Bug 14507 introduced the use of checkpw in C4::SIP::ILS::Patron so that non-Koha internal authentication processes would be able to function via SIP ( LDAP et al ). The problem is that checkpw changes the userenv to that of the patron! This is not usually an issue in Koha because most of the time that patron running through checkpw is the one to be logged in. Aside from SIP2 the only other area where this may be an issue is in SCO when using SelfCheckoutByLogin.
Created attachment 51390 [details] [review] Bug 16492 - Checkouts ( and possibly checkins and other actions ) will use the patron home branch as the logged in library Bug 14507 introduced the use of checkpw in C4::SIP::ILS::Patron so that non-Koha internal authentication processes would be able to function via SIP ( LDAP et al ). The problem is that checkpw changes the userenv to that of the patron! This is not usually an issue in Koha because most of the time that patron running through checkpw is the one to be logged in. Aside from SIP2 the only other area where this may be an issue is in SCO when using SelfCheckoutByLogin. Test Plan: 1) On master, check out an item to a patron via SIP2 2) Note the checkout lists the item as having been checked out from the patron's home library not matter which library is was supposed to be checked out from. 3) Apply this patch 4) Re-checkout the item 5) The item should now be checked out as if it was checked out from the library as defined in the SIP configuration file.
Created attachment 51391 [details] [review] Bug 16492 - Checkouts ( and possibly checkins and other actions ) will use the patron home branch as the logged in library Bug 14507 introduced the use of checkpw in C4::SIP::ILS::Patron so that non-Koha internal authentication processes would be able to function via SIP ( LDAP et al ). The problem is that checkpw changes the userenv to that of the patron! This is not usually an issue in Koha because most of the time that patron running through checkpw is the one to be logged in. Aside from SIP2 the only other area where this may be an issue is in SCO when using SelfCheckoutByLogin. Test Plan: 1) On master, check out an item to a patron via SIP2 2) Note the checkout lists the item as having been checked out from the patron's home library not matter which library is was supposed to be checked out from. 3) Apply this patch 4) Re-checkout the item 5) The item should now be checked out as if it was checked out from the library as defined in the SIP configuration file.
I think that we need a test for this one.
The call to checkpw in Patron.pm is weird and will probably make people think some magic is being invoked. the parameters should be more explicit i.e. : checkpw($dvh, $self->{userid}, $pwd, undef, undef, 1); with a comment to document
Created attachment 51744 [details] [review] Bug 16492 [QA Followup]
Created attachment 51745 [details] [review] Bug 16492 - Checkouts ( and possibly checkins and other actions ) will use the patron home branch as the logged in library Bug 14507 introduced the use of checkpw in C4::SIP::ILS::Patron so that non-Koha internal authentication processes would be able to function via SIP ( LDAP et al ). The problem is that checkpw changes the userenv to that of the patron! This is not usually an issue in Koha because most of the time that patron running through checkpw is the one to be logged in. Aside from SIP2 the only other area where this may be an issue is in SCO when using SelfCheckoutByLogin. Test Plan: 1) On master, check out an item to a patron via SIP2 2) Note the checkout lists the item as having been checked out from the patron's home library not matter which library is was supposed to be checked out from. 3) Apply this patch 4) Re-checkout the item 5) The item should now be checked out as if it was checked out from the library as defined in the SIP configuration file.
(In reply to Srdjan Jankovic from comment #3) > I think that we need a test for this one. Unit test added!
(In reply to Colin Campbell from comment #4) > The call to checkpw in Patron.pm is weird and will probably make people > think some magic is being invoked. the parameters should be more explicit > i.e. : > > checkpw($dvh, $self->{userid}, $pwd, undef, undef, 1); > > with a comment to document Fixed in new patch!
Created attachment 51768 [details] [review] Bug 16492 - Checkouts ( and possibly checkins and other actions ) will use the patron home branch as the logged in library Bug 14507 introduced the use of checkpw in C4::SIP::ILS::Patron so that non-Koha internal authentication processes would be able to function via SIP ( LDAP et al ). The problem is that checkpw changes the userenv to that of the patron! This is not usually an issue in Koha because most of the time that patron running through checkpw is the one to be logged in. Aside from SIP2 the only other area where this may be an issue is in SCO when using SelfCheckoutByLogin. Test Plan: 1) On master, check out an item to a patron via SIP2 2) Note the checkout lists the item as having been checked out from the patron's home library not matter which library is was supposed to be checked out from. 3) Apply this patch 4) Re-checkout the item 5) The item should now be checked out as if it was checked out from the library as defined in the SIP configuration file. Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 51797 [details] [review] Bug 16492: Test that no_set_userenv will not set userenv if not exist yet
Should not we just set a correct userenv instead of not creating at all? There are several places where an error could occur if not set.
(In reply to Jonathan Druart from comment #11) > Should not we just set a correct userenv instead of not creating at all? > There are several places where an error could occur if not set. That's a good idea. Would you be able to add that as a followup?
Created attachment 52188 [details] [review] Bug 16492 - Checkouts ( and possibly checkins and other actions ) will use the patron home branch as the logged in library Bug 14507 introduced the use of checkpw in C4::SIP::ILS::Patron so that non-Koha internal authentication processes would be able to function via SIP ( LDAP et al ). The problem is that checkpw changes the userenv to that of the patron! This is not usually an issue in Koha because most of the time that patron running through checkpw is the one to be logged in. Aside from SIP2 the only other area where this may be an issue is in SCO when using SelfCheckoutByLogin. Test Plan: 1) On master, check out an item to a patron via SIP2 2) Note the checkout lists the item as having been checked out from the patron's home library not matter which library is was supposed to be checked out from. 3) Apply this patch 4) Re-checkout the item 5) The item should now be checked out as if it was checked out from the library as defined in the SIP configuration file. Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 52189 [details] [review] Bug 16492: Test that no_set_userenv will not set userenv if not exist yet
Created attachment 52190 [details] [review] Bug 16492: Add a FIXME to explain the possible problem with no_set_userenv
(In reply to Kyle M Hall from comment #12) > (In reply to Jonathan Druart from comment #11) > > Should not we just set a correct userenv instead of not creating at all? > > There are several places where an error could occur if not set. > > That's a good idea. Would you be able to add that as a followup? I do not have the time right now. Let's see later, when we will need to reuse again this parameter.
Pushed to master for 16.11, thanks for the followups Jonathan!
Pushed in 16.05. Will be in 16.05.01.
Patch pushed to 3.22.x, will be in 3.22.8