Attachment #139389 for bug #31250

View | Details | Raw Unified | Return to bug 31250
Collapse All | Expand All




        }
        next if !$name;

        if( $self->_should_be_cleared($name) ) {
        my $stripped_name = $name;
        $stripped_name =~ s/_\d+$/_/;

        if( !$self->{_remove_unless}->{$stripped_name} && !$self->{_remove_unless}->{$name} ) {
            next if $seen->{$name};
            push @rv, CGI::Cookie->new(
                # -expires explicitly omitted to create shortlived 'session' cookie

    return \@rv;
}

sub _should_be_cleared { # when it is not on the deny list in koha-conf
    my ( $self, $name ) = @_;

    return if $self->{_remove_unless}->{$name}; # exact match

    # Now try the entries as regex
    foreach my $k ( keys %{$self->{_remove_unless}} ) {
        my $reg = $self->{_remove_unless}->{$k};
        # The entry in koha-conf is always considered to be from the start
        return if $name =~ qr/^${k}/;
    }
    return 1;
}

=head2 replace_in_list

    $list2 = $mgr->replace_in_list( $list1, $cookie );

Lines 457-465 __END_SRU_PUBLICSERVER__ Link Here

(-)a/debian/templates/koha-conf-site.xml.in (-1 / +2 lines)
457	</message_broker>	457	</message_broker>
458		458
459	<do_not_remove_cookie>__KEEP_COOKIE__</do_not_remove_cookie>	459	<do_not_remove_cookie>__KEEP_COOKIE__</do_not_remove_cookie>
460	<do_not_remove_cookie>catalogue_editor_</do_not_remove_cookie>	460	<do_not_remove_cookie>catalogue_editor_\d+</do_not_remove_cookie>
461	<!-- Uncomment lines like hereunder to not clear cookies at logout:	461	<!-- Uncomment lines like hereunder to not clear cookies at logout:
462	The cookie name is case sensitive.	462	The cookie name is case sensitive.
		463	NOTE: You may use regex constructions like the example above.
463	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>	464	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
464	-->	465	-->
465		466

Lines 273-281 Link Here

(-)a/etc/koha-conf.xml (-1 / +2 lines)
273	<vhost></vhost>	273	<vhost></vhost>
274	</message_broker>	274	</message_broker>
275		275
276	<do_not_remove_cookie>catalogue_editor_</do_not_remove_cookie>	276	<do_not_remove_cookie>catalogue_editor_\d+</do_not_remove_cookie>
277	<!-- Uncomment lines like hereunder to not clear cookies at logout:	277	<!-- Uncomment lines like hereunder to not clear cookies at logout:
278	The cookie name is case sensitive.	278	The cookie name is case sensitive.
		279	NOTE: You may use regex constructions like the example above.
279	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>	280	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
280	-->	281	-->
281		282




};

subtest 'clear_unless' => sub {
    plan tests => 17;

    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'aap', 'noot' ] );


    is( $rv[1]->httponly, 0, 'cleared wim is not httponly' );
    is( $rv[2]->httponly, 1, 'aap httponly' );

    # Test with numeric suffix (via regex)
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'catalogue_editor_\d+' ] );
    $cmgr = Koha::CookieManager->new;
    $cookie1 = $q->cookie( -name => 'catalogue_editor_234', -value => '1', -expires => '+1y' );
    $cookie2 = $q->cookie( -name => 'catalogue_editor_345', -value => '1', -expires => '+1y' );

    $list = [ $cookie1, $cookie2, $cookie3, $cookie4 ];
    @rv = @{$cmgr->clear_unless( @$list )};
    is_deeply( [ map { $_->value ? $_->name : () } @rv ],
        [ 'catalogue_editor_234', 'catalogue_editor_345' ],
        'Cookie3 and cookie4 should have been cleared' );

    # Test with another regex (yes, highly realistic examples :)
    t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'next_\w+_number\d{2}_(now|never).*' ] );
    $cmgr = Koha::CookieManager->new;
    my $cookie5;
    $cookie1 = $q->cookie( -name => 'next_mynewword_number99_neverrr', -value => '1', -expires => '+1y' ); #fine
    $cookie2 = $q->cookie( -name => 'prefixed_next_mynewword_number99_never_better_123', -value => '1', -expires => '+1y' ); # wrong prefix
    $cookie3 = $q->cookie( -name => 'next_mynew-word_number99_never_better_123', -value => '1', -expires => '+1y' ); # wrong: hyphen in word
    $cookie4 = $q->cookie( -name => 'mynewword_number999_never_better_123', -value => '1', -expires => '+1y' ); # wrong: three digits
    $cookie5 = $q->cookie( -name => 'next_mynewword_number99_nooit_meer', -value => '1', -expires => '+1y' ); # wrong: nooit
    @rv = @{$cmgr->clear_unless( $cookie1, $cookie2, $cookie3, $cookie4, $cookie5 )};
    is_deeply( [ map { $_->value ? $_->name : () } @rv ], [ 'next_mynewword_number99_neverrr' ], 'Only cookie1' );

};

subtest 'replace_in_list' => sub {
- 

Return to bug 31250

Lines 101-111 sub clear_unless { Link Here

(-)a/Koha/CookieManager.pm (-5 / +15 lines)
101	}	101	}
102	next if !$name;	102	next if !$name;
103		103
104	# Try stripping _\d+ from name for cookiea like catalogue_editor_123	104	if( $self->_should_be_cleared($name) ) {
105	my $stripped_name = $name;
106	$stripped_name =~ s/_\d+$/_/;
107
108	if( !$self->{_remove_unless}->{$stripped_name} && !$self->{_remove_unless}->{$name} ) {
109	next if $seen->{$name};	105	next if $seen->{$name};
110	push @rv, CGI::Cookie->new(	106	push @rv, CGI::Cookie->new(
111	# -expires explicitly omitted to create shortlived 'session' cookie	107	# -expires explicitly omitted to create shortlived 'session' cookie
Lines 122-127 sub clear_unless { Link Here
122	return \@rv;	118	return \@rv;
123	}	119	}
124		120
		121	sub _should_be_cleared { # when it is not on the deny list in koha-conf
		122	my ( $self, $name ) = @_;
		123
		124	return if $self->{_remove_unless}->{$name}; # exact match
		125
		126	# Now try the entries as regex
		127	foreach my $k ( keys %{$self->{_remove_unless}} ) {
		128	my $reg = $self->{_remove_unless}->{$k};
		129	# The entry in koha-conf is always considered to be from the start
		130	return if $name =~ qr/^${k}/;
		131	}
		132	return 1;
		133	}
		134
125	=head2 replace_in_list	135	=head2 replace_in_list
126		136
127	$list2 = $mgr->replace_in_list( $list1, $cookie );	137	$list2 = $mgr->replace_in_list( $list1, $cookie );

Lines 41-47 subtest 'new' => sub { Link Here

(-)a/t/CookieManager.t (-6 / +18 lines)
41	};	41	};
42		42
43	subtest 'clear_unless' => sub {	43	subtest 'clear_unless' => sub {
44	plan tests => 16;	44	plan tests => 17;
45		45
46	t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'aap', 'noot' ] );	46	t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'aap', 'noot' ] );
47		47
Lines 74-81 subtest 'clear_unless' => sub { Link Here
74	is( $rv[1]->httponly, 0, 'cleared wim is not httponly' );	74	is( $rv[1]->httponly, 0, 'cleared wim is not httponly' );
75	is( $rv[2]->httponly, 1, 'aap httponly' );	75	is( $rv[2]->httponly, 1, 'aap httponly' );
76		76
77	# Test with _123 prefix	77	# Test with numeric suffix (via regex)
78	t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'catalogue_editor_' ] );	78	t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'catalogue_editor_\d+' ] );
79	$cmgr = Koha::CookieManager->new;	79	$cmgr = Koha::CookieManager->new;
80	$cookie1 = $q->cookie( -name => 'catalogue_editor_234', -value => '1', -expires => '+1y' );	80	$cookie1 = $q->cookie( -name => 'catalogue_editor_234', -value => '1', -expires => '+1y' );
81	$cookie2 = $q->cookie( -name => 'catalogue_editor_345', -value => '1', -expires => '+1y' );	81	$cookie2 = $q->cookie( -name => 'catalogue_editor_345', -value => '1', -expires => '+1y' );
Lines 85-92 subtest 'clear_unless' => sub { Link Here
85	$list = [ $cookie1, $cookie2, $cookie3, $cookie4 ];	85	$list = [ $cookie1, $cookie2, $cookie3, $cookie4 ];
86	@rv = @{$cmgr->clear_unless( @$list )};	86	@rv = @{$cmgr->clear_unless( @$list )};
87	is_deeply( [ map { $_->value ? $_->name : () } @rv ],	87	is_deeply( [ map { $_->value ? $_->name : () } @rv ],
88	[ 'catalogue_editor_234', 'catalogue_editor_345', 'catalogue_editor_' ],	88	[ 'catalogue_editor_234', 'catalogue_editor_345' ],
89	'Only cookie4 should have been cleared' );	89	'Cookie3 and cookie4 should have been cleared' );
		90
		91	# Test with another regex (yes, highly realistic examples :)
		92	t::lib::Mocks::mock_config( Koha::CookieManager::DENY_LIST_VAR, [ 'next_\w+_number\d{2}_(now\|never).*' ] );
		93	$cmgr = Koha::CookieManager->new;
		94	my $cookie5;
		95	$cookie1 = $q->cookie( -name => 'next_mynewword_number99_neverrr', -value => '1', -expires => '+1y' ); #fine
		96	$cookie2 = $q->cookie( -name => 'prefixed_next_mynewword_number99_never_better_123', -value => '1', -expires => '+1y' ); # wrong prefix
		97	$cookie3 = $q->cookie( -name => 'next_mynew-word_number99_never_better_123', -value => '1', -expires => '+1y' ); # wrong: hyphen in word
		98	$cookie4 = $q->cookie( -name => 'mynewword_number999_never_better_123', -value => '1', -expires => '+1y' ); # wrong: three digits
		99	$cookie5 = $q->cookie( -name => 'next_mynewword_number99_nooit_meer', -value => '1', -expires => '+1y' ); # wrong: nooit
		100	@rv = @{$cmgr->clear_unless( $cookie1, $cookie2, $cookie3, $cookie4, $cookie5 )};
		101	is_deeply( [ map { $_->value ? $_->name : () } @rv ], [ 'next_mynewword_number99_neverrr' ], 'Only cookie1' );
		102
90	};	103	};
91		104
92	subtest 'replace_in_list' => sub {	105	subtest 'replace_in_list' => sub {
93	-