Bugzilla – Attachment 129822 Details for
Bug 29915
Anonymous session generates 1 new session ID per hit
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29915: Add tests
Bug-29915-Add-tests.patch (text/plain), 5.96 KB, created by
Jonathan Druart
on 2022-01-26 10:58:51 UTC
(
hide
)
Description:
Bug 29915: Add tests
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-01-26 10:58:51 UTC
Size:
5.96 KB
patch
obsolete
>From f8f34a9b34171e028113a50e299bf9ec3043f05e Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 26 Jan 2022 11:58:33 +0100 >Subject: [PATCH] Bug 29915: Add tests > >--- > t/db_dependent/Auth.t | 122 ++++++++++++++++++++++++++++++++++++++++-- > 1 file changed, 119 insertions(+), 3 deletions(-) > >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 3e6a8b47742..f848f6451c0 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -10,11 +10,12 @@ use CGI qw ( -utf8 ); > use Test::MockObject; > use Test::MockModule; > use List::MoreUtils qw/all any none/; >-use Test::More tests => 24; >+use Test::More tests => 14; > use Test::Warn; > use t::lib::Mocks; > use t::lib::TestBuilder; > >+use C4::Auth; > use C4::Members; > use Koha::AuthUtils qw/hash_password/; > use Koha::Database; >@@ -201,7 +202,7 @@ subtest 'checkpw lockout tests' => sub { > > # get_template_and_user tests > >-{ # Tests for the language URL parameter >+subtest 'get_template_and_user' => sub { # Tests for the language URL parameter > > sub MockedCheckauth { > my ($query,$authnotrequired,$flagsrequired,$type) = @_; >@@ -342,7 +343,9 @@ subtest 'checkpw lockout tests' => sub { > ); > is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); > is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); >-} >+ >+ delete $ENV{"HTTP_COOKIE"}; >+}; > > # Check that there is always an OPACBaseURL set. > my $input = CGI->new(); >@@ -483,4 +486,117 @@ subtest 'check_cookie_auth' => sub { > #FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission > }; > >+subtest 'checkauth & check_cookie_auth' => sub { >+ plan tests => 27; >+ >+ # flags = 4 => { catalogue => 1 } >+ my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); >+ my $password = 'password'; >+ t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); >+ $patron->set_password( { password => $password } ); >+ >+ my $cgi_mock = Test::MockModule->new('CGI'); >+ $cgi_mock->mock( 'request_method', sub { return 'POST' } ); >+ >+ my $cgi = CGI->new; >+ >+ my $auth = Test::MockModule->new( 'C4::Auth' ); >+ # Tests will fail if we hit safe_exit >+ $auth->mock( 'safe_exit', sub { return } ); >+ >+ my ( $userid, $cookie, $sessionID, $flags ); >+ { >+ # checkauth will redirect and safe_exit if not authenticated and not authorized >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ like( $stdout, qr{<title>\s*Log in to your account} ); >+ $sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef; >+ ok($sessionID); >+ close STDOUT; >+ }; >+ >+ my $first_sessionID = $sessionID; >+ >+ $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; >+ # Not authenticated yet, checkauth didn't return the session >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ is( $sessionID, undef); >+ is( $userid, undef); >+ >+ # Same here, check_cookie_auth does not return the session >+ my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); >+ is( $auth_status, 'failed' ); >+ is( $session, undef ); >+ >+ # Simulating the login form submission >+ $cgi->param('userid', $patron->userid); >+ $cgi->param('password', $password); >+ >+ # Logged in! >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ is( $sessionID, $first_sessionID ); >+ is( $userid, $patron->userid ); >+ >+ ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); >+ is( $auth_status, 'ok' ); >+ is( $session->id, $first_sessionID ); >+ >+ # Logging out! >+ $cgi->param('logout.x', 1); >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ is( $sessionID, undef ); >+ is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); >+ is( $auth_status, "expired"); >+ is( $session, undef ); >+ >+ { >+ # Trying to access without sessionID >+ undef $ENV{"HTTP_COOKIE"}; >+ $cgi = CGI->new; >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1}); >+ is( $auth_status, 'failed' ); >+ is( $session, undef ); >+ >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ is( $userid, undef ); >+ is( $sessionID, undef ); >+ >+ } >+ >+ { >+ # Hit unauthorized page then reuse the cookie >+ undef $ENV{"HTTP_COOKIE"}; >+ $cgi = CGI->new; >+ # Logging in >+ $cgi->param('userid', $patron->userid); >+ $cgi->param('password', $password); >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ is( $userid, $patron->userid ); >+ $first_sessionID = $sessionID; >+ >+ $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; >+ >+ # Patron does not have the borrowers permission >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); >+ is( $userid, undef ); >+ is( $sessionID, undef ); >+ >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1}); >+ is( $auth_status, "failed" ); >+ is( $session, undef ); >+ >+ # Reuse the cookie >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ is( $userid, $patron->userid ); >+ is( $sessionID, $first_sessionID ); >+ >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); >+ is( $auth_status, "ok" ); >+ is( $session, $first_sessionID ); >+ } >+}; >+ > $schema->storage->txn_rollback; >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29915
:
129644
|
129653
|
129683
|
129748
|
129750
|
129751
|
129752
|
129753
|
129754
|
129755
|
129756
|
129822
|
129826
|
129827
|
129828
|
129829
|
129830
|
129831
|
129832
|
129833
|
129860
|
129861
|
129862
|
129863
|
129864
|
129865
|
129866
|
129878
|
129879
|
129880
|
129882
|
129883
|
129884
|
129885
|
129886
|
129887
|
129888
|
129889
|
129906
|
129907
|
129908
|
129909
|
129910
|
129911
|
129912
|
129913
|
129951
|
130596
|
130597
|
130598
|
130599
|
130600
|
130601
|
130602
|
130603
|
130604
|
131708
|
131709
|
131710
|
131711
|
131712
|
131713
|
131714
|
131715
|
131716
|
131788
|
131789
|
131790
|
131791
|
131792
|
131793
|
131794
|
131795
|
131796
|
131797
|
132101
|
132104
|
132114
|
132158
|
132159