Bug 35276 - Suggestions form crashes on Unknown column 'auth_forwarded_hash' when logging in
Summary: Suggestions form crashes on Unknown column 'auth_forwarded_hash' when logging in
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Marcel de Rooy
QA Contact: Katrin Fischer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-07 12:37 UTC by Marcel de Rooy
Modified: 2024-07-04 20:40 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes an issue when trying to directly access the suggestions management page in the staff interface ([YOURDOMAIN]/cgi-bin/koha/suggestion/suggestion.pl) when you are logged out. Previously, if you were logged out, tried to access the suggestions management page, and then entered your credentials, you would get an error trace.
Version(s) released in:
23.11.00,23.05.06,22.11.12
Circulation function:

Attachments
Bug 35276: Remove authentication params from suggestion hash (1.51 KB, patch)
2023-11-07 13:13 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Bug 35276: Remove authentication params from suggestion hash (1.52 KB, patch)
2023-11-07 20:38 UTC, David Nind 		Details | Diff | Splinter Review
Bug 35276: Remove authentication params from suggestion hash (1.57 KB, patch)
2023-11-10 20:03 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2023-11-07 12:37:57 UTC 
Seen in production on 22.11.
Still investigating further a bit. May affect severity later.

It seems that the Auth.pm originating auth_forwarded_hash is passed into a Koha Objects search. So it should be deleted before that point.

L426 my @suggestions = Koha::Suggestions->search_limited($search_params)->as_list;

Will still be adding comment(s).
Comment 1 Marcel de Rooy 2023-11-07 12:53:10 UTC 
And I am seeing a similar friend:

DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'koha_login_context' in 'where clause' at /usr/share/koha/Koha/Objects.pm line 394
 at /usr/share/perl5/DBIx/Class/Exception.pm line 77

Very similar issue actually.
Comment 2 Marcel de Rooy 2023-11-07 13:05:19 UTC 
Fix is underway.

When you login on the suggestion/suggestion.pl url, Auth will add a few params which are copied into the Koha Objects->as_list call. We need to remove them.

The fact that this only happens when directly hitting the URL when not logged in, makes me keep the current severity.

Some crash details:
DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'auth_forwarded_hash' in 'where clause' at /usr/share/koha/Koha/Objects.pm line 394
 at /usr/share/perl5/DBIx/Class/Exception.pm line 77
    DBIx::Class::Storage::DBI::_dbh_execute('DBIx::Class::Storage::DBI::mysql=HASH(0x5564b8285490)', 'DBI::db=HASH(0x5564baa26de0)', 'SELECT `me`.`suggestionid`, `me`.`suggestedby`, `me`.`suggesteddate`, `me`.`managedby`, `me`.`manageddate`, `me`.`acceptedby`, `me`.`accepteddate`, `me`.`rejectedby`, `me`.`rejecteddate`, `me`.`lastmodificationby`, `me`.`lastmodificationdate`, `me`.`STATUS`, `me`.`archived`, `me`.`note`, `me`.`staff_note`, `me`.`author`, `me`.`title`, `me`.`copyrightdate`, `me`.`publishercode`, `me`.`date`, `me`.`volumedesc`, `me`.`publicationyear`, `me`.`place`, `me`.`isbn`, `me`.`biblionumber`, `me`.`reason`, `me`.`patronreason`, `me`.`budgetid`, `me`.`branchcode`, `me`.`collectiontitle`, `me`.`itemtype`, `me`.`quantity`, `me`.`currency`, `me`.`price`, `me`.`total` FROM `suggestions` `me` WHERE ( ( `STATUS` = ? AND `archived` = ? AND `auth_forwarded_hash` = ? AND `branchcode` = ? AND `koha_login_context` = ? AND `password` = ? AND `userid` = ? ) )', 'ARRAY(0x5564b85a9e98)', 'ARRAY(0x5564bb7fc430)') called at /usr/share/perl5/DBIx/Class/Storage/DBI.pm line 856
        Koha::Objects::as_list('Koha::Suggestions=HASH(0x5564bd270de8)') called at /usr/share/koha/suggestion/suggestion.pl line 426
        eval {...} at /usr/share/koha/suggestion/suggestion.pl line 564

=> Look at the WHERE clause and note the presence of auth_forwarded_hash, koha_login_context, password and userid.

Actually, the suggestion code could be improved further. This should not be done really:
my $suggestion_ref  = { %{$input->Vars} }; # Copying, otherwise $input will be modified
Here we get the additional cruft from Auth into our suggestion hash.

The fix simply removes them without a complete refactor of the script.
Comment 3 Marcel de Rooy 2023-11-07 13:13:19 UTC 
Created attachment 158595 [details] [review]
Bug 35276: Remove authentication params from suggestion hash

These would be forwarded to Koha::Objects->as_list and crash on
unknown column.

Test plan:
Logout from staff.
Enter URL /suggestion/suggestion.pl
Without this patch, it crashes. Now it does not.

Note: The crash may show auth_forwarded_hash but I also saw
koha_login_context passing by. Same issue.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 David Nind 2023-11-07 20:38:55 UTC 
Created attachment 158620 [details] [review]
Bug 35276: Remove authentication params from suggestion hash

These would be forwarded to Koha::Objects->as_list and crash on
unknown column.

Test plan:
Logout from staff.
Enter URL /suggestion/suggestion.pl
Without this patch, it crashes. Now it does not.

Note: The crash may show auth_forwarded_hash but I also saw
koha_login_context passing by. Same issue.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Nind <david@davidnind.com>
Comment 5 David Nind 2023-11-07 20:47:34 UTC 
Testing notes (using KTD):

1. Make sure you are logged out of the staff interface.
2. Enter the URL: http://127.0.0.1:8081/cgi-bin/koha/suggestion/suggestion.pl
3. Enter your login details
4. You get an error trace:

   DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'koha_login_context' in 'where clause' at /kohadevbox/koha/Koha/Objects.pm line 399
   at /usr/share/perl5/DBIx/Class/Exception.pm line 77
...

5. Apply the patch, flush_memcached, restart_all, etc.
6. Repeat steps 1-3.
7. You now safely arrive at the suggestions management page.
Comment 6 Katrin Fischer 2023-11-10 20:03:02 UTC 
Created attachment 158821 [details] [review]
Bug 35276: Remove authentication params from suggestion hash

These would be forwarded to Koha::Objects->as_list and crash on
unknown column.

Test plan:
Logout from staff.
Enter URL /suggestion/suggestion.pl
Without this patch, it crashes. Now it does not.

Note: The crash may show auth_forwarded_hash but I also saw
koha_login_context passing by. Same issue.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Tomás Cohen Arazi (tcohen) 2023-11-14 13:33:06 UTC 
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-11-14 19:03:16 UTC 
Pushed to 23.05.x for 23.05.06
Comment 9 Matt Blenkinsop 2023-11-16 09:37:33 UTC 
Nice work everyone!

Pushed to oldstable for 22.11.x