Bugzilla – Attachment 130597 Details for
Bug 29915
Anonymous session generates 1 new session ID per hit
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29915: Changes for get_session and check_cookie_auth
Bug-29915-Changes-for-getsession-and-checkcookieau.patch (text/plain), 6.91 KB, created by
Jonathan Druart
on 2022-02-15 09:15:34 UTC
(
hide
)
Description:
Bug 29915: Changes for get_session and check_cookie_auth
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-02-15 09:15:34 UTC
Size:
6.91 KB
patch
obsolete
>From c9fbe55d3b02c3b63a4dd30214ee1fa20412941a Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Mon, 24 Jan 2022 13:08:01 +0000 >Subject: [PATCH] Bug 29915: Changes for get_session and check_cookie_auth > >If we look for an existing session, do not create a new one. >Found a bug in the unset_userenv calls. For this moment >changing the calls in Auth here. Later fix goes to bug >29954. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > C4/Auth.pm | 65 +++++++++++++++++++++++++++++------------------------- > 1 file changed, 35 insertions(+), 30 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index ea6fa35c3af..d46288b1c11 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -23,6 +23,7 @@ use Carp qw( croak ); > > use Digest::MD5 qw( md5_base64 ); > use CGI::Session; >+use CGI::Session::ErrorHandler; > use URI; > use URI::QueryParam; > >@@ -902,7 +903,7 @@ sub checkauth { > $anon_search_history = $session->param('search_history'); > $session->delete(); > $session->flush; >- C4::Context->_unset_userenv($sessionID); >+ C4::Context::_unset_userenv($sessionID); > } > elsif ($logout) { > >@@ -912,7 +913,7 @@ sub checkauth { > $session->delete(); > $session->flush; > $cookies = clear_all_cookies($query); >- C4::Context->_unset_userenv($sessionID); >+ C4::Context::_unset_userenv($sessionID); > > if ($cas and $caslogout) { > logout_cas($query, $type); >@@ -1105,7 +1106,7 @@ sub checkauth { > } > else { > $info{'nopermission'} = 1; >- C4::Context->_unset_userenv($sessionID); >+ C4::Context::_unset_userenv($sessionID); > } > my ( $borrowernumber, $firstname, $surname, $userflags, > $branchcode, $branchname, $emailaddress, $desk_id, >@@ -1230,7 +1231,7 @@ sub checkauth { > else { > if ($userid) { > $info{'invalid_username_or_password'} = 1; >- C4::Context->_unset_userenv($sessionID); >+ C4::Context::_unset_userenv($sessionID); > } > $session->param( 'lasttime', time() ); > $session->param( 'ip', $session->remote_addr() ); >@@ -1688,57 +1689,57 @@ sub check_cookie_auth { > # however, if a userid parameter is present (i.e., from > # a form submission, assume that any current cookie > # is to be ignored >- unless ( defined $sessionID and $sessionID ) { >+ unless ( $sessionID ) { > return ( "failed", undef ); > } >+ C4::Context::_unset_userenv($sessionID); # remove old userenv first > my $session = get_session($sessionID); >- C4::Context->_new_userenv($sessionID); > if ($session) { >- C4::Context->interface($session->param('interface')); >- C4::Context->set_userenv( >- $session->param('number'), $session->param('id') // '', >- $session->param('cardnumber'), $session->param('firstname'), >- $session->param('surname'), $session->param('branch'), >- $session->param('branchname'), $session->param('flags'), >- $session->param('emailaddress'), $session->param('shibboleth'), >- $session->param('desk_id'), $session->param('desk_name'), >- $session->param('register_id'), $session->param('register_name') >- ); >- > my $userid = $session->param('id'); > my $ip = $session->param('ip'); > my $lasttime = $session->param('lasttime'); > my $timeout = _timeout_syspref(); > > if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { >- > # time out > $session->delete(); > $session->flush; >- C4::Context->_unset_userenv($sessionID); > return ("expired", undef); >- } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { > >+ } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { > # IP address changed > $session->delete(); > $session->flush; >- C4::Context->_unset_userenv($sessionID); > return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); >+ > } elsif ( $userid ) { > $session->param( 'lasttime', time() ); > my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; > if ($flags) { >+ C4::Context->_new_userenv($sessionID); >+ C4::Context->interface($session->param('interface')); >+ C4::Context->set_userenv( >+ $session->param('number'), $session->param('id') // '', >+ $session->param('cardnumber'), $session->param('firstname'), >+ $session->param('surname'), $session->param('branch'), >+ $session->param('branchname'), $session->param('flags'), >+ $session->param('emailaddress'), $session->param('shibboleth'), >+ $session->param('desk_id'), $session->param('desk_name'), >+ $session->param('register_id'), $session->param('register_name') >+ ); > return ( "ok", $session ); >+ } else { >+ $session->delete(); >+ $session->flush; >+ return ( "failed", undef ); > } >+ > } else { >+ C4::Context->_new_userenv($sessionID); >+ C4::Context->interface($session->param('interface')); >+ C4::Context->set_userenv( undef, q{} ); > return ( "anon", $session ); > } >- # If here user was logged in, but doesn't have correct permissions >- # could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors >- $session->delete(); >- $session->flush; >- C4::Context->_unset_userenv($sessionID); >- return ( "failed", undef ); > } else { > return ( "expired", undef ); > } >@@ -1784,9 +1785,13 @@ sub _get_session_params { > sub get_session { > my $sessionID = shift; > my $params = _get_session_params(); >- my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); >- if ( ! $session ){ >- die CGI::Session->errstr(); >+ my $session; >+ if( $sessionID ) { # find existing >+ CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463 >+ $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} ); >+ } else { >+ $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); >+ # $session->flush; > } > return $session; > } >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29915
:
129644
|
129653
|
129683
|
129748
|
129750
|
129751
|
129752
|
129753
|
129754
|
129755
|
129756
|
129822
|
129826
|
129827
|
129828
|
129829
|
129830
|
129831
|
129832
|
129833
|
129860
|
129861
|
129862
|
129863
|
129864
|
129865
|
129866
|
129878
|
129879
|
129880
|
129882
|
129883
|
129884
|
129885
|
129886
|
129887
|
129888
|
129889
|
129906
|
129907
|
129908
|
129909
|
129910
|
129911
|
129912
|
129913
|
129951
|
130596
|
130597
|
130598
|
130599
|
130600
|
130601
|
130602
|
130603
|
130604
|
131708
|
131709
|
131710
|
131711
|
131712
|
131713
|
131714
|
131715
|
131716
|
131788
|
131789
|
131790
|
131791
|
131792
|
131793
|
131794
|
131795
|
131796
|
131797
|
132101
|
132104
|
132114
|
132158
|
132159