Bugzilla – Attachment 90811 Details for
Bug 23042
Local login attempt populates shibboleth url with userid and password in plain text
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23042: Correct shib param escaping
Bug-23042-Correct-shib-param-escaping.patch (text/plain), 4.71 KB, created by
Jonathan Druart
on 2019-06-19 17:13:49 UTC
(
hide
)
Description:
Bug 23042: Correct shib param escaping
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2019-06-19 17:13:49 UTC
Size:
4.71 KB
patch
obsolete
>From 4d105ed8af7a42df021414b16b7c4df580953b0b Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 19 Jun 2019 12:12:15 -0500 >Subject: [PATCH] Bug 23042: Correct shib param escaping > >--- > C4/Auth_with_shibboleth.pm | 4 ++-- > koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 2 +- > t/Auth_with_shibboleth.t | 11 +++++++---- > 5 files changed, 12 insertions(+), 9 deletions(-) > >diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm >index 54813ba6f6..94190b20b3 100644 >--- a/C4/Auth_with_shibboleth.pm >+++ b/C4/Auth_with_shibboleth.pm >@@ -201,12 +201,12 @@ sub _get_return { > if ($uriPiece) { > $uri_params_part .= '&' if $uri_params_part; > $uri_params_part .= $param . '='; >- $uri_params_part .= URI::Escape::uri_escape( $uriPiece ); >+ $uri_params_part .= $uriPiece; > } > } > $uri_base_part .= '%3F' if $uri_params_part; > >- return $uri_base_part . $uri_params_part; >+ return $uri_base_part . URI::Escape::uri_escape_utf8($uri_params_part); > } > > sub _get_shib_config { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index b46a5425f5..4d73d26355 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -55,7 +55,7 @@ > [% IF (invalidShibLogin ) %] > <div id="login_error"><Strong>Error: </strong>Shibboleth login failed</div> > [% END %] >-<p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl | url %]">click here</a> to login.</p> >+<p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl | $raw %]">click here</a> to login.</p> > [% END %] > > <!-- login prompt time--> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >index 184a60527d..df6a36af47 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >@@ -318,7 +318,7 @@ > </div> > [% ELSE %] > <h4>Shibboleth login</h4> >- <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl | url %]">click here to login</a>.</p> >+ <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl | raw %]">click here to login</a>.</p> > <h4>Local Login</h4> > [% END %] > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 348a830ba5..ac4930fdf2 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -83,7 +83,7 @@ > </div> > [% ELSE %] > <h4>Shibboleth Login</h4> >- <p><a href="[% shibbolethLoginUrl | url %]">If you have a Shibboleth account, please click here to log in.</a></p> >+ <p><a href="[% shibbolethLoginUrl | $raw %]">If you have a Shibboleth account, please click here to log in.</a></p> > [% END %] > [% IF ( casAuthentication ) %] > <h4>CAS login</h4> >diff --git a/t/Auth_with_shibboleth.t b/t/Auth_with_shibboleth.t >index 73d1173b3d..44a30fe633 100644 >--- a/t/Auth_with_shibboleth.t >+++ b/t/Auth_with_shibboleth.t >@@ -24,7 +24,8 @@ use Test::MockModule; > use Test::Warn; > use File::Temp qw(tempdir); > >-use CGI; >+use utf8; >+use CGI qw(-utf8 ); > use C4::Context; > > BEGIN { >@@ -128,7 +129,9 @@ subtest "shib_ok tests" => sub { > subtest "login_shib_url tests" => sub { > plan tests => 2; > >- my $query_string = 'language=en-GB'; >+ my $string = 'language=en-GB¶m="hehâ¤"'; >+ my $query_string = Encode::encode('UTF-8', $string); >+ my $query_string_uri_escaped = URI::Escape::uri_escape_utf8('?'.$string); > > local $ENV{REQUEST_METHOD} = 'GET'; > local $ENV{QUERY_STRING} = $query_string; >@@ -138,8 +141,8 @@ subtest "login_shib_url tests" => sub { > login_shib_url($query), > 'https://testopac.com' > . '/Shibboleth.sso/Login?target=' >- . 'https://testopac.com/cgi-bin/koha/opac-user.pl' . '%3F' >- . $query_string, >+ . 'https://testopac.com/cgi-bin/koha/opac-user.pl' >+ . $query_string_uri_escaped, > "login shib url" > ); > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23042
:
90579
|
90636
|
90772
|
90773
|
90811
|
90814
|
90911
|
90912
|
90913
|
94404
|
94405
|
94406
|
94431
|
94432
|
94433