Attachment 124692 Details for Bug 28772 – Bug 28772: Make secret validation use the new method

[patch] Bug 28772: Make secret validation use the new method

Bug-28772-Make-secret-validation-use-the-new-metho.patch (text/plain), 1.69 KB, created by Tomás Cohen Arazi (tcohen) on 2021-09-09 11:54:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2021-09-09 11:54:27 UTC

Size: 1.69 KB

patch

obsolete

>From f9a3ec76c76c40341f23042367cd1781a6a13b61 Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Thu, 9 Sep 2021 08:38:25 -0300
>Subject: [PATCH] Bug 28772: Make secret validation use the new method
>
>This patch makes the Koha::OAuth library use the new validation method
>
>To test:
>1. In master, enable RESTOAuth2ClientCredentials and have your
>   superlibrarian patron a client_id/secret pair generated
>2. Use Postman to gain an access token with the client_id/secret pair
>=> SUCCESS: This works in Koha
>3. Use the access token to GET /api/v1/patrons
>=> SUCCESS: It works
>4. Apply this patchset up to the regression tests
>5. Run:
>   $ updatedatabase
>   $ koha-plack --restart kohadev
>=> SUCCESS: All good
>6. Repeat 2
>=> FAIL: You get an error trying to acquire an access token. Boo
>7. Run:
>   $ kshell
>  k$ prove t/db_dependent/api/v1/oauth.t
>=> FAIL: Tests fail!
>8. Apply this patch
>9. Run:
>   $ koha-plack --restart kohadev
>   $ kshell
>  k$ prove t/db_dependent/api/v1/oauth.t
>=> SUCCESS: Tests pass!
>10. Repeat 2
>=> SUCCESS: Your original client_id/secret pair works!
>11. Sign off :-D
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> Koha/OAuth.pm | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/Koha/OAuth.pm b/Koha/OAuth.pm
>index 29a701114c..99f6108656 100644
>--- a/Koha/OAuth.pm
>+++ b/Koha/OAuth.pm
>@@ -65,7 +65,7 @@ sub _verify_client_cb {
>     # client_id mandatory and exists on the DB
>     return (0, 'unauthorized_client') unless $api_key && $api_key->active;
> 
>-    return (0, 'access_denied') unless $api_key->secret eq $client_secret;
>+    return (0, 'access_denied') unless $api_key->validate_secret( $client_secret );
> 
>     return (1, undef, []);
> }
>-- 
>2.33.0

Actions: View | Diff | Splinter Review

Attachments on bug 28772: 124195 | 124247 | 124248 | 124249 | 124250 | 124251 | 124487 | 124488 | 124489 | 124490 | 124491 | 124691 | 124692 | 124693 | 124694 | 124695 | 124696 | 124697 | 124698 | 124699 | 124700 | 124701 | 124702 | 124703 | 124704 | 124705 | 124727 | 125088 | 125112 | 125116 | 125118 | 125128