Attachment 123024 Details for Bug 28735 – Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID

[patch] Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID

Bug-28735-Self-checkout-users-can-access-opac-user.patch (text/plain), 3.74 KB, created by David Cook on 2021-07-22 06:45:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2021-07-22 06:45:08 UTC

Size: 3.74 KB

patch

obsolete

>From d61b81d1081820942149a5104faf6a3e310f1753 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 22 Jul 2021 06:34:20 +0000
>Subject: [PATCH] Bug 28735: Self-checkout users can access opac-user.pl for
> sco user when not using AutoSelfCheckID
>
>This patch makes the sandboxing of the selfcheckout more robust by
>adding a "sco_user" session variable which is turned on when
>logging into the self-checkout (either by AutoSelfCheckAllowed or manually).
>
>If a user with this session variable turned on tries to access
>other parts of the system (like the rest of the OPAC), it will
>"kick out", so that the browser user will lose the authenticated session.
>
>Test plan:
>1) Apply the patch
>2) koha-plack --restart kohadev
>3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>4) Note that you are logged into the self-checkout
>5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
>6) Note that you are not logged into the OPAC
>7) Log into the staff interface and disable the
>system preference AutoSelfCheckAllowed
>8) Log out of the staff interface (this step is very important)
>9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>10) Note that you are prompted to log into Koha
>11) Login using the "koha" user (when using koha-testing-docker)
>12) Note that you are logged into the self-checkout
>13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
>14) Note that you are not logged into the OPAC
>15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>16) Note that you will need to log in again as you've lost your
>session cookie
>
>Voila!
>---
> C4/Auth.pm | 20 ++++++++++++++++++--
> 1 file changed, 18 insertions(+), 2 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index fd327bf618..5190a379b0 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -196,14 +196,20 @@ sub get_template_and_user {
>     }
> 
>     if ( $in->{type} eq 'opac' && $user ) {
>+        my $is_sco_user;
>+        if ($sessionID){
>+            my $session = get_session($sessionID);
>+            if ($session){
>+                $is_sco_user = $session->param('sco_user');
>+            }
>+        }
>         my $kick_out;
> 
>         if (
> # If the user logged in is the SCO user and they try to go out of the SCO module,
> # log the user out removing the CGISESSID cookie
>             $in->{template_name} !~ m|sco/| && $in->{template_name} !~ m|errors/errorpage.tt|
>-            && C4::Context->preference('AutoSelfCheckID')
>-            && $user eq C4::Context->preference('AutoSelfCheckID')
>+            && $is_sco_user
>           )
>         {
>             $kick_out = 1;
>@@ -1204,6 +1210,15 @@ sub checkauth {
>                             $branchname    = $branches->{$br}->{'branchname'};
>                         }
>                     }
>+
>+                    my $is_sco_user = 0;
>+                    if (
>+                            ( $query->param('koha_login_context') && ($query->param('koha_login_context') eq 'sco') ) ||
>+                            ( $query->param('sco_user_login') && ( $query->param('sco_user_login') eq '1' ) )
>+                        ){
>+                        $is_sco_user = 1;
>+                    }
>+
>                     $session->param( 'number',       $borrowernumber );
>                     $session->param( 'id',           $userid );
>                     $session->param( 'cardnumber',   $cardnumber );
>@@ -1221,6 +1236,7 @@ sub checkauth {
>                     $session->param( 'shibboleth',   $shibSuccess );
>                     $session->param( 'register_id',  $register_id );
>                     $session->param( 'register_name',  $register_name );
>+                    $session->param( 'sco_user', $is_sco_user );
>                 }
>                 $session->param('cas_ticket', $cas_ticket) if $cas_ticket;
>                 C4::Context->set_userenv(
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 28735: 123024 | 123025 | 125918 | 128936 | 129229 | 129680