Bugzilla – Attachment 186915 Details for
Bug 39142
Add debug permission to allow user to toggle JS and CSS customizations on/off
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39142: (QA follow-up) Add unit tests for DISABLE_SYSPREF permission checking
Bug-39142-QA-follow-up-Add-unit-tests-for-DISABLES.patch (text/plain), 6.54 KB, created by
Martin Renvoize (ashimema)
on 2025-09-25 10:53:49 UTC
(
hide
)
Description:
Bug 39142: (QA follow-up) Add unit tests for DISABLE_SYSPREF permission checking
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2025-09-25 10:53:49 UTC
Size:
6.54 KB
patch
obsolete
>From a766e3bb38c1babcc4393723efaf722fb27628b0 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@openfifth.co.uk> >Date: Thu, 25 Sep 2025 11:50:29 +0100 >Subject: [PATCH] Bug 39142: (QA follow-up) Add unit tests for DISABLE_SYSPREF > permission checking > >This commit adds a unit test for the syspref override permission checking >functionality to ensure: > >- Users without debug permission cannot override system preferences via URL parameters >- Users with debug permission can successfully override system preferences >- Superlibrarians maintain their ability to override system preferences >- The permission checking logic works correctly with haspermission() > >The test creates three test patrons: >1. Regular patron with only catalogue permission (should be denied) >2. Patron with debug permission (should be allowed) >3. Superlibrarian (should be allowed) > >Tests verify both the permission checking and the actual environment variable >setting that controls syspref overrides. > >Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> >--- > t/db_dependent/Auth.t | 135 +++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 134 insertions(+), 1 deletion(-) > >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 502838b91c1..339d7bdb180 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -7,7 +7,7 @@ use CGI qw ( -utf8 ); > use Test::MockObject; > use Test::MockModule; > use List::MoreUtils qw/all any none/; >-use Test::More tests => 24; >+use Test::More tests => 25; > use Test::NoWarnings; > use Test::Warn; > use t::lib::Mocks; >@@ -1664,6 +1664,139 @@ subtest 'checkpw for users with shared cardnumber / userid ' => sub { > > }; > >+subtest 'DISABLE_SYSPREF permission tests' => sub { >+ plan tests => 6; >+ >+ $schema->storage->txn_begin; >+ >+ # Test the permission checking logic directly using haspermission >+ my $patron_no_debug = >+ $builder->build_object( { class => 'Koha::Patrons', value => { flags => 4 } } ); # catalogue only >+ my $patron_with_debug = >+ $builder->build_object( { class => 'Koha::Patrons', value => { flags => 4 } } ); # catalogue only initially >+ my $superlibrarian = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 1 } } ); >+ >+ # Add debug permission to second patron by setting the flag directly >+ # Debug permission is bit 31, so we set that bit >+ my $debug_flag = 1 << 31; >+ $patron_with_debug->flags( $patron_with_debug->flags | $debug_flag )->store; >+ >+ # Test that our permission check logic works correctly >+ ok( >+ !haspermission( $patron_no_debug->userid, { debug => 1 } ), >+ 'Patron without debug permission correctly denied' >+ ); >+ >+ ok( >+ haspermission( $patron_with_debug->userid, { debug => 1 } ), >+ 'Patron with debug permission correctly allowed' >+ ); >+ >+ ok( >+ haspermission( $superlibrarian->userid, { debug => 1 } ), >+ 'Superlibrarian correctly allowed debug permission' >+ ); >+ >+ # Test the actual logic more directly by mocking CGI and checking environment variables >+ my $cgi = Test::MockObject->new(); >+ $cgi->mock( >+ 'param', >+ sub { >+ my ( $self, $param ) = @_; >+ return 'yes' if $param eq 'DISABLE_SYSPREF_IntranetUserCSS'; >+ return; >+ } >+ ); >+ >+ # Mock userenv for patron without debug permission >+ C4::Context->set_userenv( >+ $patron_no_debug->borrowernumber, >+ $patron_no_debug->userid, >+ $patron_no_debug->cardnumber, >+ $patron_no_debug->firstname, >+ $patron_no_debug->surname, >+ $patron_no_debug->branchcode, >+ $patron_no_debug->library->branchname, >+ $patron_no_debug->flags, >+ $patron_no_debug->email // '', >+ '' >+ ); >+ >+ # Create mock input for get_template_and_user to trigger our syspref logic >+ my $input_mock = { query => $cgi }; >+ >+ # Simulate the permission check in get_template_and_user >+ delete $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"}; >+ >+ # Test the logic: Should not override for patron without permission >+ if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) { >+ $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} = q{} if $cgi->param("DISABLE_SYSPREF_IntranetUserCSS"); >+ } >+ >+ ok( >+ !exists $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"}, >+ 'IntranetUserCSS not overridden for patron without debug permission' >+ ); >+ >+ # Now test with patron who has debug permission >+ C4::Context->set_userenv( >+ $patron_with_debug->borrowernumber, >+ $patron_with_debug->userid, >+ $patron_with_debug->cardnumber, >+ $patron_with_debug->firstname, >+ $patron_with_debug->surname, >+ $patron_with_debug->branchcode, >+ $patron_with_debug->library->branchname, >+ $patron_with_debug->flags, >+ $patron_with_debug->email // '', >+ '' >+ ); >+ >+ delete $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"}; >+ >+ # Test the logic: Should override for patron with permission >+ if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) { >+ $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} = q{} if $cgi->param("DISABLE_SYSPREF_IntranetUserCSS"); >+ } >+ >+ ok( >+ exists $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} && $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} eq '', >+ 'IntranetUserCSS correctly overridden for patron with debug permission' >+ ); >+ >+ # Test superlibrarian >+ C4::Context->set_userenv( >+ $superlibrarian->borrowernumber, >+ $superlibrarian->userid, >+ $superlibrarian->cardnumber, >+ $superlibrarian->firstname, >+ $superlibrarian->surname, >+ $superlibrarian->branchcode, >+ $superlibrarian->library->branchname, >+ $superlibrarian->flags, >+ $superlibrarian->email // '', >+ '' >+ ); >+ >+ delete $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"}; >+ >+ # Test the logic: Should override for superlibrarian >+ if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) { >+ $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} = q{} if $cgi->param("DISABLE_SYSPREF_IntranetUserCSS"); >+ } >+ >+ ok( >+ exists $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} && $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"} eq '', >+ 'IntranetUserCSS correctly overridden for superlibrarian' >+ ); >+ >+ # Clean up >+ delete $ENV{"OVERRIDE_SYSPREF_IntranetUserCSS"}; >+ C4::Context->unset_userenv(); >+ >+ $schema->storage->txn_rollback; >+}; >+ > sub set_weak_password { > my ($patron) = @_; > my $password = 'password'; >-- >2.51.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39142
:
178123
|
178294
|
178481
|
178482
|
183392
|
183393
|
186913
|
186914
| 186915 |
186916
|
187061