Bugzilla – Attachment 143899 Details for
Bug 32178
query parameters in check_api_auth lets anyone assume a user id
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 32178: (follow-up) Transform 'staff' interface to 'intranet'
Bug-32178-follow-up-Transform-staff-interface-to-i.patch (text/plain), 2.27 KB, created by
Agustín Moyano
on 2022-11-15 12:19:21 UTC
(
hide
)
Description:
Bug 32178: (follow-up) Transform 'staff' interface to 'intranet'
Filename:
MIME Type:
Creator:
Agustín Moyano
Created:
2022-11-15 12:19:21 UTC
Size:
2.27 KB
patch
obsolete
>From df6214912b953ef810dbd3d71da67d7ae5251927 Mon Sep 17 00:00:00 2001 >From: Agustin Moyano <agustinmoyano@theke.io> >Date: Tue, 15 Nov 2022 09:17:11 -0300 >Subject: [PATCH] Bug 32178: (follow-up) Transform 'staff' interface to > 'intranet' > >--- > C4/Auth.pm | 2 ++ > t/db_dependent/Auth.t | 10 ++++++---- > 2 files changed, 8 insertions(+), 4 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 785291f050..d8ddb17098 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1880,6 +1880,8 @@ sub create_basic_session { > my $patron = $params->{patron}; > my $interface = $params->{interface}; > >+ $interface = 'intranet' if $interface eq 'staff'; >+ > my $session = get_session(""); > > $session->param( 'number', $patron->borrowernumber ); >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 197dec5d95..ee690f79ae 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -834,12 +834,11 @@ subtest 'Userenv clearing in check_cookie_auth' => sub { > }; > > subtest 'create_basic_session tests' => sub { >- plan tests => 12; >+ plan tests => 13; > > my $patron = $builder->build_object({ class => 'Koha::Patrons' }); >- my $interface = 'opac'; > >- my $session = C4::Auth::create_basic_session({ patron => $patron, interface => $interface }); >+ my $session = C4::Auth::create_basic_session({ patron => $patron, interface => 'opac' }); > > isnt($session->id, undef, 'A new sessionID was created'); > is( $session->param('number'), $patron->borrowernumber, 'Session parameter number matches' ); >@@ -852,7 +851,10 @@ subtest 'create_basic_session tests' => sub { > is( $session->param('flags'), $patron->flags, 'Session parameter flags matches' ); > is( $session->param('emailaddress'), $patron->email, 'Session parameter emailaddress matches' ); > is( $session->param('ip'), $session->remote_addr(), 'Session parameter ip matches' ); >- is( $session->param('interface'), $interface, 'Session parameter interface matches' ); >+ is( $session->param('interface'), 'opac', 'Session parameter interface matches' ); >+ >+ $session = C4::Auth::create_basic_session({ patron => $patron, interface => 'staff' }); >+ is( $session->param('interface'), 'intranet', 'Staff interface gets converted to intranet' ); > }; > > $schema->storage->txn_rollback; >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 32178
:
143799
|
143816
|
143841
|
143842
| 143899 |
144069
|
144070