Bugzilla – Attachment 132159 Details for
Bug 29915
Anonymous session generates 1 new session ID per hit
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29915: Prevent bad cookie from corrupted session
Bug-29915-Prevent-bad-cookie-from-corrupted-sessio.patch (text/plain), 2.61 KB, created by
Jonathan Druart
on 2022-03-24 13:49:27 UTC
(
hide
)
Description:
Bug 29915: Prevent bad cookie from corrupted session
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-03-24 13:49:27 UTC
Size:
2.61 KB
patch
obsolete
>From aaa189345bd355e3bfd35c08713213c0f3466a6c Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 24 Mar 2022 07:31:12 +0000 >Subject: [PATCH] Bug 29915: Prevent bad cookie from corrupted session > >If there is deleted session info but no session->id, a wrong cookie >with empty name could be generated containing expired session id. > >Test plan: >Run t/db_dependent/Auth.t >Login. Check cookies in browser. >Logout. Check cookies in browser. >Without this patch, you should see an invalid cookie. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > C4/Auth.pm | 6 ++++-- > t/db_dependent/Auth.t | 9 ++++++++- > 2 files changed, 12 insertions(+), 3 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 88dc23165f6..b4edd2d9321 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -958,7 +958,9 @@ sub checkauth { > > unless ( $userid ) { > #we initiate a session prior to checking for a username to allow for anonymous sessions... >- $session ||= get_session("") or die "Auth ERROR: Cannot get_session()"; >+ if( !$session or !$sessionID ) { # if we cleared sessionID, we need a new session >+ $session = get_session() or die "Auth ERROR: Cannot get_session()"; >+ } > > # Save anonymous search history in new session so it can be retrieved > # by get_template_and_user to store it in user's search history after >@@ -1793,7 +1795,7 @@ sub get_session { > $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} ); > } else { > $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); >- # $session->flush; >+ # no need to flush here > } > return $session; > } >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 199637f08c0..8c7f82c6665 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -547,7 +547,14 @@ subtest 'checkauth & check_cookie_auth' => sub { > > # Logging out! > $cgi->param('logout.x', 1); >- ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ $cgi->delete( 'userid', 'password' ); >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); >+ close STDOUT; >+ } > is( $sessionID, undef ); > is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); > ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} ); >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29915
:
129644
|
129653
|
129683
|
129748
|
129750
|
129751
|
129752
|
129753
|
129754
|
129755
|
129756
|
129822
|
129826
|
129827
|
129828
|
129829
|
129830
|
129831
|
129832
|
129833
|
129860
|
129861
|
129862
|
129863
|
129864
|
129865
|
129866
|
129878
|
129879
|
129880
|
129882
|
129883
|
129884
|
129885
|
129886
|
129887
|
129888
|
129889
|
129906
|
129907
|
129908
|
129909
|
129910
|
129911
|
129912
|
129913
|
129951
|
130596
|
130597
|
130598
|
130599
|
130600
|
130601
|
130602
|
130603
|
130604
|
131708
|
131709
|
131710
|
131711
|
131712
|
131713
|
131714
|
131715
|
131716
|
131788
|
131789
|
131790
|
131791
|
131792
|
131793
|
131794
|
131795
|
131796
|
131797
|
132101
|
132104
|
132114
|
132158
| 132159