Bugzilla – Attachment 154746 Details for
Bug 34513
Authenticated users can bypass permissions and view some privileged pages
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34513: (QA follow-up) Tidy
Bug-34513-QA-follow-up-Tidy.patch (text/plain), 3.99 KB, created by
Nick Clemens (kidclamp)
on 2023-08-24 18:21:23 UTC
(
hide
)
Description:
Bug 34513: (QA follow-up) Tidy
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2023-08-24 18:21:23 UTC
Size:
3.99 KB
patch
obsolete
>From abc499a234ab8d571f881b93d9f72236453aeba8 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Thu, 24 Aug 2023 18:19:37 +0000 >Subject: [PATCH] Bug 34513: (QA follow-up) Tidy > >--- > t/db_dependent/Auth.t | 22 ++++++++++++---------- > t/db_dependent/selenium/authentication.t | 7 +++++-- > 2 files changed, 17 insertions(+), 12 deletions(-) > >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 3f25e3f917..cc4016afc3 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -153,29 +153,31 @@ subtest 'checkauth() tests' => sub { > }; > > subtest 'Reset auth state when changing users' => sub { >+ > #NOTE: It's easiest to detect this when changing to a non-existent user, since > #that should trigger a redirect to login (instead of returning a session cookie) > plan tests => 2; >- my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => undef } }); >+ my $patron = $builder->build_object( { class => 'Koha::Patrons', value => { flags => undef } } ); > > my $session = C4::Auth::get_session(); >- $session->param( 'number', $patron->id ); >- $session->param( 'id', $patron->userid ); >- $session->param( 'ip', '1.2.3.4' ); >- $session->param( 'lasttime', time() ); >- $session->param( 'interface', 'intranet' ); >+ $session->param( 'number', $patron->id ); >+ $session->param( 'id', $patron->userid ); >+ $session->param( 'ip', '1.2.3.4' ); >+ $session->param( 'lasttime', time() ); >+ $session->param( 'interface', 'intranet' ); > $session->flush; > my $sessionID = $session->id; > C4::Context->_new_userenv($sessionID); > >- my ( $return ) = C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } ); >+ my ($return) = >+ C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } ); > is( $return, 'ok', 'Patron authenticated' ); > > my $mock1 = Test::MockModule->new('C4::Auth'); >- $mock1->mock( 'safe_exit', sub {return 'safe_exit_redirect'} ); >+ $mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } ); > my $mock2 = Test::MockModule->new('CGI'); > $mock2->mock( 'request_method', 'POST' ); >- $mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified.. >+ $mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified.. > my $cgi = CGI->new; > > $cgi->param( -name => 'userid', -value => 'Bond' ); >@@ -190,7 +192,7 @@ subtest 'checkauth() tests' => sub { > @return = C4::Auth::checkauth( $cgi, 0, {} ); > close STDOUT; > } >- is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login'); >+ is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' ); > }; > > >diff --git a/t/db_dependent/selenium/authentication.t b/t/db_dependent/selenium/authentication.t >index 47778dd84b..77f96e3b73 100755 >--- a/t/db_dependent/selenium/authentication.t >+++ b/t/db_dependent/selenium/authentication.t >@@ -57,8 +57,11 @@ SKIP: { > like( $driver->get_title, qr(Access denied), 'Patron without permission should be redirected to the login form' ); > > # Try logging in as someone else (even a non-existent patron) and you should still be denied access >- $s->auth('Bond','James Bond'); >- like( $driver->get_title, qr(Invalid username or password), 'Trying to change to a non-existent user should fail login' ); >+ $s->auth( 'Bond', 'James Bond' ); >+ like( >+ $driver->get_title, qr(Invalid username or password), >+ 'Trying to change to a non-existent user should fail login' >+ ); > > $driver->get($mainpage . q|?logout.x=1|); > $patron->flags(4)->store; # catalogue permission >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34513
:
154357
|
154439
|
154440
|
154743
|
154744
|
154745
|
154746
|
154781
|
154782
|
154783
|
154784