Bugzilla – Attachment 171932 Details for
Bug 37041
Logging into addbiblio.pl triggers a 403
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37041: Use session_id from userenv instead of cookie for value_builder
Bug-37041-Use-sessionid-from-userenv-instead-of-co.patch (text/plain), 8.55 KB, created by
Jonathan Druart
on 2024-09-24 13:25:22 UTC
(
hide
)
Description:
Bug 37041: Use session_id from userenv instead of cookie for value_builder
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2024-09-24 13:25:22 UTC
Size:
8.55 KB
patch
obsolete
>From 280ab99d9310c2b959401740d060c62663b5f1a4 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 24 Sep 2024 15:22:59 +0200 >Subject: [PATCH] Bug 37041: Use session_id from userenv instead of cookie for > value_builder > >--- > C4/Context.pm | 18 ++++++++++++++++-- > C4/InstallAuth.pm | 12 +----------- > cataloguing/value_builder/barcode_manual.pl | 2 +- > cataloguing/value_builder/dateaccessioned.pl | 4 +++- > cataloguing/value_builder/marc21_field_005.pl | 4 +++- > cataloguing/value_builder/marc21_field_245h.pl | 4 +++- > cataloguing/value_builder/marc21_field_260b.pl | 4 +++- > cataloguing/value_builder/marc21_orgcode.pl | 3 ++- > cataloguing/value_builder/stocknumber.pl | 2 +- > cataloguing/value_builder/upload.pl | 3 ++- > 10 files changed, 35 insertions(+), 21 deletions(-) > >diff --git a/C4/Context.pm b/C4/Context.pm >index 8d49feda7c4..8798416d3c0 100644 >--- a/C4/Context.pm >+++ b/C4/Context.pm >@@ -662,13 +662,26 @@ set_userenv is called in Auth.pm > =cut > > #' >+sub set_userenv_from_session { >+ my ( $class, $session ) = @_; >+ return $class->set_userenv( >+ $session->param('number'), $session->param('id') // '', >+ $session->param('cardnumber'), $session->param('firstname'), >+ $session->param('surname'), $session->param('branch'), >+ $session->param('branchname'), $session->param('flags'), >+ $session->param('emailaddress'), $session->param('shibboleth'), >+ $session->param('desk_id'), $session->param('desk_name'), >+ $session->param('register_id'), $session->param('register_name'), >+ $session->id, >+ ); >+} > sub set_userenv { > shift @_; > my ( > $usernum, $userid, $usercnum, $userfirstname, > $usersurname, $userbranch, $branchname, $userflags, > $emailaddress, $shibboleth, $desk_id, $desk_name, >- $register_id, $register_name >+ $register_id, $register_name, $session_id, > ) = @_; > > my $cell = { >@@ -687,7 +700,8 @@ sub set_userenv { > "desk_id" => $desk_id, > "desk_name" => $desk_name, > "register_id" => $register_id, >- "register_name" => $register_name >+ "register_name" => $register_name, >+ "session_id" => $session_id, > }; > $context->{userenv} = $cell; > return $cell; >diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm >index fa52cbcfc56..49114917ac9 100644 >--- a/C4/InstallAuth.pm >+++ b/C4/InstallAuth.pm >@@ -253,17 +253,7 @@ sub checkauth { > > if ( $session ) { > if ( $session->param('cardnumber') ) { >- C4::Context->set_userenv( >- $session->param('number'), >- $session->param('id'), >- $session->param('cardnumber'), >- $session->param('firstname'), >- $session->param('surname'), >- $session->param('branch'), >- $session->param('branchname'), >- $session->param('flags'), >- $session->param('emailaddress') >- ); >+ C4::Context->set_userenv_from_session($session); > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => $session->id, >diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl >index 67891789e31..cbc2990139c 100755 >--- a/cataloguing/value_builder/barcode_manual.pl >+++ b/cataloguing/value_builder/barcode_manual.pl >@@ -31,7 +31,7 @@ use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl >index 65c806b29c8..939bb345d7d 100755 >--- a/cataloguing/value_builder/dateaccessioned.pl >+++ b/cataloguing/value_builder/dateaccessioned.pl >@@ -23,9 +23,11 @@ > use Modern::Perl; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); >+use C4::Context; >+ > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl >index 6428bd61a99..4d2b5cbedd4 100755 >--- a/cataloguing/value_builder/marc21_field_005.pl >+++ b/cataloguing/value_builder/marc21_field_005.pl >@@ -23,9 +23,11 @@ use Modern::Perl; > > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); >+use C4::Context; >+ > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl >index 4fe4a2f1e75..55888510edb 100755 >--- a/cataloguing/value_builder/marc21_field_245h.pl >+++ b/cataloguing/value_builder/marc21_field_245h.pl >@@ -23,9 +23,11 @@ use Modern::Perl; > > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); >+use C4::Context; >+ > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl >index e9a74a07ba4..c7703712d55 100755 >--- a/cataloguing/value_builder/marc21_field_260b.pl >+++ b/cataloguing/value_builder/marc21_field_260b.pl >@@ -29,9 +29,11 @@ use C4::Context; > > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); >+use C4::Context; >+ > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl >index 0dd985803c9..65e0d2efc4e 100755 >--- a/cataloguing/value_builder/marc21_orgcode.pl >+++ b/cataloguing/value_builder/marc21_orgcode.pl >@@ -26,9 +26,10 @@ use C4::Context; > use Koha::Libraries; > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); >+ > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl >index 61885d12b05..4358ffb1d7d 100755 >--- a/cataloguing/value_builder/stocknumber.pl >+++ b/cataloguing/value_builder/stocknumber.pl >@@ -25,7 +25,7 @@ use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl >index eeb422d5258..e79e650647e 100755 >--- a/cataloguing/value_builder/upload.pl >+++ b/cataloguing/value_builder/upload.pl >@@ -32,9 +32,10 @@ use Modern::Perl; > > use CGI qw ( -utf8 ); > use C4::Auth qw( check_cookie_auth ); >+use C4::Context; > my $input = CGI->new; > my ($auth_status) = >- check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+ check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); > if ( $auth_status ne "ok" ) { > print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); > exit 0; >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37041
:
171931
|
171932
|
172685
|
172686
|
172694
|
172695
|
172696