From dd04b5817cc69dcf8070d5cc7fc6ea4bd47b75a4 Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 19 Jul 2018 16:57:22 +1000 Subject: [PATCH] Bug 13779: sessionID declared twice in C4::Auth::checkauth() The bug is that $sessionID is declared twice in C4::Auth::checkauth(). At the moment, this doesn't actually create a problem, because no one seems to be using the $sessionID which is returned by checkauth(), except in the case of opac/external/overdrive/auth.pl which skips the second declartion as it doesn't require auth. This patch removes the redefining of the $sessionID variable. In terms of testing, try logging in with a username and password and see if it works. The only risk this patch would pose is breaking auth I would think, since nothing is actually using the return value from checkauth() for $sessionID. NOTE: It was initially defined near the top of the function (~line 791). I believe the scoping would mean the correct version of $sessionID would be used in the latter lines for the unset'ing. I have skimmed code to see if the sessionID return value is used. I did not test overdrive, as I do not know how. However, this is the only area, I think this could possibly break. This change makes sense to me. QA: Please test overdrive. opac/external/overdrive/auth.pl only checks if the value is set, so this patch might fix/break something there? opac/svc/overdrive same kind of check. Signed-off-by: Mark Tompsett --- C4/Auth.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 8fd97289ec..4854477807 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -943,7 +943,7 @@ sub checkauth { $session->param( 'search_history', $anon_search_history ); } - my $sessionID = $session->id; + $sessionID = $session->id; C4::Context->_new_userenv($sessionID); $cookie = $query->cookie( -name => 'CGISESSID', -- 2.11.0