Attachment 152029 Details for Bug 33881 – Bug 33881: Clear self-check JWT during auth kick out

[patch] Bug 33881: Clear self-check JWT during auth kick out

Bug-33881-Clear-self-check-JWT-during-auth-kick-ou.patch (text/plain), 1.76 KB, created by David Cook on 2023-06-06 03:52:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2023-06-06 03:52:56 UTC

Size: 1.76 KB

patch

obsolete

>From 46f87fdf07f8bc19886c0653094d703d5f08b44a Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Tue, 6 Jun 2023 03:48:06 +0000
>Subject: [PATCH] Bug 33881: Clear self-check JWT during auth kick out
>
>This patch clears the JWT cookie during auth kick out (ie
>when a web user navigates from the self-check out/in to
>the rest of Koha).
>
>Test plan:
>0. Apply patch and koha-plack --reload kohadev
>1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>2. Log in as the "koha" user
>3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1
>5. Note that you are prompted to "Log in to your account" via the normal Koha prompt
>6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>7. Note that you are prompted to "Log in to your account" within the "Self checkout system",
>and note that your self-checkout session for the "koha" user has *not* persisted like
>it did before the patch was applied
>---
> C4/Auth.pm | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 07afd24018..1761b19416 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -259,6 +259,15 @@ sub get_template_and_user {
>                 -sameSite => 'Lax',
>             ));
> 
>+            #NOTE: This JWT should only be used by the self-check controllers
>+            $cookie = $cookie_mgr->replace_in_list( $cookie, $in->{query}->cookie(
>+                -name     => 'JWT',
>+                -value    => '',
>+                -HttpOnly => 1,
>+                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
>+                -sameSite => 'Lax',
>+            ));
>+
>             my $auth_error = $in->{query}->param('auth_error');
> 
>             $template->param(
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 33881: 152029 | 153209 | 153312 | 153750