From e84125f65ef5882ce3225eceb959b51a50deaa96 Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 22 Jul 2021 06:34:20 +0000 Subject: [PATCH] Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID This patch makes the sandboxing of the selfcheckout more robust by adding a "sco_user" session variable which is turned on when logging into the self-checkout (either by AutoSelfCheckAllowed or manually). If a user with this session variable turned on tries to access other parts of the system (like the rest of the OPAC), it will "kick out", so that the browser user will lose the authenticated session. Test plan: 1) Apply the patch 2) koha-plack --restart kohadev 3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4) Note that you are logged into the self-checkout 5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 6) Note that you are not logged into the OPAC 7) Log into the staff interface and disable the system preference AutoSelfCheckAllowed 8) Log out of the staff interface (this step is very important) 9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 10) Note that you are prompted to log into Koha 11) Login using the "koha" user (when using koha-testing-docker) 12) Note that you are logged into the self-checkout 13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 14) Note that you are not logged into the OPAC 15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 16) Note that you will need to log in again as you've lost your session cookie Voila! --- C4/Auth.pm | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index fd327bf618..65579d961b 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -196,14 +196,20 @@ sub get_template_and_user { } if ( $in->{type} eq 'opac' && $user ) { + my $is_sco_user; + if ($sessionID){ + my $session = get_session($sessionID); + if ($session){ + $is_sco_user = $session->param('sco_user'); + } + } my $kick_out; if ( # If the user logged in is the SCO user and they try to go out of the SCO module, # log the user out removing the CGISESSID cookie $in->{template_name} !~ m|sco/| && $in->{template_name} !~ m|errors/errorpage.tt| - && C4::Context->preference('AutoSelfCheckID') - && $user eq C4::Context->preference('AutoSelfCheckID') + && $is_sco_user ) { $kick_out = 1; @@ -1204,6 +1210,12 @@ sub checkauth { $branchname = $branches->{$br}->{'branchname'}; } } + + my $is_sco_user = 0; + if ( $query->param('sco_user_login') && ( $query->param('sco_user_login') eq '1' ) ){ + $is_sco_user = 1; + } + $session->param( 'number', $borrowernumber ); $session->param( 'id', $userid ); $session->param( 'cardnumber', $cardnumber ); @@ -1221,6 +1233,7 @@ sub checkauth { $session->param( 'shibboleth', $shibSuccess ); $session->param( 'register_id', $register_id ); $session->param( 'register_name', $register_name ); + $session->param( 'sco_user', $is_sco_user ); } $session->param('cas_ticket', $cas_ticket) if $cas_ticket; C4::Context->set_userenv( -- 2.11.0