-23 14:17:15 +00:00
Contract.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
CourseReserves.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Creators.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
HTML5Media.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Heading.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
HoldsQueue.pm Bug 41959: (QA follow-up) Add missing POD 2026-05-24 13:42:13 +01:00
ImportBatch.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
ImportExportFramework.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
InstallAuth.pm Bug 41454: Remove unused dbh calls 2026-05-24 13:42:17 +01:00
Installer.pm Bug 42318: Populate record_sources with system defined values on install 2026-05-24 13:42:17 +01:00
ItemCirculationAlertPreference.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Items.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Koha.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Labels.pm
…
Languages.pm Bug 41440: Fix bug revealed by unit test 2026-05-24 13:42:18 +01:00
Letters.pm Bug 42136: prevent cgi, directory, and file plugins from use in user-entered templates 2026-04-22 17:00:45 +01:00
Linker.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Log.pm Bug 42030: (follow-up) Don't diff undefined fields 2026-05-24 13:42:24 +01:00
MarcModificationTemplates.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Matcher.pm Bug 42156: (QA follow-up) Correct POD typos and demote private helpers 2026-05-24 13:42:21 +01:00
Members.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Message.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Output.pm Bug 30261: Render opac 404 for opac/tracklinks.pl 2026-05-24 13:42:10 +01:00
Overdues.pm Bug 41315: (follow-up) Rename statements for clarity 2026-03-14 12:21:05 +00:00
Patroncards.pm Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
Record.pm Bug 41690: Add MARC21 245 (subtitle) to Cite option 2026-05-24 13:42:25 +01:00
Reports.pm Bug 42360: [25.11] Move separator validation to C4::Context::csv_delimiter 2026-06-23 14:17:15 +00:00
Reserves.pm Bug 42255: Maximum total holds allowed (count) 2026-05-24 13:42:50 +01:00
Ris.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
RotatingCollections.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
SMS.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Scheduler.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Scrubber.pm Bug 39860: Update scrubber profile and add Scrubber.t test 2025-11-03 14:13:47 -07:00
Search.pm Bug 41454: Remove unused dbh calls 2026-05-24 13:42:17 +01:00
Serials.pm Bug 41330: Escape braces in serials number management 2026-04-13 14:04:54 +01:00
Service.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ShelfBrowser.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
SocialData.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Stats.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Suggestions.pm Bug 42030: Populate diff column for suggestion CREATE/MODIFY/DELETE logs 2026-05-24 13:42:23 +01:00
TTParser.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Tags.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Templates.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TmplToken.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TmplTokenType.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
UsageStats.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
XISBN.pm Bug 41454: Remove unused dbh calls 2026-05-24 13:42:17 +01:00
XSLT.pm Bug 40972: (QA follow-up) POD 2026-05-24 13:42:18 +01:00