Attachment 26971 Details for Bug 11219 – signed patch

[patch] signed patch

0001-Bug-11219-Bug-11219-CAS-authentication-fails-with-UR.patch (text/plain), 2.23 KB, created by Matthias Meusburger on 2014-04-10 12:42:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthias Meusburger

Created: 2014-04-10 12:42:29 UTC

Size: 2.23 KB

patch

obsolete

>From 2323f41d3e677d779f22c6f87eab8b2bba2dd91b Mon Sep 17 00:00:00 2001
>From: Fridolin Somers <fridolin.somers@biblibre.com>
>Date: Thu, 10 Apr 2014 13:12:19 +0200
>Subject: [PATCH] Bug 11219 - Bug 11219 - CAS authentication fails with URL
> parameters - followup
>
>This followup corrects the fact that when using $query->url(), both GET and POST params are get.
>Using $query->url_param() will only get params directly in URL.
>
>Test plan :
>- Enable CAS
>- Go to login page : cgi-bin/koha/opac-user.pl
>- Try to connect with local login using random login and password (they will be transmitted by POST)
>- You stay to login page
>- Look at CAS login URL
>=> Without this patch it will contain the random login and password as parameters of opac-user.pl
>=> With this patch it does not contain any parameter
>
>Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
>---
> C4/Auth_with_cas.pm | 20 ++++++++++++++++++--
> 1 file changed, 18 insertions(+), 2 deletions(-)
>
>diff --git a/C4/Auth_with_cas.pm b/C4/Auth_with_cas.pm
>index e71898e..a42a71c 100644
>--- a/C4/Auth_with_cas.pm
>+++ b/C4/Auth_with_cas.pm
>@@ -184,8 +184,7 @@ sub _get_cas_and_service {
>     my $query = shift;
>     my $key   = shift;    # optional
> 
>-    my $uri = C4::Context->preference('OPACBaseURL'); # server address
>-    $uri .= $query->url( -absolute => 1, -query => 1 ); # page with params
>+    my $uri = _url_with_get_params($query);
> 
>     my $casparam = $defaultcasserver;
>     $casparam = $query->param('cas') if defined $query->param('cas');
>@@ -195,6 +194,23 @@ sub _get_cas_and_service {
>     return ( $cas, $uri );
> }
> 
>+# Get the current URL with parameters contained directly into URL (GET params)
>+# This method replaces $query->url() which will give both GET and POST params
>+sub _url_with_get_params {
>+    my $query = shift;
>+
>+    my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
>+    my $uri_params_part = '';
>+    foreach ( $query->url_param() ) {
>+        $uri_params_part .= '&' if $uri_params_part;
>+        $uri_params_part .= $_ . '=';
>+        $uri_params_part .= URI::Escape::uri_escape( $query->url_param($_) );
>+    }
>+    $uri_base_part .= '?' if $uri_params_part;
>+
>+    return $uri_base_part . $uri_params_part;
>+}
>+
> 1;
> __END__
> 
>-- 
>1.8.3.2
>

Actions: View | Diff | Splinter Review

Attachments on bug 11219: 22807 | 23138 | 23744 | 26967 | 26971 | 27054 | 27055 | 27095 | 27096