Lines 10-20
use CGI qw ( -utf8 );
Link Here
|
10 |
use Test::MockObject; |
10 |
use Test::MockObject; |
11 |
use Test::MockModule; |
11 |
use Test::MockModule; |
12 |
use List::MoreUtils qw/all any none/; |
12 |
use List::MoreUtils qw/all any none/; |
13 |
use Test::More tests => 24; |
13 |
use Test::More tests => 14; |
14 |
use Test::Warn; |
14 |
use Test::Warn; |
15 |
use t::lib::Mocks; |
15 |
use t::lib::Mocks; |
16 |
use t::lib::TestBuilder; |
16 |
use t::lib::TestBuilder; |
17 |
|
17 |
|
|
|
18 |
use C4::Auth; |
18 |
use C4::Members; |
19 |
use C4::Members; |
19 |
use Koha::AuthUtils qw/hash_password/; |
20 |
use Koha::AuthUtils qw/hash_password/; |
20 |
use Koha::Database; |
21 |
use Koha::Database; |
Lines 201-207
subtest 'checkpw lockout tests' => sub {
Link Here
|
201 |
|
202 |
|
202 |
# get_template_and_user tests |
203 |
# get_template_and_user tests |
203 |
|
204 |
|
204 |
{ # Tests for the language URL parameter |
205 |
subtest 'get_template_and_user' => sub { # Tests for the language URL parameter |
205 |
|
206 |
|
206 |
sub MockedCheckauth { |
207 |
sub MockedCheckauth { |
207 |
my ($query,$authnotrequired,$flagsrequired,$type) = @_; |
208 |
my ($query,$authnotrequired,$flagsrequired,$type) = @_; |
Lines 342-348
subtest 'checkpw lockout tests' => sub {
Link Here
|
342 |
); |
343 |
); |
343 |
is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); |
344 |
is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly"); |
344 |
is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); |
345 |
is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly"); |
345 |
} |
346 |
|
|
|
347 |
delete $ENV{"HTTP_COOKIE"}; |
348 |
}; |
346 |
|
349 |
|
347 |
# Check that there is always an OPACBaseURL set. |
350 |
# Check that there is always an OPACBaseURL set. |
348 |
my $input = CGI->new(); |
351 |
my $input = CGI->new(); |
Lines 483-486
subtest 'check_cookie_auth' => sub {
Link Here
|
483 |
#FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission |
486 |
#FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission |
484 |
}; |
487 |
}; |
485 |
|
488 |
|
|
|
489 |
subtest 'checkauth & check_cookie_auth' => sub { |
490 |
plan tests => 27; |
491 |
|
492 |
# flags = 4 => { catalogue => 1 } |
493 |
my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } }); |
494 |
my $password = 'password'; |
495 |
t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); |
496 |
$patron->set_password( { password => $password } ); |
497 |
|
498 |
my $cgi_mock = Test::MockModule->new('CGI'); |
499 |
$cgi_mock->mock( 'request_method', sub { return 'POST' } ); |
500 |
|
501 |
my $cgi = CGI->new; |
502 |
|
503 |
my $auth = Test::MockModule->new( 'C4::Auth' ); |
504 |
# Tests will fail if we hit safe_exit |
505 |
$auth->mock( 'safe_exit', sub { return } ); |
506 |
|
507 |
my ( $userid, $cookie, $sessionID, $flags ); |
508 |
{ |
509 |
# checkauth will redirect and safe_exit if not authenticated and not authorized |
510 |
local *STDOUT; |
511 |
my $stdout; |
512 |
open STDOUT, '>', \$stdout; |
513 |
C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
514 |
like( $stdout, qr{<title>\s*Log in to your account} ); |
515 |
$sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef; |
516 |
ok($sessionID); |
517 |
close STDOUT; |
518 |
}; |
519 |
|
520 |
my $first_sessionID = $sessionID; |
521 |
|
522 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
523 |
# Not authenticated yet, checkauth didn't return the session |
524 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
525 |
is( $sessionID, undef); |
526 |
is( $userid, undef); |
527 |
|
528 |
# Same here, check_cookie_auth does not return the session |
529 |
my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
530 |
is( $auth_status, 'failed' ); |
531 |
is( $session, undef ); |
532 |
|
533 |
# Simulating the login form submission |
534 |
$cgi->param('userid', $patron->userid); |
535 |
$cgi->param('password', $password); |
536 |
|
537 |
# Logged in! |
538 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
539 |
is( $sessionID, $first_sessionID ); |
540 |
is( $userid, $patron->userid ); |
541 |
|
542 |
( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1}); |
543 |
is( $auth_status, 'ok' ); |
544 |
is( $session->id, $first_sessionID ); |
545 |
|
546 |
# Logging out! |
547 |
$cgi->param('logout.x', 1); |
548 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
549 |
is( $sessionID, undef ); |
550 |
is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' ); |
551 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
552 |
is( $auth_status, "expired"); |
553 |
is( $session, undef ); |
554 |
|
555 |
{ |
556 |
# Trying to access without sessionID |
557 |
undef $ENV{"HTTP_COOKIE"}; |
558 |
$cgi = CGI->new; |
559 |
( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1}); |
560 |
is( $auth_status, 'failed' ); |
561 |
is( $session, undef ); |
562 |
|
563 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
564 |
is( $userid, undef ); |
565 |
is( $sessionID, undef ); |
566 |
|
567 |
} |
568 |
|
569 |
{ |
570 |
# Hit unauthorized page then reuse the cookie |
571 |
undef $ENV{"HTTP_COOKIE"}; |
572 |
$cgi = CGI->new; |
573 |
# Logging in |
574 |
$cgi->param('userid', $patron->userid); |
575 |
$cgi->param('password', $password); |
576 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
577 |
is( $userid, $patron->userid ); |
578 |
$first_sessionID = $sessionID; |
579 |
|
580 |
$ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; |
581 |
|
582 |
# Patron does not have the borrowers permission |
583 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}); |
584 |
is( $userid, undef ); |
585 |
is( $sessionID, undef ); |
586 |
|
587 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1}); |
588 |
is( $auth_status, "failed" ); |
589 |
is( $session, undef ); |
590 |
|
591 |
# Reuse the cookie |
592 |
( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); |
593 |
is( $userid, $patron->userid ); |
594 |
is( $sessionID, $first_sessionID ); |
595 |
|
596 |
( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1}); |
597 |
is( $auth_status, "ok" ); |
598 |
is( $session, $first_sessionID ); |
599 |
} |
600 |
}; |
601 |
|
486 |
$schema->storage->txn_rollback; |
602 |
$schema->storage->txn_rollback; |
487 |
- |
|
|