de07356028
This patch introduces code to detect (cookie) annonymous sessions and act as expected. Right now, as check_cookie_auth is not passed the required permissions (because there aren't always required permissions, and the code to check permissions is shared with other authentication mechanisms) it returns 'ok' and the session id. This use case was overlooked when this was coded, and yeilds unexpected error codes (500) when the user logs out and the annonymous session cookie is used to hit the API. The end result doesn't pose any security issue (i.e. the resource access is rejected) but the returned error code is not correct and should be fixed. This patch verifies for an anonymous session (and avoids querying the corresponding patron) and then verifies if there is an authorization config on the route and if the patron object is defined. To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t => FAIL: Tests fail, 500 instead of the expected 401 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Repeat the original 'steps to reproduce' from the bug report using the browser => SUCCESS: Problem solved! 6. Sign off :-D Sponsored-by: ByWater Solutions Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> |
||
|---|---|---|
| C4 | ||
| Koha | ||
| acqui | ||
| admin | ||
| api/v1 | ||
| authorities | ||
| basket | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| errors | ||
| etc | ||
| ill | ||
| installer | ||
| koha-tmpl | ||
| labels | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| pos | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| skel | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| tmp/modified_authorities | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .editorconfig | ||
| .eslintrc.json | ||
| .gitignore | ||
| .htaccess | ||
| .mailmap | ||
| .scss-lint.yml | ||
| INSTALL | ||
| Koha.pm | ||
| LICENSE | ||
| MANIFEST.SKIP | ||
| Makefile.PL | ||
| README | ||
| README.md | ||
| README.robots | ||
| about.pl | ||
| changelanguage.pl | ||
| cpanfile | ||
| fix-perl-path.PL | ||
| gulpfile.js | ||
| help.pl | ||
| koha_perl_deps.pl | ||
| kohaversion.pl | ||
| mainpage.pl | ||
| package.json | ||
| rewrite-config.PL | ||
| yarn.lock | ||
README.md
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: This is a synced mirror of the official Koha repo.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
