Lines 3-9
Link Here
|
3 |
# This file is part of Koha. |
3 |
# This file is part of Koha. |
4 |
# |
4 |
# |
5 |
# Copyright (C) 2017 Catalyst IT |
5 |
# Copyright (C) 2017 Catalyst IT |
6 |
# Copyright 2018 Koha Development team |
6 |
# Copyright 2021 Koha Development team |
7 |
# |
7 |
# |
8 |
# Koha is free software; you can redistribute it and/or modify it |
8 |
# Koha is free software; you can redistribute it and/or modify it |
9 |
# under the terms of the GNU General Public License as published by |
9 |
# under the terms of the GNU General Public License as published by |
Lines 42-48
SKIP: {
Link Here
|
42 |
my $driver = $s->driver; |
42 |
my $driver = $s->driver; |
43 |
|
43 |
|
44 |
subtest 'Staff interface authentication' => sub { |
44 |
subtest 'Staff interface authentication' => sub { |
45 |
plan tests => 5; |
45 |
plan tests => 6; |
46 |
my $mainpage = $s->base_url . q|mainpage.pl|; |
46 |
my $mainpage = $s->base_url . q|mainpage.pl|; |
47 |
$driver->get($mainpage); |
47 |
$driver->get($mainpage); |
48 |
like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form'); |
48 |
like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form'); |
Lines 68-78
SKIP: {
Link Here
|
68 |
$s->auth( $patron->userid, $password ); |
68 |
$s->auth( $patron->userid, $password ); |
69 |
like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' ); |
69 |
like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' ); |
70 |
|
70 |
|
|
|
71 |
subtest 'not authorized' => sub { |
72 |
plan tests => 17; |
73 |
|
74 |
# First, logout! |
75 |
$driver->get($mainpage . q|?logout.x=1|); |
76 |
$patron->flags(4)->store; # Patron has only catalogue permission |
77 |
like( $driver->get_title, qr(Log in to Koha), 'Patron should hit the login form after logout' ); |
78 |
# Login! |
79 |
$s->fill_form({ userid => $patron->userid, password => $password }); |
80 |
$s->driver->find_element('//input[@id="submit-button"]')->click; |
81 |
|
82 |
my $cookie = $driver->get_cookie_named('CGISESSID'); |
83 |
my $first_sessionID = $cookie->{value}; |
84 |
|
85 |
# Patron is logged in and got a CGISESSID cookie, miam |
86 |
like( $driver->get_title, qr(Koha staff interface), 'Patron is logged in' ); |
87 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
88 |
is( $cookie->{value}, $first_sessionID, 'no new session after login, the session has been upgraded' ); |
89 |
|
90 |
# Authorized page can be accessed, cookie does not change |
91 |
$driver->get( $s->base_url . q|catalogue/search.pl| ); |
92 |
like( $driver->get_title, qr(Advanced search), 'Patron can access advanced search' ); |
93 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
94 |
is( $cookie->{value}, $first_sessionID, 'no new session after hit' ); |
95 |
|
96 |
# Unauthorized page redirect to the login form |
97 |
$driver->get( $s->base_url . q|circ/circulation.pl| ); |
98 |
like( $driver->get_title, qr(Access denied), 'Patron cannot access the circulation module' ); |
99 |
# But the patron does not lose the CGISESSID cookie! |
100 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
101 |
is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' ); |
102 |
|
103 |
# Luckily mainpage can still be accessed |
104 |
$s->click( { id => 'mainpage', main_class => 'main container-fluid' } ); |
105 |
like( $driver->get_title, qr(Koha staff interface), 'Patron can come back to the mainpage' ); |
106 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
107 |
is( $cookie->{value}, $first_sessionID, 'no new session if back to the mainpage' ); |
108 |
|
109 |
# As well as the search |
110 |
$driver->get( $s->base_url . q|catalogue/search.pl| ); |
111 |
like( $driver->get_title, qr(Advanced search), 'Patron can access advanced search' ); |
112 |
# But circulation module is prohibided! |
113 |
$driver->get( $s->base_url . q|circ/circulation.pl| ); |
114 |
like( $driver->get_title, qr(Access denied), 'Patron cannot access the circulation module' ); |
115 |
# Still can reuse the same cookie |
116 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
117 |
is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' ); |
118 |
|
119 |
# This is the "previous page" using the back() JS |
120 |
$s->click( { id => 'previous_page', main_class => 'main container-fluid' } ); |
121 |
like( $driver->get_title, qr(Advanced search), 'Patron can come back to the previous page' ); |
122 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
123 |
is( $cookie->{value}, $first_sessionID, 'no new session if back to the previous page' ); |
124 |
|
125 |
# Check with a script that is using check_cookie_auth, session must not be deleted! |
126 |
$driver->get( $s->base_url . q|svc/checkouts| ); |
127 |
#FIXME - 500 is the current behaviour, but it's not nice. It could be improved. |
128 |
like( $driver->get_title, qr(Error 500), 'Patron cannot access svc script where circulate permissions are required'); |
129 |
$driver->get( $s->base_url . q|catalogue/search.pl| ); |
130 |
like( $driver->get_title, qr(Advanced search), 'Patron can reuse the cookie after a script that used check_cookie_auth' ); |
131 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
132 |
is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' ); |
133 |
}; |
71 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
134 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
72 |
}; |
135 |
}; |
73 |
|
136 |
|
74 |
subtest 'OPAC interface authentication' => sub { |
137 |
subtest 'OPAC interface authentication' => sub { |
75 |
plan tests => 6; |
138 |
plan tests => 7; |
76 |
|
139 |
|
77 |
my $mainpage = $s->opac_base_url . q|opac-main.pl|; |
140 |
my $mainpage = $s->opac_base_url . q|opac-main.pl|; |
78 |
|
141 |
|
Lines 149-154
SKIP: {
Link Here
|
149 |
$driver->find_element('//a[@id="logout"]')->click; |
212 |
$driver->find_element('//a[@id="logout"]')->click; |
150 |
$driver->find_element('//div[@id="login"]'); # logged out |
213 |
$driver->find_element('//div[@id="login"]'); # logged out |
151 |
|
214 |
|
|
|
215 |
subtest 'not authorized' => sub { |
216 |
plan tests => 13; |
217 |
|
218 |
$driver->get($mainpage . q|?logout.x=1|); |
219 |
$driver->get($mainpage); |
220 |
my $cookie = $driver->get_cookie_named('CGISESSID'); |
221 |
my $first_sessionID = $cookie->{value}; |
222 |
|
223 |
# User is not logged in, navigation does not generate a new cookie |
224 |
$driver->get( $s->opac_base_url . q|opac-search.pl| ); |
225 |
like( $driver->get_title, qr(Advanced search) ); |
226 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
227 |
is( $cookie->{value}, $first_sessionID, ); |
228 |
|
229 |
# Login |
230 |
$driver->get($mainpage); |
231 |
$s->fill_form( { userid => $patron->userid, password => $password } ); |
232 |
$s->submit_form; |
233 |
|
234 |
# After logged in, the same cookie is reused |
235 |
like( $driver->get_title, qr(Your library home) ); |
236 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
237 |
is( $cookie->{value}, $first_sessionID, ); |
238 |
$driver->get( $s->opac_base_url . q|opac-search.pl| ); |
239 |
like( $driver->get_title, qr(Advanced search) ); |
240 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
241 |
is( $cookie->{value}, $first_sessionID, ); |
242 |
|
243 |
# Logged in user can place holds |
244 |
$driver->get( $s->opac_base_url . q|opac-reserve.pl| ); # We may need to pass a biblionumber here in the future |
245 |
like( $driver->get_title, qr(Placing a hold) ); |
246 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
247 |
is( $cookie->{value}, $first_sessionID, ); |
248 |
|
249 |
$driver->get($mainpage . q|?logout.x=1|); |
250 |
|
251 |
# FIXME This new get should not be needed, but the cookie is not modified right after logout |
252 |
# However it's not the behavour when testing the UI |
253 |
$driver->get($mainpage); |
254 |
|
255 |
# After logout a new cookie is generated, the previous session has been deleted |
256 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
257 |
isnt( $cookie->{value}, $first_sessionID, ); |
258 |
$first_sessionID = $cookie->{value}; |
259 |
|
260 |
$driver->get( $s->opac_base_url . q|svc/checkout_notes| ); |
261 |
#FIXME - 500 is the current behaviour, but it's not nice. It could be improved. |
262 |
like( $driver->get_title, qr(An error has occurred), 'Patron cannot access svc'); |
263 |
# No new cookie generated |
264 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
265 |
is( $cookie->{value}, $first_sessionID, ); |
266 |
|
267 |
$driver->get( $s->opac_base_url . q|opac-reserve.pl| ); |
268 |
like( $driver->get_title, qr(Log in to your account) ); |
269 |
|
270 |
# Still no new cookie generated |
271 |
$driver->get($mainpage); |
272 |
$cookie = $driver->get_cookie_named('CGISESSID'); |
273 |
is( $cookie->{value}, $first_sessionID, ); |
274 |
}; |
275 |
|
152 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
276 |
push @data_to_cleanup, $patron, $patron->category, $patron->library; |
153 |
}; |
277 |
}; |
154 |
|
278 |
|
155 |
- |
|
|