From 23dafae13152fb5dcdd93f6d94c169358d570e0c Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Wed, 16 Mar 2022 12:43:07 +0000 Subject: [PATCH] Bug 29957: Adjust push @$cookie statements in Auth Content-Type: text/plain; charset=utf-8 We can now use $cookie_mgr->replace_in_list instead. This effectively removes duplicates and keeps the newest cookie. Test plan: Run t/db_dependent/Auth.t Add removable_cookie entries in koha-conf for: form_serialized, form_serialized_limits (Note: these are js cookies, no httponly flag.) Login at OPAC. If you are using the same domain, check if you are logged in on the staff client too. Go back to OPAC, perform an Advanced search. Check cookies on browser dev console. Look for the 2 form_ cookies. Go to staff. Logout Go to OPAC. Check cookies in dev console. Are you logged out? Login at staff again. Hit some pages in the staff client and verify that they respond as expected. Signed-off-by: Marcel de Rooy --- C4/Auth.pm | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index e690fc473d..d5ee7d9573 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -156,6 +156,8 @@ sub get_template_and_user { my ( $user, $cookie, $sessionID, $flags ); $cookie = []; + my $cookie_mgr = Koha::CookieManager->new; + # Get shibboleth login attribute my $shib = C4::Context->config('useshibboleth') && shib_ok(); my $shib_login = $shib ? get_login_shib() : undef; @@ -244,13 +246,12 @@ sub get_template_and_user { if ($kick_out) { $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} ); - push @$cookie, $in->{query}->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $in->{query}->cookie( -name => 'CGISESSID', -value => '', - -expires => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); $template->param( loginprompt => 1, @@ -656,7 +657,7 @@ sub get_template_and_user { # what to do my $language = C4::Languages::getlanguage( $in->{'query'} ); my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language ); - push @{$cookie}, $languagecookie; + $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); } return ( $template, $borrowernumber, $cookie, $flags ); @@ -868,13 +869,12 @@ sub checkauth { if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { # Using Basic Authentication, no cookies required - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', - -expires => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); $loggedin = 1; } elsif ( $emailaddress) { @@ -924,12 +924,12 @@ sub checkauth { } } else { - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); my $sessiontype = $session->param('sessiontype') || ''; unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... @@ -970,12 +970,12 @@ sub checkauth { $sessionID = $session->id; C4::Context->_new_userenv($sessionID); - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { print STDERR "ERROR: Missing system preference AllowPKIAuth.\n"; @@ -1170,12 +1170,12 @@ sub checkauth { $domain =~ s|\.\*||g; if ( $ip !~ /^$domain/ ) { $loggedin = 0; - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); $info{'wrongip'} = 1; } } @@ -1258,12 +1258,12 @@ sub checkauth { { # successful login unless (@$cookie) { - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); } track_login_daily( $userid ); -- 2.20.1