Attachment #163040 for bug #36149

View | Details | Raw Unified | Return to bug 36149
Collapse All | Expand All




                $session->delete();
                $session->flush;
                $cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );
                C4::Context::unset_userenv();
                $sessionID = undef;
                undef $userid; # IMPORTANT: this assures us a new session in code below
                $auth_state = 'failed';

            $session->delete();
            $session->flush;
        }
        C4::Context::unset_userenv();
        $cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );

        if ($cas and $caslogout) {

        }

        $sessionID = $session->id;
        C4::Context->_new_userenv($sessionID);
        $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
            -name     => 'CGISESSID',
            -value    => $sessionID,

                    # although we do present an authorization failure. (Yes, the
                    # authentication was actually correct.)
                    $info{'nopermission'} = 1;
                    C4::Context::unset_userenv();
                }
                my ( $borrowernumber, $firstname, $surname, $userflags,
                    $branchcode, $branchname, $emailaddress, $desk_id,

            else {
                if ($userid) {
                    $info{'invalid_username_or_password'} = 1;
                    C4::Context::unset_userenv();
                }
                $session->param( 'lasttime', time() );
                $session->param( 'ip',       $session->remote_addr() );

            return ( "failed", undef, undef ) unless $session;

            my $sessionID = $session->id;
            C4::Context->_new_userenv($sessionID);
            my $cookie = $query->cookie(
                -name     => 'CGISESSID',
                -value    => $sessionID,

    unless ( $sessionID ) {
        return ( "failed", undef );
    }
    C4::Context::unset_userenv();
    my $session   = get_session($sessionID);
    if ($session) {
        my $userid   = $session->param('id');

            return ("password_expired", undef ) if $patron->password_expired;
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
            if ($flags) {
                C4::Context->_new_userenv($sessionID);
                if ( !C4::Context->interface ) {
                    # No need to override the interface, most often set by get_template_and_user
                    C4::Context->interface( $session->param('interface') );

            }

        } else {
            C4::Context->_new_userenv($sessionID);
            C4::Context->interface($session->param('interface'));
            C4::Context->set_userenv( undef, q{} );
            return ( "anon", $session );





    $self->{"Zconn"} = undef;    # Zebra Connections
    $self->{"userenv"} = undef;        # User env
    $self->{"activeuser"} = undef;        # current active user
    $self->{"shelves"} = undef;
    $self->{tz} = undef; # local timezone object



Retrieves a hash for user environment variables.

This hash shall be cached for future use: if you call
C<C4::Context-E<gt>userenv> twice, you will get the same hash without real DB access

=cut

#'
sub userenv {
    return $context->{userenv};
    if (defined $var and defined $context->{"userenv"}->{$var}) {
        return $context->{"userenv"}->{$var};
    } else {
        return;
    }
}

=head2 set_userenv

        $register_id,  $register_name
    ) = @_;

    my $var=$context->{"activeuser"} || '';
    my $cell = {
        "number"     => $usernum,
        "id"         => $userid,

        "register_id"   => $register_id,
        "register_name" => $register_name
    };
    $context->{userenv} = $cell;
    return $cell;
}

=head2 unset_userenv

  C4::Context->_new_userenv($session);  # FIXME: This calling style is wrong for what looks like an _internal function

Builds a hash for user environment variables.

This hash shall be cached for future use: if you call
C<C4::Context-E<gt>userenv> twice, you will get the same hash without real DB access

_new_userenv is called in Auth.pm

=cut

#'
sub _new_userenv
{
    shift;  # Useless except it compensates for bad calling style
    my ($sessionID)= @_;
     $context->{"activeuser"}=$sessionID;
}

=head2 _unset_userenv

  C4::Context->unset_userenv;

Destroys user environment variables.

=cut

sub unset_userenv

sub _unset_userenv
{
    $context->{userenv} = {};
}






    my $session = Koha::Session->get_session( { sessionID => $sessionID, storage_method => 'file' } );

    if ( $session ) {
        C4::Context->_new_userenv($sessionID);
        if ( $session->param('cardnumber') ) {
            C4::Context->set_userenv(
                $session->param('number'),


    if ($logout || !$session) {
        # voluntary logout the user
        C4::Context->unset_userenv();
        $session = Koha::Session->get_session( { storage_method => 'file' } );
    }


    unless ($userid) {
        $userid = $query->param('login_userid');
        my $password = $query->param('login_password');
        C4::Context->_new_userenv($sessionID);
        my ( $return, $cardnumber ) = checkpw( $userid, $password );
        if ($return) {
            $loggedin = 1;

        else {
            if ($userid) {
                $info{'invalid_username_or_password'} = 1;
                C4::Context->unset_userenv();
            }
        }
    }

Lines 170-176 sub process { Link Here

(-)a/Koha/BackgroundJob.pm (-1 lines)
170		170
171	if ( $self->context ) {	171	if ( $self->context ) {
172	my $context = $self->json->decode($self->context);	172	my $context = $self->json->decode($self->context);
173	C4::Context->_new_userenv(-1);
174	C4::Context->interface( $context->{interface} );	173	C4::Context->interface( $context->{interface} );
175	C4::Context->set_userenv(	174	C4::Context->set_userenv(
176	$context->{number}, $context->{id},	175	$context->{number}, $context->{id},

Lines 10-16 sub call { Link Here

(-)a/Koha/Middleware/UserEnv.pm (-1 / +1 lines)
10		10
11	my $req = Plack::Request->new($env);	11	my $req = Plack::Request->new($env);
12		12
13	C4::Context->_unset_userenv;	13	C4::Context->unset_userenv;
14		14
15	return $self->app->($env);	15	return $self->app->($env);
16	}	16	}

Lines 569-575 sub _set_userenv { Link Here

(-)a/Koha/REST/V1/Auth.pm (-1 / +1 lines)
569	$THE_library = $patron->library;	569	$THE_library = $patron->library;
570	}	570	}
571		571
572	C4::Context->_new_userenv( $patron->borrowernumber );	572	C4::Context->new_userenv();
573	C4::Context->set_userenv(	573	C4::Context->set_userenv(
574	$patron->borrowernumber, # number,	574	$patron->borrowernumber, # number,
575	$patron->userid, # userid,	575	$patron->userid, # userid,

Lines 46-56 sub import { Link Here

(-)a/Koha/Script.pm (-2 lines)
46	my $class = shift;	46	my $class = shift;
47	my @flags = @_;	47	my @flags = @_;
48		48
49	C4::Context->_new_userenv(1);
50	if ( ( $flags[0] \|\| '' ) eq '-cron' ) {	49	if ( ( $flags[0] \|\| '' ) eq '-cron' ) {
51		50
52	# Set userenv	51	# Set userenv
53	C4::Context->_new_userenv(1);
54	C4::Context->set_userenv(	52	C4::Context->set_userenv(
55	undef, undef, undef, 'CRON', 'CRON',	53	undef, undef, undef, 'CRON', 'CRON',
56	undef, undef, undef, undef, undef	54	undef, undef, undef, undef, undef

Lines 128-134 unless ( $cgi->param('service') ) { Link Here

(-)a/opac/ilsdi.pl (-1 lines)
128	}	128	}
129		129
130	# Set the userenv	130	# Set the userenv
131	C4::Context->_new_userenv( 'ILSDI_'.time() );
132	C4::Context->set_userenv(	131	C4::Context->set_userenv(
133	undef, undef, undef, 'ILSDI', 'ILSDI',	132	undef, undef, undef, 'ILSDI', 'ILSDI',
134	undef, undef, undef, undef, undef,	133	undef, undef, undef, undef, undef,




use C4::Context;
use Koha::Token;

C4::Context->_new_userenv('DUMMY SESSION');
C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, '');

my $tokenizer = Koha::Token->new;

    is( $result->{id}, 'anonymous_567', 'Check userid' );

    # Clear userenv
    C4::Context::_unset_userenv('DUMMY SESSION');
    is( C4::Context::userenv, undef, 'No userenv anymore' );
    $result = Koha::Token::_add_default_csrf_params({}); # pass no session_id
    is( $result->{session_id}, Koha::Token::DEFA_SESSION_ID, 'Check session id' );
    is( $result->{id}, Koha::Token::DEFA_SESSION_USERID. '_'. $result->{session_id}, 'Check userid' );

    # Empty anonymous userenv (see C4::Auth::check_cookie_auth)
    C4::Context->_new_userenv('ANON SESSION');
    C4::Context->set_userenv( undef, q{} );
    ok( C4::Context->userenv, "Userenv exists" );
    $result = Koha::Token::_add_default_csrf_params( {} );    # pass no session_id




        $session->param( 'interface', 'intranet' );
        $session->flush;
        my $sessionID = $session->id;
        C4::Context->_new_userenv($sessionID);

        my ($return) =
            C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );

        $session->param( 'interface',    'opac' );
        $session->flush;
        my $previous_sessionID = $session->id;
        C4::Context->_new_userenv($previous_sessionID);

        my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
        is( $return, 'ok', 'Former session in shape now' );

        $session->param( 'interface',    'intranet' );
        $session->flush;
        $previous_sessionID = $session->id;
        C4::Context->_new_userenv($previous_sessionID);
        $cgi->param( -name => 'login_userid',             -value => $patron2->userid );
        $cgi->param( -name => 'login_password',           -value => $password );
        $cgi->param( -name => 'koha_login_context', -value => 1 );

        is( $sesh->param('branch'), $branch->branchcode, "If user is superlibrarian, they should be able to choose a branch" );

    };
    C4::Context->_new_userenv; # For next tests
};

subtest 'no_set_userenv parameter tests' => sub {

    my $password = set_weak_password($patron);

    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
    C4::Context->unset_userenv;
    is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
    C4::Context->_new_userenv('DUMMY SESSION');
    C4::Context->set_userenv(0,0,0,'firstname','surname', $library->branchcode, 'Library 1', 0, '', '');
    is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv gives correct branch' );
    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );

    is( C4::Context->userenv, undef, 'Environment should be cleared too' );

    # Show that we clear the userenv again: set up env and check deleted session
    C4::Context->_new_userenv( $sessionID );
    C4::Context->set_userenv; # empty
    is( defined C4::Context->userenv, 1, 'There should be an empty userenv again' );
    ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID );

Lines 229-235 subtest 'process tests' => sub { Link Here

(-)a/t/db_dependent/Koha/BackgroundJob.t (-1 lines)
229	{ size => 10, a => 'aaa', b => 'bbb' } );	229	{ size => 10, a => 'aaa', b => 'bbb' } );
230	my $job = Koha::BackgroundJobs->find($job_id);	230	my $job = Koha::BackgroundJobs->find($job_id);
231		231
232	C4::Context->_new_userenv(-1);
233	C4::Context->interface('opac');	232	C4::Context->interface('opac');
234	is( C4::Context->userenv, undef, "Userenv unset prior to calling process");	233	is( C4::Context->userenv, undef, "Userenv unset prior to calling process");
235	is( C4::Context->interface, 'opac', "Interface set to opac prior to calling process");	234	is( C4::Context->interface, 'opac', "Interface set to opac prior to calling process");

Lines 1317-1323 subtest 'store' => sub { Link Here

(-)a/t/db_dependent/Koha/Items.t (-1 / +1 lines)
1317	C4::Circulation::LostItem( $item->itemnumber, 1 );	1317	C4::Circulation::LostItem( $item->itemnumber, 1 );
1318		1318
1319	# Unset the userenv	1319	# Unset the userenv
1320	C4::Context->_new_userenv(undef);	1320	C4::Context->unset_userenv();
1321		1321
1322	# Simluate item marked as found	1322	# Simluate item marked as found
1323	$item->itemlost(0)->store;	1323	$item->itemlost(0)->store;

Lines 70-76 is( $retrieved_review_1_1->review, $new_review_1_1->review, 'Find a review by id Link Here

(-)a/t/db_dependent/Koha/Reviews.t (-1 lines)
70		70
71	subtest 'search_limited' => sub {	71	subtest 'search_limited' => sub {
72	plan tests => 2;	72	plan tests => 2;
73	C4::Context->_new_userenv('xxx');
74	my $group_1 = Koha::Library::Group->new( { title => 'TEST Group 1' } )->store;	73	my $group_1 = Koha::Library::Group->new( { title => 'TEST Group 1' } )->store;
75	my $group_2 = Koha::Library::Group->new( { title => 'TEST Group 2' } )->store;	74	my $group_2 = Koha::Library::Group->new( { title => 'TEST Group 2' } )->store;
76	Koha::Library::Group->new({ parent_id => $group_1->id, branchcode => $patron_1->branchcode })->store();	75	Koha::Library::Group->new({ parent_id => $group_1->id, branchcode => $patron_1->branchcode })->store();

Lines 45-51 subtest 'session_register_id' => sub { Link Here

(-)a/t/db_dependent/Koha/Template/Plugin/Registers.t (-2 / +2 lines)
45	'1', "Returns the register id when set in the userenv" );	45	'1', "Returns the register id when set in the userenv" );
46		46
47	# Unset the userenv	47	# Unset the userenv
48	C4::Context->_new_userenv(undef);	48	C4::Context->unset_userenv();
49	};	49	};
50		50
51	subtest 'session_register_name' => sub {	51	subtest 'session_register_name' => sub {
Lines 61-67 subtest 'session_register_name' => sub { Link Here
61	'Register One', "Returns the register name when set in the userenv" );	61	'Register One', "Returns the register name when set in the userenv" );
62		62
63	# Unset the userenv	63	# Unset the userenv
64	C4::Context->_new_userenv(undef);	64	C4::Context->unset_userenv();
65	};	65	};
66		66
67	subtest 'all() tests' => sub {	67	subtest 'all() tests' => sub {

Lines 47-53 my $library = $builder->build({ source => 'Branch' }); Link Here

(-)a/t/db_dependent/Patron/Borrower_Discharge.t (-1 lines)
47	my $another_library = $builder->build({ source => 'Branch' });	47	my $another_library = $builder->build({ source => 'Branch' });
48	my $itemtype = $builder->build({ source => 'Itemtype' })->{itemtype};	48	my $itemtype = $builder->build({ source => 'Itemtype' })->{itemtype};
49		49
50	C4::Context->_new_userenv('xxx');
51	my $patron = $builder->build_object({	50	my $patron = $builder->build_object({
52	class => 'Koha::Patrons',	51	class => 'Koha::Patrons',
53	value => {	52	value => {

Lines 119-126 Also, some sane defaults are set if no parameters are passed. Link Here

(-)a/t/lib/Mocks.pm (-3 lines)
119	sub mock_userenv {	119	sub mock_userenv {
120	my ( $params ) = @_;	120	my ( $params ) = @_;
121		121
122	C4::Context->_new_userenv(42);
123
124	my $userenv;	122	my $userenv;
125	if ( $params and my $patron = $params->{patron} ) {	123	if ( $params and my $patron = $params->{patron} ) {
126	$userenv = $patron->unblessed;	124	$userenv = $patron->unblessed;
127	-

Return to bug 36149

Lines 925-931 sub checkauth { Link Here

(-)a/C4/Auth.pm (-9 / +5 lines)
925	$session->delete();	925	$session->delete();
926	$session->flush;	926	$session->flush;
927	$cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );	927	$cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );
928	C4::Context::_unset_userenv($sessionID);	928	C4::Context::unset_userenv();
929	$sessionID = undef;	929	$sessionID = undef;
930	undef $userid; # IMPORTANT: this assures us a new session in code below	930	undef $userid; # IMPORTANT: this assures us a new session in code below
931	$auth_state = 'failed';	931	$auth_state = 'failed';
Lines 974-980 sub checkauth { Link Here
974	$session->delete();	974	$session->delete();
975	$session->flush;	975	$session->flush;
976	}	976	}
977	C4::Context::_unset_userenv($sessionID);	977	C4::Context::unset_userenv();
978	$cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );	978	$cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );
979		979
980	if ($cas and $caslogout) {	980	if ($cas and $caslogout) {
Lines 1004-1010 sub checkauth { Link Here
1004	}	1004	}
1005		1005
1006	$sessionID = $session->id;	1006	$sessionID = $session->id;
1007	C4::Context->_new_userenv($sessionID);
1008	$cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(	1007	$cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
1009	-name => 'CGISESSID',	1008	-name => 'CGISESSID',
1010	-value => $sessionID,	1009	-value => $sessionID,
Lines 1150-1156 sub checkauth { Link Here
1150	# although we do present an authorization failure. (Yes, the	1149	# although we do present an authorization failure. (Yes, the
1151	# authentication was actually correct.)	1150	# authentication was actually correct.)
1152	$info{'nopermission'} = 1;	1151	$info{'nopermission'} = 1;
1153	C4::Context::_unset_userenv($sessionID);	1152	C4::Context::unset_userenv();
1154	}	1153	}
1155	my ( $borrowernumber, $firstname, $surname, $userflags,	1154	my ( $borrowernumber, $firstname, $surname, $userflags,
1156	$branchcode, $branchname, $emailaddress, $desk_id,	1155	$branchcode, $branchname, $emailaddress, $desk_id,
Lines 1281-1287 sub checkauth { Link Here
1281	else {	1280	else {
1282	if ($userid) {	1281	if ($userid) {
1283	$info{'invalid_username_or_password'} = 1;	1282	$info{'invalid_username_or_password'} = 1;
1284	C4::Context::_unset_userenv($sessionID);	1283	C4::Context::unset_userenv();
1285	}	1284	}
1286	$session->param( 'lasttime', time() );	1285	$session->param( 'lasttime', time() );
1287	$session->param( 'ip', $session->remote_addr() );	1286	$session->param( 'ip', $session->remote_addr() );
Lines 1642-1648 sub check_api_auth { Link Here
1642	return ( "failed", undef, undef ) unless $session;	1641	return ( "failed", undef, undef ) unless $session;
1643		1642
1644	my $sessionID = $session->id;	1643	my $sessionID = $session->id;
1645	C4::Context->_new_userenv($sessionID);
1646	my $cookie = $query->cookie(	1644	my $cookie = $query->cookie(
1647	-name => 'CGISESSID',	1645	-name => 'CGISESSID',
1648	-value => $sessionID,	1646	-value => $sessionID,
Lines 1806-1812 sub check_cookie_auth { Link Here
1806	unless ( $sessionID ) {	1804	unless ( $sessionID ) {
1807	return ( "failed", undef );	1805	return ( "failed", undef );
1808	}	1806	}
1809	C4::Context::_unset_userenv($sessionID); # remove old userenv first	1807	C4::Context::unset_userenv();
1810	my $session = get_session($sessionID);	1808	my $session = get_session($sessionID);
1811	if ($session) {	1809	if ($session) {
1812	my $userid = $session->param('id');	1810	my $userid = $session->param('id');
Lines 1843-1849 sub check_cookie_auth { Link Here
1843	return ("password_expired", undef ) if $patron->password_expired;	1841	return ("password_expired", undef ) if $patron->password_expired;
1844	my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;	1842	my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1845	if ($flags) {	1843	if ($flags) {
1846	C4::Context->_new_userenv($sessionID);
1847	if ( !C4::Context->interface ) {	1844	if ( !C4::Context->interface ) {
1848	# No need to override the interface, most often set by get_template_and_user	1845	# No need to override the interface, most often set by get_template_and_user
1849	C4::Context->interface( $session->param('interface') );	1846	C4::Context->interface( $session->param('interface') );
Lines 1873-1879 sub check_cookie_auth { Link Here
1873	}	1870	}
1874		1871
1875	} else {	1872	} else {
1876	C4::Context->_new_userenv($sessionID);
1877	C4::Context->interface($session->param('interface'));	1873	C4::Context->interface($session->param('interface'));
1878	C4::Context->set_userenv( undef, q{} );	1874	C4::Context->set_userenv( undef, q{} );
1879	return ( "anon", $session );	1875	return ( "anon", $session );

Lines 182-188 sub new { Link Here

(-)a/C4/Context.pm (-41 / +7 lines)
182		182
183	$self->{"Zconn"} = undef; # Zebra Connections	183	$self->{"Zconn"} = undef; # Zebra Connections
184	$self->{"userenv"} = undef; # User env	184	$self->{"userenv"} = undef; # User env
185	$self->{"activeuser"} = undef; # current active user
186	$self->{"shelves"} = undef;	185	$self->{"shelves"} = undef;
187	$self->{tz} = undef; # local timezone object	186	$self->{tz} = undef; # local timezone object
188		187
Lines 757-775 sub restore_dbh Link Here
757		756
758	Retrieves a hash for user environment variables.	757	Retrieves a hash for user environment variables.
759		758
760	This hash shall be cached for future use: if you call
761	C<C4::Context-E<gt>userenv> twice, you will get the same hash without real DB access
762
763	=cut	759	=cut
764		760
765	#'
766	sub userenv {	761	sub userenv {
767	my $var = $context->{"activeuser"};	762	return $context->{userenv};
768	if (defined $var and defined $context->{"userenv"}->{$var}) {
769	return $context->{"userenv"}->{$var};
770	} else {
771	return;
772	}
773	}	763	}
774		764
775	=head2 set_userenv	765	=head2 set_userenv
Lines 797-803 sub set_userenv { Link Here
797	$register_id, $register_name	787	$register_id, $register_name
798	) = @_;	788	) = @_;
799		789
800	my $var=$context->{"activeuser"} \|\| '';
801	my $cell = {	790	my $cell = {
802	"number" => $usernum,	791	"number" => $usernum,
803	"id" => $userid,	792	"id" => $userid,
Lines 816-859 sub set_userenv { Link Here
816	"register_id" => $register_id,	805	"register_id" => $register_id,
817	"register_name" => $register_name	806	"register_name" => $register_name
818	};	807	};
819	$context->{userenv}->{$var} = $cell;	808	$context->{userenv} = $cell;
820	return $cell;	809	return $cell;
821	}	810	}
822		811
823	=head2 _new_userenv	812	=head2 unset_userenv
824
825	C4::Context->_new_userenv($session); # FIXME: This calling style is wrong for what looks like an _internal function
826
827	Builds a hash for user environment variables.
828
829	This hash shall be cached for future use: if you call
830	C<C4::Context-E<gt>userenv> twice, you will get the same hash without real DB access
831
832	_new_userenv is called in Auth.pm
833
834	=cut
835
836	#'
837	sub _new_userenv
838	{
839	shift; # Useless except it compensates for bad calling style
840	my ($sessionID)= @_;
841	$context->{"activeuser"}=$sessionID;
842	}
843
844	=head2 _unset_userenv
845		813
846	C4::Context->_unset_userenv;	814	C4::Context->unset_userenv;
847		815
848	Destroys the hash for activeuser user environment variables.	816	Destroys user environment variables.
849		817
850	=cut	818	=cut
851		819
852	#'	820	sub unset_userenv
853
854	sub _unset_userenv
855	{	821	{
856	delete $context->{activeuser};	822	$context->{userenv} = {};
857	}	823	}
858		824
859		825

Lines 252-258 sub checkauth { Link Here

(-)a/C4/InstallAuth.pm (-4 / +2 lines)
252	my $session = Koha::Session->get_session( { sessionID => $sessionID, storage_method => 'file' } );	252	my $session = Koha::Session->get_session( { sessionID => $sessionID, storage_method => 'file' } );
253		253
254	if ( $session ) {	254	if ( $session ) {
255	C4::Context->_new_userenv($sessionID);
256	if ( $session->param('cardnumber') ) {	255	if ( $session->param('cardnumber') ) {
257	C4::Context->set_userenv(	256	C4::Context->set_userenv(
258	$session->param('number'),	257	$session->param('number'),
Lines 279-285 sub checkauth { Link Here
279		278
280	if ($logout \|\| !$session) {	279	if ($logout \|\| !$session) {
281	# voluntary logout the user	280	# voluntary logout the user
282	C4::Context->_unset_userenv($sessionID);	281	C4::Context->unset_userenv();
283	$session = Koha::Session->get_session( { storage_method => 'file' } );	282	$session = Koha::Session->get_session( { storage_method => 'file' } );
284	}	283	}
285		284
Lines 288-294 sub checkauth { Link Here
288	unless ($userid) {	287	unless ($userid) {
289	$userid = $query->param('login_userid');	288	$userid = $query->param('login_userid');
290	my $password = $query->param('login_password');	289	my $password = $query->param('login_password');
291	C4::Context->_new_userenv($sessionID);
292	my ( $return, $cardnumber ) = checkpw( $userid, $password );	290	my ( $return, $cardnumber ) = checkpw( $userid, $password );
293	if ($return) {	291	if ($return) {
294	$loggedin = 1;	292	$loggedin = 1;
Lines 334-340 sub checkauth { Link Here
334	else {	332	else {
335	if ($userid) {	333	if ($userid) {
336	$info{'invalid_username_or_password'} = 1;	334	$info{'invalid_username_or_password'} = 1;
337	C4::Context->_unset_userenv($sessionID);	335	C4::Context->unset_userenv();
338	}	336	}
339	}	337	}
340	}	338	}

Lines 199-205 subtest 'checkauth() tests' => sub { Link Here

(-)a/t/db_dependent/Auth.t (-6 / +1 lines)
199	$session->param( 'interface', 'intranet' );	199	$session->param( 'interface', 'intranet' );
200	$session->flush;	200	$session->flush;
201	my $sessionID = $session->id;	201	my $sessionID = $session->id;
202	C4::Context->_new_userenv($sessionID);
203		202
204	my ($return) =	203	my ($return) =
205	C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );	204	C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
Lines 233-239 subtest 'checkauth() tests' => sub { Link Here
233	$session->param( 'interface', 'opac' );	232	$session->param( 'interface', 'opac' );
234	$session->flush;	233	$session->flush;
235	my $previous_sessionID = $session->id;	234	my $previous_sessionID = $session->id;
236	C4::Context->_new_userenv($previous_sessionID);
237		235
238	my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );	236	my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
239	is( $return, 'ok', 'Former session in shape now' );	237	is( $return, 'ok', 'Former session in shape now' );
Lines 262-268 subtest 'checkauth() tests' => sub { Link Here
262	$session->param( 'interface', 'intranet' );	260	$session->param( 'interface', 'intranet' );
263	$session->flush;	261	$session->flush;
264	$previous_sessionID = $session->id;	262	$previous_sessionID = $session->id;
265	C4::Context->_new_userenv($previous_sessionID);
266	$cgi->param( -name => 'login_userid', -value => $patron2->userid );	263	$cgi->param( -name => 'login_userid', -value => $patron2->userid );
267	$cgi->param( -name => 'login_password', -value => $password );	264	$cgi->param( -name => 'login_password', -value => $password );
268	$cgi->param( -name => 'koha_login_context', -value => 1 );	265	$cgi->param( -name => 'koha_login_context', -value => 1 );
Lines 417-423 subtest 'checkauth() tests' => sub { Link Here
417	is( $sesh->param('branch'), $branch->branchcode, "If user is superlibrarian, they should be able to choose a branch" );	414	is( $sesh->param('branch'), $branch->branchcode, "If user is superlibrarian, they should be able to choose a branch" );
418		415
419	};	416	};
420	C4::Context->_new_userenv; # For next tests
421	};	417	};
422		418
423	subtest 'no_set_userenv parameter tests' => sub {	419	subtest 'no_set_userenv parameter tests' => sub {
Lines 430-437 subtest 'no_set_userenv parameter tests' => sub { Link Here
430	my $password = set_weak_password($patron);	426	my $password = set_weak_password($patron);
431		427
432	ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );	428	ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
		429	C4::Context->unset_userenv;
433	is( C4::Context->userenv, undef, 'Userenv should be undef as required' );	430	is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
434	C4::Context->_new_userenv('DUMMY SESSION');
435	C4::Context->set_userenv(0,0,0,'firstname','surname', $library->branchcode, 'Library 1', 0, '', '');	431	C4::Context->set_userenv(0,0,0,'firstname','surname', $library->branchcode, 'Library 1', 0, '', '');
436	is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv gives correct branch' );	432	is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv gives correct branch' );
437	ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );	433	ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
Lines 940-946 subtest 'Userenv clearing in check_cookie_auth' => sub { Link Here
940	is( C4::Context->userenv, undef, 'Environment should be cleared too' );	936	is( C4::Context->userenv, undef, 'Environment should be cleared too' );
941		937
942	# Show that we clear the userenv again: set up env and check deleted session	938	# Show that we clear the userenv again: set up env and check deleted session
943	C4::Context->_new_userenv( $sessionID );
944	C4::Context->set_userenv; # empty	939	C4::Context->set_userenv; # empty
945	is( defined C4::Context->userenv, 1, 'There should be an empty userenv again' );	940	is( defined C4::Context->userenv, 1, 'There should be an empty userenv again' );
946	( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID );	941	( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID );

Lines 27-33 use Time::HiRes qw\|usleep\|; Link Here

(-)a/t/Token.t (-3 lines)
27	use C4::Context;	27	use C4::Context;
28	use Koha::Token;	28	use Koha::Token;
29		29
30	C4::Context->_new_userenv('DUMMY SESSION');
31	C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, '');	30	C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, '');
32		31
33	my $tokenizer = Koha::Token->new;	32	my $tokenizer = Koha::Token->new;
Lines 114-127 subtest 'testing _add_default_csrf_params with/without userenv (bug 27849)' => s Link Here
114	is( $result->{id}, 'anonymous_567', 'Check userid' );	113	is( $result->{id}, 'anonymous_567', 'Check userid' );
115		114
116	# Clear userenv	115	# Clear userenv
117	C4::Context::_unset_userenv('DUMMY SESSION');
118	is( C4::Context::userenv, undef, 'No userenv anymore' );	116	is( C4::Context::userenv, undef, 'No userenv anymore' );
119	$result = Koha::Token::_add_default_csrf_params({}); # pass no session_id	117	$result = Koha::Token::_add_default_csrf_params({}); # pass no session_id
120	is( $result->{session_id}, Koha::Token::DEFA_SESSION_ID, 'Check session id' );	118	is( $result->{session_id}, Koha::Token::DEFA_SESSION_ID, 'Check session id' );
121	is( $result->{id}, Koha::Token::DEFA_SESSION_USERID. '_'. $result->{session_id}, 'Check userid' );	119	is( $result->{id}, Koha::Token::DEFA_SESSION_USERID. '_'. $result->{session_id}, 'Check userid' );
122		120
123	# Empty anonymous userenv (see C4::Auth::check_cookie_auth)	121	# Empty anonymous userenv (see C4::Auth::check_cookie_auth)
124	C4::Context->_new_userenv('ANON SESSION');
125	C4::Context->set_userenv( undef, q{} );	122	C4::Context->set_userenv( undef, q{} );
126	ok( C4::Context->userenv, "Userenv exists" );	123	ok( C4::Context->userenv, "Userenv exists" );
127	$result = Koha::Token::_add_default_csrf_params( {} ); # pass no session_id	124	$result = Koha::Token::_add_default_csrf_params( {} ); # pass no session_id