View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/t/db_dependent/Auth.t (-22 / +22 lines)
Lines 483-489 subtest 'check_cookie_auth' => sub { Link Here
483
};
483
};
484
484
485
subtest 'checkauth & check_cookie_auth' => sub {
485
subtest 'checkauth & check_cookie_auth' => sub {
486
    plan tests => 27;
486
    plan tests => 29;
487
487
488
    # flags = 4 => { catalogue => 1 }
488
    # flags = 4 => { catalogue => 1 }
489
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
489
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
Lines 517-528 subtest 'checkauth & check_cookie_auth' => sub { Link Here
517
517
518
    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
518
    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
519
    # Not authenticated yet, checkauth didn't return the session
519
    # Not authenticated yet, checkauth didn't return the session
520
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
520
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, undef, undef, undef, { skip_auth_template => 1 } );
521
    is( $sessionID, undef);
521
    is( $sessionID, undef);
522
    is( $userid, undef);
522
    is( $userid, undef);
523
523
524
    # Same here, check_cookie_auth does not return the session
524
    # Sending undefined fails obviously
525
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
525
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} );
526
    is( $auth_status, 'failed' );
526
    is( $auth_status, 'failed' );
527
    is( $session, undef );
527
    is( $session, undef );
528
528
Lines 544-597 subtest 'checkauth & check_cookie_auth' => sub { Link Here
544
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
544
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
545
    is( $sessionID, undef );
545
    is( $sessionID, undef );
546
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
546
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
547
    ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1});
547
    ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} );
548
    is( $auth_status, "expired");
548
    is( $auth_status, "expired");
549
    is( $session, undef );
549
    is( $session, undef );
550
550
551
    {
551
    {
552
        # Trying to access without sessionID
552
        # Trying to access without sessionID
553
        undef $ENV{"HTTP_COOKIE"};
554
        $cgi = CGI->new;
553
        $cgi = CGI->new;
555
        ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, 0, {catalogue => 1});
554
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( undef, {catalogue => 1});
556
        is( $auth_status, 'failed' );
555
        is( $auth_status, 'failed' );
557
        is( $session, undef );
556
        is( $session, undef );
558
557
559
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
558
        # This will fail on permissions
559
        undef $ENV{"HTTP_COOKIE"};
560
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, undef, undef, undef, { skip_auth_template => 1 } );
560
        is( $userid, undef );
561
        is( $userid, undef );
561
        is( $sessionID, undef );
562
        is( $sessionID, undef );
562
563
    }
563
    }
564
564
565
    {
565
    {
566
        # Hit unauthorized page then reuse the cookie
566
        # First logging in
567
        undef $ENV{"HTTP_COOKIE"};
568
        $cgi = CGI->new;
567
        $cgi = CGI->new;
569
        # Logging in
570
        $cgi->param('userid', $patron->userid);
568
        $cgi->param('userid', $patron->userid);
571
        $cgi->param('password', $password);
569
        $cgi->param('password', $password);
572
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
570
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
573
        is( $userid, $patron->userid );
571
        is( $userid, $patron->userid );
574
        $first_sessionID = $sessionID;
572
        $first_sessionID = $sessionID;
575
573
576
        $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
577
578
        # Patron does not have the borrowers permission
574
        # Patron does not have the borrowers permission
579
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1});
575
        # $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; # not needed, we use $cgi here
576
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1}, undef, undef, undef, { skip_auth_template => 1 } );
580
        is( $userid, undef );
577
        is( $userid, undef );
581
        is( $sessionID, undef );
578
        is( $sessionID, undef );
582
579
583
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {borrowers => 1});
580
        # When calling check_cookie_auth, the session will be deleted
581
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } );
584
        is( $auth_status, "failed" );
582
        is( $auth_status, "failed" );
585
        is( $session, undef );
583
        is( $session, undef );
584
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } );
585
        is( $auth_status, 'expired', 'Session no longer exists' );
586
586
587
        # Reuse the cookie
587
        # Try reusing the deleted session: since it does not exist, we should get a new one now when passing correct permissions
588
        $cgi->cookie( -name => 'CGISESSID', value => $first_sessionID );
588
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
589
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
589
        is( $userid, $patron->userid );
590
        is( $userid, $patron->userid );
590
        is( $sessionID, $first_sessionID );
591
        isnt( $sessionID, undef, 'Check if we have a sessionID' );
591
592
        isnt( $sessionID, $first_sessionID, 'New value expected' );
592
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($cgi, 0, {catalogue => 1});
593
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID, {catalogue => 1} );
593
        is( $auth_status, "ok" );
594
        is( $auth_status, "ok" );
594
        is( $session, $first_sessionID );
595
        is( $session->id, $sessionID, 'Same session' );
595
    }
596
    }
596
};
597
};
597
598
598
- 

Return to bug 29915