|
Lines 3-9
Link Here
|
| 3 |
# This file is part of Koha. |
3 |
# This file is part of Koha. |
| 4 |
# |
4 |
# |
| 5 |
# Copyright (C) 2017 Catalyst IT |
5 |
# Copyright (C) 2017 Catalyst IT |
| 6 |
# Copyright 2018 Koha Development team |
6 |
# Copyright 2021 Koha Development team |
| 7 |
# |
7 |
# |
| 8 |
# Koha is free software; you can redistribute it and/or modify it |
8 |
# Koha is free software; you can redistribute it and/or modify it |
| 9 |
# under the terms of the GNU General Public License as published by |
9 |
# under the terms of the GNU General Public License as published by |
|
Lines 42-48
SKIP: {
Link Here
|
| 42 |
my $driver = $s->driver; |
42 |
my $driver = $s->driver; |
| 43 |
|
43 |
|
| 44 |
subtest 'Staff interface authentication' => sub { |
44 |
subtest 'Staff interface authentication' => sub { |
| 45 |
plan tests => 5; |
45 |
plan tests => 6; |
| 46 |
my $mainpage = $s->base_url . q|mainpage.pl|; |
46 |
my $mainpage = $s->base_url . q|mainpage.pl|; |
| 47 |
$driver->get($mainpage); |
47 |
$driver->get($mainpage); |
| 48 |
like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form'); |
48 |
like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form'); |
|
Lines 68-78
SKIP: {
Link Here
|
| 68 |
$s->auth( $patron->userid, $password ); |
68 |
$s->auth( $patron->userid, $password ); |
| 69 |
like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' ); |
69 |
like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' ); |
| 70 |
|
70 |
|
|
|
71 |
subtest 'not authorized' => sub { |
| 72 |
plan tests => 17; |
| 73 |
|
| 74 |
# First, logout! |
| 75 |
$driver->get($mainpage . q|?logout.x=1|); |
| 76 |
$patron->flags(4)->store; # Patron has only catalogue permission |
| 77 |
like( $driver->get_title, qr(Log in to Koha), 'Patron should hit the login form after logout' ); |
| 78 |
# Login! |
| 79 |
$s->fill_form({ userid => $patron->userid, password => $password }); |
| 80 |
$s->driver->find_element('//input[@id="submit-button"]')->click; |
| 81 |
|
| 82 |
my $cookie = $driver->get_cookie_named('CGISESSID'); |
| 83 |
my $first_sessionID = $cookie->{value}; |
| 84 |
|
| 85 |
# Patron is logged in and got a CGISESSID cookie, miam |
| 86 |
like( $driver->get_title, qr(Koha staff interface), 'Patron is logged in' ); |
| 87 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 88 |
is( $cookie->{value}, $first_sessionID, 'no new session after login, the session has been upgraded' ); |
| 89 |
|
| 90 |
# Authorized page can be accessed, cookie does not change |
| 91 |
$driver->get( $s->base_url . q|catalogue/search.pl| ); |
| 92 |
like( $driver->get_title, qr(Advanced search), 'Patron can access advanced search' ); |
| 93 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 94 |
is( $cookie->{value}, $first_sessionID, 'no new session after hit' ); |
| 95 |
|
| 96 |
# Unauthorized page redirect to the login form |
| 97 |
$driver->get( $s->base_url . q|circ/circulation.pl| ); |
| 98 |
like( $driver->get_title, qr(Access denied), 'Patron cannot access the circulation module' ); |
| 99 |
# But the patron does not lose the CGISESSID cookie! |
| 100 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 101 |
is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' ); |
| 102 |
|
| 103 |
# Luckily mainpage can still be accessed |
| 104 |
$s->click( { id => 'mainpage', main_class => 'main container-fluid' } ); |
| 105 |
like( $driver->get_title, qr(Koha staff interface), 'Patron can come back to the mainpage' ); |
| 106 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 107 |
is( $cookie->{value}, $first_sessionID, 'no new session if back to the mainpage' ); |
| 108 |
|
| 109 |
# As well as the search |
| 110 |
$driver->get( $s->base_url . q|catalogue/search.pl| ); |
| 111 |
like( $driver->get_title, qr(Advanced search), 'Patron can access advanced search' ); |
| 112 |
# But circulation module is prohibided! |
| 113 |
$driver->get( $s->base_url . q|circ/circulation.pl| ); |
| 114 |
like( $driver->get_title, qr(Access denied), 'Patron cannot access the circulation module' ); |
| 115 |
# Still can reuse the same cookie |
| 116 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 117 |
is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' ); |
| 118 |
|
| 119 |
# This is the "previous page" using the back() JS |
| 120 |
$s->click( { id => 'previous_page', main_class => 'main container-fluid' } ); |
| 121 |
like( $driver->get_title, qr(Advanced search), 'Patron can come back to the previous page' ); |
| 122 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 123 |
is( $cookie->{value}, $first_sessionID, 'no new session if back to the previous page' ); |
| 124 |
|
| 125 |
# Check with a script that is using check_cookie_auth, session must not be deleted! |
| 126 |
$driver->get( $s->base_url . q|svc/checkouts| ); |
| 127 |
#FIXME - 500 is the current behaviour, but it's not nice. It could be improved. |
| 128 |
like( $driver->get_title, qr(Error 500), 'Patron cannot access svc script where circulate permissions are required'); |
| 129 |
$driver->get( $s->base_url . q|catalogue/search.pl| ); |
| 130 |
like( $driver->get_title, qr(Advanced search), 'Patron can reuse the cookie after a script that used check_cookie_auth' ); |
| 131 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 132 |
is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' ); |
| 133 |
}; |
| 71 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
134 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
| 72 |
}; |
135 |
}; |
| 73 |
|
136 |
|
| 74 |
subtest 'OPAC interface authentication' => sub { |
137 |
subtest 'OPAC interface authentication' => sub { |
| 75 |
plan tests => 6; |
138 |
plan tests => 7; |
| 76 |
|
139 |
|
| 77 |
my $mainpage = $s->opac_base_url . q|opac-main.pl|; |
140 |
my $mainpage = $s->opac_base_url . q|opac-main.pl|; |
| 78 |
|
141 |
|
|
Lines 149-154
SKIP: {
Link Here
|
| 149 |
$driver->find_element('//a[@id="logout"]')->click; |
212 |
$driver->find_element('//a[@id="logout"]')->click; |
| 150 |
$driver->find_element('//div[@id="login"]'); # logged out |
213 |
$driver->find_element('//div[@id="login"]'); # logged out |
| 151 |
|
214 |
|
|
|
215 |
subtest 'not authorized' => sub { |
| 216 |
plan tests => 13; |
| 217 |
|
| 218 |
$driver->get($mainpage . q|?logout.x=1|); |
| 219 |
$driver->get($mainpage); |
| 220 |
my $cookie = $driver->get_cookie_named('CGISESSID'); |
| 221 |
my $first_sessionID = $cookie->{value}; |
| 222 |
|
| 223 |
# User is not logged in, navigation does not generate a new cookie |
| 224 |
$driver->get( $s->opac_base_url . q|opac-search.pl| ); |
| 225 |
like( $driver->get_title, qr(Advanced search) ); |
| 226 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 227 |
is( $cookie->{value}, $first_sessionID, ); |
| 228 |
|
| 229 |
# Login |
| 230 |
$driver->get($mainpage); |
| 231 |
$s->fill_form( { userid => $patron->userid, password => $password } ); |
| 232 |
$s->submit_form; |
| 233 |
|
| 234 |
# After logged in, the same cookie is reused |
| 235 |
like( $driver->get_title, qr(Your library home) ); |
| 236 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 237 |
is( $cookie->{value}, $first_sessionID, ); |
| 238 |
$driver->get( $s->opac_base_url . q|opac-search.pl| ); |
| 239 |
like( $driver->get_title, qr(Advanced search) ); |
| 240 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 241 |
is( $cookie->{value}, $first_sessionID, ); |
| 242 |
|
| 243 |
# Logged in user can place holds |
| 244 |
$driver->get( $s->opac_base_url . q|opac-reserve.pl| ); # We may need to pass a biblionumber here in the future |
| 245 |
like( $driver->get_title, qr(Placing a hold) ); |
| 246 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 247 |
is( $cookie->{value}, $first_sessionID, ); |
| 248 |
|
| 249 |
$driver->get($mainpage . q|?logout.x=1|); |
| 250 |
|
| 251 |
# FIXME This new get should not be needed, but the cookie is not modified right after logout |
| 252 |
# However it's not the behavour when testing the UI |
| 253 |
$driver->get($mainpage); |
| 254 |
|
| 255 |
# After logout a new cookie is generated, the previous session has been deleted |
| 256 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 257 |
isnt( $cookie->{value}, $first_sessionID, ); |
| 258 |
$first_sessionID = $cookie->{value}; |
| 259 |
|
| 260 |
$driver->get( $s->opac_base_url . q|svc/checkout_notes| ); |
| 261 |
#FIXME - 500 is the current behaviour, but it's not nice. It could be improved. |
| 262 |
like( $driver->get_title, qr(An error has occurred), 'Patron cannot access svc'); |
| 263 |
# No new cookie generated |
| 264 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 265 |
is( $cookie->{value}, $first_sessionID, ); |
| 266 |
|
| 267 |
$driver->get( $s->opac_base_url . q|opac-reserve.pl| ); |
| 268 |
like( $driver->get_title, qr(Log in to your account) ); |
| 269 |
|
| 270 |
# Still no new cookie generated |
| 271 |
$driver->get($mainpage); |
| 272 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
| 273 |
is( $cookie->{value}, $first_sessionID, ); |
| 274 |
}; |
| 275 |
|
| 152 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
276 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
| 153 |
}; |
277 |
}; |
| 154 |
|
278 |
|
| 155 |
- |
|
|