From d46137d383b2c437a4d712d9d10cc5a3a5d23c57 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 20 Jan 2022 10:10:05 +0100 Subject: [PATCH] Bug 29914: Make check_cookie_auth compare the userid check_cookie_auth is assuming that the user is authenticated if a cookie exists and that the login/username exists in the DB. So basically if you hit the login page, fill the login input with a valid username, click "login" => A cookie will be generated, and the sessions table will contain a line with this session id. On the second hit, if the username is in the DB, it will be enough to be considered authenticated. --- C4/Auth.pm | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 1cfeed48cc4..6ba0fd56db6 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1700,17 +1700,16 @@ sub check_cookie_auth { $session->flush; C4::Context->_unset_userenv($sessionID); return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); - } else { + } elsif ( $session->param("id") eq $userid ) { $session->param( 'lasttime', time() ); my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; if ($flags) { return ( "ok", $session ); - } else { - $session->delete(); - $session->flush; - C4::Context->_unset_userenv($sessionID); - return ( "failed", undef ); } + $session->delete(); + $session->flush; + C4::Context->_unset_userenv($sessionID); + return ( "failed", undef ); } } else { return ( "expired", undef ); -- 2.25.1