From 59704c3960a5daee0eae3e2cc4488944ac874789 Mon Sep 17 00:00:00 2001 From: Robin Sheat Date: Wed, 29 Apr 2015 17:26:11 +1200 Subject: [PATCH] Bug 13932: unset userenv when using trusted header As the trusted header system doesn't keep a session hanging around, when running with plack it can end up with the userenv of another user, which is bad. So this clears it forcing it to be recreated cleanly. --- C4/Auth.pm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 6090f6b..3451bad 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -698,6 +698,10 @@ sub checkauth { -expires => '', -HttpOnly => 1, ); + + # Unset the userenv as we don't have a sessionID anyway, and it risks + # getting the environment for another user, which is quite bad. + C4::Context::_new_userenv(undef); $loggedin = check_user_exists($userid); } elsif ( $persona ){ # we dont want to set a session because we are being called by a persona callback @@ -886,7 +890,7 @@ sub checkauth { $return = $value ? 1 : 0; $userid = $value; - } + } else { my $retuserid; ( $return, $cardnumber, $retuserid ) = -- 2.1.0