|
Lines 10-20
use CGI qw ( -utf8 );
Link Here
|
| 10 |
use Test::MockObject; |
10 |
use Test::MockObject; |
| 11 |
use Test::MockModule; |
11 |
use Test::MockModule; |
| 12 |
use List::MoreUtils qw/all any none/; |
12 |
use List::MoreUtils qw/all any none/; |
| 13 |
use Test::More tests => 24; |
13 |
use Test::More tests => 14; |
| 14 |
use Test::Warn; |
14 |
use Test::Warn; |
| 15 |
use t::lib::Mocks; |
15 |
use t::lib::Mocks; |
| 16 |
use t::lib::TestBuilder; |
16 |
use t::lib::TestBuilder; |
| 17 |
|
17 |
|
|
|
18 |
use C4::Auth; |
| 18 |
use C4::Members; |
19 |
use C4::Members; |
| 19 |
use Koha::AuthUtils qw/hash_password/; |
20 |
use Koha::AuthUtils qw/hash_password/; |
| 20 |
use Koha::Database; |
21 |
use Koha::Database; |
|
Lines 201-207
subtest 'checkpw lockout tests' => sub {
Link Here
|
| 201 |
|
202 |
|
| 202 |
# get_template_and_user tests |
203 |
# get_template_and_user tests |
| 203 |
|
204 |
|
| 204 |
{ # Tests for the language URL parameter |
205 |
subtest 'get_template_and_user' => sub { # Tests for the language URL parameter |
| 205 |
|
206 |
|
| 206 |
sub MockedCheckauth { |
207 |
sub MockedCheckauth { |
| 207 |
my ($query,$authnotrequired,$flagsrequired,$type) = @_; |
208 |
my ($query,$authnotrequired,$flagsrequired,$type) = @_; |
|
Lines 342-348
subtest 'checkpw lockout tests' => sub {
Link Here
|
| 342 |
); |
343 |
); |
| 343 |
is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); |
344 |
is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); |
| 344 |
is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); |
345 |
is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); |
| 345 |
} |
346 |
|
|
|
347 |
delete $ENV{"HTTP_COOKIE"}; |
| 348 |
}; |
| 346 |
|
349 |
|
| 347 |
# Check that there is always an OPACBaseURL set. |
350 |
# Check that there is always an OPACBaseURL set. |
| 348 |
my $input = CGI->new(); |
351 |
my $input = CGI->new(); |
|
Lines 479-482
subtest 'check_cookie_auth' => sub {
Link Here
|
| 479 |
#FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission |
482 |
#FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission |
| 480 |
}; |
483 |
}; |
| 481 |
|
484 |
|
|
|
485 |
subtest 'checkauth & check_cookie_auth' => sub { |
| 486 |
plan tests => 27; |
| 487 |
|
| 488 |
# flags = 4 => { catalogue => 1 } |
| 489 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
| 490 |
my $password = 'password'; |
| 491 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
| 492 |
$patron->set_password( { password => $password } ); |
| 493 |
|
| 494 |
my $cgi_mock = Test::MockModule->new('CGI'); |
| 495 |
$cgi_mock->mock( 'request_method', sub { return 'POST' } ); |
| 496 |
|
| 497 |
my $cgi = CGI->new; |
| 498 |
|
| 499 |
my $auth = Test::MockModule->new( 'C4::Auth' ); |
| 500 |
# Tests will fail if we hit safe_exit |
| 501 |
$auth->mock( 'safe_exit', sub { return } ); |
| 502 |
|
| 503 |
my ( $userid, $cookie, $sessionID, $flags ); |
| 504 |
{ |
| 505 |
# checkauth will redirect and safe_exit if not authenticated and not authorized |
| 506 |
local *STDOUT; |
| 507 |
my $stdout; |
| 508 |
open STDOUT, '>', \$stdout; |
| 509 |
C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 510 |
like( $stdout, qr{<title>\s*Log in to your account} ); |
| 511 |
$sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef; |
| 512 |
ok($sessionID); |
| 513 |
close STDOUT; |
| 514 |
}; |
| 515 |
|
| 516 |
my $first_sessionID = $sessionID; |
| 517 |
|
| 518 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
| 519 |
# Not authenticated yet, checkauth didn't return the session |
| 520 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 521 |
is( $sessionID, undef); |
| 522 |
is( $userid, undef); |
| 523 |
|
| 524 |
# Same here, check_cookie_auth does not return the session |
| 525 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
| 526 |
is( $auth_status, 'failed' ); |
| 527 |
is( $session, undef ); |
| 528 |
|
| 529 |
# Simulating the login form submission |
| 530 |
$cgi->param('userid', $patron->userid); |
| 531 |
$cgi->param('password', $password); |
| 532 |
|
| 533 |
# Logged in! |
| 534 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 535 |
is( $sessionID, $first_sessionID ); |
| 536 |
is( $userid, $patron->userid ); |
| 537 |
|
| 538 |
( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
| 539 |
is( $auth_status, 'ok' ); |
| 540 |
is( $session->id, $first_sessionID ); |
| 541 |
|
| 542 |
# Logging out! |
| 543 |
$cgi->param('logout.x', 1); |
| 544 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 545 |
is( $sessionID, undef ); |
| 546 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
| 547 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
| 548 |
is( $auth_status, "expired"); |
| 549 |
is( $session, undef ); |
| 550 |
|
| 551 |
{ |
| 552 |
# Trying to access without sessionID |
| 553 |
undef $ENV{"HTTP_COOKIE"}; |
| 554 |
$cgi = CGI->new; |
| 555 |
( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1}); |
| 556 |
is( $auth_status, 'failed' ); |
| 557 |
is( $session, undef ); |
| 558 |
|
| 559 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 560 |
is( $userid, undef ); |
| 561 |
is( $sessionID, undef ); |
| 562 |
|
| 563 |
} |
| 564 |
|
| 565 |
{ |
| 566 |
# Hit unauthorized page then reuse the cookie |
| 567 |
undef $ENV{"HTTP_COOKIE"}; |
| 568 |
$cgi = CGI->new; |
| 569 |
# Logging in |
| 570 |
$cgi->param('userid', $patron->userid); |
| 571 |
$cgi->param('password', $password); |
| 572 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 573 |
is( $userid, $patron->userid ); |
| 574 |
$first_sessionID = $sessionID; |
| 575 |
|
| 576 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
| 577 |
|
| 578 |
# Patron does not have the borrowers permission |
| 579 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); |
| 580 |
is( $userid, undef ); |
| 581 |
is( $sessionID, undef ); |
| 582 |
|
| 583 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1}); |
| 584 |
is( $auth_status, "failed" ); |
| 585 |
is( $session, undef ); |
| 586 |
|
| 587 |
# Reuse the cookie |
| 588 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 589 |
is( $userid, $patron->userid ); |
| 590 |
is( $sessionID, $first_sessionID ); |
| 591 |
|
| 592 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
| 593 |
is( $auth_status, "ok" ); |
| 594 |
is( $session, $first_sessionID ); |
| 595 |
} |
| 596 |
}; |
| 597 |
|
| 482 |
$schema->storage->txn_rollback; |
598 |
$schema->storage->txn_rollback; |
| 483 |
- |
|
|