View | Details | Raw Unified | Return to bug 28785
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-2 / +1 lines)
Lines 216-226 sub authenticate_api_request { Link Here
216
        # Mojo doesn't use %ENV the way CGI apps do
216
        # Mojo doesn't use %ENV the way CGI apps do
217
        # Manually pass the remote_address to check_auth_cookie
217
        # Manually pass the remote_address to check_auth_cookie
218
        my $remote_addr = $c->tx->remote_address;
218
        my $remote_addr = $c->tx->remote_address;
219
        my ($status, $sessionID) = check_cookie_auth(
219
        my ($status, $session) = check_cookie_auth(
220
                                                $cookie, undef,
220
                                                $cookie, undef,
221
                                                { remote_addr => $remote_addr });
221
                                                { remote_addr => $remote_addr });
222
        if ($status eq "ok") {
222
        if ($status eq "ok") {
223
            my $session = get_session($sessionID);
224
            $user = Koha::Patrons->find( $session->param('number') )
223
            $user = Koha::Patrons->find( $session->param('number') )
225
              unless $session->param('sessiontype')
224
              unless $session->param('sessiontype')
226
                 and $session->param('sessiontype') eq 'anon';
225
                 and $session->param('sessiontype') eq 'anon';
(-)a/admin/import_export_framework.pl (-2 / +2 lines)
Lines 27-35 use C4::ImportExportFramework qw( createODS ExportFramework ImportFramework ); Link Here
27
27
28
my %cookies = CGI::Cookie->fetch();
28
my %cookies = CGI::Cookie->fetch();
29
my $authenticated = 0;
29
my $authenticated = 0;
30
my ($auth_status, $sessionID);
30
my ($auth_status);
31
if (exists $cookies{'CGISESSID'}) {
31
if (exists $cookies{'CGISESSID'}) {
32
    ($auth_status, $sessionID) = check_cookie_auth(
32
    ($auth_status, undef) = check_cookie_auth(
33
        $cookies{'CGISESSID'}->value,
33
        $cookies{'CGISESSID'}->value,
34
        { parameters => 'manage_marc_frameworks' },
34
        { parameters => 'manage_marc_frameworks' },
35
    );
35
    );
(-)a/authorities/merge_ajax.pl (-1 / +1 lines)
Lines 11-17 use C4::Auth qw( check_cookie_auth ); Link Here
11
use C4::AuthoritiesMarc qw( GetTagsLabels );
11
use C4::AuthoritiesMarc qw( GetTagsLabels );
12
12
13
my %cookies = CGI::Cookie->fetch;
13
my %cookies = CGI::Cookie->fetch;
14
my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' });
14
my ($auth_status) = check_cookie_auth($cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' });
15
my $reply = CGI->new;
15
my $reply = CGI->new;
16
if ($auth_status ne "ok") {
16
if ($auth_status ne "ok") {
17
    print $reply->header(-type => 'text/html');
17
    print $reply->header(-type => 'text/html');
(-)a/authorities/ysearch.pl (-1 / +1 lines)
Lines 40-46 use Koha::SearchEngine::QueryBuilder; Link Here
40
40
41
my $query = CGI->new;
41
my $query = CGI->new;
42
42
43
my ( $auth_status, $sessionID ) = check_cookie_auth( $query->cookie('CGISESSID'), { catalogue => 1 } );
43
my ( $auth_status) = check_cookie_auth( $query->cookie('CGISESSID'), { catalogue => 1 } );
44
44
45
if ( $auth_status ne "ok" ) {
45
if ( $auth_status ne "ok" ) {
46
    # send empty response
46
    # send empty response
(-)a/cataloguing/merge_ajax.pl (-1 / +1 lines)
Lines 11-17 use C4::Biblio qw( GetMarcStructure ); Link Here
11
use C4::Auth qw( check_cookie_auth );
11
use C4::Auth qw( check_cookie_auth );
12
12
13
my %cookies = CGI::Cookie->fetch;
13
my %cookies = CGI::Cookie->fetch;
14
my ( $auth_status, $sessionID ) = check_cookie_auth(
14
my ( $auth_status ) = check_cookie_auth(
15
    $cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' },
15
    $cookies{'CGISESSID'}->value, { editcatalogue => 'edit_catalogue' },
16
);
16
);
17
my $reply = CGI->new;
17
my $reply = CGI->new;
(-)a/cataloguing/ysearch.pl (-1 / +1 lines)
Lines 42-48 die() unless ($table eq "biblioitems"); Link Here
42
binmode STDOUT, ":encoding(UTF-8)";
42
binmode STDOUT, ":encoding(UTF-8)";
43
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
43
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
44
44
45
my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'), { editcatalogue => '*' } );
45
my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { editcatalogue => '*' } );
46
if ( $auth_status ne "ok" ) {
46
if ( $auth_status ne "ok" ) {
47
    exit 0;
47
    exit 0;
48
}
48
}
(-)a/circ/ysearch.pl (-1 / +1 lines)
Lines 39-45 my $query = $input->param('term'); Link Here
39
binmode STDOUT, ":encoding(UTF-8)";
39
binmode STDOUT, ":encoding(UTF-8)";
40
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
40
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
41
41
42
my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '1' } );
42
my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '1' } );
43
if ( $auth_status ne "ok" ) {
43
if ( $auth_status ne "ok" ) {
44
    exit 0;
44
    exit 0;
45
}
45
}
(-)a/offline_circ/service.pl (-1 / +1 lines)
Lines 34-40 my $nocookie = $cgi->param('nocookie') || 0; Link Here
34
34
35
# get the status of the user, this will check his credentials and rights
35
# get the status of the user, this will check his credentials and rights
36
my ($status, $cookie, $sessionId) = C4::Auth::check_api_auth($cgi, undef);
36
my ($status, $cookie, $sessionId) = C4::Auth::check_api_auth($cgi, undef);
37
($status, $sessionId) = C4::Auth::check_cookie_auth($cgi, undef) if ($status ne 'ok' && !$nocookie);
37
($status) = C4::Auth::check_cookie_auth($cgi, undef) if ($status ne 'ok' && !$nocookie);
38
38
39
my $result;
39
my $result;
40
40
(-)a/opac/opac-patron-image.pl (-1 / +1 lines)
Lines 35-41 unless (C4::Context->preference('OPACpatronimages')) { Link Here
35
my $needed_flags;
35
my $needed_flags;
36
my %cookies = CGI::Cookie->fetch;
36
my %cookies = CGI::Cookie->fetch;
37
my $sessid = $cookies{'CGISESSID'}->value;
37
my $sessid = $cookies{'CGISESSID'}->value;
38
my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags);
38
my ($auth_status) = check_cookie_auth($sessid, $needed_flags);
39
my $borrowernumber = C4::Context->userenv->{'number'};
39
my $borrowernumber = C4::Context->userenv->{'number'};
40
40
41
my $patron_image = Koha::Patron::Images->find($borrowernumber);
41
my $patron_image = Koha::Patron::Images->find($borrowernumber);
(-)a/opac/opac-ratings-ajax.pl (-1 / +1 lines)
Lines 110-116 sub ajax_auth_cgi { Link Here
110
    my %cookies      = CGI::Cookie->fetch;
110
    my %cookies      = CGI::Cookie->fetch;
111
    my $input        = CGI->new;
111
    my $input        = CGI->new;
112
    my $sessid = $cookies{'CGISESSID'}->value || $input->param('CGISESSID');
112
    my $sessid = $cookies{'CGISESSID'}->value || $input->param('CGISESSID');
113
    my ( $auth_status, $auth_sessid ) =
113
    my ( $auth_status ) =
114
      check_cookie_auth( $sessid, $needed_flags );
114
      check_cookie_auth( $sessid, $needed_flags );
115
    return $input, $auth_status;
115
    return $input, $auth_status;
116
}
116
}
(-)a/opac/opac-tags.pl (-1 / +1 lines)
Lines 69-75 sub ajax_auth_cgi { # returns CGI object Link Here
69
    my %cookies = CGI::Cookie->fetch;
69
    my %cookies = CGI::Cookie->fetch;
70
	my $input = CGI->new;
70
	my $input = CGI->new;
71
    my $sessid = $cookies{'CGISESSID'}->value;
71
    my $sessid = $cookies{'CGISESSID'}->value;
72
	my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags);
72
	my ($auth_status) = check_cookie_auth($sessid, $needed_flags);
73
	if ($auth_status ne "ok") {
73
	if ($auth_status ne "ok") {
74
		output_with_http_headers $input, undef,
74
		output_with_http_headers $input, undef,
75
		"window.alert('Your CGI session cookie ($sessid) is not current.  " .
75
		"window.alert('Your CGI session cookie ($sessid) is not current.  " .
(-)a/opac/svc/checkout_notes (-1 / +1 lines)
Lines 43-49 svc/checkout_notes - Web service for setting patron notes on items Link Here
43
# AJAX requests
43
# AJAX requests
44
my $is_ajax = is_ajax();
44
my $is_ajax = is_ajax();
45
my $query = CGI->new;
45
my $query = CGI->new;
46
my ( $auth_status, $sessionID ) = check_cookie_auth( $query->cookie('CGISESSID'), {} );
46
my ( $auth_status ) = check_cookie_auth( $query->cookie('CGISESSID'), {} );
47
if ( $auth_status ne "ok" ) {
47
if ( $auth_status ne "ok" ) {
48
    exit 0;
48
    exit 0;
49
}
49
}
(-)a/opac/svc/club/cancel_enrollment (-1 / +1 lines)
Lines 28-34 use Koha::Club::Enrollments; Link Here
28
28
29
my $cgi = CGI->new;
29
my $cgi = CGI->new;
30
30
31
my ( $auth_status, $sessionID ) =
31
my ( $auth_status ) =
32
  check_cookie_auth( $cgi->cookie('CGISESSID') );
32
  check_cookie_auth( $cgi->cookie('CGISESSID') );
33
if ( $auth_status ne "ok" ) {
33
if ( $auth_status ne "ok" ) {
34
    exit 0;
34
    exit 0;
(-)a/opac/svc/club/enroll (-1 / +1 lines)
Lines 30-36 use Koha::Clubs; Link Here
30
30
31
my $cgi = CGI->new;
31
my $cgi = CGI->new;
32
32
33
my ( $auth_status, $sessionID ) =
33
my ( $auth_status ) =
34
  check_cookie_auth( $cgi->cookie('CGISESSID') );
34
  check_cookie_auth( $cgi->cookie('CGISESSID') );
35
if ( $auth_status ne "ok" ) {
35
if ( $auth_status ne "ok" ) {
36
    exit 0;
36
    exit 0;
(-)a/plugins/plugins-enable.pl (-1 / +1 lines)
Lines 27-33 die("Koha plugins are disabled!") unless C4::Context->config("enable_plugins"); Link Here
27
27
28
my $input = CGI->new;
28
my $input = CGI->new;
29
29
30
my ( $auth_status, $sessionID ) =
30
my ( $auth_status ) =
31
  check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } );
31
  check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } );
32
32
33
my $class = $input->param('class');
33
my $class = $input->param('class');
(-)a/serials/create-numberpattern.pl (-1 / +1 lines)
Lines 28-34 use C4::Auth qw( check_cookie_auth ); Link Here
28
28
29
my $input = CGI->new;
29
my $input = CGI->new;
30
30
31
my ($auth_status, $sessionID) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' });
31
my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' });
32
if ($auth_status ne "ok") {
32
if ($auth_status ne "ok") {
33
    print $input->header(-type => 'text/plain', -status => '403 Forbidden');
33
    print $input->header(-type => 'text/plain', -status => '403 Forbidden');
34
    exit 0;
34
    exit 0;
(-)a/serials/subscription-frequency.pl (-1 / +1 lines)
Lines 26-32 use JSON qw( to_json ); Link Here
26
26
27
my $input=CGI->new;
27
my $input=CGI->new;
28
my $frqid=$input->param("frequency_id");
28
my $frqid=$input->param("frequency_id");
29
my ($auth_status, $sessionID) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' });
29
my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' });
30
if ($auth_status ne "ok") {
30
if ($auth_status ne "ok") {
31
    exit 0;
31
    exit 0;
32
}
32
}
(-)a/serials/subscription-numberpattern.pl (-1 / +1 lines)
Lines 25-31 use JSON qw( to_json ); Link Here
25
25
26
my $input=CGI->new;
26
my $input=CGI->new;
27
27
28
my ($auth_status, $sessionID) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' });
28
my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' });
29
if ($auth_status ne "ok") {
29
if ($auth_status ne "ok") {
30
    print $input->header(-type => 'text/plain', -status => '403 Forbidden');
30
    print $input->header(-type => 'text/plain', -status => '403 Forbidden');
31
    exit 0;
31
    exit 0;
(-)a/svc/article_request (-1 / +1 lines)
Lines 28-34 use Koha::ArticleRequests; Link Here
28
28
29
my $cgi = CGI->new;
29
my $cgi = CGI->new;
30
30
31
my ( $auth_status, $sessionID ) =
31
my ( $auth_status ) =
32
  check_cookie_auth( $cgi->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
32
  check_cookie_auth( $cgi->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
33
if ( $auth_status ne "ok" ) {
33
if ( $auth_status ne "ok" ) {
34
    exit 0;
34
    exit 0;
(-)a/svc/authorised_values (-1 lines)
Lines 22-28 use Modern::Perl; Link Here
22
use JSON qw( to_json );
22
use JSON qw( to_json );
23
use CGI;
23
use CGI;
24
use C4::Service;
24
use C4::Service;
25
use C4::Auth qw( check_cookie_auth );
26
use Koha::AuthorisedValues;
25
use Koha::AuthorisedValues;
27
26
28
=head1 NAME
27
=head1 NAME
(-)a/svc/barcode (-1 / +1 lines)
Lines 91-97 below the scannable barcode. Link Here
91
91
92
my $input = CGI->new;
92
my $input = CGI->new;
93
93
94
my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } );
94
my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } );
95
95
96
if ( $auth_status ne "ok" ) {
96
if ( $auth_status ne "ok" ) {
97
    exit 0;
97
    exit 0;
(-)a/svc/cataloguing/automatic_linker.pl (-1 / +1 lines)
Lines 28-34 my $input = CGI->new; Link Here
28
print $input->header('application/json');
28
print $input->header('application/json');
29
29
30
# Check the user's permissions
30
# Check the user's permissions
31
my ( $auth_status, $auth_sessid ) =
31
my ( $auth_status ) =
32
  C4::Auth::check_cookie_auth( $input->cookie('CGISESSID'), { editauthorities => 1, editcatalogue => 1 } );
32
  C4::Auth::check_cookie_auth( $input->cookie('CGISESSID'), { editauthorities => 1, editcatalogue => 1 } );
33
if ( $auth_status ne "ok" ) {
33
if ( $auth_status ne "ok" ) {
34
    print to_json( { status => 'UNAUTHORIZED' } );
34
    print to_json( { status => 'UNAUTHORIZED' } );
(-)a/svc/checkin (-1 / +1 lines)
Lines 31-37 use Koha::Items; Link Here
31
31
32
my $input = CGI->new;
32
my $input = CGI->new;
33
33
34
my ( $auth_status, $sessionID ) =
34
my ( $auth_status ) =
35
  check_cookie_auth( $input->cookie('CGISESSID'),
35
  check_cookie_auth( $input->cookie('CGISESSID'),
36
    { circulate => 'circulate_remaining_permissions' } );
36
    { circulate => 'circulate_remaining_permissions' } );
37
37
(-)a/svc/checkout_notes (-1 / +1 lines)
Lines 37-43 svc/checkout_notes - Web service for managing patron notes set on issues Link Here
37
# AJAX requests
37
# AJAX requests
38
my $is_ajax = is_ajax();
38
my $is_ajax = is_ajax();
39
my $query = CGI->new;
39
my $query = CGI->new;
40
my ( $auth_status, $sessionID ) = check_cookie_auth( $query->cookie('CGISESSID'), { circulate => 'manage_checkout_notes' } );
40
my ( $auth_status ) = check_cookie_auth( $query->cookie('CGISESSID'), { circulate => 'manage_checkout_notes' } );
41
if ( $auth_status ne "ok" ) {
41
if ( $auth_status ne "ok" ) {
42
    exit 0;
42
    exit 0;
43
}
43
}
(-)a/svc/checkouts (-3 / +2 lines)
Lines 22-28 use Modern::Perl; Link Here
22
use CGI;
22
use CGI;
23
use JSON qw(to_json);
23
use JSON qw(to_json);
24
24
25
use C4::Auth qw(check_cookie_auth haspermission get_session);
25
use C4::Auth qw(check_cookie_auth haspermission);
26
use C4::Circulation qw(GetIssuingCharges CanBookBeRenewed GetRenewCount GetSoonestRenewDate);
26
use C4::Circulation qw(GetIssuingCharges CanBookBeRenewed GetRenewCount GetSoonestRenewDate);
27
use C4::Overdues qw(GetFine);
27
use C4::Overdues qw(GetFine);
28
use C4::Context;
28
use C4::Context;
Lines 33-42 use Koha::ItemTypes; Link Here
33
33
34
my $input = CGI->new;
34
my $input = CGI->new;
35
35
36
my ( $auth_status, $sessionID ) =
36
my ( $auth_status, $session ) =
37
  check_cookie_auth( $input->cookie('CGISESSID'));
37
  check_cookie_auth( $input->cookie('CGISESSID'));
38
38
39
my $session   = get_session($sessionID);
40
my $userid   = $session->param('id');
39
my $userid   = $session->param('id');
41
40
42
unless (haspermission($userid, { circulate => 'circulate_remaining_permissions' })
41
unless (haspermission($userid, { circulate => 'circulate_remaining_permissions' })
(-)a/svc/club/cancel_enrollment (-1 / +1 lines)
Lines 29-35 use Koha::Club::Enrollments; Link Here
29
29
30
my $cgi = CGI->new;
30
my $cgi = CGI->new;
31
31
32
my ( $auth_status, $sessionID ) =
32
my ( $auth_status ) =
33
  check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
33
  check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
34
if ( $auth_status ne "ok" ) {
34
if ( $auth_status ne "ok" ) {
35
    exit 0;
35
    exit 0;
(-)a/svc/club/delete (-1 / +1 lines)
Lines 28-34 use Koha::Clubs; Link Here
28
28
29
my $cgi = CGI->new;
29
my $cgi = CGI->new;
30
30
31
my ( $auth_status, $sessionID ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'edit_clubs' } );
31
my ( $auth_status ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'edit_clubs' } );
32
if ( $auth_status ne "ok" ) {
32
if ( $auth_status ne "ok" ) {
33
    exit 0;
33
    exit 0;
34
}
34
}
(-)a/svc/club/enroll (-1 / +1 lines)
Lines 30-36 use Koha::Clubs; Link Here
30
30
31
my $cgi = CGI->new;
31
my $cgi = CGI->new;
32
32
33
my ( $auth_status, $sessionID ) =
33
my ( $auth_status ) =
34
  check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
34
  check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
35
if ( $auth_status ne "ok" ) {
35
if ( $auth_status ne "ok" ) {
36
    exit 0;
36
    exit 0;
(-)a/svc/club/template/delete (-1 / +1 lines)
Lines 29-35 use Koha::Club::Templates; Link Here
29
29
30
my $cgi = CGI->new;
30
my $cgi = CGI->new;
31
31
32
my ( $auth_status, $sessionID ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'edit_templates' } );
32
my ( $auth_status ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'edit_templates' } );
33
if ( $auth_status ne "ok" ) {
33
if ( $auth_status ne "ok" ) {
34
    exit 0;
34
    exit 0;
35
}
35
}
(-)a/svc/cover_images (-1 / +1 lines)
Lines 27-33 use JSON qw/to_json/; Link Here
27
27
28
my $input = CGI->new;
28
my $input = CGI->new;
29
29
30
my ( $auth_status, $sessionID ) =
30
my ( $auth_status ) =
31
        check_cookie_auth(
31
        check_cookie_auth(
32
            $input->cookie('CGISESSID'),
32
            $input->cookie('CGISESSID'),
33
            { tools => 'upload_local_cover_images' } );
33
            { tools => 'upload_local_cover_images' } );
(-)a/svc/creator_batches (-1 / +1 lines)
Lines 39-45 svc/creator_batches - Web service for managing AJAX functionality for patroncard Link Here
39
# AJAX requests
39
# AJAX requests
40
my $is_ajax = is_ajax();
40
my $is_ajax = is_ajax();
41
my $cgi = CGI->new;
41
my $cgi = CGI->new;
42
my ( $auth_status, $sessionID ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } );
42
my ( $auth_status ) = check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } );
43
if ( $auth_status ne "ok" ) {
43
if ( $auth_status ne "ok" ) {
44
    exit 0;
44
    exit 0;
45
}
45
}
(-)a/svc/hold/resume (-1 / +1 lines)
Lines 30-36 use Koha::Holds; Link Here
30
30
31
my $input = CGI->new;
31
my $input = CGI->new;
32
32
33
my ( $auth_status, $sessionID ) =
33
my ( $auth_status ) =
34
  check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
34
  check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
35
35
36
if ( $auth_status ne "ok" ) {
36
if ( $auth_status ne "ok" ) {
(-)a/svc/hold/suspend (-1 / +1 lines)
Lines 30-36 use Koha::Holds; Link Here
30
30
31
my $input = CGI->new;
31
my $input = CGI->new;
32
32
33
my ( $auth_status, $sessionID ) =
33
my ( $auth_status ) =
34
  check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
34
  check_cookie_auth( $input->cookie('CGISESSID'), { circulate => 'circulate_remaining_permissions' } );
35
35
36
if ( $auth_status ne "ok" ) {
36
if ( $auth_status ne "ok" ) {
(-)a/svc/holds (-1 / +1 lines)
Lines 34-40 use Koha::Libraries; Link Here
34
34
35
my $input = CGI->new;
35
my $input = CGI->new;
36
36
37
my ( $auth_status, $sessionID ) =
37
my ( $auth_status ) =
38
  check_cookie_auth( $input->cookie('CGISESSID'),
38
  check_cookie_auth( $input->cookie('CGISESSID'),
39
    { circulate => 'circulate_remaining_permissions' } );
39
    { circulate => 'circulate_remaining_permissions' } );
40
40
(-)a/svc/mana/increment (-1 / +1 lines)
Lines 31-37 my $input = CGI->new; Link Here
31
binmode STDOUT, ":encoding(UTF-8)";
31
binmode STDOUT, ":encoding(UTF-8)";
32
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
32
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
33
33
34
my ( $auth_status, $sessionID ) =
34
my ( $auth_status ) =
35
  check_cookie_auth( $input->cookie('CGISESSID'),
35
  check_cookie_auth( $input->cookie('CGISESSID'),
36
    { serials => 'create_subscription' } );
36
    { serials => 'create_subscription' } );
37
37
(-)a/svc/mana/search (-1 / +1 lines)
Lines 22-28 use Modern::Perl; Link Here
22
22
23
use Koha::SharedContent;
23
use Koha::SharedContent;
24
use Koha::Subscription;
24
use Koha::Subscription;
25
use C4::Auth qw(check_cookie_auth), qw(get_template_and_user);
25
use C4::Auth qw(get_template_and_user);
26
use C4::Output qw( output_html_with_http_headers );
26
use C4::Output qw( output_html_with_http_headers );
27
27
28
use CGI;
28
use CGI;
(-)a/svc/mana/share (-1 / +1 lines)
Lines 30-36 my $input = CGI->new; Link Here
30
binmode STDOUT, ":encoding(UTF-8)";
30
binmode STDOUT, ":encoding(UTF-8)";
31
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
31
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
32
32
33
my ( $auth_status, $sessionID ) =
33
my ( $auth_status ) =
34
  check_cookie_auth( $input->cookie('CGISESSID'),
34
  check_cookie_auth( $input->cookie('CGISESSID'),
35
    { serials => 'create_subscription' } );
35
    { serials => 'create_subscription' } );
36
36
(-)a/svc/mana/use (-1 / +1 lines)
Lines 32-38 my $input = CGI->new; Link Here
32
binmode STDOUT, ":encoding(UTF-8)";
32
binmode STDOUT, ":encoding(UTF-8)";
33
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
33
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
34
34
35
my ( $auth_status, $sessionID ) =
35
my ( $auth_status ) =
36
  check_cookie_auth( $input->cookie('CGISESSID'),
36
  check_cookie_auth( $input->cookie('CGISESSID'),
37
    { serials => 'create_subscription' } );
37
    { serials => 'create_subscription' } );
38
38
(-)a/svc/members/add_to_list (-1 / +1 lines)
Lines 26-32 use Koha::List::Patron qw( AddPatronList GetPatronLists AddPatronsToList ); Link Here
26
26
27
my $input = CGI->new;
27
my $input = CGI->new;
28
28
29
my ( $auth_status, $sessionID ) = check_cookie_auth(
29
my ( $auth_status ) = check_cookie_auth(
30
    $input->cookie('CGISESSID'),
30
    $input->cookie('CGISESSID'),
31
    { tools => 'manage_patron_lists' },
31
    { tools => 'manage_patron_lists' },
32
);
32
);
(-)a/svc/problem_reports (-1 / +1 lines)
Lines 37-43 svc/problem_reports - Web service for managing OPAC problem reports Link Here
37
# AJAX requests
37
# AJAX requests
38
my $is_ajax = is_ajax();
38
my $is_ajax = is_ajax();
39
my $query = CGI->new;
39
my $query = CGI->new;
40
my ( $auth_status, $sessionID ) = check_cookie_auth( $query->cookie('CGISESSID'), { problem_reports => 1 } );
40
my ( $auth_status ) = check_cookie_auth( $query->cookie('CGISESSID'), { problem_reports => 1 } );
41
if ( $auth_status ne "ok" ) {
41
if ( $auth_status ne "ok" ) {
42
    exit 0;
42
    exit 0;
43
}
43
}
(-)a/svc/renew (-1 / +1 lines)
Lines 31-37 use Koha::DateUtils qw(output_pref dt_from_string); Link Here
31
31
32
my $input = CGI->new;
32
my $input = CGI->new;
33
33
34
my ( $auth_status, $sessionID ) =
34
my ( $auth_status ) =
35
  check_cookie_auth( $input->cookie('CGISESSID'),
35
  check_cookie_auth( $input->cookie('CGISESSID'),
36
    { circulate => 'circulate_remaining_permissions' } );
36
    { circulate => 'circulate_remaining_permissions' } );
37
37
(-)a/svc/return_claims (-3 / +2 lines)
Lines 22-28 use Modern::Perl; Link Here
22
use CGI;
22
use CGI;
23
use JSON qw(to_json);
23
use JSON qw(to_json);
24
24
25
use C4::Auth qw(check_cookie_auth haspermission get_session);
25
use C4::Auth qw(check_cookie_auth haspermission);
26
use C4::Context;
26
use C4::Context;
27
27
28
use Koha::AuthorisedValues;
28
use Koha::AuthorisedValues;
Lines 31-40 use Koha::Patrons; Link Here
31
31
32
my $input = CGI->new;
32
my $input = CGI->new;
33
33
34
my ( $auth_status, $sessionID ) =
34
my ( $auth_status, $session ) =
35
  check_cookie_auth( $input->cookie('CGISESSID') );
35
  check_cookie_auth( $input->cookie('CGISESSID') );
36
36
37
my $session = get_session($sessionID);
38
my $userid  = $session->param('id');
37
my $userid  = $session->param('id');
39
38
40
unless (
39
unless (
(-)a/tags/review.pl (-1 / +1 lines)
Lines 44-50 sub ajax_auth_cgi { # returns CGI object Link Here
44
    my %cookies = CGI::Cookie->fetch;
44
    my %cookies = CGI::Cookie->fetch;
45
    my $input = CGI->new;
45
    my $input = CGI->new;
46
    my $sessid = $cookies{'CGISESSID'}->value;
46
    my $sessid = $cookies{'CGISESSID'}->value;
47
    my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags);
47
    my ($auth_status) = check_cookie_auth($sessid, $needed_flags);
48
    if ($auth_status ne "ok") {
48
    if ($auth_status ne "ok") {
49
        output_with_http_headers $input, undef,
49
        output_with_http_headers $input, undef,
50
            "window.alert('Your CGI session cookie ($sessid) is not current.  " .
50
            "window.alert('Your CGI session cookie ($sessid) is not current.  " .
(-)a/tools/background-job-progress.pl (-1 / +2 lines)
Lines 30-36 use CGI::Cookie; # need to check cookies before Link Here
30
30
31
my $input = CGI->new;
31
my $input = CGI->new;
32
my %cookies = CGI::Cookie->fetch;
32
my %cookies = CGI::Cookie->fetch;
33
my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { tools => '*' });
33
my ($auth_status, $session) = check_cookie_auth($cookies{'CGISESSID'}->value, { tools => '*' });
34
if ($auth_status ne "ok") {
34
if ($auth_status ne "ok") {
35
    my $reply = CGI->new("");
35
    my $reply = CGI->new("");
36
    print $reply->header(-type => 'text/html');
36
    print $reply->header(-type => 'text/html');
Lines 38-43 if ($auth_status ne "ok") { Link Here
38
    exit 0;
38
    exit 0;
39
}
39
}
40
40
41
my $sessionID = $session->id;
41
my $jobID = $input->param('jobID');
42
my $jobID = $input->param('jobID');
42
my $job = C4::BackgroundJob->fetch($sessionID, $jobID);
43
my $job = C4::BackgroundJob->fetch($sessionID, $jobID);
43
my $reported_progress = 0;
44
my $reported_progress = 0;
(-)a/tools/batch_records_ajax.pl (-1 / +1 lines)
Lines 54-60 $results_per_page = undef if $results_per_page && $results_per_page == -1; Link Here
54
binmode STDOUT, ":encoding(UTF-8)";
54
binmode STDOUT, ":encoding(UTF-8)";
55
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
55
print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
56
56
57
my ( $auth_status, $sessionID ) =
57
my ( $auth_status ) =
58
  check_cookie_auth( $input->cookie('CGISESSID'), { tools => 'manage_staged_marc' } );
58
  check_cookie_auth( $input->cookie('CGISESSID'), { tools => 'manage_staged_marc' } );
59
if ( $auth_status ne "ok" ) {
59
if ( $auth_status ne "ok" ) {
60
    exit 0;
60
    exit 0;
(-)a/tools/upload-file.pl (-2 / +1 lines)
Lines 39-45 use Koha::Uploader; Link Here
39
39
40
my %cookies = CGI::Cookie->fetch;
40
my %cookies = CGI::Cookie->fetch;
41
my $sid = $cookies{'CGISESSID'}->value;
41
my $sid = $cookies{'CGISESSID'}->value;
42
my ( $auth_status, $sessionID ) = check_cookie_auth( $sid );
42
my ( $auth_status ) = check_cookie_auth( $sid );
43
my $uid = C4::Auth::get_session($sid)->param('id');
43
my $uid = C4::Auth::get_session($sid)->param('id');
44
my $allowed = Koha::Uploader->allows_add_by( $uid );
44
my $allowed = Koha::Uploader->allows_add_by( $uid );
45
45
46
- 

Return to bug 28785