View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/C4/Auth.pm (-27 / +29 lines)
Lines 23-28 use Carp qw( croak ); Link Here
23
23
24
use Digest::MD5 qw( md5_base64 );
24
use Digest::MD5 qw( md5_base64 );
25
use CGI::Session;
25
use CGI::Session;
26
use CGI::Session::ErrorHandler;
26
use URI;
27
use URI;
27
use URI::QueryParam;
28
use URI::QueryParam;
28
29
Lines 1663-1719 sub check_cookie_auth { Link Here
1663
    # however, if a userid parameter is present (i.e., from
1664
    # however, if a userid parameter is present (i.e., from
1664
    # a form submission, assume that any current cookie
1665
    # a form submission, assume that any current cookie
1665
    # is to be ignored
1666
    # is to be ignored
1666
    unless ( defined $sessionID and $sessionID ) {
1667
    unless ( $sessionID ) {
1667
        return ( "failed", undef );
1668
        return ( "failed", undef );
1668
    }
1669
    }
1669
    my $session   = get_session($sessionID);
1670
    my $session   = get_session($sessionID);
1670
    C4::Context->_new_userenv($sessionID);
1671
    if ($session) {
1671
    if ($session) {
1672
        C4::Context->interface($session->param('interface'));
1673
        C4::Context->set_userenv(
1674
            $session->param('number'),       $session->param('id') // '',
1675
            $session->param('cardnumber'),   $session->param('firstname'),
1676
            $session->param('surname'),      $session->param('branch'),
1677
            $session->param('branchname'),   $session->param('flags'),
1678
            $session->param('emailaddress'), $session->param('shibboleth'),
1679
            $session->param('desk_id'),      $session->param('desk_name'),
1680
            $session->param('register_id'),  $session->param('register_name')
1681
        );
1682
1683
        my $userid   = $session->param('id');
1672
        my $userid   = $session->param('id');
1684
        my $ip       = $session->param('ip');
1673
        my $ip       = $session->param('ip');
1685
        my $lasttime = $session->param('lasttime');
1674
        my $lasttime = $session->param('lasttime');
1686
        my $timeout = _timeout_syspref();
1675
        my $timeout = _timeout_syspref();
1687
1676
1688
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1677
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1689
1690
            # time out
1678
            # time out
1691
            $session->delete();
1679
            $session->delete();
1692
            $session->flush;
1680
            $session->flush;
1693
            C4::Context->_unset_userenv($sessionID);
1694
            return ("expired", undef);
1681
            return ("expired", undef);
1695
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1696
1682
1683
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1697
            # IP address changed
1684
            # IP address changed
1698
            $session->delete();
1685
            $session->delete();
1699
            $session->flush;
1686
            $session->flush;
1700
            C4::Context->_unset_userenv($sessionID);
1701
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1687
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1688
1702
        } elsif ( $userid ) {
1689
        } elsif ( $userid ) {
1703
            $session->param( 'lasttime', time() );
1690
            $session->param( 'lasttime', time() );
1704
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1691
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1705
            if ($flags) {
1692
            if ($flags) {
1693
                C4::Context->_new_userenv($sessionID);
1694
                C4::Context->interface($session->param('interface'));
1695
                C4::Context->set_userenv(
1696
                    $session->param('number'),       $session->param('id') // '',
1697
                    $session->param('cardnumber'),   $session->param('firstname'),
1698
                    $session->param('surname'),      $session->param('branch'),
1699
                    $session->param('branchname'),   $session->param('flags'),
1700
                    $session->param('emailaddress'), $session->param('shibboleth'),
1701
                    $session->param('desk_id'),      $session->param('desk_name'),
1702
                    $session->param('register_id'),  $session->param('register_name')
1703
                );
1706
                return ( "ok", $session );
1704
                return ( "ok", $session );
1705
            } else {
1706
                $session->delete();
1707
                $session->flush;
1708
                return ( "failed", undef );
1707
            }
1709
            }
1710
1708
        } else {
1711
        } else {
1712
            C4::Context->_new_userenv($sessionID);
1713
            C4::Context->interface($session->param('interface'));
1709
            return ( "anon", $session );
1714
            return ( "anon", $session );
1710
        }
1715
        }
1711
        # If here user was logged in, but doesn't have correct permissions
1712
        # could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors
1713
        $session->delete();
1714
        $session->flush;
1715
        C4::Context->_unset_userenv($sessionID);
1716
        return ( "failed", undef );
1717
    } else {
1716
    } else {
1718
        return ( "expired", undef );
1717
        return ( "expired", undef );
1719
    }
1718
    }
Lines 1759-1767 sub _get_session_params { Link Here
1759
sub get_session {
1758
sub get_session {
1760
    my $sessionID      = shift;
1759
    my $sessionID      = shift;
1761
    my $params = _get_session_params();
1760
    my $params = _get_session_params();
1762
    my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1761
    my $session;
1763
    if ( ! $session ){
1762
    if( $sessionID ) { # find existing
1764
        die CGI::Session->errstr();
1763
        CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463
1764
        $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} );
1765
    } else {
1766
        $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1767
        # $session->flush;
1765
    }
1768
    }
1766
    return $session;
1769
    return $session;
1767
}
1770
}
1768
- 

Return to bug 29915