Bugzilla – Attachment 138449 Details for
Bug 27849
Koha::Token may access undefined C4::Context->userenv
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27849: (follow-up) Add test
Bug-27849-follow-up-Add-test.patch (text/plain), 3.06 KB, created by
Marcel de Rooy
on 2022-08-01 08:12:09 UTC
(
hide
)
Description:
Bug 27849: (follow-up) Add test
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-08-01 08:12:09 UTC
Size:
3.06 KB
patch
obsolete
>From 8b1cda9eacbdd7ef2e7d3b0d6506c31b10d56927 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Mon, 1 Aug 2022 07:25:10 +0000 >Subject: [PATCH] Bug 27849: (follow-up) Add test >Content-Type: text/plain; charset=utf-8 > >Compacting the code a bit too. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > Koha/Token.pm | 18 +++++++----------- > t/Token.t | 19 ++++++++++++++++++- > 2 files changed, 25 insertions(+), 12 deletions(-) > >diff --git a/Koha/Token.pm b/Koha/Token.pm >index 866bfc3ae4..62b5a6c739 100644 >--- a/Koha/Token.pm >+++ b/Koha/Token.pm >@@ -60,6 +60,8 @@ use Koha::Exceptions::Token; > use base qw(Class::Accessor); > use constant HMAC_SHA1_LENGTH => 20; > use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days.. >+use constant DEFA_SESSION_ID => 0; >+use constant DEFA_SESSION_USERID => 'anonymous'; > > =head1 METHODS > >@@ -212,17 +214,11 @@ sub decode_jwt { > > sub _add_default_csrf_params { > my ( $params ) = @_; >- $params->{session_id} //= ''; >- if( !$params->{id} ) { >- if( defined( C4::Context->userenv ) ) { >- $params->{id} = Encode::encode( 'UTF-8', C4::Context->userenv->{id} . $params->{session_id} ); >- } else { >- $params->{id} = Encode::encode( 'UTF-8', $params->{session_id} ); >- } >- } else { >- $params->{id} .= $params->{session_id}; >- } >- $params->{id} //= Encode::encode( 'UTF-8', C4::Context->userenv->{id} ); >+ $params->{session_id} //= DEFA_SESSION_ID; >+ my $userenv = C4::Context->userenv // { id => DEFA_SESSION_USERID }; >+ $params->{id} //= Encode::encode( 'UTF-8', $userenv->{id} ); >+ $params->{id} .= '_' . $params->{session_id}; >+ > my $pw = C4::Context->config('pass'); > $params->{secret} //= md5_base64( Encode::encode( 'UTF-8', $pw ) ), > return $params; >diff --git a/t/Token.t b/t/Token.t >index d7de3113cf..2e38451c19 100755 >--- a/t/Token.t >+++ b/t/Token.t >@@ -20,9 +20,10 @@ > # along with Koha; if not, see <http://www.gnu.org/licenses>. > > use Modern::Perl; >-use Test::More tests => 12; >+use Test::More tests => 13; > use Test::Exception; > use Time::HiRes qw|usleep|; >+ > use C4::Context; > use Koha::Token; > >@@ -117,3 +118,19 @@ subtest 'JWT' => sub { > my $retrieved_id = $tokenizer->decode_jwt({ token => $jwt }); > is( $retrieved_id, $id, 'id stored in jwt should be correct' ); > }; >+ >+subtest 'testing _add_default_csrf_params with/without userenv (bug 27849)' => sub { >+ plan tests => 5; >+ >+ # Current userenv: userid == 42 >+ my $result = Koha::Token::_add_default_csrf_params({ session_id => '567' }); >+ is( $result->{session_id}, 567, 'Check session id' ); >+ is( $result->{id}, '42_567', 'Check userid' ); >+ >+ # Clear userenv >+ C4::Context::_unset_userenv('DUMMY SESSION'); >+ is( C4::Context::userenv, undef, 'No userenv anymore' ); >+ $result = Koha::Token::_add_default_csrf_params({}); # pass no session_id >+ is( $result->{session_id}, Koha::Token::DEFA_SESSION_ID, 'Check session id' ); >+ is( $result->{id}, Koha::Token::DEFA_SESSION_USERID. '_'. $result->{session_id}, 'Check userid' ); >+}; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27849
:
117744
|
137802
|
138448
| 138449