Attachment 74088 Details for Bug 20402 – Bug 20402: Don't look at cookies if OAuth2 is attempted and has failed

[patch] Bug 20402: Don't look at cookies if OAuth2 is attempted and has failed

Bug-20402-Dont-look-at-cookies-if-OAuth2-is-attemp.patch (text/plain), 2.97 KB, created by Julian Maurice on 2018-04-12 12:51:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Julian Maurice

Created: 2018-04-12 12:51:32 UTC

Size: 2.97 KB

patch

obsolete

>From 804debf34a96faca1b77b50545f02a1fef53051f Mon Sep 17 00:00:00 2001
>From: Julian Maurice <julian.maurice@biblibre.com>
>Date: Thu, 12 Apr 2018 14:48:58 +0200
>Subject: [PATCH] Bug 20402: Don't look at cookies if OAuth2 is attempted and
> has failed
>
>---
> Koha/REST/V1/Auth.pm | 47 ++++++++++++++++++++++++++++-------------------
> 1 file changed, 28 insertions(+), 19 deletions(-)
>
>diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
>index 3ca43faadd..f9b885f491 100644
>--- a/Koha/REST/V1/Auth.pm
>+++ b/Koha/REST/V1/Auth.pm
>@@ -113,27 +113,36 @@ sub authenticate_api_request {
>     my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
>     my $authorization = $spec->{'x-koha-authorization'};
> 
>-    if (my $oauth = $c->oauth) {
>-        my $clients = C4::Context->config('api_client');
>-        $clients = [ $clients ] unless ref $clients eq 'ARRAY';
>-        my ($client) = grep { $_->{client_id} eq $oauth->{client_id} } @$clients;
>-
>-        my $patron = Koha::Patrons->find($client->{patron_id});
>-        my $permissions = $authorization->{'permissions'};
>-        # Check if the patron is authorized
>-        if ( haspermission($patron->userid, $permissions)
>-            or allow_owner($c, $authorization, $patron)
>-            or allow_guarantor($c, $authorization, $patron) ) {
>-
>-            validate_query_parameters( $c, $spec );
>-
>-            # Everything is ok
>-            return 1;
>+    my $authorization_header = $c->req->headers->authorization;
>+    if ($authorization_header and $authorization_header =~ /^Bearer /) {
>+        if (my $oauth = $c->oauth) {
>+            my $clients = C4::Context->config('api_client');
>+            $clients = [ $clients ] unless ref $clients eq 'ARRAY';
>+            my ($client) = grep { $_->{client_id} eq $oauth->{client_id} } @$clients;
>+
>+            my $patron = Koha::Patrons->find($client->{patron_id});
>+            my $permissions = $authorization->{'permissions'};
>+            # Check if the patron is authorized
>+            if ( haspermission($patron->userid, $permissions)
>+                or allow_owner($c, $authorization, $patron)
>+                or allow_guarantor($c, $authorization, $patron) ) {
>+
>+                validate_query_parameters( $c, $spec );
>+
>+                # Everything is ok
>+                return 1;
>+            }
>+
>+            Koha::Exceptions::Authorization::Unauthorized->throw(
>+                error => "Authorization failure. Missing required permission(s).",
>+                required_permissions => $permissions,
>+            );
>         }
> 
>-        Koha::Exceptions::Authorization::Unauthorized->throw(
>-            error => "Authorization failure. Missing required permission(s).",
>-            required_permissions => $permissions,
>+        # If we have "Authorization: Bearer" header and oauth authentication
>+        # failed, do not try other authentication means
>+        Koha::Exceptions::Authentication::Required->throw(
>+            error => 'Authentication failure.'
>         );
>     }
> 
>-- 
>2.14.2

Actions: View | Diff | Splinter Review

Attachments on bug 20402: 72865 | 72874 | 72886 | 72887 | 72888 | 72892 | 72893 | 72894 | 73086 | 73087 | 74009 | 74018 | 74050 | 74051 | 74069 | 74070 | 74088 | 74365 | 74366 | 74367 | 74368 | 74369 | 74380 | 74381 | 74382 | 74383 | 74384 | 74385 | 74386 | 74600 | 75026 | 75027 | 75028 | 75029 | 75030 | 75031 | 75032 | 75033 | 75189