View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/t/db_dependent/Auth.t (-4 / +119 lines)
Lines 10-20 use CGI qw ( -utf8 ); Link Here
10
use Test::MockObject;
10
use Test::MockObject;
11
use Test::MockModule;
11
use Test::MockModule;
12
use List::MoreUtils qw/all any none/;
12
use List::MoreUtils qw/all any none/;
13
use Test::More tests => 24;
13
use Test::More tests => 14;
14
use Test::Warn;
14
use Test::Warn;
15
use t::lib::Mocks;
15
use t::lib::Mocks;
16
use t::lib::TestBuilder;
16
use t::lib::TestBuilder;
17
17
18
use C4::Auth;
18
use C4::Members;
19
use C4::Members;
19
use Koha::AuthUtils qw/hash_password/;
20
use Koha::AuthUtils qw/hash_password/;
20
use Koha::Database;
21
use Koha::Database;
Lines 201-207 subtest 'checkpw lockout tests' => sub { Link Here
201
202
202
# get_template_and_user tests
203
# get_template_and_user tests
203
204
204
{   # Tests for the language URL parameter
205
subtest 'get_template_and_user' => sub {   # Tests for the language URL parameter
205
206
206
    sub MockedCheckauth {
207
    sub MockedCheckauth {
207
        my ($query,$authnotrequired,$flagsrequired,$type) = @_;
208
        my ($query,$authnotrequired,$flagsrequired,$type) = @_;
Lines 342-348 subtest 'checkpw lockout tests' => sub { Link Here
342
    );
343
    );
343
    is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly");
344
    is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly");
344
    is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly");
345
    is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly");
345
}
346
347
    delete $ENV{"HTTP_COOKIE"};
348
};
346
349
347
# Check that there is always an OPACBaseURL set.
350
# Check that there is always an OPACBaseURL set.
348
my $input = CGI->new();
351
my $input = CGI->new();
Lines 479-482 subtest 'check_cookie_auth' => sub { Link Here
479
    #FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission
482
    #FIXME We should have a test to cover 'failed' status when a user has logged in, but doesn't have permission
480
};
483
};
481
484
485
subtest 'checkauth & check_cookie_auth' => sub {
486
    plan tests => 27;
487
488
    # flags = 4 => { catalogue => 1 }
489
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
490
    my $password = 'password';
491
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
492
    $patron->set_password( { password => $password } );
493
494
    my $cgi_mock = Test::MockModule->new('CGI');
495
    $cgi_mock->mock( 'request_method', sub { return 'POST' } );
496
497
    my $cgi = CGI->new;
498
499
    my $auth = Test::MockModule->new( 'C4::Auth' );
500
    # Tests will fail if we hit safe_exit
501
    $auth->mock( 'safe_exit', sub { return } );
502
503
    my ( $userid, $cookie, $sessionID, $flags );
504
    {
505
        # checkauth will redirect and safe_exit if not authenticated and not authorized
506
        local *STDOUT;
507
        my $stdout;
508
        open STDOUT, '>', \$stdout;
509
        C4::Auth::checkauth($cgi, 0, {catalogue => 1});
510
        like( $stdout, qr{<title>\s*Log in to your account} );
511
        $sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef;
512
        ok($sessionID);
513
        close STDOUT;
514
    };
515
516
    my $first_sessionID = $sessionID;
517
518
    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
519
    # Not authenticated yet, checkauth didn't return the session
520
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
521
    is( $sessionID, undef);
522
    is( $userid, undef);
523
524
    # Same here, check_cookie_auth does not return the session
525
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
526
    is( $auth_status, 'failed' );
527
    is( $session, undef );
528
529
    # Simulating the login form submission
530
    $cgi->param('userid', $patron->userid);
531
    $cgi->param('password', $password);
532
533
    # Logged in!
534
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
535
    is( $sessionID, $first_sessionID );
536
    is( $userid, $patron->userid );
537
538
    ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
539
    is( $auth_status, 'ok' );
540
    is( $session->id, $first_sessionID );
541
542
    # Logging out!
543
    $cgi->param('logout.x', 1);
544
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
545
    is( $sessionID, undef );
546
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
547
    ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1});
548
    is( $auth_status, "expired");
549
    is( $session, undef );
550
551
    {
552
        # Trying to access without sessionID
553
        undef $ENV{"HTTP_COOKIE"};
554
        $cgi = CGI->new;
555
        ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1});
556
        is( $auth_status, 'failed' );
557
        is( $session, undef );
558
559
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
560
        is( $userid, undef );
561
        is( $sessionID, undef );
562
563
    }
564
565
    {
566
        # Hit unauthorized page then reuse the cookie
567
        undef $ENV{"HTTP_COOKIE"};
568
        $cgi = CGI->new;
569
        # Logging in
570
        $cgi->param('userid', $patron->userid);
571
        $cgi->param('password', $password);
572
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
573
        is( $userid, $patron->userid );
574
        $first_sessionID = $sessionID;
575
576
        $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
577
578
        # Patron does not have the borrowers permission
579
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1});
580
        is( $userid, undef );
581
        is( $sessionID, undef );
582
583
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1});
584
        is( $auth_status, "failed" );
585
        is( $session, undef );
586
587
        # Reuse the cookie
588
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
589
        is( $userid, $patron->userid );
590
        is( $sessionID, $first_sessionID );
591
592
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1});
593
        is( $auth_status, "ok" );
594
        is( $session, $first_sessionID );
595
    }
596
};
597
482
$schema->storage->txn_rollback;
598
$schema->storage->txn_rollback;
483
- 

Return to bug 29915