Bugzilla – Attachment 86385 Details for
Bug 22483
haspermissions previously supported passing 'undef' for $flagsrequired
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22483: (QA follow-up) Corrections to logic in check_cookie_auth
Bug-22483-QA-follow-up-Corrections-to-logic-in-che.patch (text/plain), 2.46 KB, created by
Martin Renvoize (ashimema)
on 2019-03-08 14:22:27 UTC
(
hide
)
Description:
Bug 22483: (QA follow-up) Corrections to logic in check_cookie_auth
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2019-03-08 14:22:27 UTC
Size:
2.46 KB
patch
obsolete
>From 9dd445a53a5419f757d4f4f2a6789c858b6ea3d2 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Fri, 8 Mar 2019 14:20:41 +0000 >Subject: [PATCH] Bug 22483: (QA follow-up) Corrections to logic in > check_cookie_auth > >check_cookie_auth needs to allow for cases where we wish to check for >ANY permission and cases where we wish to skip the permissions check >entirely and just authenticate the session. > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/Auth.pm | 8 ++++++-- > Koha/REST/V1/Auth.pm | 2 +- > 2 files changed, 7 insertions(+), 3 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 963584a185..7629e9b187 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1606,7 +1606,11 @@ sub check_api_auth { > ($status, $sessionId) = check_api_auth($cookie, $userflags); > > Given a CGISESSID cookie set during a previous login to Koha, determine >-if the user has the privileges specified by C<$userflags>. >+if the user has the privileges specified by C<$userflags>. C<$userflags> >+is passed unaltered into C<haspermission> and as such accepts all options >+avaiable to that routine with the one caveat that C<check_api_auth> will >+also allow 'undef' to be passed and in such a case the permissions check >+will be skipped altogether. > > C<check_cookie_auth> is meant for authenticating special services > such as tools/upload-file.pl that are invoked by other pages that >@@ -1701,7 +1705,7 @@ sub check_cookie_auth { > return ( "expired", undef ); > } else { > $session->param( 'lasttime', time() ); >- my $flags = haspermission( $userid, $flagsrequired ); >+ my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; > if ($flags) { > return ( "ok", $sessionID ); > } else { >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 71ef60a277..92cafc22f2 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -189,7 +189,7 @@ sub authenticate_api_request { > # Manually pass the remote_address to check_auth_cookie > my $remote_addr = $c->tx->remote_address; > my ($status, $sessionID) = check_cookie_auth( >- $cookie, '*', >+ $cookie, undef, > { remote_addr => $remote_addr }); > if ($status eq "ok") { > my $session = get_session($sessionID); >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22483
:
86379
|
86380
|
86385
|
86386
|
86388
|
86389
|
86390
|
86391
|
86392
|
86393
|
86394
|
86395
|
86407
|
86408
|
86409
|
86410