Attachment 153750 Details for Bug 33881 – Bug 33881: [21.11] Clear self-check JWT during auth kick out

[patch] Bug 33881: [21.11] Clear self-check JWT during auth kick out

Bug-33881-2111-Clear-self-check-JWT-during-auth-ki.patch (text/plain), 1.93 KB, created by Jonathan Druart on 2023-07-21 06:06:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2023-07-21 06:06:31 UTC

Size: 1.93 KB

patch

obsolete

>From 33da0b27a22abbc802884e893a14d3ce31f3bf54 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Tue, 6 Jun 2023 03:48:06 +0000
>Subject: [PATCH] Bug 33881: [21.11] Clear self-check JWT during auth kick out
>
>This patch clears the JWT cookie during auth kick out (ie
>when a web user navigates from the self-check out/in to
>the rest of Koha).
>
>Test plan:
>0. Apply patch and koha-plack --reload kohadev
>1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>2. Log in as the "koha" user
>3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1
>5. Note that you are prompted to "Log in to your account" via the normal Koha prompt
>6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
>7. Note that you are prompted to "Log in to your account" within the "Self checkout system",
>and note that your self-checkout session for the "koha" user has *not* persisted like
>it did before the patch was applied
>
>Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
>Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
>---
> C4/Auth.pm | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 13128407f58..608a2435f6f 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -254,6 +254,15 @@ sub get_template_and_user {
>                 -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
>             ));
> 
>+            #NOTE: This JWT should only be used by the self-check controllers
>+            $cookie = $cookie_mgr->replace_in_list( $cookie, $in->{query}->cookie(
>+                -name     => 'JWT',
>+                -value    => '',
>+                -HttpOnly => 1,
>+                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
>+                -sameSite => 'Lax',
>+            ));
>+
>             $template->param(
>                 loginprompt => 1,
>                 script_name => get_script_name(),
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 33881: 152029 | 153209 | 153312 | 153750