Lines 633-645
sub checkauth {
Link Here
|
633 |
if ( $userid = $ENV{'REMOTE_USER'} ) { |
633 |
if ( $userid = $ENV{'REMOTE_USER'} ) { |
634 |
# Using Basic Authentication, no cookies required |
634 |
# Using Basic Authentication, no cookies required |
635 |
$cookie = $query->cookie( |
635 |
$cookie = $query->cookie( |
636 |
-name => 'CGISESSID', |
636 |
-name => 'CGISESSID', |
637 |
-value => '', |
637 |
-value => '', |
638 |
-expires => '' |
638 |
-expires => '', |
|
|
639 |
-HttpOnly => 1, |
639 |
); |
640 |
); |
640 |
$loggedin = 1; |
641 |
$loggedin = 1; |
641 |
} |
642 |
} |
642 |
elsif ( $sessionID = $query->cookie("CGISESSID")) { # assignment, not comparison |
643 |
elsif ( $sessionID = $query->cookie("CGISESSID") ) |
|
|
644 |
{ # assignment, not comparison |
643 |
my $session = get_session($sessionID); |
645 |
my $session = get_session($sessionID); |
644 |
C4::Context->_new_userenv($sessionID); |
646 |
C4::Context->_new_userenv($sessionID); |
645 |
my ($ip, $lasttime, $sessiontype); |
647 |
my ($ip, $lasttime, $sessiontype); |
Lines 705-712
sub checkauth {
Link Here
|
705 |
$userid = undef; |
707 |
$userid = undef; |
706 |
} |
708 |
} |
707 |
else { |
709 |
else { |
708 |
$cookie = $query->cookie( CGISESSID => $session->id ); |
710 |
$cookie = $query->cookie( |
709 |
$session->param('lasttime',time()); |
711 |
-name => 'CGISESSID', |
|
|
712 |
-value => $session->id, |
713 |
-HttpOnly => 1 |
714 |
); |
715 |
$session->param( 'lasttime', time() ); |
710 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
716 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
711 |
$flags = haspermission($userid, $flagsrequired); |
717 |
$flags = haspermission($userid, $flagsrequired); |
712 |
if ($flags) { |
718 |
if ($flags) { |
Lines 722-729
sub checkauth {
Link Here
|
722 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
728 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
723 |
my $sessionID = $session->id; |
729 |
my $sessionID = $session->id; |
724 |
C4::Context->_new_userenv($sessionID); |
730 |
C4::Context->_new_userenv($sessionID); |
725 |
$cookie = $query->cookie( CGISESSID => $sessionID ); |
731 |
$cookie = $query->cookie( |
726 |
$userid = $query->param('userid'); |
732 |
-name => 'CGISESSID', |
|
|
733 |
-value => $session->id, |
734 |
-HttpOnly => 1 |
735 |
); |
736 |
$userid = $query->param('userid'); |
727 |
if ( ( $cas && $query->param('ticket') ) |
737 |
if ( ( $cas && $query->param('ticket') ) |
728 |
|| $userid |
738 |
|| $userid |
729 |
|| ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne |
739 |
|| ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne |
Lines 914-920
sub checkauth {
Link Here
|
914 |
{ |
924 |
{ |
915 |
# successful login |
925 |
# successful login |
916 |
unless ($cookie) { |
926 |
unless ($cookie) { |
917 |
$cookie = $query->cookie( CGISESSID => '' ); |
927 |
$cookie = $query->cookie( |
|
|
928 |
-name => 'CGISESSID', |
929 |
-value => '', |
930 |
-HttpOnly => 1 |
931 |
); |
918 |
} |
932 |
} |
919 |
return ( $userid, $cookie, $sessionID, $flags ); |
933 |
return ( $userid, $cookie, $sessionID, $flags ); |
920 |
} |
934 |
} |
921 |
- |
|
|