| 
      
            Lines 19-25
          package Koha::REST::V1::Auth;
      
      
        Link Here
      
     | 
  
        
          | 19 | 
           | 
          19 | 
           | 
        
        
          | 20 | 
          use Mojo::Base 'Mojolicious::Controller';  | 
          20 | 
          use Mojo::Base 'Mojolicious::Controller';  | 
        
        
          | 21 | 
           | 
          21 | 
           | 
        
          
            
              | 22 | 
              use C4::Auth qw( check_cookie_auth get_session haspermission );  | 
              22 | 
              use C4::Auth qw( check_cookie_auth checkpw_internal get_session haspermission );  | 
            
        
          | 23 | 
          use C4::Context;  | 
          23 | 
          use C4::Context;  | 
        
        
          | 24 | 
           | 
          24 | 
           | 
        
        
          | 25 | 
          use Koha::ApiKeys;  | 
          25 | 
          use Koha::ApiKeys;  | 
        
  
    | 
      
            Lines 35-40
          use Koha::Exceptions;
      
      
        Link Here
      
     | 
  
        
          | 35 | 
          use Koha::Exceptions::Authentication;  | 
          35 | 
          use Koha::Exceptions::Authentication;  | 
        
        
          | 36 | 
          use Koha::Exceptions::Authorization;  | 
          36 | 
          use Koha::Exceptions::Authorization;  | 
        
        
          | 37 | 
           | 
          37 | 
           | 
        
            
               | 
               | 
              38 | 
              use MIME::Base64;  | 
            
        
          | 38 | 
          use Module::Load::Conditional;  | 
          39 | 
          use Module::Load::Conditional;  | 
        
        
          | 39 | 
          use Scalar::Util qw( blessed );  | 
          40 | 
          use Scalar::Util qw( blessed );  | 
        
        
          | 40 | 
          use Try::Tiny;  | 
          41 | 
          use Try::Tiny;  | 
        
  
    | 
      
            Lines 87-93
          sub under {
      
      
        Link Here
      
     | 
  
        
          | 87 | 
                      return $c->render(status => 401, json => { error => $_->error }); | 
          88 | 
                      return $c->render(status => 401, json => { error => $_->error }); | 
        
        
          | 88 | 
                  }  | 
          89 | 
                  }  | 
        
        
          | 89 | 
                  elsif ($_->isa('Koha::Exceptions::Authentication')) { | 
          90 | 
                  elsif ($_->isa('Koha::Exceptions::Authentication')) { | 
        
          
            
              | 90 | 
                          return $c->render(status => 500, json => { error => $_->error }); | 
              91 | 
                          return $c->render(status => 401, json => { error => $_->error }); | 
            
        
          | 91 | 
                  }  | 
          92 | 
                  }  | 
        
        
          | 92 | 
                  elsif ($_->isa('Koha::Exceptions::BadParameter')) { | 
          93 | 
                  elsif ($_->isa('Koha::Exceptions::BadParameter')) { | 
        
        
          | 93 | 
                      return $c->render(status => 400, json => $_->error );  | 
          94 | 
                      return $c->render(status => 400, json => $_->error );  | 
        
  
    | 
      
            Lines 163-168
          sub authenticate_api_request {
      
      
        Link Here
      
     | 
  
        
          | 163 | 
                      );  | 
          164 | 
                      );  | 
        
        
          | 164 | 
                  }  | 
          165 | 
                  }  | 
        
        
          | 165 | 
              }  | 
          166 | 
              }  | 
        
            
               | 
               | 
              167 | 
                  elsif ( $authorization_header and $authorization_header =~ /^Basic / ) { | 
            
            
              | 168 | 
                      unless ( C4::Context->preference('RESTBasicAuth') ) { | 
            
            
              | 169 | 
                          Koha::Exceptions::Authentication::Required->throw(  | 
            
            
              | 170 | 
                              error => 'Basic authentication disabled'  | 
            
            
              | 171 | 
                          );  | 
            
            
              | 172 | 
                      }  | 
            
            
              | 173 | 
                      $user = $c->_basic_auth( $authorization_header );  | 
            
            
              | 174 | 
                      unless ( $user ) { | 
            
            
              | 175 | 
                          # If we have "Authorization: Basic" header and authentication  | 
            
            
              | 176 | 
                          # failed, do not try other authentication means  | 
            
            
              | 177 | 
                          Koha::Exceptions::Authentication::Required->throw(  | 
            
            
              | 178 | 
                              error => 'Authentication failure.'  | 
            
            
              | 179 | 
                          );  | 
            
            
              | 180 | 
                      }  | 
            
            
              | 181 | 
                  }  | 
            
        
          | 166 | 
              else { | 
          182 | 
              else { | 
        
        
          | 167 | 
           | 
          183 | 
           | 
        
        
          | 168 | 
                  my $cookie = $c->cookie('CGISESSID'); | 
          184 | 
                  my $cookie = $c->cookie('CGISESSID'); | 
        
  
    | 
      
            Lines 402-405
          sub _object_ownership_by_reserve_id {
      
      
        Link Here
      
     | 
  
        
          | 402 | 
              return $reserve && $user->borrowernumber == $reserve->borrowernumber;  | 
          418 | 
              return $reserve && $user->borrowernumber == $reserve->borrowernumber;  | 
        
        
          | 403 | 
          }  | 
          419 | 
          }  | 
        
        
          | 404 | 
           | 
          420 | 
           | 
        
            
               | 
               | 
              421 | 
              =head3 _basic_auth  | 
            
            
              | 422 | 
               | 
            
            
              | 423 | 
              Internal method that performs Basic authentication.  | 
            
            
              | 424 | 
               | 
            
            
              | 425 | 
              =cut  | 
            
            
              | 426 | 
               | 
            
            
              | 427 | 
              sub _basic_auth { | 
            
            
              | 428 | 
                  my ( $c, $authorization_header ) = @_;  | 
            
            
              | 429 | 
               | 
            
            
              | 430 | 
                  my ( $type, $credentials ) = split / /, $authorization_header;  | 
            
            
              | 431 | 
               | 
            
            
              | 432 | 
                  unless ($credentials) { | 
            
            
              | 433 | 
                      Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' );  | 
            
            
              | 434 | 
                  }  | 
            
            
              | 435 | 
               | 
            
            
              | 436 | 
                  my $decoded_credentials = decode_base64( $credentials );  | 
            
            
              | 437 | 
                  my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 );  | 
            
            
              | 438 | 
               | 
            
            
              | 439 | 
                  my $dbh = C4::Context->dbh;  | 
            
            
              | 440 | 
                  unless ( checkpw_internal($dbh, $user_id, $password ) ) { | 
            
            
              | 441 | 
                      Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Invalid password' );  | 
            
            
              | 442 | 
                  }  | 
            
            
              | 443 | 
               | 
            
            
              | 444 | 
                  return Koha::Patrons->find({ userid => $user_id }); | 
            
            
              | 445 | 
              }  | 
            
            
              | 446 | 
               | 
            
        
          | 405 | 
          1;  | 
          447 | 
          1;  | 
        
            
              | 406 | 
              -   | 
               | 
               |