Bugzilla – Attachment 143947 Details for
Bug 32208
Re-login without enough permissions needs attention
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 32208: Adjust Auth.pm for relogin without perms
Bug-32208-Adjust-Authpm-for-relogin-without-perms.patch (text/plain), 1.83 KB, created by
Nick Clemens (kidclamp)
on 2022-11-16 10:52:39 UTC
(
hide
)
Description:
Bug 32208: Adjust Auth.pm for relogin without perms
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2022-11-16 10:52:39 UTC
Size:
1.83 KB
patch
obsolete
>From e967a4a63da03a7325a74fa3aac162afeb7d6f5a Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Tue, 15 Nov 2022 13:55:18 +0000 >Subject: [PATCH] Bug 32208: Adjust Auth.pm for relogin without perms > >If a second login on top of a current session fails on >permissions, we should not grant access without context. > >Test plan: >[1] Run t/db../Auth.t, it should pass now. >[2] Test interface with/without this patch: > Pick two users: A has perms, B has not. > Put two staff login forms in two tabs. > Login as A in tab1. Login as B in tab2. > Without this patch, B gets in and crashes. > With this patch, B does not get in ('no perms'). > Bonus: Go to opac if on same domain. You are still > logged in as B. > >NOTE: I added a FIXME here, since you could argue about filling >the session info or otoh deleting the session. We present an >authorization failure; people may not realize that they are >still logged in (see test plan - bonus). > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > C4/Auth.pm | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index c135521f2d..0c20bb7057 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1119,6 +1119,11 @@ sub checkauth { > $auth_state = "logged_in"; > } > else { >+ $auth_state = 'failed'; >+ # FIXME We could add $return = 0; or even delete the session? >+ # Currently return == 1 and we will fill session info later on, >+ # although we do present an authorization failure. (Yes, the >+ # authentication was actually correct.) > $info{'nopermission'} = 1; > C4::Context::_unset_userenv($sessionID); > } >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 32208
:
143914
|
143915
|
143946
|
143947
|
143970
|
143971