View | Details | Raw Unified | Return to bug 34893
Collapse All | Expand All

(-)a/C4/Auth.pm (-25 / +29 lines)
Lines 1940-1968 sub checkpw { Link Here
1940
    $type = 'opac' unless $type;
1940
    $type = 'opac' unless $type;
1941
1941
1942
    # Get shibboleth login attribute
1942
    # Get shibboleth login attribute
1943
    my $shib = C4::Context->config('useshibboleth') && shib_ok();
1943
    my $shib       = C4::Context->config('useshibboleth') && shib_ok();
1944
    my $shib_login = $shib ? get_login_shib() : undef;
1944
    my $shib_login = $shib ? get_login_shib() : undef;
1945
1945
1946
    my @return;
1946
    my @return;
1947
    my $patron;
1947
    my $patron;
1948
    if ( defined $userid ){
1948
    if ( defined $userid ) {
1949
        $patron = Koha::Patrons->find({ userid => $userid });
1949
        $patron = Koha::Patrons->find( { userid     => $userid } );
1950
        $patron = Koha::Patrons->find({ cardnumber => $userid }) unless $patron;
1950
        $patron = Koha::Patrons->find( { cardnumber => $userid } ) unless $patron;
1951
    }
1951
    }
1952
    my $check_internal_as_fallback = 0;
1952
    my $check_internal_as_fallback = 0;
1953
    my $passwd_ok = 0;
1953
    my $passwd_ok                  = 0;
1954
1954
    # Note: checkpw_* routines returns:
1955
    # Note: checkpw_* routines returns:
1955
    # 1 if auth is ok
1956
    # 1 if auth is ok
1956
    # 0 if auth is nok
1957
    # 0 if auth is nok
1957
    # -1 if user bind failed (LDAP only)
1958
    # -1 if user bind failed (LDAP only)
1958
1959
1959
    if ( $patron and ( $patron->account_locked )  ) {
1960
    if ( $patron and ( $patron->account_locked ) ) {
1961
1960
        # Nothing to check, account is locked
1962
        # Nothing to check, account is locked
1961
    } elsif ($ldap && defined($password)) {
1963
    } elsif ( $ldap && defined($password) ) {
1962
        my ( $retval, $retcard, $retuserid );
1964
        my ( $retval, $retcard, $retuserid );
1963
        ( $retval, $retcard, $retuserid, $patron ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1965
        ( $retval, $retcard, $retuserid, $patron ) = checkpw_ldap(@_);    # EXTERNAL AUTH
1964
        if ( $retval == 1 ) {
1966
        if ( $retval == 1 ) {
1965
            @return = ( $retval, $retcard, $retuserid, $patron );
1967
            @return    = ( $retval, $retcard, $retuserid, $patron );
1966
            $passwd_ok = 1;
1968
            $passwd_ok = 1;
1967
        }
1969
        }
1968
        $check_internal_as_fallback = 1 if $retval == 0;
1970
        $check_internal_as_fallback = 1 if $retval == 0;
Lines 1971-1979 sub checkpw { Link Here
1971
1973
1972
        # In case of a CAS authentication, we use the ticket instead of the password
1974
        # In case of a CAS authentication, we use the ticket instead of the password
1973
        my $ticket = $query->param('ticket');
1975
        my $ticket = $query->param('ticket');
1974
        $query->delete('ticket');                                   # remove ticket to come back to original URL
1976
        $query->delete('ticket');                                         # remove ticket to come back to original URL
1975
        my ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) = checkpw_cas( $ticket, $query, $type );    # EXTERNAL AUTH
1977
        my ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) =
1976
        if ( $retval ) {
1978
            checkpw_cas( $ticket, $query, $type );                        # EXTERNAL AUTH
1979
        if ($retval) {
1977
            @return = ( $retval, $retcard, $retuserid, $patron, $cas_ticket );
1980
            @return = ( $retval, $retcard, $retuserid, $patron, $cas_ticket );
1978
        } else {
1981
        } else {
1979
            @return = (0);
1982
            @return = (0);
Lines 1992-1999 sub checkpw { Link Here
1992
1995
1993
        # Then, we check if it matches a valid koha user
1996
        # Then, we check if it matches a valid koha user
1994
        if ($shib_login) {
1997
        if ($shib_login) {
1995
            my ( $retval, $retcard, $retuserid, $patron ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
1998
            my ( $retval, $retcard, $retuserid, $patron ) =
1996
            if ( $retval ) {
1999
                C4::Auth_with_shibboleth::checkpw_shib($shib_login);    # EXTERNAL AUTH
2000
            if ($retval) {
1997
                @return = ( $retval, $retcard, $retuserid, $patron );
2001
                @return = ( $retval, $retcard, $retuserid, $patron );
1998
            }
2002
            }
1999
            $passwd_ok = $retval;
2003
            $passwd_ok = $retval;
Lines 2003-2029 sub checkpw { Link Here
2003
    }
2007
    }
2004
2008
2005
    # INTERNAL AUTH
2009
    # INTERNAL AUTH
2006
    if ( $check_internal_as_fallback ) {
2010
    if ($check_internal_as_fallback) {
2007
        @return = checkpw_internal( $userid, $password, $no_set_userenv);
2011
        @return = checkpw_internal( $userid, $password, $no_set_userenv );
2008
        push(@return, $patron);
2012
        push( @return, $patron );
2009
        $passwd_ok = 1 if $return[0] > 0; # 1 or 2
2013
        $passwd_ok = 1 if $return[0] > 0;    # 1 or 2
2010
    }
2014
    }
2011
2015
2012
    if( $patron ) {
2016
    if ($patron) {
2013
        if ( $passwd_ok ) {
2017
        if ($passwd_ok) {
2014
            $patron->update({ login_attempts => 0 });
2018
            $patron->update( { login_attempts => 0 } );
2015
            if( $patron->password_expired ){
2019
            if ( $patron->password_expired ) {
2016
                @return = (-2);
2020
                @return = (-2);
2017
            }
2021
            }
2018
        } elsif( !$patron->account_locked ) {
2022
        } elsif ( !$patron->account_locked ) {
2019
            $patron->update({ login_attempts => $patron->login_attempts + 1 });
2023
            $patron->update( { login_attempts => $patron->login_attempts + 1 } );
2020
        }
2024
        }
2021
    }
2025
    }
2022
2026
2023
    # Optionally log success or failure
2027
    # Optionally log success or failure
2024
    if( $patron && $passwd_ok && C4::Context->preference('AuthSuccessLog') ) {
2028
    if ( $patron && $passwd_ok && C4::Context->preference('AuthSuccessLog') ) {
2025
        logaction( 'AUTH', 'SUCCESS', $patron->id, "Valid password for $userid", $type );
2029
        logaction( 'AUTH', 'SUCCESS', $patron->id, "Valid password for $userid", $type );
2026
    } elsif( !$passwd_ok && C4::Context->preference('AuthFailureLog') ) {
2030
    } elsif ( !$passwd_ok && C4::Context->preference('AuthFailureLog') ) {
2027
        logaction( 'AUTH', 'FAILURE', $patron ? $patron->id : 0, "Wrong password for $userid", $type );
2031
        logaction( 'AUTH', 'FAILURE', $patron ? $patron->id : 0, "Wrong password for $userid", $type );
2028
    }
2032
    }
2029
2033
(-)a/C4/Auth_with_cas.pm (-5 / +5 lines)
Lines 117-129 sub checkpw_cas { Link Here
117
            # we should store the CAS ticekt too, we need this for single logout https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#233-single-logout
117
            # we should store the CAS ticekt too, we need this for single logout https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#233-single-logout
118
118
119
            # Does it match one of our users ?
119
            # Does it match one of our users ?
120
            my $dbh = C4::Context->dbh;
120
            my $dbh    = C4::Context->dbh;
121
            my $patron = Koha::Patrons->find({ userid => $userid });
121
            my $patron = Koha::Patrons->find( { userid => $userid } );
122
            if ( $patron ) {
122
            if ($patron) {
123
                return ( 1, $patron->cardnumber, $patron->userid, $ticket, $patron );
123
                return ( 1, $patron->cardnumber, $patron->userid, $ticket, $patron );
124
            }
124
            }
125
            $patron = Koha::Patrons->find({ cardnumber => $userid });
125
            $patron = Koha::Patrons->find( { cardnumber => $userid } );
126
            if ( $patron ) {
126
            if ($patron) {
127
                return ( 1, $patron->cardnumber, $patron->userid, $ticket, $patron );
127
                return ( 1, $patron->cardnumber, $patron->userid, $ticket, $patron );
128
            }
128
            }
129
129
(-)a/t/db_dependent/ILSDI_Services.t (-28 / +33 lines)
Lines 1052-1092 subtest 'Bug 34893: ILS-DI can return the wrong patron for AuthenticatePatron' = Link Here
1052
1052
1053
    my $plain_password = 'tomasito';
1053
    my $plain_password = 'tomasito';
1054
1054
1055
    $builder->build({
1055
    $builder->build(
1056
        source => 'Borrower',
1056
        {
1057
        value => {
1057
            source => 'Borrower',
1058
            cardnumber => undef,
1058
            value  => {
1059
                cardnumber => undef,
1060
            }
1059
        }
1061
        }
1060
    });
1062
    );
1061
1063
1062
    my $borrower0 = $builder->build({
1064
    my $borrower0 = $builder->build(
1063
        source => 'Borrower',
1065
        {
1064
        value  => {
1066
            source => 'Borrower',
1065
            cardnumber => "cardnumber1",
1067
            value  => {
1066
            userid => undef,
1068
                cardnumber => "cardnumber1",
1067
            password => Koha::AuthUtils::hash_password( $plain_password ),
1069
                userid     => undef,
1068
            lastseen => "2001-01-01 12:34:56"
1070
                password   => Koha::AuthUtils::hash_password($plain_password),
1071
                lastseen   => "2001-01-01 12:34:56"
1072
            }
1069
        }
1073
        }
1070
    });
1074
    );
1071
1075
1072
    my $borrower = $builder->build({
1076
    my $borrower = $builder->build(
1073
        source => 'Borrower',
1077
        {
1074
        value  => {
1078
            source => 'Borrower',
1075
            cardnumber => "cardnumber2",
1079
            value  => {
1076
            userid => undef,
1080
                cardnumber => "cardnumber2",
1077
            password => Koha::AuthUtils::hash_password( $plain_password ),
1081
                userid     => undef,
1078
            lastseen => "2001-01-01 12:34:56"
1082
                password   => Koha::AuthUtils::hash_password($plain_password),
1083
                lastseen   => "2001-01-01 12:34:56"
1084
            }
1079
        }
1085
        }
1080
    });
1086
    );
1081
1087
1082
    my $query = CGI->new;
1088
    my $query = CGI->new;
1083
    $query->param( 'username', $borrower->{cardnumber});
1089
    $query->param( 'username', $borrower->{cardnumber} );
1084
    $query->param( 'password', $plain_password);
1090
    $query->param( 'password', $plain_password );
1085
1091
1086
    my $reply = C4::ILSDI::Services::AuthenticatePatron( $query );
1092
    my $reply = C4::ILSDI::Services::AuthenticatePatron($query);
1087
    is( $reply->{id}, $borrower->{borrowernumber}, "userid and password - Patron authenticated" );
1093
    is( $reply->{id},   $borrower->{borrowernumber}, "userid and password - Patron authenticated" );
1088
    is( $reply->{code}, undef, "Error code undef");
1094
    is( $reply->{code}, undef,                       "Error code undef" );
1089
    my $seen_patron = Koha::Patrons->find({ borrowernumber => $reply->{id} });
1095
    my $seen_patron = Koha::Patrons->find( { borrowernumber => $reply->{id} } );
1090
1096
1091
    $schema->storage->txn_rollback;
1097
    $schema->storage->txn_rollback;
1092
};
1098
};
1093
- 

Return to bug 34893