Bugzilla – Attachment 73400 Details for
Bug 20489
Prevent DB user login
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 20489: Prevent DB user login
Bug-20489-Prevent-DB-user-login.patch (text/plain), 9.21 KB, created by
Jonathan Druart
on 2018-03-28 17:44:48 UTC
(
hide
)
Description:
Bug 20489: Prevent DB user login
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2018-03-28 17:44:48 UTC
Size:
9.21 KB
patch
obsolete
>From 34814963788f8ce48535fb255cbf8921daaae21c Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 28 Mar 2018 14:44:21 -0300 >Subject: [PATCH] Bug 20489: Prevent DB user login > >--- > C4/Auth.pm | 47 +---------------------------------------------- > acqui/neworderempty.pl | 3 +++ > members/member-flags.pl | 7 ++----- > members/memberentry.pl | 6 ++---- > members/moremember.pl | 8 +++----- > t/db_dependent/Auth.t | 2 +- > 6 files changed, 12 insertions(+), 61 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 13c4652d2e..00dedcb22a 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1048,10 +1048,8 @@ sub checkauth { > } > } > >- # $return: 1 = valid user, 2 = superlibrarian >+ # $return: 1 = valid user > if ($return) { >- # If DB user is logged in >- $userid ||= $q_userid if $return == 2; > > #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); > if ( $flags = haspermission( $userid, $flagsrequired ) ) { >@@ -1151,22 +1149,6 @@ sub checkauth { > $session->param( 'shibboleth', $shibSuccess ); > $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map { $session->param($_) } qw(cardnumber firstname surname branch); > } >- elsif ( $return == 2 ) { >- >- #We suppose the user is the superlibrarian >- $borrowernumber = 0; >- $session->param( 'number', 0 ); >- $session->param( 'id', C4::Context->config('user') ); >- $session->param( 'cardnumber', C4::Context->config('user') ); >- $session->param( 'firstname', C4::Context->config('user') ); >- $session->param( 'surname', C4::Context->config('user') ); >- $session->param( 'branch', 'NO_LIBRARY_SET' ); >- $session->param( 'branchname', 'NO_LIBRARY_SET' ); >- $session->param( 'flags', 1 ); >- $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); >- $session->param( 'ip', $session->remote_addr() ); >- $session->param( 'lasttime', time() ); >- } > $session->param('cas_ticket', $cas_ticket) if $cas_ticket; > C4::Context->set_userenv( > $session->param('number'), $session->param('id'), >@@ -1598,20 +1580,6 @@ sub check_api_auth { > $session->param( 'emailaddress', $emailaddress ); > $session->param( 'ip', $session->remote_addr() ); > $session->param( 'lasttime', time() ); >- } elsif ( $return == 2 ) { >- >- #We suppose the user is the superlibrarian >- $session->param( 'number', 0 ); >- $session->param( 'id', C4::Context->config('user') ); >- $session->param( 'cardnumber', C4::Context->config('user') ); >- $session->param( 'firstname', C4::Context->config('user') ); >- $session->param( 'surname', C4::Context->config('user') ); >- $session->param( 'branch', 'NO_LIBRARY_SET' ); >- $session->param( 'branchname', 'NO_LIBRARY_SET' ); >- $session->param( 'flags', 1 ); >- $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); >- $session->param( 'ip', $session->remote_addr() ); >- $session->param( 'lasttime', time() ); > } > $session->param( 'cas_ticket', $cas_ticket); > C4::Context->set_userenv( >@@ -1805,7 +1773,6 @@ sub checkpw { > # 1 if auth is ok > # 0 if auth is nok > # -1 if user bind failed (LDAP only) >- # 2 if DB user is used (internal only) > > if ( $patron and $patron->account_locked ) { > # Nothing to check, account is locked >@@ -1878,18 +1845,6 @@ sub checkpw_internal { > $password = Encode::encode( 'UTF-8', $password ) > if Encode::is_utf8($password); > >- if ( $userid && $userid eq C4::Context->config('user') ) { >- if ( $password && $password eq C4::Context->config('pass') ) { >- >- # Koha superuser account >- # C4::Context->set_userenv(0,0,C4::Context->config('user'),C4::Context->config('user'),C4::Context->config('user'),"",1); >- return 2; >- } >- else { >- return 0; >- } >- } >- > my $sth = > $dbh->prepare( > "select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where userid=?" >diff --git a/acqui/neworderempty.pl b/acqui/neworderempty.pl >index 680be6ab45..372fe202e5 100755 >--- a/acqui/neworderempty.pl >+++ b/acqui/neworderempty.pl >@@ -203,6 +203,9 @@ else { #modify order > my $order_patron = Koha::Patrons->find( $order_user_id ); > push @order_users, $order_patron if $order_patron; > } >+ if ( $data->{subscriptionid} ) { >+ $template->param( subscriptionid => $data->{subscriptionid} ); >+ } > } > > my $suggestion; >diff --git a/members/member-flags.pl b/members/member-flags.pl >index 6f9780e161..14fb50a183 100755 >--- a/members/member-flags.pl >+++ b/members/member-flags.pl >@@ -44,11 +44,8 @@ my ($template, $loggedinuser, $cookie) = get_template_and_user({ > debug => 1, > }); > >-my $userenv = C4::Context->userenv; >-if ( $userenv and $userenv->{number} ) { # Allow DB user to create a superlibrarian patron >- my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >- output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my %member2; > $member2{'borrowernumber'}=$member; >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 94e371ff85..9beff5ad6a 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -152,10 +152,8 @@ $template->param( "quickadd" => 1 ) if ( $quickadd ); > $template->param( "duplicate" => 1 ) if ( $op eq 'duplicate' ); > $template->param( "checked" => 1 ) if ( defined($nodouble) && $nodouble eq 1 ); > if ( $op eq 'modify' or $op eq 'save' or $op eq 'duplicate' ) { >- if ( $patron and $userenv and $userenv->{number} ) { # Allow DB user to create a superlibrarian patron >- my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >- output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >- } >+ my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > $borrower_data = $patron->unblessed; > $borrower_data->{category_type} = $patron->category->category_type; >diff --git a/members/moremember.pl b/members/moremember.pl >index 0f7eddd428..b88b4eeacf 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -122,11 +122,8 @@ my $error = $input->param('error'); > $template->param( error => $error ) if ( $error ); > > my $patron = Koha::Patrons->find( $borrowernumber ); >-my $userenv = C4::Context->userenv; >-if ( $userenv and $userenv->{number} ) { # Allow DB user to create a superlibrarian patron >- my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >- output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); >-} >+my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; >+output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > my $issues = $patron->checkouts; > my $balance = $patron->account->balance; >@@ -206,6 +203,7 @@ if ( C4::Context->preference("IndependentBranches") ) { > $samebranch = 1; > } > else { >+ my $userenv = C4::Context->userenv; > $samebranch = ( $data->{'branchcode'} eq $userenv->{branch} ); > } > } >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index f1d1ddd702..c08060e93c 100644 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -62,7 +62,7 @@ subtest 'checkauth() tests' => sub { > else { return; } > }); > ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, $authnotrequired ); >- is ( $userid, $db_user_id, 'If DB user is logging in, it should be considered as logged in, i.e. checkauth return the relevant userid' ); >+ is ( $userid, undef, 'If DB user is used, it should not be logged in' ); > C4::Context->_new_userenv; # For next tests > > }; >-- >2.11.0
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=73400">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 20489
:
73400
|
73402
|
73425
|
73528
|
73529
|
73543
|
73544
|
74150
|
74151