Attachment 163499 Details for Bug 36149 – Bug 36149: Unset userenv from middleware

[patch] Bug 36149: Unset userenv from middleware

Bug-36149-Unset-userenv-from-middleware.patch (text/plain), 2.39 KB, created by Jonathan Druart on 2024-03-20 07:48:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2024-03-20 07:48:08 UTC

Size: 2.39 KB

patch

obsolete

>From 253915a661a0a7dc6fd5e243f339230a82da3870 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Fri, 8 Mar 2024 16:06:11 +0100
>Subject: [PATCH] Bug 36149: Unset userenv from middleware
>
>The userenv (logged in user's info) are stored in
>$C4::Context->context->{activeuser}, which persists in plack worker's
>memory.
>It's really bad in theory as we are not cleaning it before or after the
>HTTP request, but only when set_userenv is called (what we are doing
>commonly in C4::Auth::get_template_and_user).
>If C4::Context->userenv is called before set_userenv we should get undef,
>not the userenv from the previous request!
>In practice this should not be a problem, but well... who really knows?
>
>This patch suggests to have a middleware to deal with removing the
>userenv at the beginning of each request (maybe it should be after, right? - FIXME).
>---
> C4/Context.pm               |  3 +--
> Koha/Middleware/UserEnv.pm  | 18 ++++++++++++++++++
> debian/templates/plack.psgi |  1 +
> 3 files changed, 20 insertions(+), 2 deletions(-)
> create mode 100644 Koha/Middleware/UserEnv.pm
>
>diff --git a/C4/Context.pm b/C4/Context.pm
>index 0169b10f85e..bc1633313d0 100644
>--- a/C4/Context.pm
>+++ b/C4/Context.pm
>@@ -853,8 +853,7 @@ Destroys the hash for activeuser user environment variables.
> 
> sub _unset_userenv
> {
>-    my ($sessionID)= @_;
>-    undef $context->{activeuser} if $sessionID && $context->{activeuser} && $context->{activeuser} eq $sessionID;
>+    delete $context->{activeuser};
> }
> 
> 
>diff --git a/Koha/Middleware/UserEnv.pm b/Koha/Middleware/UserEnv.pm
>new file mode 100644
>index 00000000000..03d515fdcff
>--- /dev/null
>+++ b/Koha/Middleware/UserEnv.pm
>@@ -0,0 +1,18 @@
>+package Koha::Middleware::UserEnv;
>+use Modern::Perl;
>+
>+use parent qw(Plack::Middleware);
>+
>+use C4::Context;
>+
>+sub call {
>+    my ( $self, $env ) =@_;
>+
>+    my $req = Plack::Request->new($env);
>+
>+    C4::Context->_unset_userenv;
>+
>+    return $self->app->($env);
>+}
>+
>+1;
>diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi
>index 530c3b0962b..bf31ecf152f 100644
>--- a/debian/templates/plack.psgi
>+++ b/debian/templates/plack.psgi
>@@ -73,6 +73,7 @@ builder {
>     enable "Plack::Middleware::Static";
> 
>     # + is required so Plack doesn't try to prefix Plack::Middleware::
>+    enable "+Koha::Middleware::UserEnv";
>     enable "+Koha::Middleware::SetEnv";
>     enable "+Koha::Middleware::RealIP";
> 
>-- 
>2.34.1

Actions: View | Diff | Splinter Review

Attachments on bug 36149: 163039 | 163040 | 163041 | 163042 | 163043 | 163402 | 163403 | 163404 | 163406 | 163407 | 163409 | 163412 | 163499 | 164145 | 164146 | 164555 | 164567 | 164568 | 164569