Lines 10-16
use CGI qw ( -utf8 );
Link Here
|
10 |
use Test::MockObject; |
10 |
use Test::MockObject; |
11 |
use Test::MockModule; |
11 |
use Test::MockModule; |
12 |
use List::MoreUtils qw/all any none/; |
12 |
use List::MoreUtils qw/all any none/; |
13 |
use Test::More tests => 14; |
13 |
use Test::More tests => 15; |
14 |
use Test::Warn; |
14 |
use Test::Warn; |
15 |
use t::lib::Mocks; |
15 |
use t::lib::Mocks; |
16 |
use t::lib::TestBuilder; |
16 |
use t::lib::TestBuilder; |
Lines 483-489
subtest 'check_cookie_auth' => sub {
Link Here
|
483 |
}; |
483 |
}; |
484 |
|
484 |
|
485 |
subtest 'checkauth & check_cookie_auth' => sub { |
485 |
subtest 'checkauth & check_cookie_auth' => sub { |
486 |
plan tests => 27; |
486 |
plan tests => 31; |
487 |
|
487 |
|
488 |
# flags = 4 => { catalogue => 1 } |
488 |
# flags = 4 => { catalogue => 1 } |
489 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
489 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
Lines 517-528
subtest 'checkauth & check_cookie_auth' => sub {
Link Here
|
517 |
|
517 |
|
518 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
518 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
519 |
# Not authenticated yet, checkauth didn't return the session |
519 |
# Not authenticated yet, checkauth didn't return the session |
520 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
520 |
{ |
|
|
521 |
local *STDOUT; |
522 |
my $stdout; |
523 |
open STDOUT, '>', \$stdout; |
524 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} ); |
525 |
close STDOUT; |
526 |
} |
521 |
is( $sessionID, undef); |
527 |
is( $sessionID, undef); |
522 |
is( $userid, undef); |
528 |
is( $userid, undef); |
523 |
|
529 |
|
524 |
# Same here, check_cookie_auth does not return the session |
530 |
# Sending undefined fails obviously |
525 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
531 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} ); |
526 |
is( $auth_status, 'failed' ); |
532 |
is( $auth_status, 'failed' ); |
527 |
is( $session, undef ); |
533 |
is( $session, undef ); |
528 |
|
534 |
|
Lines 544-598
subtest 'checkauth & check_cookie_auth' => sub {
Link Here
|
544 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
550 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
545 |
is( $sessionID, undef ); |
551 |
is( $sessionID, undef ); |
546 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
552 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
547 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
553 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} ); |
548 |
is( $auth_status, "expired"); |
554 |
is( $auth_status, "expired"); |
549 |
is( $session, undef ); |
555 |
is( $session, undef ); |
550 |
|
556 |
|
551 |
{ |
557 |
{ |
552 |
# Trying to access without sessionID |
558 |
# Trying to access without sessionID |
553 |
undef $ENV{"HTTP_COOKIE"}; |
|
|
554 |
$cgi = CGI->new; |
559 |
$cgi = CGI->new; |
555 |
( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1}); |
560 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( undef, {catalogue => 1}); |
556 |
is( $auth_status, 'failed' ); |
561 |
is( $auth_status, 'failed' ); |
557 |
is( $session, undef ); |
562 |
is( $session, undef ); |
558 |
|
563 |
|
559 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
564 |
# This will fail on permissions |
|
|
565 |
undef $ENV{"HTTP_COOKIE"}; |
566 |
{ |
567 |
local *STDOUT; |
568 |
my $stdout; |
569 |
open STDOUT, '>', \$stdout; |
570 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} ); |
571 |
close STDOUT; |
572 |
} |
560 |
is( $userid, undef ); |
573 |
is( $userid, undef ); |
561 |
is( $sessionID, undef ); |
574 |
is( $sessionID, undef ); |
562 |
|
|
|
563 |
} |
575 |
} |
564 |
|
576 |
|
565 |
{ |
577 |
{ |
566 |
# Hit unauthorized page then reuse the cookie |
578 |
# First logging in |
567 |
undef $ENV{"HTTP_COOKIE"}; |
|
|
568 |
$cgi = CGI->new; |
579 |
$cgi = CGI->new; |
569 |
# Logging in |
|
|
570 |
$cgi->param('userid', $patron->userid); |
580 |
$cgi->param('userid', $patron->userid); |
571 |
$cgi->param('password', $password); |
581 |
$cgi->param('password', $password); |
572 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
582 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
573 |
is( $userid, $patron->userid ); |
583 |
is( $userid, $patron->userid ); |
574 |
$first_sessionID = $sessionID; |
584 |
$first_sessionID = $sessionID; |
575 |
|
585 |
|
576 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
|
|
577 |
|
578 |
# Patron does not have the borrowers permission |
586 |
# Patron does not have the borrowers permission |
579 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); |
587 |
# $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; # not needed, we use $cgi here |
|
|
588 |
{ |
589 |
local *STDOUT; |
590 |
my $stdout; |
591 |
open STDOUT, '>', \$stdout; |
592 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1} ); |
593 |
close STDOUT; |
594 |
} |
580 |
is( $userid, undef ); |
595 |
is( $userid, undef ); |
581 |
is( $sessionID, undef ); |
596 |
is( $sessionID, undef ); |
582 |
|
597 |
|
583 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1}); |
598 |
# When calling check_cookie_auth, the session will be deleted |
|
|
599 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); |
584 |
is( $auth_status, "failed" ); |
600 |
is( $auth_status, "failed" ); |
585 |
is( $session, undef ); |
601 |
is( $session, undef ); |
|
|
602 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); |
603 |
is( $auth_status, 'expired', 'Session no longer exists' ); |
586 |
|
604 |
|
587 |
# Reuse the cookie |
605 |
# Try reusing the deleted session: since it does not exist, we should get a new one now when passing correct permissions |
|
|
606 |
$cgi->cookie( -name => 'CGISESSID', value => $first_sessionID ); |
588 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
607 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
589 |
is( $userid, $patron->userid ); |
608 |
is( $userid, $patron->userid ); |
590 |
is( $sessionID, $first_sessionID ); |
609 |
isnt( $sessionID, undef, 'Check if we have a sessionID' ); |
591 |
|
610 |
isnt( $sessionID, $first_sessionID, 'New value expected' ); |
592 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
611 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID, {catalogue => 1} ); |
593 |
is( $auth_status, "ok" ); |
612 |
is( $auth_status, "ok" ); |
594 |
is( $session, $first_sessionID ); |
613 |
is( $session->id, $sessionID, 'Same session' ); |
|
|
614 |
# Two additional tests on userenv |
615 |
is( $C4::Context::context->{activeuser}, $session->id, 'Check if environment has been setup for session' ); |
616 |
is( C4::Context->userenv->{id}, $userid, 'Check userid in userenv' ); |
595 |
} |
617 |
} |
596 |
}; |
618 |
}; |
597 |
|
619 |
|
|
|
620 |
subtest 'Userenv clearing in check_cookie_auth' => sub { |
621 |
# Note: We did already test userenv for a logged-in user in previous subtest |
622 |
plan tests => 9; |
623 |
|
624 |
t::lib::Mocks::mock_preference( 'timeout', 600 ); |
625 |
my $cgi = CGI->new; |
626 |
|
627 |
# Create a new anonymous session by passing a fake session ID |
628 |
$cgi->cookie( -name => 'CGISESSID', -value => 'fake_sessionID' ); |
629 |
my ($userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 1); |
630 |
my ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID ); |
631 |
is( $auth_status, 'anon', 'Should be anonymous' ); |
632 |
is( $C4::Context::context->{activeuser}, $session->id, 'Check activeuser' ); |
633 |
is( defined C4::Context->userenv, 1, 'There should be a userenv' ); |
634 |
is( C4::Context->userenv->{id}, q{}, 'userid should be empty string' ); |
635 |
|
636 |
# Make the session expire now, check_cookie_auth will delete it |
637 |
$session->param('lasttime', time() - 1200 ); |
638 |
$session->flush; |
639 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID ); |
640 |
is( $auth_status, 'expired', 'Should be expired' ); |
641 |
is( C4::Context->userenv, undef, 'Environment should be cleared too' ); |
642 |
|
643 |
# Show that we clear the userenv again: set up env and check deleted session |
644 |
C4::Context->_new_userenv( $sessionID ); |
645 |
C4::Context->set_userenv; # empty |
646 |
is( defined C4::Context->userenv, 1, 'There should be an empty userenv again' ); |
647 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID ); |
648 |
is( $auth_status, 'expired', 'Should be expired already' ); |
649 |
is( C4::Context->userenv, undef, 'Environment should be cleared again' ); |
650 |
}; |
651 |
|
598 |
$schema->storage->txn_rollback; |
652 |
$schema->storage->txn_rollback; |
599 |
- |
|
|