When using koha-testing-docker or any other Koha that uses the same domain name (or IP address) for OPAC and staff interface, there is a hole in the staff interface authorization. If you log into the OPAC as a user with no flags, you can see a restricted view of /cgi-bin/koha/tools/tools-home.pl instead of seeing the login screen. It's a very limited view, but it's still a view of the staff interface when the user should not be able to see anything. -- tools-home.php uses an arrayref instead of a hashref for "flagsrequired" so I'd say there is a subtle bug there. Looks like Bug 26628 probably caused this regression.
According to Auth.pm docs, an arrayref needs to be used like this: $flagsrequired = [ 'a_flag', 'b_flag' ]; $flagsrequired = { 'a_flag' => [ 'sub_a, 'sub_b' ] }; But we're using it like this: flagsrequired => [ tools => '*', clubs => '*' ] -- Looking at C4::Auth::_dispatch now...
Yeah it looks like the following is syntactically invalid and C4::Auth::_dispatch just silently fails to perform authorization on this page: flagsrequired => [ tools => '*', clubs => '*' ]
(In reply to David Cook from comment #2) > Yeah it looks like the following is syntactically invalid and > C4::Auth::_dispatch just silently fails to perform authorization on this > page: flagsrequired => [ tools => '*', clubs => '*' ] Ah right because [ tools => '*', clubs => '*' ] is the same as saying ['tools','*','clubs','*']
Yeah, I don't think there's any way that the change from bug 26628 is going to work without refactoring C4::Auth::_dispatch I see that t/db_dependent/Auth/haspermission.t has a lot of use of arrayrefs, but I don't think they're doing what we think they're doing. C4::Auth::_dispatch defaults to authorized when it should actually default to not authorized... so if you feed it something it can't handle it just defaults to authorized. I think the shortest path here is just to revert Bug 26628 and then improve Koha's authorizations.
(In reply to David Cook from comment #4) > I think the shortest path here is just to revert Bug 26628 and then improve > Koha's authorizations. It actually doesn't need to be that complicated. In Koha::Auth::Permissions, I create an authorization hashref with the "CAN_user_" prefix. We could easily do a different version like this: $authz->{clubs} = 1 or $authz->{clubs}->{'enroll'} = 1 If the flagsrequired is any, then it just needs to test for the existence of the module permission (ie 'clubs'). If it needs to find a specific permission, it checks for the module permission, and then it checks for the subpermission as a key of that permission (or if it's a 1 instead of a ref then you return as authorized). For backwards compatibility, we just need to make sure we honour "flagsrequired".
Created attachment 151065 [details] [review] Bug 33595: (bug 26628 follow-up) Fix authorization for tools-home.pl If you log into the OPAC as a user with no flags, you can see a restricted view of /cgi-bin/koha/tools/tools-home.pl instead of seeing the login screen. Test plan: Use a patron with catalogue permission only Login and access the tools home page => redirected to the login screen Add a club sub permission Login and access the tools home page => You see the tools home page with the clubs link Add a tool sub permission, remove club Login and access the tools home page => You see the tools home page with the relevant link
Created attachment 151108 [details] [review] Bug 33595: (bug 26628 follow-up) Fix authorization for tools-home.pl If you log into the OPAC as a user with no flags, you can see a restricted view of /cgi-bin/koha/tools/tools-home.pl instead of seeing the login screen. Test plan: Use a patron with catalogue permission only Login and access the tools home page => redirected to the login screen Add a club sub permission Login and access the tools home page => You see the tools home page with the clubs link Add a tool sub permission, remove club Login and access the tools home page => You see the tools home page with the relevant link Signed-off-by: David Cook <dcook@prosentient.com.au>
Thanks, Jonathan. That's much better. -- Although it makes me realize that "catalogue" isn't actually required for staff access... but I'll open a different report for that...
Created attachment 151114 [details] [review] Bug 33595: (bug 26628 follow-up) Fix authorization for tools-home.pl If you log into the OPAC as a user with no flags, you can see a restricted view of /cgi-bin/koha/tools/tools-home.pl instead of seeing the login screen. Test plan: Use a patron with catalogue permission only Login and access the tools home page => redirected to the login screen Add a club sub permission Login and access the tools home page => You see the tools home page with the clubs link Add a tool sub permission, remove club Login and access the tools home page => You see the tools home page with the relevant link Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to master for 23.05
Nice work everyone! Pushed to 22.11.x for next release