Attachment 137331 Details for Bug 28787 – Bug 28787: Don't send the notice if we are not waiting for 2FA

[patch] Bug 28787: Don't send the notice if we are not waiting for 2FA

Bug-28787-Dont-send-the-notice-if-we-are-not-waiti.patch (text/plain), 5.07 KB, created by Jonathan Druart on 2022-07-07 17:30:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2022-07-07 17:30:41 UTC

Size: 5.07 KB

patch

obsolete

>From 84cef3c74571277539c9a5fa852da9191011f537 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 7 Jul 2022 19:28:38 +0200
>Subject: [PATCH] Bug 28787: Don't send the notice if we are not waiting for
> 2FA
>
>If we are fully logged-in or haven't pass the password phase, don't send
>the notice!
>---
> Koha/REST/V1/Auth.pm                    | 68 ++++++++++++++-----------
> t/db_dependent/api/v1/two_factor_auth.t | 12 ++++-
> 2 files changed, 48 insertions(+), 32 deletions(-)
>
>diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
>index ae2488f2127..ba90ac4ab4b 100644
>--- a/Koha/REST/V1/Auth.pm
>+++ b/Koha/REST/V1/Auth.pm
>@@ -223,42 +223,50 @@ sub authenticate_api_request {
>         my ($status, $session) = check_cookie_auth(
>                                                 $cookie, undef,
>                                                 { remote_addr => $remote_addr });
>-        if ($status eq "ok") {
>-            $user = Koha::Patrons->find( $session->param('number') );
>-            $cookie_auth = 1;
>-        }
>-        elsif ($status eq "anon") {
>-            $cookie_auth = 1;
>-        }
>-        elsif ($status eq "additional-auth-needed") {
>-            if ( $c->req->url->to_abs->path eq '/api/v1/auth/otp/token_delivery' ) {
>+
>+        if ( $c->req->url->to_abs->path eq '/api/v1/auth/otp/token_delivery' ) {
>+            if ( $status eq 'additional-auth-needed' ) {
>+                $user        = Koha::Patrons->find( $session->param('number') );
>+                $cookie_auth = 1;
>+            }
>+            elsif ( $status eq 'ok' ) {
>+                Koha::Exceptions::Authentication->throw(
>+                    error => 'Cannot request a new token.' );
>+            }
>+            else {
>+                Koha::Exceptions::Authentication::Required->throw(
>+                    error => 'Authentication failure.' );
>+            }
>+        } else {
>+            if ($status eq "ok") {
>                 $user = Koha::Patrons->find( $session->param('number') );
>                 $cookie_auth = 1;
>-            } else {
>+            }
>+            elsif ($status eq "anon") {
>+                $cookie_auth = 1;
>+            }
>+            elsif ($status eq "additional-auth-needed") {
>+            }
>+            elsif ($status eq "maintenance") {
>+                Koha::Exceptions::UnderMaintenance->throw(
>+                    error => 'System is under maintenance.'
>+                );
>+            }
>+            elsif ($status eq "expired" and $authorization) {
>+                Koha::Exceptions::Authentication::SessionExpired->throw(
>+                    error => 'Session has been expired.'
>+                );
>+            }
>+            elsif ($status eq "failed" and $authorization) {
>                 Koha::Exceptions::Authentication::Required->throw(
>                     error => 'Authentication failure.'
>                 );
>             }
>-        }
>-        elsif ($status eq "maintenance") {
>-            Koha::Exceptions::UnderMaintenance->throw(
>-                error => 'System is under maintenance.'
>-            );
>-        }
>-        elsif ($status eq "expired" and $authorization) {
>-            Koha::Exceptions::Authentication::SessionExpired->throw(
>-                error => 'Session has been expired.'
>-            );
>-        }
>-        elsif ($status eq "failed" and $authorization) {
>-            Koha::Exceptions::Authentication::Required->throw(
>-                error => 'Authentication failure.'
>-            );
>-        }
>-        elsif ($authorization) {
>-            Koha::Exceptions::Authentication->throw(
>-                error => 'Unexpected authentication status.'
>-            );
>+            elsif ($authorization) {
>+                Koha::Exceptions::Authentication->throw(
>+                    error => 'Unexpected authentication status.'
>+                );
>+            }
>         }
>     }
> 
>diff --git a/t/db_dependent/api/v1/two_factor_auth.t b/t/db_dependent/api/v1/two_factor_auth.t
>index ddda4fd0a0a..402d78ac6c1 100755
>--- a/t/db_dependent/api/v1/two_factor_auth.t
>+++ b/t/db_dependent/api/v1/two_factor_auth.t
>@@ -38,7 +38,7 @@ my $t              = Test::Mojo->new('Koha::REST::V1');
> 
> subtest 'send_otp_token' => sub {
> 
>-    plan tests => 7;
>+    plan tests => 9;
> 
>     $schema->storage->txn_begin;
> 
>@@ -63,7 +63,7 @@ subtest 'send_otp_token' => sub {
>     $tx->req->env( { REMOTE_ADDR => $remote_address } );
> 
>     # Patron is not authenticated yet
>-    $t->request_ok($tx)->status_is(500); # FIXME Check the exception instead?
>+    $t->request_ok($tx)->status_is(401);
> 
>     $session->param('waiting-for-2FA', 1);
>     $session->flush;
>@@ -100,6 +100,14 @@ subtest 'send_otp_token' => sub {
>     # Everything is ok, the email will be sent
>     $t->request_ok($tx)->status_is(200);
> 
>+    $session->param('waiting-for-2FA', 0);
>+    $session->flush;
>+    $tx = $t->ua->build_tx( POST => "/api/v1/auth/otp/token_delivery" );
>+    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
>+    $tx->req->env( { REMOTE_ADDR => $remote_address } );
>+
>+    $t->request_ok($tx)->status_is(401);
>+
>     $schema->storage->txn_rollback;
> };
> 
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 28787: 135287 | 136571 | 136572 | 136573 | 137251 | 137330 | 137331 | 137369 | 137370 | 137371 | 137379 | 137380 | 137381 | 137391 | 137392 | 137393 | 137394 | 137395 | 137396 | 137397 | 137398 | 137399 | 137400 | 138146 | 138149 | 138150 | 138151 | 138152 | 138153 | 138154 | 138155 | 138156 | 138157 | 138158 | 138159 | 138689 | 138696 | 138697 | 138698 | 138699 | 138700 | 138701 | 138702 | 138703 | 138704 | 138705 | 138706 | 138707 | 138931 | 138932