From 01d0f398e1d81ef906554a10b473ab1faaa9d819 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Mon, 24 Jan 2022 13:08:01 +0000 Subject: [PATCH] Bug 29915: Changes for get_session and check_cookie_auth Content-Type: text/plain; charset=utf-8 If we look for an existing session, do not create a new one. Signed-off-by: Marcel de Rooy --- C4/Auth.pm | 55 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 26 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index aa2082f8ab..dff729cd6c 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -23,6 +23,7 @@ use Carp qw( croak ); use Digest::MD5 qw( md5_base64 ); use CGI::Session; +use CGI::Session::ErrorHandler; use URI; use URI::QueryParam; @@ -1663,57 +1664,55 @@ sub check_cookie_auth { # however, if a userid parameter is present (i.e., from # a form submission, assume that any current cookie # is to be ignored - unless ( defined $sessionID and $sessionID ) { + unless ( $sessionID ) { return ( "failed", undef ); } my $session = get_session($sessionID); - C4::Context->_new_userenv($sessionID); if ($session) { - C4::Context->interface($session->param('interface')); - C4::Context->set_userenv( - $session->param('number'), $session->param('id') // '', - $session->param('cardnumber'), $session->param('firstname'), - $session->param('surname'), $session->param('branch'), - $session->param('branchname'), $session->param('flags'), - $session->param('emailaddress'), $session->param('shibboleth'), - $session->param('desk_id'), $session->param('desk_name'), - $session->param('register_id'), $session->param('register_name') - ); - my $userid = $session->param('id'); my $ip = $session->param('ip'); my $lasttime = $session->param('lasttime'); my $timeout = _timeout_syspref(); if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { - # time out $session->delete(); $session->flush; - C4::Context->_unset_userenv($sessionID); return ("expired", undef); - } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { # IP address changed $session->delete(); $session->flush; - C4::Context->_unset_userenv($sessionID); return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); + } elsif ( $userid ) { $session->param( 'lasttime', time() ); my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; if ($flags) { + C4::Context->_new_userenv($sessionID); + C4::Context->interface($session->param('interface')); + C4::Context->set_userenv( + $session->param('number'), $session->param('id') // '', + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('shibboleth'), + $session->param('desk_id'), $session->param('desk_name'), + $session->param('register_id'), $session->param('register_name') + ); return ( "ok", $session ); + } else { + $session->delete(); + $session->flush; + return ( "failed", undef ); } + } else { + C4::Context->_new_userenv($sessionID); + C4::Context->interface($session->param('interface')); return ( "anon", $session ); } - # If here user was logged in, but doesn't have correct permissions - # could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors - $session->delete(); - $session->flush; - C4::Context->_unset_userenv($sessionID); - return ( "failed", undef ); } else { return ( "expired", undef ); } @@ -1759,9 +1758,13 @@ sub _get_session_params { sub get_session { my $sessionID = shift; my $params = _get_session_params(); - my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); - if ( ! $session ){ - die CGI::Session->errstr(); + my $session; + if( $sessionID ) { # find existing + CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463 + $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} ); + } else { + $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); + # $session->flush; } return $session; } -- 2.20.1