From e84125f65ef5882ce3225eceb959b51a50deaa96 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Thu, 22 Jul 2021 06:34:20 +0000
Subject: [PATCH] Bug 28735: Self-checkout users can access opac-user.pl for
 sco user when not using AutoSelfCheckID

This patch makes the sandboxing of the selfcheckout more robust by
adding a "sco_user" session variable which is turned on when
logging into the self-checkout (either by AutoSelfCheckAllowed or manually).

If a user with this session variable turned on tries to access
other parts of the system (like the rest of the OPAC), it will
"kick out", so that the browser user will lose the authenticated session.

Test plan:
1) Apply the patch
2) koha-plack --restart kohadev
3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
4) Note that you are logged into the self-checkout
5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
6) Note that you are not logged into the OPAC
7) Log into the staff interface and disable the
system preference AutoSelfCheckAllowed
8) Log out of the staff interface (this step is very important)
9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
10) Note that you are prompted to log into Koha
11) Login using the "koha" user (when using koha-testing-docker)
12) Note that you are logged into the self-checkout
13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
14) Note that you are not logged into the OPAC
15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
16) Note that you will need to log in again as you've lost your
session cookie

Voila!
---
 C4/Auth.pm | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index fd327bf618..65579d961b 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -196,14 +196,20 @@ sub get_template_and_user {
     }
 
     if ( $in->{type} eq 'opac' && $user ) {
+        my $is_sco_user;
+        if ($sessionID){
+            my $session = get_session($sessionID);
+            if ($session){
+                $is_sco_user = $session->param('sco_user');
+            }
+        }
         my $kick_out;
 
         if (
 # If the user logged in is the SCO user and they try to go out of the SCO module,
 # log the user out removing the CGISESSID cookie
             $in->{template_name} !~ m|sco/| && $in->{template_name} !~ m|errors/errorpage.tt|
-            && C4::Context->preference('AutoSelfCheckID')
-            && $user eq C4::Context->preference('AutoSelfCheckID')
+            && $is_sco_user
           )
         {
             $kick_out = 1;
@@ -1204,6 +1210,12 @@ sub checkauth {
                             $branchname    = $branches->{$br}->{'branchname'};
                         }
                     }
+
+                    my $is_sco_user = 0;
+                    if ( $query->param('sco_user_login') && ( $query->param('sco_user_login') eq '1' ) ){
+                        $is_sco_user = 1;
+                    }
+
                     $session->param( 'number',       $borrowernumber );
                     $session->param( 'id',           $userid );
                     $session->param( 'cardnumber',   $cardnumber );
@@ -1221,6 +1233,7 @@ sub checkauth {
                     $session->param( 'shibboleth',   $shibSuccess );
                     $session->param( 'register_id',  $register_id );
                     $session->param( 'register_name',  $register_name );
+                    $session->param( 'sco_user', $is_sco_user );
                 }
                 $session->param('cas_ticket', $cas_ticket) if $cas_ticket;
                 C4::Context->set_userenv(
-- 
2.11.0