Bugzilla – Attachment 129887 Details for
Bug 29915
Anonymous session generates 1 new session ID per hit
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29915: Changes to Auth.t
Bug-29915-Changes-to-Autht.patch (text/plain), 7.72 KB, created by
Jonathan Druart
on 2022-01-27 14:18:01 UTC
(
hide
)
Description:
Bug 29915: Changes to Auth.t
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-01-27 14:18:01 UTC
Size:
7.72 KB
patch
obsolete
>From 15be486f96138bb8794b794576d02c7bd833f789 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Wed, 26 Jan 2022 12:27:56 +0000 >Subject: [PATCH] Bug 29915: Changes to Auth.t > >Test plan: >Run Auth.t > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > t/db_dependent/Auth.t | 98 +++++++++++++++++++++++++++++++++---------- > 1 file changed, 76 insertions(+), 22 deletions(-) > >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 58879ed28e3..6e82bd4182f 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -10,7 +10,7 @@ use CGI qw ( -utf8 ); > use Test::MockObject; > use Test::MockModule; > use List::MoreUtils qw/all any none/; >-use Test::More tests => 14; >+use Test::More tests => 15; > use Test::Warn; > use t::lib::Mocks; > use t::lib::TestBuilder; >@@ -483,7 +483,7 @@ subtest 'check_cookie_auth' => sub { > }; > > subtest 'checkauth & check_cookie_auth' => sub { >- plan tests => 27; >+ plan tests => 31; > > # flags = 4 => { catalogue => 1 } > my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); >@@ -517,12 +517,18 @@ subtest 'checkauth & check_cookie_auth' => sub { > > $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; > # Not authenticated yet, checkauth didn't return the session >- ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} ); >+ close STDOUT; >+ } > is( $sessionID, undef); > is( $userid, undef); > >- # Same here, check_cookie_auth does not return the session >- my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); >+ # Sending undefined fails obviously >+ my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} ); > is( $auth_status, 'failed' ); > is( $session, undef ); > >@@ -544,55 +550,103 @@ subtest 'checkauth & check_cookie_auth' => sub { > ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); > is( $sessionID, undef ); > is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); >- ( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); >- is( $auth_status, "failed"); >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} ); >+ is( $auth_status, "expired"); > is( $session, undef ); > > { > # Trying to access without sessionID >- undef $ENV{"HTTP_COOKIE"}; > $cgi = CGI->new; > ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, {catalogue => 1}); > is( $auth_status, 'failed' ); > is( $session, undef ); > >- ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ # This will fail on permissions >+ undef $ENV{"HTTP_COOKIE"}; >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} ); >+ close STDOUT; >+ } > is( $userid, undef ); > is( $sessionID, undef ); >- > } > > { >- # Hit unauthorized page then reuse the cookie >- undef $ENV{"HTTP_COOKIE"}; >+ # First logging in > $cgi = CGI->new; >- # Logging in > $cgi->param('userid', $patron->userid); > $cgi->param('password', $password); > ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); > is( $userid, $patron->userid ); > $first_sessionID = $sessionID; > >- $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; >- > # Patron does not have the borrowers permission >- ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); >+ # $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; # not needed, we use $cgi here >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1} ); >+ close STDOUT; >+ } > is( $userid, undef ); > is( $sessionID, undef ); > >- ( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, {borrowers => 1}); >+ # When calling check_cookie_auth, the session will be deleted >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); > is( $auth_status, "failed" ); > is( $session, undef ); >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); >+ is( $auth_status, 'expired', 'Session no longer exists' ); > >- # Reuse the cookie >+ # Try reusing the deleted session: since it does not exist, we should get a new one now when passing correct permissions >+ $cgi->cookie( -name => 'CGISESSID', value => $first_sessionID ); > ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); > is( $userid, $patron->userid ); >- is( $sessionID, $first_sessionID ); >- >- ( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, 0, {catalogue => 1}); >+ isnt( $sessionID, undef, 'Check if we have a sessionID' ); >+ isnt( $sessionID, $first_sessionID, 'New value expected' ); >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID, {catalogue => 1} ); > is( $auth_status, "ok" ); >- is( $session, $first_sessionID ); >+ is( $session->id, $sessionID, 'Same session' ); >+ # Two additional tests on userenv >+ is( $C4::Context::context->{activeuser}, $session->id, 'Check if environment has been setup for session' ); >+ is( C4::Context->userenv->{id}, $userid, 'Check userid in userenv' ); > } > }; > >+subtest 'Userenv clearing in check_cookie_auth' => sub { >+ # Note: We did already test userenv for a logged-in user in previous subtest >+ plan tests => 9; >+ >+ t::lib::Mocks::mock_preference( 'timeout', 600 ); >+ my $cgi = CGI->new; >+ >+ # Create a new anonymous session by passing a fake session ID >+ $cgi->cookie( -name => 'CGISESSID', -value => 'fake_sessionID' ); >+ my ($userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 1); >+ my ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID ); >+ is( $auth_status, 'anon', 'Should be anonymous' ); >+ is( $C4::Context::context->{activeuser}, $session->id, 'Check activeuser' ); >+ is( defined C4::Context->userenv, 1, 'There should be a userenv' ); >+ is( C4::Context->userenv->{id}, q{}, 'userid should be empty string' ); >+ >+ # Make the session expire now, check_cookie_auth will delete it >+ $session->param('lasttime', time() - 1200 ); >+ $session->flush; >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID ); >+ is( $auth_status, 'expired', 'Should be expired' ); >+ is( C4::Context->userenv, undef, 'Environment should be cleared too' ); >+ >+ # Show that we clear the userenv again: set up env and check deleted session >+ C4::Context->_new_userenv( $sessionID ); >+ C4::Context->set_userenv; # empty >+ is( defined C4::Context->userenv, 1, 'There should be an empty userenv again' ); >+ ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID ); >+ is( $auth_status, 'expired', 'Should be expired already' ); >+ is( C4::Context->userenv, undef, 'Environment should be cleared again' ); >+}; >+ > $schema->storage->txn_rollback; >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29915
:
129644
|
129653
|
129683
|
129748
|
129750
|
129751
|
129752
|
129753
|
129754
|
129755
|
129756
|
129822
|
129826
|
129827
|
129828
|
129829
|
129830
|
129831
|
129832
|
129833
|
129860
|
129861
|
129862
|
129863
|
129864
|
129865
|
129866
|
129878
|
129879
|
129880
|
129882
|
129883
|
129884
|
129885
|
129886
|
129887
|
129888
|
129889
|
129906
|
129907
|
129908
|
129909
|
129910
|
129911
|
129912
|
129913
|
129951
|
130596
|
130597
|
130598
|
130599
|
130600
|
130601
|
130602
|
130603
|
130604
|
131708
|
131709
|
131710
|
131711
|
131712
|
131713
|
131714
|
131715
|
131716
|
131788
|
131789
|
131790
|
131791
|
131792
|
131793
|
131794
|
131795
|
131796
|
131797
|
132101
|
132104
|
132114
|
132158
|
132159