|
Lines 21-27
use Modern::Perl;
Link Here
|
| 21 |
|
21 |
|
| 22 |
use Mojo::Base 'Mojolicious::Controller'; |
22 |
use Mojo::Base 'Mojolicious::Controller'; |
| 23 |
|
23 |
|
| 24 |
use C4::Auth qw( check_cookie_auth get_session haspermission ); |
24 |
use C4::Auth qw( check_cookie_auth checkpw_internal get_session haspermission ); |
| 25 |
use C4::Context; |
25 |
use C4::Context; |
| 26 |
|
26 |
|
| 27 |
use Koha::ApiKeys; |
27 |
use Koha::ApiKeys; |
|
Lines 37-42
use Koha::Exceptions;
Link Here
|
| 37 |
use Koha::Exceptions::Authentication; |
37 |
use Koha::Exceptions::Authentication; |
| 38 |
use Koha::Exceptions::Authorization; |
38 |
use Koha::Exceptions::Authorization; |
| 39 |
|
39 |
|
|
|
40 |
use MIME::Base64; |
| 40 |
use Module::Load::Conditional; |
41 |
use Module::Load::Conditional; |
| 41 |
use Scalar::Util qw( blessed ); |
42 |
use Scalar::Util qw( blessed ); |
| 42 |
use Try::Tiny; |
43 |
use Try::Tiny; |
|
Lines 78-84
sub under {
Link Here
|
| 78 |
return $c->render(status => 401, json => { error => $_->error }); |
79 |
return $c->render(status => 401, json => { error => $_->error }); |
| 79 |
} |
80 |
} |
| 80 |
elsif ($_->isa('Koha::Exceptions::Authentication')) { |
81 |
elsif ($_->isa('Koha::Exceptions::Authentication')) { |
| 81 |
return $c->render(status => 500, json => { error => $_->error }); |
82 |
return $c->render(status => 401, json => { error => $_->error }); |
| 82 |
} |
83 |
} |
| 83 |
elsif ($_->isa('Koha::Exceptions::BadParameter')) { |
84 |
elsif ($_->isa('Koha::Exceptions::BadParameter')) { |
| 84 |
return $c->render(status => 400, json => $_->error ); |
85 |
return $c->render(status => 400, json => $_->error ); |
|
Lines 89-94
sub under {
Link Here
|
| 89 |
required_permissions => $_->required_permissions, |
90 |
required_permissions => $_->required_permissions, |
| 90 |
}); |
91 |
}); |
| 91 |
} |
92 |
} |
|
|
93 |
elsif ($_->isa('Koha::Exceptions::Authorization')) { |
| 94 |
return $c->render(status => 403, json => $_->error); |
| 95 |
} |
| 92 |
elsif ($_->isa('Koha::Exceptions')) { |
96 |
elsif ($_->isa('Koha::Exceptions')) { |
| 93 |
return $c->render(status => 500, json => { error => $_->error }); |
97 |
return $c->render(status => 500, json => { error => $_->error }); |
| 94 |
} |
98 |
} |
|
Lines 151-156
sub authenticate_api_request {
Link Here
|
| 151 |
); |
155 |
); |
| 152 |
} |
156 |
} |
| 153 |
} |
157 |
} |
|
|
158 |
elsif ( $authorization_header and $authorization_header =~ /^Basic / ) { |
| 159 |
unless ( C4::Context->preference('RESTBasicAuth') ) { |
| 160 |
Koha::Exceptions::Authentication::Required->throw( |
| 161 |
error => 'Basic authentication disabled' |
| 162 |
); |
| 163 |
} |
| 164 |
$user = $c->_basic_auth( $authorization_header ); |
| 165 |
unless ( $user ) { |
| 166 |
# If we have "Authorization: Basic" header and authentication |
| 167 |
# failed, do not try other authentication means |
| 168 |
Koha::Exceptions::Authentication::Required->throw( |
| 169 |
error => 'Authentication failure.' |
| 170 |
); |
| 171 |
} |
| 172 |
} |
| 154 |
else { |
173 |
else { |
| 155 |
|
174 |
|
| 156 |
my $cookie = $c->cookie('CGISESSID'); |
175 |
my $cookie = $c->cookie('CGISESSID'); |
|
Lines 390-393
sub _object_ownership_by_reserve_id {
Link Here
|
| 390 |
return $reserve && $user->borrowernumber == $reserve->borrowernumber; |
409 |
return $reserve && $user->borrowernumber == $reserve->borrowernumber; |
| 391 |
} |
410 |
} |
| 392 |
|
411 |
|
|
|
412 |
=head3 _basic_auth |
| 413 |
|
| 414 |
Internal method that performs Basic authentication. |
| 415 |
|
| 416 |
=cut |
| 417 |
|
| 418 |
sub _basic_auth { |
| 419 |
my ( $c, $authorization_header ) = @_; |
| 420 |
|
| 421 |
my ( $type, $credentials ) = split / /, $authorization_header; |
| 422 |
|
| 423 |
unless ($credentials) { |
| 424 |
Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' ); |
| 425 |
} |
| 426 |
|
| 427 |
my $decoded_credentials = decode_base64( $credentials ); |
| 428 |
my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 ); |
| 429 |
|
| 430 |
my $dbh = C4::Context->dbh; |
| 431 |
unless ( checkpw_internal($dbh, $user_id, $password ) ) { |
| 432 |
Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Invalid password' ); |
| 433 |
} |
| 434 |
|
| 435 |
return Koha::Patrons->find({ userid => $user_id }); |
| 436 |
} |
| 437 |
|
| 393 |
1; |
438 |
1; |
| 394 |
- |
|
|