Lines 483-489
subtest 'check_cookie_auth' => sub {
Link Here
|
483 |
}; |
483 |
}; |
484 |
|
484 |
|
485 |
subtest 'checkauth & check_cookie_auth' => sub { |
485 |
subtest 'checkauth & check_cookie_auth' => sub { |
486 |
plan tests => 27; |
486 |
plan tests => 29; |
487 |
|
487 |
|
488 |
# flags = 4 => { catalogue => 1 } |
488 |
# flags = 4 => { catalogue => 1 } |
489 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
489 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
Lines 517-528
subtest 'checkauth & check_cookie_auth' => sub {
Link Here
|
517 |
|
517 |
|
518 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
518 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
519 |
# Not authenticated yet, checkauth didn't return the session |
519 |
# Not authenticated yet, checkauth didn't return the session |
520 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
520 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, undef, undef, undef, { skip_auth_template => 1 } ); |
521 |
is( $sessionID, undef); |
521 |
is( $sessionID, undef); |
522 |
is( $userid, undef); |
522 |
is( $userid, undef); |
523 |
|
523 |
|
524 |
# Same here, check_cookie_auth does not return the session |
524 |
# Sending undefined fails obviously |
525 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
525 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} ); |
526 |
is( $auth_status, 'failed' ); |
526 |
is( $auth_status, 'failed' ); |
527 |
is( $session, undef ); |
527 |
is( $session, undef ); |
528 |
|
528 |
|
Lines 544-597
subtest 'checkauth & check_cookie_auth' => sub {
Link Here
|
544 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
544 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
545 |
is( $sessionID, undef ); |
545 |
is( $sessionID, undef ); |
546 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
546 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
547 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
547 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} ); |
548 |
is( $auth_status, "expired"); |
548 |
is( $auth_status, "expired"); |
549 |
is( $session, undef ); |
549 |
is( $session, undef ); |
550 |
|
550 |
|
551 |
{ |
551 |
{ |
552 |
# Trying to access without sessionID |
552 |
# Trying to access without sessionID |
553 |
undef $ENV{"HTTP_COOKIE"}; |
|
|
554 |
$cgi = CGI->new; |
553 |
$cgi = CGI->new; |
555 |
( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1}); |
554 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( undef, {catalogue => 1}); |
556 |
is( $auth_status, 'failed' ); |
555 |
is( $auth_status, 'failed' ); |
557 |
is( $session, undef ); |
556 |
is( $session, undef ); |
558 |
|
557 |
|
559 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
558 |
# This will fail on permissions |
|
|
559 |
undef $ENV{"HTTP_COOKIE"}; |
560 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, undef, undef, undef, { skip_auth_template => 1 } ); |
560 |
is( $userid, undef ); |
561 |
is( $userid, undef ); |
561 |
is( $sessionID, undef ); |
562 |
is( $sessionID, undef ); |
562 |
|
|
|
563 |
} |
563 |
} |
564 |
|
564 |
|
565 |
{ |
565 |
{ |
566 |
# Hit unauthorized page then reuse the cookie |
566 |
# First logging in |
567 |
undef $ENV{"HTTP_COOKIE"}; |
|
|
568 |
$cgi = CGI->new; |
567 |
$cgi = CGI->new; |
569 |
# Logging in |
|
|
570 |
$cgi->param('userid', $patron->userid); |
568 |
$cgi->param('userid', $patron->userid); |
571 |
$cgi->param('password', $password); |
569 |
$cgi->param('password', $password); |
572 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
570 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
573 |
is( $userid, $patron->userid ); |
571 |
is( $userid, $patron->userid ); |
574 |
$first_sessionID = $sessionID; |
572 |
$first_sessionID = $sessionID; |
575 |
|
573 |
|
576 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
|
|
577 |
|
578 |
# Patron does not have the borrowers permission |
574 |
# Patron does not have the borrowers permission |
579 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); |
575 |
# $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; # not needed, we use $cgi here |
|
|
576 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}, undef, undef, undef, { skip_auth_template => 1 } ); |
580 |
is( $userid, undef ); |
577 |
is( $userid, undef ); |
581 |
is( $sessionID, undef ); |
578 |
is( $sessionID, undef ); |
582 |
|
579 |
|
583 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1}); |
580 |
# When calling check_cookie_auth, the session will be deleted |
|
|
581 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); |
584 |
is( $auth_status, "failed" ); |
582 |
is( $auth_status, "failed" ); |
585 |
is( $session, undef ); |
583 |
is( $session, undef ); |
|
|
584 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); |
585 |
is( $auth_status, 'expired', 'Session no longer exists' ); |
586 |
|
586 |
|
587 |
# Reuse the cookie |
587 |
# Try reusing the deleted session: since it does not exist, we should get a new one now when passing correct permissions |
|
|
588 |
$cgi->cookie( -name => 'CGISESSID', value => $first_sessionID ); |
588 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
589 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
589 |
is( $userid, $patron->userid ); |
590 |
is( $userid, $patron->userid ); |
590 |
is( $sessionID, $first_sessionID ); |
591 |
isnt( $sessionID, undef, 'Check if we have a sessionID' ); |
591 |
|
592 |
isnt( $sessionID, $first_sessionID, 'New value expected' ); |
592 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
593 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID, {catalogue => 1} ); |
593 |
is( $auth_status, "ok" ); |
594 |
is( $auth_status, "ok" ); |
594 |
is( $session, $first_sessionID ); |
595 |
is( $session->id, $sessionID, 'Same session' ); |
595 |
} |
596 |
} |
596 |
}; |
597 |
}; |
597 |
|
598 |
|
598 |
- |
|
|