Bugzilla – Attachment 172685 Details for
Bug 37041
Logging into addbiblio.pl triggers a 403
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37041: Add C4::Auth::check_value_builder_caller
Bug-37041-Add-C4Authcheckvaluebuildercaller.patch (text/plain), 2.55 KB, created by
Marcel de Rooy
on 2024-10-11 09:59:46 UTC
(
hide
)
Description:
Bug 37041: Add C4::Auth::check_value_builder_caller
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-10-11 09:59:46 UTC
Size:
2.55 KB
patch
obsolete
>From 5daf7bf7da05f6f9c6cccf1e3b01c667b950a221 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Fri, 11 Oct 2024 09:42:03 +0000 >Subject: [PATCH] Bug 37041: Add C4::Auth::check_value_builder_caller >Content-Type: text/plain; charset=utf-8 > >Test plan: >Run t/db_dependent/FrameworkPlugin.t >Run xt/find-missing-auth_checks.t > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Auth.pm | 37 +++++++++++++++++++++++++++++++++++ > xt/find-missing-auth_checks.t | 2 +- > 2 files changed, 38 insertions(+), 1 deletion(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index d4b83bb75e..c799eb86c4 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -2392,6 +2392,43 @@ sub getborrowernumber { > return 0; > } > >+=head2 check_value_builder_caller >+ >+ C4::Auth::check_value_builder_caller(); >+ my $check = C4::Auth::check_value_builder_caller{ { exit => 0 } ); >+ >+ A value builder plugin should be called (with do $file) from >+ Koha::FrameworkPlugin. (Used by plugin_launcher, form builders, >+ a.o.) In that case we will return 1. >+ In all other case like someone trying to hit a value builder plugin >+ directly, we may return false or exit with a 403 immediately (based >+ on the exit parameter). >+ >+ NOTE: If exit is not passed, it defaults to 1! >+ >+=cut >+ >+sub check_value_builder_caller { >+ my ($params) = @_; >+ my $exit = $params->{exit} // 1; >+ >+ my $callers; >+ $callers->[0] = [ caller(0) ]; >+ if ( $callers->[0]->[1] =~ /\/cataloguing\/value_builder\// ) { >+ >+ # Need to check call stack >+ $callers->[1] = [ caller(1) ]; >+ return 1 if $callers->[1]->[1] =~ /\/Koha\/FrameworkPlugin\.pm$/; >+ } >+ >+ if ($exit) { >+ require CGI; >+ print CGI->new->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ safe_exit; >+ } >+ return; >+} >+ > END { } # module clean-up code here (global destructor) > 1; > __END__ >diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t >index a1a5c0d594..e3c929989c 100755 >--- a/xt/find-missing-auth_checks.t >+++ b/xt/find-missing-auth_checks.t >@@ -32,7 +32,7 @@ FILE: foreach my $file (@files) { > chomp $file; > my @lines = read_file($file); > for my $line (@lines) { >- for my $routine (qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init )) { >+ for my $routine (qw( get_template_and_user check_cookie_auth checkauth check_api_auth check_value_builder_caller C4::Service->init )) { > next FILE if $line =~ m|^[^#]*$routine|; > } > } >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37041
:
171931
|
171932
|
172685
|
172686
|
172694
|
172695
|
172696