Bugzilla – Attachment 93592 Details for
Bug 22522
API authentication breaks with updated Mojolicious version
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22522 - Update API specs' access in Auth.pm
Bug-22522---Update-API-specs-access-in-Authpm.patch (text/plain), 1.95 KB, created by
Magnus Enger
on 2019-10-03 13:07:33 UTC
(
hide
)
Description:
Bug 22522 - Update API specs' access in Auth.pm
Filename:
MIME Type:
Creator:
Magnus Enger
Created:
2019-10-03 13:07:33 UTC
Size:
1.95 KB
patch
obsolete
>From d0d9163fc22ad53be21ad17ab328ebd3fd46ff7a Mon Sep 17 00:00:00 2001 >From: Jose-Mario Monteiro-Santos <jose-mario.monteiro-santos@inLibro.com> >Date: Tue, 19 Mar 2019 11:55:45 -0400 >Subject: [PATCH] Bug 22522 - Update API specs' access in Auth.pm > >With newer versions of Mojolicious and its plugins, endpoints' specs >could no longer be accessed, thus bypassing authorization checks >and failing to validate query parameters. > >Test plan: >1. Without being logged in to Koha, access an endpoint directly > (such as /api/v1/patrons/{patron_id}) >2. Notice results are received (which is bad since we're not authenticated) >3. Try again with an endpoint that accepts query parameters > (such as /api/v1/patrons?firstname=something) >4. Notice that the query is not accepted (even with correct parameters) > >5. Apply the patch > >6. Repeat step 1 >7. Notice that the access is denied >8. Login as a user with proper access rights >9. Repeat step 1 >10. Notice that you can now get results >11. Repeat step 3 >12. Notice that the query is now accepted >13. Repeat step 3 but with an absurd parameter >14. Notice the query is correctly rejected > >15. Ideally, check if other API calls were not broken > >Signed-off-by: Magnus Enger <magnus@libriotech.no> >Upgraded modules with: >$ sudo cpanm Mojolicious JSON::Validator Mojolicious::Plugin::OpenAPI@2.14 >Before the patch data is returned without being logged in. Not good! >After the patch: {"error":"Authentication failure."} >--- > Koha/REST/V1/Auth.pm | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 8bffc977da..0b00735869 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -136,7 +136,7 @@ sub authenticate_api_request { > > my $user; > >- my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; >+ my $spec = $c->openapi->spec; > my $authorization = $spec->{'x-koha-authorization'}; > > my $authorization_header = $c->req->headers->authorization; >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22522
:
86756
|
93592
|
98061
|
98089
|
98372
|
98557
|
98558
|
98559
|
98665
|
98666
|
98667
|
99181
|
99182
|
99183
|
105591
|
105639
|
105657
|
105658
|
105659
|
105692