Attachment #161378 for bug #35904

View | Details | Raw Unified | Return to bug 35904
Collapse All | Expand All

Lines 791-796 sub checkauth { Link Here

(-)a/C4/Auth.pm (-4 / +10 lines)
791	my $type = shift;	791	my $type = shift;
792	my $emailaddress = shift;	792	my $emailaddress = shift;
793	my $template_name = shift;	793	my $template_name = shift;
		794	my $params = shift \|\| {}; # do_not_print
794	$type = 'opac' unless $type;	795	$type = 'opac' unless $type;
795		796
796	if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {	797	if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
Lines 1327-1334 sub checkauth { Link Here
1327	$uri->query_param_delete('userid');	1328	$uri->query_param_delete('userid');
1328	$uri->query_param_delete('password');	1329	$uri->query_param_delete('password');
1329	$uri->query_param_delete('koha_login_context');	1330	$uri->query_param_delete('koha_login_context');
1330	print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other');	1331	unless ( $params->{do_not_print} ) {
1331	safe_exit;	1332	print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other');
		1333	safe_exit;
		1334	}
1332	}	1335	}
1333		1336
1334	return ( $userid, $cookie, $sessionID, $flags );	1337	return ( $userid, $cookie, $sessionID, $flags );
Lines 1476-1483 sub checkauth { Link Here
1476	);	1479	);
1477	$template->param(%info);	1480	$template->param(%info);
1478		1481
1479	# $cookie = $query->cookie(CGISESSID => $session->id	1482	if ( $params->{do_not_print} ) {
1480	# );	1483	# This must be used for testing purpose only!
		1484	return ( undef, undef, undef, undef, $template );
		1485	}
		1486
1481	print $query->header(	1487	print $query->header(
1482	{ type => 'text/html',	1488	{ type => 'text/html',
1483	charset => 'utf-8',	1489	charset => 'utf-8',





use C4::Auth;
use C4::Members;
use Koha::AuthUtils qw( hash_password );
use Koha::DateUtils qw( dt_from_string );
use Koha::Database;
use Koha::Patrons;
use Koha::Auth::TwoFactorAuth;


        my $patron = $builder->build_object(
            { class => 'Koha::Patrons', value => { flags => 1 } } );
        my $password = set_weak_password($patron);
        t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
        $patron->set_password( { password => $password } );
        $cgi = Test::MockObject->new();
        $cgi->mock( 'cookie', sub { return; } );
        $cgi->mock(


        my $password_expired;

        my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
        $patron_class->mock( 'password_expired', sub { return $password_expired; } );

        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 1 } });
        my $password = 'password';
        t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
        $patron->set_password( { password => $password } );

        my $cgi_mock = Test::MockModule->new('CGI')->mock( 'request_method', 'POST' );
        my $cgi = CGI->new;
        $cgi->param( -name => 'userid',   -value => $patron->userid );
        $cgi->param( -name => 'password', -value => $password );

        my $auth = Test::MockModule->new( 'C4::Auth' );
        # Tests will fail if we hit safe_exit
        $auth->mock( 'safe_exit', sub { return } );

        my $password = set_weak_password($patron);
        $patron->password_expiration_date( dt_from_string->subtract(days => 1) )->store;

        my $cgi_mock = Test::MockModule->new('CGI');
        $cgi_mock->mock( 'request_method', sub { return 'POST' } );
        my $cgi  = CGI->new;
        # Simulating the login form submission
        $cgi->param( 'userid',   $patron->userid );
        $cgi->param( 'password', $password );

        my ( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
        is( $template->{VARS}->{password_has_expired}, 1 );
            C4::Auth::checkauth( $cgi, 0, { catalogue => 1 } );
            like( $stdout, qr{'password_has_expired' => 1}, 'password_has_expired is set to 1' );

            close STDOUT;
        };
    };

    subtest 'Reset auth state when changing users' => sub {

            C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
        is( $return, 'ok', 'Patron authenticated' );

        my $mock1 = Test::MockModule->new('C4::Auth');
        $mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } );
        my $mock2 = Test::MockModule->new('CGI');
        $mock2->mock( 'request_method', 'POST' );
        $mock2->mock( 'cookie',         sub { return $sessionID; } );    # oversimplified..

        $cgi->param( -name => 'userid',             -value => 'Bond' );
        $cgi->param( -name => 'password',           -value => 'James Bond' );
        $cgi->param( -name => 'koha_login_context', -value => 1 );
        my ( $userid, $cookie, $flags, $template );
        ( $userid, $cookie, $sessionID, $flags, $template ) =
            C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
        is( $template->{VARS}->{loginprompt}, 1, 'Changing to non-existent user causes a redirect to login' );
            $ENV{REMOTE_ADDR} = '1.2.3.4';
            open STDOUT, '>', \$stdout;
            @return = C4::Auth::checkauth( $cgi, 0, {} );
            close STDOUT;
        }
        is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' );
    };


    subtest 'While still logged in, relogin with another user' => sub {
        plan tests => 5;

        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} });
        my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} });

        $session->param( 'lasttime',     time() );
        $session->param( 'interface',    'opac' );
        $session->flush;
        my $previous_sessionID = $session->id;
        C4::Context->_new_userenv($previous_sessionID);

        my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
        is( $return, 'ok', 'Former session in shape now' );

        my $mock1 = Test::MockModule->new('C4::Auth');
        $mock1->mock( 'safe_exit', sub {} );
        my $mock2 = Test::MockModule->new('CGI');
        $mock2->mock( 'request_method', 'POST' );
        $mock2->mock( 'cookie', sub { return $previous_sessionID; } ); # oversimplified..
        my $cgi = CGI->new;
        my $password = 'Incr3d1blyZtr@ng93$';
        $patron2->set_password({ password => $password });
        $cgi->param( -name => 'userid',             -value => $patron2->userid );
        $cgi->param( -name => 'password',           -value => $password );
        $cgi->param( -name => 'koha_login_context', -value => 1 );
        my ( $userid, $cookie, $sessionID, $flags, $template ) =
            C4::Auth::checkauth( $cgi, 0, {}, 'opac', undef, undef, { do_not_print => 1 } );
        is( $userid, $patron2->userid, 'Login of patron2 approved' );
        isnt( $sessionID, $previous_sessionID, 'Did not return previous session ID' );
        ok( $sessionID, 'New session ID not empty' );
            open STDOUT, '>', \$stdout;
            @return = C4::Auth::checkauth( $cgi, 0, {} );
            close STDOUT;
        }
        # Note: We can test return values from checkauth here since we mocked the safe_exit after the Redirect 303
        is( $return[0], $patron2->userid, 'Login of patron2 approved' );
        isnt( $return[2], $sessionID, 'Did not return previous session ID' );
        ok( $return[2], 'New session ID not empty' );

        # Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions
        $patron2->flags(undef)->store;

        $session->param( 'id',           $patron->userid );
        $session->param( 'interface',    'intranet' );
        $session->flush;
        $previous_sessionID = $session->id;
        C4::Context->_new_userenv($previous_sessionID);
        $cgi->param( -name => 'userid',             -value => $patron2->userid );
        $cgi->param( -name => 'password',           -value => $password );
        $cgi->param( -name => 'koha_login_context', -value => 1 );
        ( $userid, $cookie, $sessionID, $flags, $template ) =
            C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
        is( $template->{VARS}->{nopermission}, 1, 'No permission response' );
            $ENV{REMOTE_ADDR} = '1.2.3.4';
            $stdout = q{};
            open STDOUT, '>', \$stdout;
            @return = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' ); # patron2 has no catalogue perm
            close STDOUT;
        }
        like( $stdout, qr/You do not have permission to access this page/, 'No permission response' );
        is( @return, 0, 'checkauth returned failure' );
    };

    subtest 'Two-factor authentication' => sub {


        my $branch = $builder->build_object({ class => 'Koha::Libraries' });

        my $password = set_weak_password($staff_user);
        t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
        $staff_user->set_password( { password => $password } );
        my $cgi = Test::MockObject->new();
        $cgi->mock( 'cookie', sub { return; } );
        $cgi->mock(


    my $library = $builder->build_object( { class => 'Koha::Libraries' } );
    my $patron  = $builder->build_object( { class => 'Koha::Patrons' } );
    my $password = 'password';

    my $password = set_weak_password($patron);
    $patron->set_password({ password => $password });

    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
    is( C4::Context->userenv, undef, 'Userenv should be undef as required' );


    my $library = $builder->build_object( { class => 'Koha::Libraries' } );
    my $patron  = $builder->build_object( { class => 'Koha::Patrons' } );
    my $password = set_weak_password($patron);
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
    t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
    $patron->set_password({ password => $password });

    my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
    ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' );

};

subtest 'checkauth & check_cookie_auth' => sub {
    plan tests => 34;

    # flags = 4 => { catalogue => 1 }
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
    my $password = set_weak_password($patron);
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
    $patron->set_password( { password => $password } );

    my $cgi_mock = Test::MockModule->new('CGI');
    $cgi_mock->mock( 'request_method', sub { return 'POST' } );

    my $first_sessionID = $sessionID;

    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
    # Not authenticated yet, the login form is displayed
    my $template;
    ( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, 'intranet', undef, undef, { do_not_print => 1 } );
    is( $template->{VARS}->{loginprompt}, 1, );
        open STDOUT, '>', \$stdout;
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} );
        close STDOUT;
    }
    is( $sessionID, undef);
    is( $userid, undef);

    # Sending undefined fails obviously
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} );

    # Logging out!
    $cgi->param('logout.x', 1);
    $cgi->delete( 'userid', 'password' );
    ( $userid, $cookie, $sessionID, $flags, $template ) =
        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );

        open STDOUT, '>', \$stdout;
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
        close STDOUT;
    }
    is( $sessionID, undef );
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
    ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} );


    $schema->storage->txn_rollback;
};

sub set_weak_password {
    my ($patron) = @_;
    my $password = 'password';
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
    $patron->set_password( { password => $password } );
    return $password;
}

Return to bug 35904

Lines 14-20 use t::lib::TestBuilder; Link Here

(-)a/t/db_dependent/Auth.t (-109 / +53 lines)
14		14
15	use C4::Auth;	15	use C4::Auth;
16	use C4::Members;	16	use C4::Members;
17	use Koha::AuthUtils qw/hash_password/;	17	use Koha::AuthUtils qw( hash_password );
		18	use Koha::DateUtils qw( dt_from_string );
18	use Koha::Database;	19	use Koha::Database;
19	use Koha::Patrons;	20	use Koha::Patrons;
20	use Koha::Auth::TwoFactorAuth;	21	use Koha::Auth::TwoFactorAuth;
Lines 87-95 subtest 'checkauth() tests' => sub { Link Here
87		88
88	my $patron = $builder->build_object(	89	my $patron = $builder->build_object(
89	{ class => 'Koha::Patrons', value => { flags => 1 } } );	90	{ class => 'Koha::Patrons', value => { flags => 1 } } );
90	my $password = 'password';	91	my $password = set_weak_password($patron);
91	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
92	$patron->set_password( { password => $password } );
93	$cgi = Test::MockObject->new();	92	$cgi = Test::MockObject->new();
94	$cgi->mock( 'cookie', sub { return; } );	93	$cgi->mock( 'cookie', sub { return; } );
95	$cgi->mock(	94	$cgi->mock(
Lines 117-155 subtest 'checkauth() tests' => sub { Link Here
117		116
118	my $password_expired;	117	my $password_expired;
119		118
120	my $patron_class = Test::MockModule->new('Koha::Patron');	119	my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
121	$patron_class->mock( 'password_expired', sub { return $password_expired; } );
122
123	my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 1 } });
124	my $password = 'password';
125	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
126	$patron->set_password( { password => $password } );
127
128	my $cgi_mock = Test::MockModule->new('CGI')->mock( 'request_method', 'POST' );
129	my $cgi = CGI->new;
130	$cgi->param( -name => 'userid', -value => $patron->userid );
131	$cgi->param( -name => 'password', -value => $password );
132
133	my $auth = Test::MockModule->new( 'C4::Auth' );
134	# Tests will fail if we hit safe_exit
135	$auth->mock( 'safe_exit', sub { return } );
136		120
137	my ( $userid, $cookie, $sessionID, $flags );	121	my $password = set_weak_password($patron);
		122	$patron->password_expiration_date( dt_from_string->subtract(days => 1) )->store;
138		123
139	{	124	my $cgi_mock = Test::MockModule->new('CGI');
140	t::lib::Mocks::mock_preference( 'DumpTemplateVarsOpac', 1 );	125	$cgi_mock->mock( 'request_method', sub { return 'POST' } );
141	# checkauth will redirect and safe_exit if not authenticated and not authorized	126	my $cgi = CGI->new;
142	local *STDOUT;	127	# Simulating the login form submission
143	my $stdout;	128	$cgi->param( 'userid', $patron->userid );
144	open STDOUT, '>', \$stdout;	129	$cgi->param( 'password', $password );
145		130
146	# Password has expired	131	my ( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
147	$password_expired = 1;	132	is( $template->{VARS}->{password_has_expired}, 1 );
148	C4::Auth::checkauth( $cgi, 0, { catalogue => 1 } );
149	like( $stdout, qr{'password_has_expired' => 1}, 'password_has_expired is set to 1' );
150
151	close STDOUT;
152	};
153	};	133	};
154		134
155	subtest 'Reset auth state when changing users' => sub {	135	subtest 'Reset auth state when changing users' => sub {
Lines 173-180 subtest 'checkauth() tests' => sub { Link Here
173	C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );	153	C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
174	is( $return, 'ok', 'Patron authenticated' );	154	is( $return, 'ok', 'Patron authenticated' );
175		155
176	my $mock1 = Test::MockModule->new('C4::Auth');
177	$mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } );
178	my $mock2 = Test::MockModule->new('CGI');	156	my $mock2 = Test::MockModule->new('CGI');
179	$mock2->mock( 'request_method', 'POST' );	157	$mock2->mock( 'request_method', 'POST' );
180	$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified..	158	$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified..
Lines 183-203 subtest 'checkauth() tests' => sub { Link Here
183	$cgi->param( -name => 'userid', -value => 'Bond' );	161	$cgi->param( -name => 'userid', -value => 'Bond' );
184	$cgi->param( -name => 'password', -value => 'James Bond' );	162	$cgi->param( -name => 'password', -value => 'James Bond' );
185	$cgi->param( -name => 'koha_login_context', -value => 1 );	163	$cgi->param( -name => 'koha_login_context', -value => 1 );
186	my ( @return, $stdout );	164	my ( $userid, $cookie, $flags, $template );
187	{	165	( $userid, $cookie, $sessionID, $flags, $template ) =
188	local *STDOUT;	166	C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
189	local %ENV;	167	is( $template->{VARS}->{loginprompt}, 1, 'Changing to non-existent user causes a redirect to login' );
190	$ENV{REMOTE_ADDR} = '1.2.3.4';
191	open STDOUT, '>', \$stdout;
192	@return = C4::Auth::checkauth( $cgi, 0, {} );
193	close STDOUT;
194	}
195	is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' );
196	};	168	};
197		169
198
199	subtest 'While still logged in, relogin with another user' => sub {	170	subtest 'While still logged in, relogin with another user' => sub {
200	plan tests => 6;	171	plan tests => 5;
201		172
202	my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} });	173	my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} });
203	my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} });	174	my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} });
Lines 209-244 subtest 'checkauth() tests' => sub { Link Here
209	$session->param( 'lasttime', time() );	180	$session->param( 'lasttime', time() );
210	$session->param( 'interface', 'opac' );	181	$session->param( 'interface', 'opac' );
211	$session->flush;	182	$session->flush;
212	my $sessionID = $session->id;	183	my $previous_sessionID = $session->id;
213	C4::Context->_new_userenv($sessionID);	184	C4::Context->_new_userenv($previous_sessionID);
214		185
215	my ( $return ) = C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );	186	my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
216	is( $return, 'ok', 'Former session in shape now' );	187	is( $return, 'ok', 'Former session in shape now' );
217		188
218	my $mock1 = Test::MockModule->new('C4::Auth');	189	my $mock1 = Test::MockModule->new('C4::Auth');
219	$mock1->mock( 'safe_exit', sub {} );	190	$mock1->mock( 'safe_exit', sub {} );
220	my $mock2 = Test::MockModule->new('CGI');	191	my $mock2 = Test::MockModule->new('CGI');
221	$mock2->mock( 'request_method', 'POST' );	192	$mock2->mock( 'request_method', 'POST' );
222	$mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified..	193	$mock2->mock( 'cookie', sub { return $previous_sessionID; } ); # oversimplified..
223	my $cgi = CGI->new;	194	my $cgi = CGI->new;
224	my $password = 'Incr3d1blyZtr@ng93$';	195	my $password = 'Incr3d1blyZtr@ng93$';
225	$patron2->set_password({ password => $password });	196	$patron2->set_password({ password => $password });
226	$cgi->param( -name => 'userid', -value => $patron2->userid );	197	$cgi->param( -name => 'userid', -value => $patron2->userid );
227	$cgi->param( -name => 'password', -value => $password );	198	$cgi->param( -name => 'password', -value => $password );
228	$cgi->param( -name => 'koha_login_context', -value => 1 );	199	$cgi->param( -name => 'koha_login_context', -value => 1 );
229	my ( @return, $stdout );	200	my ( $userid, $cookie, $sessionID, $flags, $template ) =
230	{	201	C4::Auth::checkauth( $cgi, 0, {}, 'opac', undef, undef, { do_not_print => 1 } );
231	local *STDOUT;	202	is( $userid, $patron2->userid, 'Login of patron2 approved' );
232	local %ENV;	203	isnt( $sessionID, $previous_sessionID, 'Did not return previous session ID' );
233	$ENV{REMOTE_ADDR} = '1.2.3.4';	204	ok( $sessionID, 'New session ID not empty' );
234	open STDOUT, '>', \$stdout;
235	@return = C4::Auth::checkauth( $cgi, 0, {} );
236	close STDOUT;
237	}
238	# Note: We can test return values from checkauth here since we mocked the safe_exit after the Redirect 303
239	is( $return[0], $patron2->userid, 'Login of patron2 approved' );
240	isnt( $return[2], $sessionID, 'Did not return previous session ID' );
241	ok( $return[2], 'New session ID not empty' );
242		205
243	# Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions	206	# Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions
244	$patron2->flags(undef)->store;	207	$patron2->flags(undef)->store;
Lines 246-267 subtest 'checkauth() tests' => sub { Link Here
246	$session->param( 'id', $patron->userid );	209	$session->param( 'id', $patron->userid );
247	$session->param( 'interface', 'intranet' );	210	$session->param( 'interface', 'intranet' );
248	$session->flush;	211	$session->flush;
249	$sessionID = $session->id;	212	$previous_sessionID = $session->id;
250	C4::Context->_new_userenv($sessionID);	213	C4::Context->_new_userenv($previous_sessionID);
251	$cgi->param( -name => 'userid', -value => $patron2->userid );	214	$cgi->param( -name => 'userid', -value => $patron2->userid );
252	$cgi->param( -name => 'password', -value => $password );	215	$cgi->param( -name => 'password', -value => $password );
253	$cgi->param( -name => 'koha_login_context', -value => 1 );	216	$cgi->param( -name => 'koha_login_context', -value => 1 );
254	{	217	( $userid, $cookie, $sessionID, $flags, $template ) =
255	local *STDOUT;	218	C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
256	local %ENV;	219	is( $template->{VARS}->{nopermission}, 1, 'No permission response' );
257	$ENV{REMOTE_ADDR} = '1.2.3.4';
258	$stdout = q{};
259	open STDOUT, '>', \$stdout;
260	@return = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' ); # patron2 has no catalogue perm
261	close STDOUT;
262	}
263	like( $stdout, qr/You do not have permission to access this page/, 'No permission response' );
264	is( @return, 0, 'checkauth returned failure' );
265	};	220	};
266		221
267	subtest 'Two-factor authentication' => sub {	222	subtest 'Two-factor authentication' => sub {
Lines 380-388 subtest 'checkauth() tests' => sub { Link Here
380		335
381	my $branch = $builder->build_object({ class => 'Koha::Libraries' });	336	my $branch = $builder->build_object({ class => 'Koha::Libraries' });
382		337
383	my $password = 'password';	338	my $password = set_weak_password($staff_user);
384	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
385	$staff_user->set_password( { password => $password } );
386	my $cgi = Test::MockObject->new();	339	my $cgi = Test::MockObject->new();
387	$cgi->mock( 'cookie', sub { return; } );	340	$cgi->mock( 'cookie', sub { return; } );
388	$cgi->mock(	341	$cgi->mock(
Lines 421-430 subtest 'no_set_userenv parameter tests' => sub { Link Here
421		374
422	my $library = $builder->build_object( { class => 'Koha::Libraries' } );	375	my $library = $builder->build_object( { class => 'Koha::Libraries' } );
423	my $patron = $builder->build_object( { class => 'Koha::Patrons' } );	376	my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
424	my $password = 'password';
425		377
426	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );	378	my $password = set_weak_password($patron);
427	$patron->set_password({ password => $password });
428		379
429	ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );	380	ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
430	is( C4::Context->userenv, undef, 'Userenv should be undef as required' );	381	is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
Lines 443-452 subtest 'checkpw lockout tests' => sub { Link Here
443		394
444	my $library = $builder->build_object( { class => 'Koha::Libraries' } );	395	my $library = $builder->build_object( { class => 'Koha::Libraries' } );
445	my $patron = $builder->build_object( { class => 'Koha::Patrons' } );	396	my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
446	my $password = 'password';	397	my $password = set_weak_password($patron);
447	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
448	t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );	398	t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
449	$patron->set_password({ password => $password });
450		399
451	my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );	400	my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
452	ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' );	401	ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' );
Lines 764-776 subtest 'check_cookie_auth' => sub { Link Here
764	};	713	};
765		714
766	subtest 'checkauth & check_cookie_auth' => sub {	715	subtest 'checkauth & check_cookie_auth' => sub {
767	plan tests => 35;	716	plan tests => 34;
768		717
769	# flags = 4 => { catalogue => 1 }	718	# flags = 4 => { catalogue => 1 }
770	my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });	719	my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
771	my $password = 'password';	720	my $password = set_weak_password($patron);
772	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
773	$patron->set_password( { password => $password } );
774		721
775	my $cgi_mock = Test::MockModule->new('CGI');	722	my $cgi_mock = Test::MockModule->new('CGI');
776	$cgi_mock->mock( 'request_method', sub { return 'POST' } );	723	$cgi_mock->mock( 'request_method', sub { return 'POST' } );
Lines 797-812 subtest 'checkauth & check_cookie_auth' => sub { Link Here
797	my $first_sessionID = $sessionID;	744	my $first_sessionID = $sessionID;
798		745
799	$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";	746	$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
800	# Not authenticated yet, checkauth didn't return the session	747	# Not authenticated yet, the login form is displayed
801	{	748	my $template;
802	local *STDOUT;	749	( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, 'intranet', undef, undef, { do_not_print => 1 } );
803	my $stdout;	750	is( $template->{VARS}->{loginprompt}, 1, );
804	open STDOUT, '>', \$stdout;
805	( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} );
806	close STDOUT;
807	}
808	is( $sessionID, undef);
809	is( $userid, undef);
810		751
811	# Sending undefined fails obviously	752	# Sending undefined fails obviously
812	my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} );	753	my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} );
Lines 846-858 subtest 'checkauth & check_cookie_auth' => sub { Link Here
846	# Logging out!	787	# Logging out!
847	$cgi->param('logout.x', 1);	788	$cgi->param('logout.x', 1);
848	$cgi->delete( 'userid', 'password' );	789	$cgi->delete( 'userid', 'password' );
849	{	790	( $userid, $cookie, $sessionID, $flags, $template ) =
850	local *STDOUT;	791	C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
851	my $stdout;	792
852	open STDOUT, '>', \$stdout;
853	( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
854	close STDOUT;
855	}
856	is( $sessionID, undef );	793	is( $sessionID, undef );
857	is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );	794	is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
858	( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} );	795	( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} );
Lines 1086-1088 subtest 'get_cataloguing_page_permissions() tests' => sub { Link Here
1086		1023
1087	$schema->storage->txn_rollback;	1024	$schema->storage->txn_rollback;
1088	};	1025	};
1089	-	1026
		1027	sub set_weak_password {
		1028	my ($patron) = @_;
		1029	my $password = 'password';
		1030	t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
		1031	$patron->set_password( { password => $password } );
		1032	return $password;
		1033	}