Bug 36092 - sessionID not passed to the template on auth.tt
Summary: sessionID not passed to the template on auth.tt
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 35890
Blocks: 34478
  Show dependency treegraph
 
Reported: 2024-02-14 09:53 UTC by Jonathan Druart
Modified: 2024-03-11 08:58 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.03,23.05.09


Attachments
Bug 36092: Add test (2.31 KB, patch)
2024-02-14 10:48 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36092: Pass the sessionID from checkauth if we hit auth (825 bytes, patch)
2024-02-14 10:48 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36092: Pass sessionID at the end of get_template_and_user (2.77 KB, patch)
2024-02-14 10:48 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36092: Add test (2.07 KB, patch)
2024-02-14 11:27 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36092: Pass the sessionID from checkauth if we hit auth (825 bytes, patch)
2024-02-14 11:27 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36092: Pass sessionID at the end of get_template_and_user (2.60 KB, patch)
2024-02-14 11:27 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36092: Add test (2.01 KB, patch)
2024-02-14 16:59 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 36092: Pass the sessionID from checkauth if we hit auth (881 bytes, patch)
2024-02-14 16:59 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 36092: Pass sessionID at the end of get_template_and_user (2.66 KB, patch)
2024-02-14 16:59 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 36092: Add test (2.08 KB, patch)
2024-02-15 09:38 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 36092: Pass the sessionID from checkauth if we hit auth (946 bytes, patch)
2024-02-15 09:38 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 36092: Pass sessionID at the end of get_template_and_user (2.72 KB, patch)
2024-02-15 09:38 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2024-02-14 09:53:03 UTC
The session's ID is not passed to the template and not stored in the context when we are on the authentication page.

It can be problematic, for instance we will not be able to generate a CSRF token for the login form.
Comment 1 Jonathan Druart 2024-02-14 10:48:09 UTC
Created attachment 162139 [details] [review]
Bug 36092: Add test
Comment 2 Jonathan Druart 2024-02-14 10:48:11 UTC
Created attachment 162140 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template
Comment 3 Jonathan Druart 2024-02-14 10:48:13 UTC
Created attachment 162141 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.
Comment 4 Jonathan Druart 2024-02-14 10:58:33 UTC
Do not trust me
Comment 5 Jonathan Druart 2024-02-14 11:27:36 UTC
Created attachment 162142 [details] [review]
Bug 36092: Add test
Comment 6 Jonathan Druart 2024-02-14 11:27:39 UTC
Created attachment 162143 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template
Comment 7 Jonathan Druart 2024-02-14 11:27:41 UTC
Created attachment 162144 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.
Comment 8 David Nind 2024-02-14 13:56:21 UTC
I'm getting a sha1 error when applying the patches:

Apply? [(y)es, (n)o, (i)nteractive] y
Applying: Bug 36092: Add test
error: sha1 information is lacking or useless (t/db_dependent/Auth.t).
error: could not build fake ancestor
Patch failed at 0001 Bug 36092: Add test

I was going to make sure that the tests (prove prove t/db_dependent/Auth.t) pass before and after the patches are applied. Is there anything else required to sign off/test?
Comment 9 Kyle M Hall 2024-02-14 16:59:13 UTC
Created attachment 162158 [details] [review]
Bug 36092: Add test

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Kyle M Hall 2024-02-14 16:59:26 UTC
Created attachment 162160 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 11 Kyle M Hall 2024-02-14 16:59:28 UTC
Created attachment 162161 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 12 Martin Renvoize 2024-02-15 09:38:01 UTC
Created attachment 162189 [details] [review]
Bug 36092: Add test

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 13 Martin Renvoize 2024-02-15 09:38:03 UTC
Created attachment 162190 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 14 Martin Renvoize 2024-02-15 09:38:06 UTC
Created attachment 162191 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 15 Martin Renvoize 2024-02-15 09:38:48 UTC
This makes a lot of sense and is well covered by tests. I'm happy I couldn't find any regressions. QA scripts are happy too.

Passing QA
Comment 16 Martin Renvoize 2024-02-15 09:49:29 UTC
Pushed to master for 24.05.00
Comment 17 Fridolin Somers 2024-03-11 08:57:09 UTC
Pushed to 23.11.03
Comment 18 Fridolin Somers 2024-03-11 08:57:57 UTC
In 23.05.09
Comment 19 Fridolin Somers 2024-03-11 08:58:29 UTC
I see it in 22.05.x but not in 22.11.x