Bugzilla – Attachment 144069 Details for
Bug 32178
query parameters in check_api_auth lets anyone assume a user id
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 32178: Adapt tests to new auth.session params
Bug-32178-Adapt-tests-to-new-authsession-params.patch (text/plain), 7.25 KB, created by
Tomás Cohen Arazi (tcohen)
on 2022-11-18 15:02:19 UTC
(
hide
)
Description:
Bug 32178: Adapt tests to new auth.session params
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2022-11-18 15:02:19 UTC
Size:
7.25 KB
patch
obsolete
>From ef93159260909265a332a9dc6384e4ff17da04d6 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 18 Nov 2022 11:59:23 -0300 >Subject: [PATCH] Bug 32178: Adapt tests to new auth.session params > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > t/db_dependent/Koha/REST/Plugin/Auth/IdP.t | 138 ++++++++++----------- > 1 file changed, 68 insertions(+), 70 deletions(-) > >diff --git a/t/db_dependent/Koha/REST/Plugin/Auth/IdP.t b/t/db_dependent/Koha/REST/Plugin/Auth/IdP.t >index 0e624bfc4e4..006415f07f6 100755 >--- a/t/db_dependent/Koha/REST/Plugin/Auth/IdP.t >+++ b/t/db_dependent/Koha/REST/Plugin/Auth/IdP.t >@@ -30,40 +30,41 @@ use Mojolicious::Lite; > plugin 'Koha::REST::Plugin::Auth::IdP'; > > post '/register_user' => sub { >- my $c = shift; >- my $params = $c->req->json; >- try { >- my $domain = Koha::Auth::Identity::Provider::Domains->find($params->{domain_id}); >- my $patron = $c->auth->register({ >- data => $params->{data}, >- domain => $domain, >- interface => $params->{interface} >- }); >- $c->render(status => 200, json => $patron->to_api); >- } catch { >- if ( ref($_) eq 'Koha::Exceptions::Auth::Unauthorized' ) { >- $c->render(status => 401, json => {message => 'unauthorized'}); >- } else { >- $c->render(status => 500, json => {message => 'other error'}); >+ my $c = shift; >+ my $params = $c->req->json; >+ try { >+ my $domain = Koha::Auth::Identity::Provider::Domains->find( $params->{domain_id} ); >+ my $patron = $c->auth->register( >+ { data => $params->{data}, >+ domain => $domain, >+ interface => $params->{interface} >+ } >+ ); >+ $c->render( status => 200, json => $patron->to_api ); >+ } catch { >+ if ( ref($_) eq 'Koha::Exceptions::Auth::Unauthorized' ) { >+ $c->render( status => 401, json => { message => 'unauthorized' } ); >+ } else { >+ $c->render( status => 500, json => { message => 'other error' } ); >+ } > } >- } > }; > > post '/start_session' => sub { >- my $c = shift; >- my $userid = my $params = $c->req->json->{userid}; >- >- try { >- my $patron = Koha::Patrons->search({userid => $userid}); >- my ($status, $cookie, $session_id) = $c->auth->session($patron->next); >- $c->render(status => 200, json => {status => $status}); >- } catch { >- if ( ref($_) eq 'Koha::Exceptions::Auth::CannotCreateSession' ) { >- $c->render(status => 401, json => {message => 'unauthorized'}); >- } else { >- $c->render(status => 500, json => {message => 'other error'}); >+ my $c = shift; >+ my $userid = my $params = $c->req->json->{userid}; >+ >+ try { >+ my $patron = Koha::Patrons->search( { userid => $userid } ); >+ my ( $status, $cookie, $session_id ) = $c->auth->session({ patron => $patron->next, interface => 'opac' }); >+ $c->render( status => 200, json => { status => $status } ); >+ } catch { >+ if ( ref($_) eq 'Koha::Exceptions::Auth::CannotCreateSession' ) { >+ $c->render( status => 401, json => { message => 'unauthorized' } ); >+ } else { >+ $c->render( status => 500, json => { message => 'other error' } ); >+ } > } >- } > }; > > use Test::More tests => 2; >@@ -81,53 +82,50 @@ my $builder = t::lib::TestBuilder->new; > t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); > > subtest 'auth.register helper' => sub { >- plan tests => 6; >- >- $schema->storage->txn_begin; >- >- # Remove existing patrons >- Koha::Patrons->delete; >- my $provider = $builder->build_object( { class => 'Koha::Auth::Identity::Providers', value => { matchpoint => 'email' } } ); >- my $domain_with_register = $builder->build_object( { class => 'Koha::Auth::Identity::Provider::Domains', value => { identity_provider_id => $provider->id, domain => 'domain1.com', auto_register => 1 } } ); >- my $domain_without_register = $builder->build_object( { class => 'Koha::Auth::Identity::Provider::Domains', value => { identity_provider_id => $provider->id, domain => 'domain2.com', auto_register => 0 } } ); >- my $library = $builder->build_object({ class => 'Koha::Libraries'}); >- my $category = $builder->build_object( {class => 'Koha::Patron::Categories'}); >- my $user_data = { >- firstname => 'test', >- surname => 'test', >- userid => 'id1', >- branchcode => $library->branchcode, >- categorycode => $category->categorycode >- }; >- >- my $t = Test::Mojo->new; >- >- $t->post_ok('/register_user' => json => {data => $user_data, domain_id => $domain_with_register->identity_provider_domain_id, interface => 'opac'}) >- ->status_is(200) >- ->json_has('/firstname', 'test'); >- >- $t->post_ok('/register_user' => json => {data => $user_data, domain_id => $domain_without_register->identity_provider_domain_id, interface => 'opac'}) >- ->status_is(401) >- ->json_has('/message', 'unauthorized'); >- $schema->storage->txn_rollback; >+ plan tests => 6; >+ >+ $schema->storage->txn_begin; >+ >+ # Remove existing patrons >+ Koha::Patrons->delete; >+ my $provider = $builder->build_object( { class => 'Koha::Auth::Identity::Providers', value => { matchpoint => 'email' } } ); >+ my $domain_with_register = $builder->build_object( >+ { class => 'Koha::Auth::Identity::Provider::Domains', value => { identity_provider_id => $provider->id, domain => 'domain1.com', auto_register => 1 } } ); >+ my $domain_without_register = $builder->build_object( >+ { class => 'Koha::Auth::Identity::Provider::Domains', value => { identity_provider_id => $provider->id, domain => 'domain2.com', auto_register => 0 } } ); >+ my $library = $builder->build_object( { class => 'Koha::Libraries' } ); >+ my $category = $builder->build_object( { class => 'Koha::Patron::Categories' } ); >+ my $user_data = { >+ firstname => 'test', >+ surname => 'test', >+ userid => 'id1', >+ branchcode => $library->branchcode, >+ categorycode => $category->categorycode >+ }; >+ >+ my $t = Test::Mojo->new; >+ >+ $t->post_ok( '/register_user' => json => { data => $user_data, domain_id => $domain_with_register->identity_provider_domain_id, interface => 'opac' } )->status_is(200) >+ ->json_has( '/firstname', 'test' ); >+ >+ $t->post_ok( '/register_user' => json => { data => $user_data, domain_id => $domain_without_register->identity_provider_domain_id, interface => 'opac' } )->status_is(401) >+ ->json_has( '/message', 'unauthorized' ); >+ $schema->storage->txn_rollback; > }; > > subtest 'auth.session helper' => sub { >- plan tests => 3; >+ plan tests => 3; > >- $schema->storage->txn_begin; >+ $schema->storage->txn_begin; > >- # Remove existing patrons >- Koha::Patrons->delete; >- my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); >+ # Remove existing patrons >+ Koha::Patrons->delete; >+ my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); > >+ my $t = Test::Mojo->new; >+ $t->post_ok( '/start_session' => json => { userid => $patron->userid } )->status_is(200)->json_has( '/status', 'ok' ); > >- my $t = Test::Mojo->new; >- $t->post_ok('/start_session' => json => {userid => $patron->userid}) >- ->status_is(200) >- ->json_has('/status', 'ok'); >- >- $schema->storage->txn_rollback; >+ $schema->storage->txn_rollback; > }; > >-1; >\ No newline at end of file >+1; >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 32178
:
143799
|
143816
|
143841
|
143842
|
143899
| 144069 |
144070