|
Lines 14-20
use t::lib::TestBuilder;
Link Here
|
| 14 |
|
14 |
|
| 15 |
use C4::Auth; |
15 |
use C4::Auth; |
| 16 |
use C4::Members; |
16 |
use C4::Members; |
| 17 |
use Koha::AuthUtils qw/hash_password/; |
17 |
use Koha::AuthUtils qw( hash_password ); |
|
|
18 |
use Koha::DateUtils qw( dt_from_string ); |
| 18 |
use Koha::Database; |
19 |
use Koha::Database; |
| 19 |
use Koha::Patrons; |
20 |
use Koha::Patrons; |
| 20 |
use Koha::Auth::TwoFactorAuth; |
21 |
use Koha::Auth::TwoFactorAuth; |
|
Lines 87-95
subtest 'checkauth() tests' => sub {
Link Here
|
| 87 |
|
88 |
|
| 88 |
my $patron = $builder->build_object( |
89 |
my $patron = $builder->build_object( |
| 89 |
{ class => 'Koha::Patrons', value => { flags => 1 } } ); |
90 |
{ class => 'Koha::Patrons', value => { flags => 1 } } ); |
| 90 |
my $password = 'password'; |
91 |
my $password = set_weak_password($patron); |
| 91 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
|
|
| 92 |
$patron->set_password( { password => $password } ); |
| 93 |
$cgi = Test::MockObject->new(); |
92 |
$cgi = Test::MockObject->new(); |
| 94 |
$cgi->mock( 'cookie', sub { return; } ); |
93 |
$cgi->mock( 'cookie', sub { return; } ); |
| 95 |
$cgi->mock( |
94 |
$cgi->mock( |
|
Lines 117-155
subtest 'checkauth() tests' => sub {
Link Here
|
| 117 |
|
116 |
|
| 118 |
my $password_expired; |
117 |
my $password_expired; |
| 119 |
|
118 |
|
| 120 |
my $patron_class = Test::MockModule->new('Koha::Patron'); |
119 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
| 121 |
$patron_class->mock( 'password_expired', sub { return $password_expired; } ); |
|
|
| 122 |
|
| 123 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 1 } }); |
| 124 |
my $password = 'password'; |
| 125 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
| 126 |
$patron->set_password( { password => $password } ); |
| 127 |
|
| 128 |
my $cgi_mock = Test::MockModule->new('CGI')->mock( 'request_method', 'POST' ); |
| 129 |
my $cgi = CGI->new; |
| 130 |
$cgi->param( -name => 'userid', -value => $patron->userid ); |
| 131 |
$cgi->param( -name => 'password', -value => $password ); |
| 132 |
|
| 133 |
my $auth = Test::MockModule->new( 'C4::Auth' ); |
| 134 |
# Tests will fail if we hit safe_exit |
| 135 |
$auth->mock( 'safe_exit', sub { return } ); |
| 136 |
|
120 |
|
| 137 |
my ( $userid, $cookie, $sessionID, $flags ); |
121 |
my $password = set_weak_password($patron); |
|
|
122 |
$patron->password_expiration_date( dt_from_string->subtract(days => 1) )->store; |
| 138 |
|
123 |
|
| 139 |
{ |
124 |
my $cgi_mock = Test::MockModule->new('CGI'); |
| 140 |
t::lib::Mocks::mock_preference( 'DumpTemplateVarsOpac', 1 ); |
125 |
$cgi_mock->mock( 'request_method', sub { return 'POST' } ); |
| 141 |
# checkauth will redirect and safe_exit if not authenticated and not authorized |
126 |
my $cgi = CGI->new; |
| 142 |
local *STDOUT; |
127 |
# Simulating the login form submission |
| 143 |
my $stdout; |
128 |
$cgi->param( 'userid', $patron->userid ); |
| 144 |
open STDOUT, '>', \$stdout; |
129 |
$cgi->param( 'password', $password ); |
| 145 |
|
130 |
|
| 146 |
# Password has expired |
131 |
my ( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } ); |
| 147 |
$password_expired = 1; |
132 |
is( $template->{VARS}->{password_has_expired}, 1 ); |
| 148 |
C4::Auth::checkauth( $cgi, 0, { catalogue => 1 } ); |
|
|
| 149 |
like( $stdout, qr{'password_has_expired' => 1}, 'password_has_expired is set to 1' ); |
| 150 |
|
| 151 |
close STDOUT; |
| 152 |
}; |
| 153 |
}; |
133 |
}; |
| 154 |
|
134 |
|
| 155 |
subtest 'Reset auth state when changing users' => sub { |
135 |
subtest 'Reset auth state when changing users' => sub { |
|
Lines 173-180
subtest 'checkauth() tests' => sub {
Link Here
|
| 173 |
C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } ); |
153 |
C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } ); |
| 174 |
is( $return, 'ok', 'Patron authenticated' ); |
154 |
is( $return, 'ok', 'Patron authenticated' ); |
| 175 |
|
155 |
|
| 176 |
my $mock1 = Test::MockModule->new('C4::Auth'); |
|
|
| 177 |
$mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } ); |
| 178 |
my $mock2 = Test::MockModule->new('CGI'); |
156 |
my $mock2 = Test::MockModule->new('CGI'); |
| 179 |
$mock2->mock( 'request_method', 'POST' ); |
157 |
$mock2->mock( 'request_method', 'POST' ); |
| 180 |
$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified.. |
158 |
$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified.. |
|
Lines 183-203
subtest 'checkauth() tests' => sub {
Link Here
|
| 183 |
$cgi->param( -name => 'userid', -value => 'Bond' ); |
161 |
$cgi->param( -name => 'userid', -value => 'Bond' ); |
| 184 |
$cgi->param( -name => 'password', -value => 'James Bond' ); |
162 |
$cgi->param( -name => 'password', -value => 'James Bond' ); |
| 185 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
163 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
| 186 |
my ( @return, $stdout ); |
164 |
my ( $userid, $cookie, $flags, $template ); |
| 187 |
{ |
165 |
( $userid, $cookie, $sessionID, $flags, $template ) = |
| 188 |
local *STDOUT; |
166 |
C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } ); |
| 189 |
local %ENV; |
167 |
is( $template->{VARS}->{loginprompt}, 1, 'Changing to non-existent user causes a redirect to login' ); |
| 190 |
$ENV{REMOTE_ADDR} = '1.2.3.4'; |
|
|
| 191 |
open STDOUT, '>', \$stdout; |
| 192 |
@return = C4::Auth::checkauth( $cgi, 0, {} ); |
| 193 |
close STDOUT; |
| 194 |
} |
| 195 |
is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' ); |
| 196 |
}; |
168 |
}; |
| 197 |
|
169 |
|
| 198 |
|
|
|
| 199 |
subtest 'While still logged in, relogin with another user' => sub { |
170 |
subtest 'While still logged in, relogin with another user' => sub { |
| 200 |
plan tests => 6; |
171 |
plan tests => 5; |
| 201 |
|
172 |
|
| 202 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
173 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
| 203 |
my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
174 |
my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} }); |
|
Lines 209-244
subtest 'checkauth() tests' => sub {
Link Here
|
| 209 |
$session->param( 'lasttime', time() ); |
180 |
$session->param( 'lasttime', time() ); |
| 210 |
$session->param( 'interface', 'opac' ); |
181 |
$session->param( 'interface', 'opac' ); |
| 211 |
$session->flush; |
182 |
$session->flush; |
| 212 |
my $sessionID = $session->id; |
183 |
my $previous_sessionID = $session->id; |
| 213 |
C4::Context->_new_userenv($sessionID); |
184 |
C4::Context->_new_userenv($previous_sessionID); |
| 214 |
|
185 |
|
| 215 |
my ( $return ) = C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } ); |
186 |
my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } ); |
| 216 |
is( $return, 'ok', 'Former session in shape now' ); |
187 |
is( $return, 'ok', 'Former session in shape now' ); |
| 217 |
|
188 |
|
| 218 |
my $mock1 = Test::MockModule->new('C4::Auth'); |
189 |
my $mock1 = Test::MockModule->new('C4::Auth'); |
| 219 |
$mock1->mock( 'safe_exit', sub {} ); |
190 |
$mock1->mock( 'safe_exit', sub {} ); |
| 220 |
my $mock2 = Test::MockModule->new('CGI'); |
191 |
my $mock2 = Test::MockModule->new('CGI'); |
| 221 |
$mock2->mock( 'request_method', 'POST' ); |
192 |
$mock2->mock( 'request_method', 'POST' ); |
| 222 |
$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified.. |
193 |
$mock2->mock( 'cookie', sub { return $previous_sessionID; } ); # oversimplified.. |
| 223 |
my $cgi = CGI->new; |
194 |
my $cgi = CGI->new; |
| 224 |
my $password = 'Incr3d1blyZtr@ng93$'; |
195 |
my $password = 'Incr3d1blyZtr@ng93$'; |
| 225 |
$patron2->set_password({ password => $password }); |
196 |
$patron2->set_password({ password => $password }); |
| 226 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
197 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
| 227 |
$cgi->param( -name => 'password', -value => $password ); |
198 |
$cgi->param( -name => 'password', -value => $password ); |
| 228 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
199 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
| 229 |
my ( @return, $stdout ); |
200 |
my ( $userid, $cookie, $sessionID, $flags, $template ) = |
| 230 |
{ |
201 |
C4::Auth::checkauth( $cgi, 0, {}, 'opac', undef, undef, { do_not_print => 1 } ); |
| 231 |
local *STDOUT; |
202 |
is( $userid, $patron2->userid, 'Login of patron2 approved' ); |
| 232 |
local %ENV; |
203 |
isnt( $sessionID, $previous_sessionID, 'Did not return previous session ID' ); |
| 233 |
$ENV{REMOTE_ADDR} = '1.2.3.4'; |
204 |
ok( $sessionID, 'New session ID not empty' ); |
| 234 |
open STDOUT, '>', \$stdout; |
|
|
| 235 |
@return = C4::Auth::checkauth( $cgi, 0, {} ); |
| 236 |
close STDOUT; |
| 237 |
} |
| 238 |
# Note: We can test return values from checkauth here since we mocked the safe_exit after the Redirect 303 |
| 239 |
is( $return[0], $patron2->userid, 'Login of patron2 approved' ); |
| 240 |
isnt( $return[2], $sessionID, 'Did not return previous session ID' ); |
| 241 |
ok( $return[2], 'New session ID not empty' ); |
| 242 |
|
205 |
|
| 243 |
# Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions |
206 |
# Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions |
| 244 |
$patron2->flags(undef)->store; |
207 |
$patron2->flags(undef)->store; |
|
Lines 246-267
subtest 'checkauth() tests' => sub {
Link Here
|
| 246 |
$session->param( 'id', $patron->userid ); |
209 |
$session->param( 'id', $patron->userid ); |
| 247 |
$session->param( 'interface', 'intranet' ); |
210 |
$session->param( 'interface', 'intranet' ); |
| 248 |
$session->flush; |
211 |
$session->flush; |
| 249 |
$sessionID = $session->id; |
212 |
$previous_sessionID = $session->id; |
| 250 |
C4::Context->_new_userenv($sessionID); |
213 |
C4::Context->_new_userenv($previous_sessionID); |
| 251 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
214 |
$cgi->param( -name => 'userid', -value => $patron2->userid ); |
| 252 |
$cgi->param( -name => 'password', -value => $password ); |
215 |
$cgi->param( -name => 'password', -value => $password ); |
| 253 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
216 |
$cgi->param( -name => 'koha_login_context', -value => 1 ); |
| 254 |
{ |
217 |
( $userid, $cookie, $sessionID, $flags, $template ) = |
| 255 |
local *STDOUT; |
218 |
C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } ); |
| 256 |
local %ENV; |
219 |
is( $template->{VARS}->{nopermission}, 1, 'No permission response' ); |
| 257 |
$ENV{REMOTE_ADDR} = '1.2.3.4'; |
|
|
| 258 |
$stdout = q{}; |
| 259 |
open STDOUT, '>', \$stdout; |
| 260 |
@return = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' ); # patron2 has no catalogue perm |
| 261 |
close STDOUT; |
| 262 |
} |
| 263 |
like( $stdout, qr/You do not have permission to access this page/, 'No permission response' ); |
| 264 |
is( @return, 0, 'checkauth returned failure' ); |
| 265 |
}; |
220 |
}; |
| 266 |
|
221 |
|
| 267 |
subtest 'Two-factor authentication' => sub { |
222 |
subtest 'Two-factor authentication' => sub { |
|
Lines 380-388
subtest 'checkauth() tests' => sub {
Link Here
|
| 380 |
|
335 |
|
| 381 |
my $branch = $builder->build_object({ class => 'Koha::Libraries' }); |
336 |
my $branch = $builder->build_object({ class => 'Koha::Libraries' }); |
| 382 |
|
337 |
|
| 383 |
my $password = 'password'; |
338 |
my $password = set_weak_password($staff_user); |
| 384 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
|
|
| 385 |
$staff_user->set_password( { password => $password } ); |
| 386 |
my $cgi = Test::MockObject->new(); |
339 |
my $cgi = Test::MockObject->new(); |
| 387 |
$cgi->mock( 'cookie', sub { return; } ); |
340 |
$cgi->mock( 'cookie', sub { return; } ); |
| 388 |
$cgi->mock( |
341 |
$cgi->mock( |
|
Lines 421-430
subtest 'no_set_userenv parameter tests' => sub {
Link Here
|
| 421 |
|
374 |
|
| 422 |
my $library = $builder->build_object( { class => 'Koha::Libraries' } ); |
375 |
my $library = $builder->build_object( { class => 'Koha::Libraries' } ); |
| 423 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
376 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
| 424 |
my $password = 'password'; |
|
|
| 425 |
|
377 |
|
| 426 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
378 |
my $password = set_weak_password($patron); |
| 427 |
$patron->set_password({ password => $password }); |
|
|
| 428 |
|
379 |
|
| 429 |
ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' ); |
380 |
ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' ); |
| 430 |
is( C4::Context->userenv, undef, 'Userenv should be undef as required' ); |
381 |
is( C4::Context->userenv, undef, 'Userenv should be undef as required' ); |
|
Lines 443-452
subtest 'checkpw lockout tests' => sub {
Link Here
|
| 443 |
|
394 |
|
| 444 |
my $library = $builder->build_object( { class => 'Koha::Libraries' } ); |
395 |
my $library = $builder->build_object( { class => 'Koha::Libraries' } ); |
| 445 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
396 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
| 446 |
my $password = 'password'; |
397 |
my $password = set_weak_password($patron); |
| 447 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
|
|
| 448 |
t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 ); |
398 |
t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 ); |
| 449 |
$patron->set_password({ password => $password }); |
|
|
| 450 |
|
399 |
|
| 451 |
my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 ); |
400 |
my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 ); |
| 452 |
ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' ); |
401 |
ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' ); |
|
Lines 764-776
subtest 'check_cookie_auth' => sub {
Link Here
|
| 764 |
}; |
713 |
}; |
| 765 |
|
714 |
|
| 766 |
subtest 'checkauth & check_cookie_auth' => sub { |
715 |
subtest 'checkauth & check_cookie_auth' => sub { |
| 767 |
plan tests => 35; |
716 |
plan tests => 34; |
| 768 |
|
717 |
|
| 769 |
# flags = 4 => { catalogue => 1 } |
718 |
# flags = 4 => { catalogue => 1 } |
| 770 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
719 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
| 771 |
my $password = 'password'; |
720 |
my $password = set_weak_password($patron); |
| 772 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
|
|
| 773 |
$patron->set_password( { password => $password } ); |
| 774 |
|
721 |
|
| 775 |
my $cgi_mock = Test::MockModule->new('CGI'); |
722 |
my $cgi_mock = Test::MockModule->new('CGI'); |
| 776 |
$cgi_mock->mock( 'request_method', sub { return 'POST' } ); |
723 |
$cgi_mock->mock( 'request_method', sub { return 'POST' } ); |
|
Lines 797-812
subtest 'checkauth & check_cookie_auth' => sub {
Link Here
|
| 797 |
my $first_sessionID = $sessionID; |
744 |
my $first_sessionID = $sessionID; |
| 798 |
|
745 |
|
| 799 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
746 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
| 800 |
# Not authenticated yet, checkauth didn't return the session |
747 |
# Not authenticated yet, the login form is displayed |
| 801 |
{ |
748 |
my $template; |
| 802 |
local *STDOUT; |
749 |
( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, 'intranet', undef, undef, { do_not_print => 1 } ); |
| 803 |
my $stdout; |
750 |
is( $template->{VARS}->{loginprompt}, 1, ); |
| 804 |
open STDOUT, '>', \$stdout; |
|
|
| 805 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} ); |
| 806 |
close STDOUT; |
| 807 |
} |
| 808 |
is( $sessionID, undef); |
| 809 |
is( $userid, undef); |
| 810 |
|
751 |
|
| 811 |
# Sending undefined fails obviously |
752 |
# Sending undefined fails obviously |
| 812 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} ); |
753 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} ); |
|
Lines 846-858
subtest 'checkauth & check_cookie_auth' => sub {
Link Here
|
| 846 |
# Logging out! |
787 |
# Logging out! |
| 847 |
$cgi->param('logout.x', 1); |
788 |
$cgi->param('logout.x', 1); |
| 848 |
$cgi->delete( 'userid', 'password' ); |
789 |
$cgi->delete( 'userid', 'password' ); |
| 849 |
{ |
790 |
( $userid, $cookie, $sessionID, $flags, $template ) = |
| 850 |
local *STDOUT; |
791 |
C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } ); |
| 851 |
my $stdout; |
792 |
|
| 852 |
open STDOUT, '>', \$stdout; |
|
|
| 853 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
| 854 |
close STDOUT; |
| 855 |
} |
| 856 |
is( $sessionID, undef ); |
793 |
is( $sessionID, undef ); |
| 857 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
794 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
| 858 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} ); |
795 |
( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} ); |
|
Lines 1086-1088
subtest 'get_cataloguing_page_permissions() tests' => sub {
Link Here
|
| 1086 |
|
1023 |
|
| 1087 |
$schema->storage->txn_rollback; |
1024 |
$schema->storage->txn_rollback; |
| 1088 |
}; |
1025 |
}; |
| 1089 |
- |
1026 |
|
|
|
1027 |
sub set_weak_password { |
| 1028 |
my ($patron) = @_; |
| 1029 |
my $password = 'password'; |
| 1030 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
| 1031 |
$patron->set_password( { password => $password } ); |
| 1032 |
return $password; |
| 1033 |
} |