Bugzilla – Attachment 166497 Details for
Bug 36575
Wrong patron can be returned for API validation route
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36575: Adjust checkpw_internal to return patron
Bug-36575-Adjust-checkpwinternal-to-return-patron.patch (text/plain), 4.55 KB, created by
Marcel de Rooy
on 2024-05-10 06:52:19 UTC
(
hide
)
Description:
Bug 36575: Adjust checkpw_internal to return patron
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-05-10 06:52:19 UTC
Size:
4.55 KB
patch
obsolete
>From e51d9cc0cb5feed9520ad169b2d07caf93a19fe6 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Wed, 24 Apr 2024 15:06:22 +0000 >Subject: [PATCH] Bug 36575: Adjust checkpw_internal to return patron >Content-Type: text/plain; charset=utf-8 > >This patch refactors checkpw_internal to remove the SQL code, use patron ojbects, and return the >patron that correctly matches the userid/caerdnumber when auth is successful > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Auth.pm | 59 +++++++++++++++++++++--------------------------------- > 1 file changed, 23 insertions(+), 36 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 747e87c327..f10e815523 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -2023,17 +2023,17 @@ sub checkpw { > } > > if ($check_internal_as_fallback) { >+ > # INTERNAL AUTH > @return = checkpw_internal( $userid, $password, $no_set_userenv ); >- $passwd_ok = 1 if $return[0] > 0; # 1 or 2 >- $patron = Koha::Patrons->find( { cardnumber => $return[1] } ) if $passwd_ok; >- push @return, $patron if $patron; >+ $passwd_ok = 1 if $return[0] > 0; # 1 or 2 >+ $patron = $return[3]; > } > > if ( defined $userid && !$patron ) { > $patron = Koha::Patrons->find( { userid => $userid } ); > $patron = Koha::Patrons->find( { cardnumber => $userid } ) unless $patron; >- push @return, $patron if $check_internal_as_fallback; >+ push @return, $patron if $check_internal_as_fallback; # We pass back the patron if authentication fails > } > > if ($patron) { >@@ -2063,41 +2063,28 @@ sub checkpw_internal { > my ( $userid, $password, $no_set_userenv ) = @_; > > $password = Encode::encode( 'UTF-8', $password ) >- if Encode::is_utf8($password); >- >- my $dbh = C4::Context->dbh; >- my $sth = >- $dbh->prepare( >- "select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where userid=?" >- ); >- $sth->execute($userid); >- if ( $sth->rows ) { >- my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname, >- $surname, $branchcode, $branchname, $flags ) >- = $sth->fetchrow; >- >- if ( checkpw_hash( $password, $stored_hash ) ) { >+ if Encode::is_utf8($password); > >- C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, >- $firstname, $surname, $branchcode, $branchname, $flags ) unless $no_set_userenv; >- return 1, $cardnumber, $userid; >+ my $patron = Koha::Patrons->find( { userid => $userid } ); >+ if ($patron) { >+ if ( checkpw_hash( $password, $patron->password ) ) { >+ my $borrowernumber = $patron->borrowernumber; >+ C4::Context->set_userenv( >+ "$borrowernumber", $patron->userid, $patron->cardnumber, >+ $patron->firstname, $patron->surname, $patron->branchcode, $patron->library->branchname, $patron->flags >+ ) unless $no_set_userenv; >+ return 1, $patron->cardnumber, $patron->userid, $patron; > } > } >- $sth = >- $dbh->prepare( >- "select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where cardnumber=?" >- ); >- $sth->execute($userid); >- if ( $sth->rows ) { >- my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname, >- $surname, $branchcode, $branchname, $flags ) >- = $sth->fetchrow; >- >- if ( checkpw_hash( $password, $stored_hash ) ) { >- >- C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, >- $firstname, $surname, $branchcode, $branchname, $flags ) unless $no_set_userenv; >- return 1, $cardnumber, $userid; >+ $patron = Koha::Patrons->find( { cardnumber => $userid } ); >+ if ($patron) { >+ if ( checkpw_hash( $password, $patron->password ) ) { >+ my $borrowernumber = $patron->borrowernumber; >+ C4::Context->set_userenv( >+ "$borrowernumber", $patron->userid, $patron->cardnumber, >+ $patron->firstname, $patron->surname, $patron->branchcode, $patron->library->branchname, $patron->flags >+ ) unless $no_set_userenv; >+ return 1, $patron->cardnumber, $patron->userid, $patron; > } > } > return 0; >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36575
:
164668
|
164670
|
164671
|
165133
|
165134
|
165467
|
165468
|
165469
|
165470
|
165471
|
165908
|
166493
|
166494
|
166495
|
166496
|
166497
|
166498
|
167276
|
167277
|
167278
|
167279
|
167280
|
167281
|
167282
|
167283