Attachment #154746 for bug #34513

View | Details | Raw Unified | Return to bug 34513
Collapse All | Expand All




    };

    subtest 'Reset auth state when changing users' => sub {

        #NOTE: It's easiest to detect this when changing to a non-existent user, since
        #that should trigger a redirect to login (instead of returning a session cookie)
        plan tests => 2;
        my $patron = $builder->build_object( { class => 'Koha::Patrons', value => { flags => undef } } );

        my $session = C4::Auth::get_session();
        $session->param( 'number',    $patron->id );
        $session->param( 'id',        $patron->userid );
        $session->param( 'ip',        '1.2.3.4' );
        $session->param( 'lasttime',  time() );
        $session->param( 'interface', 'intranet' );
        $session->flush;
        my $sessionID = $session->id;
        C4::Context->_new_userenv($sessionID);

        my ($return) =
            C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
        is( $return, 'ok', 'Patron authenticated' );

        my $mock1 = Test::MockModule->new('C4::Auth');
        $mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } );
        my $mock2 = Test::MockModule->new('CGI');
        $mock2->mock( 'request_method', 'POST' );
        $mock2->mock( 'cookie',         sub { return $sessionID; } );    # oversimplified..
        my $cgi = CGI->new;

        $cgi->param( -name => 'userid',             -value => 'Bond' );

            @return = C4::Auth::checkauth( $cgi, 0, {} );
            close STDOUT;
        }
        is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' );
    };



Lines 57-64 SKIP: { Link Here

(-)a/t/db_dependent/selenium/authentication.t (-3 / +5 lines)
57	like( $driver->get_title, qr(Access denied), 'Patron without permission should be redirected to the login form' );	57	like( $driver->get_title, qr(Access denied), 'Patron without permission should be redirected to the login form' );
58		58
59	# Try logging in as someone else (even a non-existent patron) and you should still be denied access	59	# Try logging in as someone else (even a non-existent patron) and you should still be denied access
60	$s->auth('Bond','James Bond');	60	$s->auth( 'Bond', 'James Bond' );
61	like( $driver->get_title, qr(Invalid username or password), 'Trying to change to a non-existent user should fail login' );	61	like(
		62	$driver->get_title, qr(Invalid username or password),
		63	'Trying to change to a non-existent user should fail login'
		64	);
62		65
63	$driver->get($mainpage . q\|?logout.x=1\|);	66	$driver->get($mainpage . q\|?logout.x=1\|);
64	$patron->flags(4)->store; # catalogue permission	67	$patron->flags(4)->store; # catalogue permission
65	-

Return to bug 34513

Lines 153-181 subtest 'checkauth() tests' => sub { Link Here

(-)a/t/db_dependent/Auth.t (-10 / +12 lines)
153	};	153	};
154		154
155	subtest 'Reset auth state when changing users' => sub {	155	subtest 'Reset auth state when changing users' => sub {
		156
156	#NOTE: It's easiest to detect this when changing to a non-existent user, since	157	#NOTE: It's easiest to detect this when changing to a non-existent user, since
157	#that should trigger a redirect to login (instead of returning a session cookie)	158	#that should trigger a redirect to login (instead of returning a session cookie)
158	plan tests => 2;	159	plan tests => 2;
159	my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => undef } });	160	my $patron = $builder->build_object( { class => 'Koha::Patrons', value => { flags => undef } } );
160		161
161	my $session = C4::Auth::get_session();	162	my $session = C4::Auth::get_session();
162	$session->param( 'number', $patron->id );	163	$session->param( 'number', $patron->id );
163	$session->param( 'id', $patron->userid );	164	$session->param( 'id', $patron->userid );
164	$session->param( 'ip', '1.2.3.4' );	165	$session->param( 'ip', '1.2.3.4' );
165	$session->param( 'lasttime', time() );	166	$session->param( 'lasttime', time() );
166	$session->param( 'interface', 'intranet' );	167	$session->param( 'interface', 'intranet' );
167	$session->flush;	168	$session->flush;
168	my $sessionID = $session->id;	169	my $sessionID = $session->id;
169	C4::Context->_new_userenv($sessionID);	170	C4::Context->_new_userenv($sessionID);
170		171
171	my ( $return ) = C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );	172	my ($return) =
		173	C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
172	is( $return, 'ok', 'Patron authenticated' );	174	is( $return, 'ok', 'Patron authenticated' );
173		175
174	my $mock1 = Test::MockModule->new('C4::Auth');	176	my $mock1 = Test::MockModule->new('C4::Auth');
175	$mock1->mock( 'safe_exit', sub {return 'safe_exit_redirect'} );	177	$mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } );
176	my $mock2 = Test::MockModule->new('CGI');	178	my $mock2 = Test::MockModule->new('CGI');
177	$mock2->mock( 'request_method', 'POST' );	179	$mock2->mock( 'request_method', 'POST' );
178	$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified..	180	$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified..
179	my $cgi = CGI->new;	181	my $cgi = CGI->new;
180		182
181	$cgi->param( -name => 'userid', -value => 'Bond' );	183	$cgi->param( -name => 'userid', -value => 'Bond' );
Lines 190-196 subtest 'checkauth() tests' => sub { Link Here
190	@return = C4::Auth::checkauth( $cgi, 0, {} );	192	@return = C4::Auth::checkauth( $cgi, 0, {} );
191	close STDOUT;	193	close STDOUT;
192	}	194	}
193	is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login');	195	is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' );
194	};	196	};
195		197
196		198