Lines 10-20
use CGI qw ( -utf8 );
Link Here
|
10 |
use Test::MockObject; |
10 |
use Test::MockObject; |
11 |
use Test::MockModule; |
11 |
use Test::MockModule; |
12 |
use List::MoreUtils qw/all any none/; |
12 |
use List::MoreUtils qw/all any none/; |
13 |
use Test::More tests => 24; |
13 |
use Test::More tests => 14; |
14 |
use Test::Warn; |
14 |
use Test::Warn; |
15 |
use t::lib::Mocks; |
15 |
use t::lib::Mocks; |
16 |
use t::lib::TestBuilder; |
16 |
use t::lib::TestBuilder; |
17 |
|
17 |
|
|
|
18 |
use C4::Auth; |
18 |
use C4::Members; |
19 |
use C4::Members; |
19 |
use Koha::AuthUtils qw/hash_password/; |
20 |
use Koha::AuthUtils qw/hash_password/; |
20 |
use Koha::Database; |
21 |
use Koha::Database; |
Lines 201-207
subtest 'checkpw lockout tests' => sub {
Link Here
|
201 |
|
202 |
|
202 |
# get_template_and_user tests |
203 |
# get_template_and_user tests |
203 |
|
204 |
|
204 |
{ # Tests for the language URL parameter |
205 |
subtest 'get_template_and_user' => sub { # Tests for the language URL parameter |
205 |
|
206 |
|
206 |
sub MockedCheckauth { |
207 |
sub MockedCheckauth { |
207 |
my ($query,$authnotrequired,$flagsrequired,$type) = @_; |
208 |
my ($query,$authnotrequired,$flagsrequired,$type) = @_; |
Lines 342-348
subtest 'checkpw lockout tests' => sub {
Link Here
|
342 |
); |
343 |
); |
343 |
is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); |
344 |
is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); |
344 |
is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); |
345 |
is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); |
345 |
} |
346 |
|
|
|
347 |
delete $ENV{"HTTP_COOKIE"}; |
348 |
}; |
346 |
|
349 |
|
347 |
# Check that there is always an OPACBaseURL set. |
350 |
# Check that there is always an OPACBaseURL set. |
348 |
my $input = CGI->new(); |
351 |
my $input = CGI->new(); |
Lines 479-482
subtest 'check_cookie_auth' => sub {
Link Here
|
479 |
#FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission |
482 |
#FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission |
480 |
}; |
483 |
}; |
481 |
|
484 |
|
|
|
485 |
subtest 'checkauth & check_cookie_auth' => sub { |
486 |
plan tests => 27; |
487 |
|
488 |
# flags = 4 => { catalogue => 1 } |
489 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
490 |
my $password = 'password'; |
491 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
492 |
$patron->set_password( { password => $password } ); |
493 |
|
494 |
my $cgi_mock = Test::MockModule->new('CGI'); |
495 |
$cgi_mock->mock( 'request_method', sub { return 'POST' } ); |
496 |
|
497 |
my $cgi = CGI->new; |
498 |
|
499 |
my $auth = Test::MockModule->new( 'C4::Auth' ); |
500 |
# Tests will fail if we hit safe_exit |
501 |
$auth->mock( 'safe_exit', sub { return } ); |
502 |
|
503 |
my ( $userid, $cookie, $sessionID, $flags ); |
504 |
{ |
505 |
# checkauth will redirect and safe_exit if not authenticated and not authorized |
506 |
local *STDOUT; |
507 |
my $stdout; |
508 |
open STDOUT, '>', \$stdout; |
509 |
C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
510 |
like( $stdout, qr{<title>\s*Log in to your account} ); |
511 |
$sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef; |
512 |
ok($sessionID); |
513 |
close STDOUT; |
514 |
}; |
515 |
|
516 |
my $first_sessionID = $sessionID; |
517 |
|
518 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
519 |
# Not authenticated yet, checkauth didn't return the session |
520 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
521 |
is( $sessionID, undef); |
522 |
is( $userid, undef); |
523 |
|
524 |
# Same here, check_cookie_auth does not return the session |
525 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
526 |
is( $auth_status, 'failed' ); |
527 |
is( $session, undef ); |
528 |
|
529 |
# Simulating the login form submission |
530 |
$cgi->param('userid', $patron->userid); |
531 |
$cgi->param('password', $password); |
532 |
|
533 |
# Logged in! |
534 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
535 |
is( $sessionID, $first_sessionID ); |
536 |
is( $userid, $patron->userid ); |
537 |
|
538 |
( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
539 |
is( $auth_status, 'ok' ); |
540 |
is( $session->id, $first_sessionID ); |
541 |
|
542 |
# Logging out! |
543 |
$cgi->param('logout.x', 1); |
544 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
545 |
is( $sessionID, undef ); |
546 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
547 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
548 |
is( $auth_status, "failed"); |
549 |
is( $session, undef ); |
550 |
|
551 |
{ |
552 |
# Trying to access without sessionID |
553 |
undef $ENV{"HTTP_COOKIE"}; |
554 |
$cgi = CGI->new; |
555 |
( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, {catalogue => 1}); |
556 |
is( $auth_status, 'failed' ); |
557 |
is( $session, undef ); |
558 |
|
559 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
560 |
is( $userid, undef ); |
561 |
is( $sessionID, undef ); |
562 |
|
563 |
} |
564 |
|
565 |
{ |
566 |
# Hit unauthorized page then reuse the cookie |
567 |
undef $ENV{"HTTP_COOKIE"}; |
568 |
$cgi = CGI->new; |
569 |
# Logging in |
570 |
$cgi->param('userid', $patron->userid); |
571 |
$cgi->param('password', $password); |
572 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
573 |
is( $userid, $patron->userid ); |
574 |
$first_sessionID = $sessionID; |
575 |
|
576 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
577 |
|
578 |
# Patron does not have the borrowers permission |
579 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); |
580 |
is( $userid, undef ); |
581 |
is( $sessionID, undef ); |
582 |
|
583 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, {borrowers => 1}); |
584 |
is( $auth_status, "failed" ); |
585 |
is( $session, undef ); |
586 |
|
587 |
# Reuse the cookie |
588 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
589 |
is( $userid, $patron->userid ); |
590 |
is( $sessionID, $first_sessionID ); |
591 |
|
592 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, 0, {catalogue => 1}); |
593 |
is( $auth_status, "ok" ); |
594 |
is( $session, $first_sessionID ); |
595 |
} |
596 |
}; |
597 |
|
482 |
$schema->storage->txn_rollback; |
598 |
$schema->storage->txn_rollback; |
483 |
- |
|
|