|
Lines 153-159
subtest 'checkauth() tests' => sub {
Link Here
|
| 153 |
}; |
153 |
}; |
| 154 |
|
154 |
|
| 155 |
subtest 'While still logged in, relogin with another user' => sub { |
155 |
subtest 'While still logged in, relogin with another user' => sub { |
| 156 |
plan tests => 4; |
156 |
plan tests => 6; |
|
|
157 |
|
| 157 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
158 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
| 158 |
my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
159 |
my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
| 159 |
# Create 'former' session |
160 |
# Create 'former' session |
|
Lines 179-190
subtest 'checkauth() tests' => sub {
Link Here
|
| 179 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
180 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
| 180 |
$cgi->param( -name => 'password', -value => $password ); |
181 |
$cgi->param( -name => 'password', -value => $password ); |
| 181 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
182 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
| 182 |
my @return; |
183 |
my ( @return, $stdout ); |
| 183 |
{ |
184 |
{ |
| 184 |
local *STDOUT; |
185 |
local *STDOUT; |
| 185 |
local %ENV; |
186 |
local %ENV; |
| 186 |
$ENV{REMOTE_ADDR} = '1.2.3.4'; |
187 |
$ENV{REMOTE_ADDR} = '1.2.3.4'; |
| 187 |
my $stdout; |
|
|
| 188 |
open STDOUT, '>', \$stdout; |
188 |
open STDOUT, '>', \$stdout; |
| 189 |
@return = C4::Auth::checkauth( $cgi, 0, {} ); |
189 |
@return = C4::Auth::checkauth( $cgi, 0, {} ); |
| 190 |
close STDOUT; |
190 |
close STDOUT; |
|
Lines 193-198
subtest 'checkauth() tests' => sub {
Link Here
|
| 193 |
is( $return[0], $patron2->userid, 'Login of patron2 approved' ); |
193 |
is( $return[0], $patron2->userid, 'Login of patron2 approved' ); |
| 194 |
isnt( $return[2], $sessionID, 'Did not return previous session ID' ); |
194 |
isnt( $return[2], $sessionID, 'Did not return previous session ID' ); |
| 195 |
ok( $return[2], 'New session ID not empty' ); |
195 |
ok( $return[2], 'New session ID not empty' ); |
|
|
196 |
|
| 197 |
# Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions |
| 198 |
$patron2->flags(undef)->store; |
| 199 |
$session->param( 'number', $patron->id ); |
| 200 |
$session->param( 'id', $patron->userid ); |
| 201 |
$session->param( 'interface', 'intranet' ); |
| 202 |
$session->flush; |
| 203 |
$sessionID = $session->id; |
| 204 |
C4::Context->_new_userenv($sessionID); |
| 205 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
| 206 |
$cgi->param( -name => 'password', -value => $password ); |
| 207 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
| 208 |
{ |
| 209 |
local *STDOUT; |
| 210 |
local %ENV; |
| 211 |
$ENV{REMOTE_ADDR} = '1.2.3.4'; |
| 212 |
$stdout = q{}; |
| 213 |
open STDOUT, '>', \$stdout; |
| 214 |
@return = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' ); # patron2 has no catalogue perm |
| 215 |
close STDOUT; |
| 216 |
} |
| 217 |
like( $stdout, qr/You do not have permission to access this page/, 'No permission response' ); |
| 218 |
is( @return, 0, 'checkauth returned failure' ); |
| 196 |
}; |
219 |
}; |
| 197 |
|
220 |
|
| 198 |
subtest 'Two-factor authentication' => sub { |
221 |
subtest 'Two-factor authentication' => sub { |
| 199 |
- |
|
|