View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/t/db_dependent/Auth.t (-4 / +119 lines)
Lines 10-20 use CGI qw ( -utf8 ); Link Here
10
use Test::MockObject;
10
use Test::MockObject;
11
use Test::MockModule;
11
use Test::MockModule;
12
use List::MoreUtils qw/all any none/;
12
use List::MoreUtils qw/all any none/;
13
use Test::More tests => 24;
13
use Test::More tests => 14;
14
use Test::Warn;
14
use Test::Warn;
15
use t::lib::Mocks;
15
use t::lib::Mocks;
16
use t::lib::TestBuilder;
16
use t::lib::TestBuilder;
17
17
18
use C4::Auth;
18
use C4::Members;
19
use C4::Members;
19
use Koha::AuthUtils qw/hash_password/;
20
use Koha::AuthUtils qw/hash_password/;
20
use Koha::Database;
21
use Koha::Database;
Lines 201-207 subtest 'checkpw lockout tests' => sub { Link Here
201
202
202
# get_template_and_user tests
203
# get_template_and_user tests
203
204
204
{   # Tests for the language URL parameter
205
subtest 'get_template_and_user' => sub {   # Tests for the language URL parameter
205
206
206
    sub MockedCheckauth {
207
    sub MockedCheckauth {
207
        my ($query,$authnotrequired,$flagsrequired,$type) = @_;
208
        my ($query,$authnotrequired,$flagsrequired,$type) = @_;
Lines 342-348 subtest 'checkpw lockout tests' => sub { Link Here
342
    );
343
    );
343
    is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly");
344
    is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly");
344
    is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly");
345
    is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly");
345
}
346
347
    delete $ENV{"HTTP_COOKIE"};
348
};
346
349
347
# Check that there is always an OPACBaseURL set.
350
# Check that there is always an OPACBaseURL set.
348
my $input = CGI->new();
351
my $input = CGI->new();
Lines 483-486 subtest 'check_cookie_auth' => sub { Link Here
483
    #FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission
486
    #FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission
484
};
487
};
485
488
489
subtest 'checkauth & check_cookie_auth' => sub {
490
    plan tests => 27;
491
492
    # flags = 4 => { catalogue => 1 }
493
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
494
    my $password = 'password';
495
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
496
    $patron->set_password( { password => $password } );
497
498
    my $cgi_mock = Test::MockModule->new('CGI');
499
    $cgi_mock->mock( 'request_method', sub { return 'POST' } );
500
501
    my $cgi = CGI->new;
502
503
    my $auth = Test::MockModule->new( 'C4::Auth' );
504
    # Tests will fail if we hit safe_exit
505
    $auth->mock( 'safe_exit', sub { return } );
506
507
    my ( $userid, $cookie, $sessionID, $flags );
508
    {
509
        # checkauth will redirect and safe_exit if not authenticated and not authorized
510
        local *STDOUT;
511
        my $stdout;
512
        open STDOUT, '>', \$stdout;
513
        C4::Auth::checkauth($cgi, 0, {catalogue => 1});
514
        like( $stdout, qr{<title>\s*Log in to your account} );
515
        $sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef;
516
        ok($sessionID);
517
        close STDOUT;
518
    };
519
520
    my $first_sessionID = $sessionID;
521
522
    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
523
    # Not authenticated yet, checkauth didn't return the session
524
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
525
    is( $sessionID, undef);
526
    is( $userid, undef);
527
528
    # Same here, check_cookie_auth does not return the session
529
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
530
    is( $auth_status, 'failed' );
531
    is( $session, undef );
532
533
    # Simulating the login form submission
534
    $cgi->param('userid', $patron->userid);
535
    $cgi->param('password', $password);
536
537
    # Logged in!
538
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
539
    is( $sessionID, $first_sessionID );
540
    is( $userid, $patron->userid );
541
542
    ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
543
    is( $auth_status, 'ok' );
544
    is( $session->id, $first_sessionID );
545
546
    # Logging out!
547
    $cgi->param('logout.x', 1);
548
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
549
    is( $sessionID, undef );
550
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
551
    ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1});
552
    is( $auth_status, "expired");
553
    is( $session, undef );
554
555
    {
556
        # Trying to access without sessionID
557
        undef $ENV{"HTTP_COOKIE"};
558
        $cgi = CGI->new;
559
        ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1});
560
        is( $auth_status, 'failed' );
561
        is( $session, undef );
562
563
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
564
        is( $userid, undef );
565
        is( $sessionID, undef );
566
567
    }
568
569
    {
570
        # Hit unauthorized page then reuse the cookie
571
        undef $ENV{"HTTP_COOKIE"};
572
        $cgi = CGI->new;
573
        # Logging in
574
        $cgi->param('userid', $patron->userid);
575
        $cgi->param('password', $password);
576
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
577
        is( $userid, $patron->userid );
578
        $first_sessionID = $sessionID;
579
580
        $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
581
582
        # Patron does not have the borrowers permission
583
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1});
584
        is( $userid, undef );
585
        is( $sessionID, undef );
586
587
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1});
588
        is( $auth_status, "failed" );
589
        is( $session, undef );
590
591
        # Reuse the cookie
592
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
593
        is( $userid, $patron->userid );
594
        is( $sessionID, $first_sessionID );
595
596
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1});
597
        is( $auth_status, "ok" );
598
        is( $session, $first_sessionID );
599
    }
600
};
601
486
$schema->storage->txn_rollback;
602
$schema->storage->txn_rollback;
487
- 

Return to bug 29915