View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/t/db_dependent/Auth.t (-23 / +76 lines)
Lines 10-16 use CGI qw ( -utf8 ); Link Here
10
use Test::MockObject;
10
use Test::MockObject;
11
use Test::MockModule;
11
use Test::MockModule;
12
use List::MoreUtils qw/all any none/;
12
use List::MoreUtils qw/all any none/;
13
use Test::More tests => 14;
13
use Test::More tests => 15;
14
use Test::Warn;
14
use Test::Warn;
15
use t::lib::Mocks;
15
use t::lib::Mocks;
16
use t::lib::TestBuilder;
16
use t::lib::TestBuilder;
Lines 483-489 subtest 'check_cookie_auth' => sub { Link Here
483
};
483
};
484
484
485
subtest 'checkauth & check_cookie_auth' => sub {
485
subtest 'checkauth & check_cookie_auth' => sub {
486
    plan tests => 27;
486
    plan tests => 31;
487
487
488
    # flags = 4 => { catalogue => 1 }
488
    # flags = 4 => { catalogue => 1 }
489
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
489
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
Lines 517-528 subtest 'checkauth & check_cookie_auth' => sub { Link Here
517
517
518
    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
518
    $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
519
    # Not authenticated yet, checkauth didn't return the session
519
    # Not authenticated yet, checkauth didn't return the session
520
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
520
    {
521
        local *STDOUT;
522
        my $stdout;
523
        open STDOUT, '>', \$stdout;
524
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} );
525
        close STDOUT;
526
    }
521
    is( $sessionID, undef);
527
    is( $sessionID, undef);
522
    is( $userid, undef);
528
    is( $userid, undef);
523
529
524
    # Same here, check_cookie_auth does not return the session
530
    # Sending undefined fails obviously
525
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
531
    my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} );
526
    is( $auth_status, 'failed' );
532
    is( $auth_status, 'failed' );
527
    is( $session, undef );
533
    is( $session, undef );
528
534
Lines 544-598 subtest 'checkauth & check_cookie_auth' => sub { Link Here
544
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
550
    ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
545
    is( $sessionID, undef );
551
    is( $sessionID, undef );
546
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
552
    is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
547
    ( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1});
553
    ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} );
548
    is( $auth_status, "failed");
554
    is( $auth_status, "expired");
549
    is( $session, undef );
555
    is( $session, undef );
550
556
551
    {
557
    {
552
        # Trying to access without sessionID
558
        # Trying to access without sessionID
553
        undef $ENV{"HTTP_COOKIE"};
554
        $cgi = CGI->new;
559
        $cgi = CGI->new;
555
        ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, {catalogue => 1});
560
        ( $auth_status, $session) = C4::Auth::check_cookie_auth(undef, {catalogue => 1});
556
        is( $auth_status, 'failed' );
561
        is( $auth_status, 'failed' );
557
        is( $session, undef );
562
        is( $session, undef );
558
563
559
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
564
        # This will fail on permissions
565
        undef $ENV{"HTTP_COOKIE"};
566
        {
567
            local *STDOUT;
568
            my $stdout;
569
            open STDOUT, '>', \$stdout;
570
            ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} );
571
            close STDOUT;
572
        }
560
        is( $userid, undef );
573
        is( $userid, undef );
561
        is( $sessionID, undef );
574
        is( $sessionID, undef );
562
563
    }
575
    }
564
576
565
    {
577
    {
566
        # Hit unauthorized page then reuse the cookie
578
        # First logging in
567
        undef $ENV{"HTTP_COOKIE"};
568
        $cgi = CGI->new;
579
        $cgi = CGI->new;
569
        # Logging in
570
        $cgi->param('userid', $patron->userid);
580
        $cgi->param('userid', $patron->userid);
571
        $cgi->param('password', $password);
581
        $cgi->param('password', $password);
572
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
582
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
573
        is( $userid, $patron->userid );
583
        is( $userid, $patron->userid );
574
        $first_sessionID = $sessionID;
584
        $first_sessionID = $sessionID;
575
585
576
        $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
577
578
        # Patron does not have the borrowers permission
586
        # Patron does not have the borrowers permission
579
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1});
587
        # $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID"; # not needed, we use $cgi here
588
        {
589
            local *STDOUT;
590
            my $stdout;
591
            open STDOUT, '>', \$stdout;
592
            ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {borrowers => 1} );
593
            close STDOUT;
594
        }
580
        is( $userid, undef );
595
        is( $userid, undef );
581
        is( $sessionID, undef );
596
        is( $sessionID, undef );
582
597
583
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, {borrowers => 1});
598
        # When calling check_cookie_auth, the session will be deleted
599
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } );
584
        is( $auth_status, "failed" );
600
        is( $auth_status, "failed" );
585
        is( $session, undef );
601
        is( $session, undef );
602
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } );
603
        is( $auth_status, 'expired', 'Session no longer exists' );
586
604
587
        # Reuse the cookie
605
        # Try reusing the deleted session: since it does not exist, we should get a new one now when passing correct permissions
606
        $cgi->cookie( -name => 'CGISESSID', value => $first_sessionID );
588
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
607
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
589
        is( $userid, $patron->userid );
608
        is( $userid, $patron->userid );
590
        is( $sessionID, $first_sessionID );
609
        isnt( $sessionID, undef, 'Check if we have a sessionID' );
591
610
        isnt( $sessionID, $first_sessionID, 'New value expected' );
592
        ( $auth_status, $session) = C4::Auth::check_cookie_auth($sessionID, 0, {catalogue => 1});
611
        ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID, {catalogue => 1} );
593
        is( $auth_status, "ok" );
612
        is( $auth_status, "ok" );
594
        is( $session, $first_sessionID );
613
        is( $session->id, $sessionID, 'Same session' );
614
        # Two additional tests on userenv
615
        is( $C4::Context::context->{activeuser}, $session->id, 'Check if environment has been setup for session' );
616
        is( C4::Context->userenv->{id}, $userid, 'Check userid in userenv' );
595
    }
617
    }
596
};
618
};
597
619
620
subtest 'Userenv clearing in check_cookie_auth' => sub {
621
    # Note: We did already test userenv for a logged-in user in previous subtest
622
    plan tests => 9;
623
624
    t::lib::Mocks::mock_preference( 'timeout', 600 );
625
    my $cgi = CGI->new;
626
627
    # Create a new anonymous session by passing a fake session ID
628
    $cgi->cookie( -name => 'CGISESSID', -value => 'fake_sessionID' );
629
    my ($userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 1);
630
    my ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID );
631
    is( $auth_status, 'anon', 'Should be anonymous' );
632
    is( $C4::Context::context->{activeuser}, $session->id, 'Check activeuser' );
633
    is( defined C4::Context->userenv, 1, 'There should be a userenv' );
634
    is(  C4::Context->userenv->{id}, q{}, 'userid should be empty string' );
635
636
    # Make the session expire now, check_cookie_auth will delete it
637
    $session->param('lasttime', time() - 1200 );
638
    $session->flush;
639
    ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID );
640
    is( $auth_status, 'expired', 'Should be expired' );
641
    is( C4::Context->userenv, undef, 'Environment should be cleared too' );
642
643
    # Show that we clear the userenv again: set up env and check deleted session
644
    C4::Context->_new_userenv( $sessionID );
645
    C4::Context->set_userenv; # empty
646
    is( defined C4::Context->userenv, 1, 'There should be an empty userenv again' );
647
    ( $auth_status, $session) = C4::Auth::check_cookie_auth( $sessionID );
648
    is( $auth_status, 'expired', 'Should be expired already' );
649
    is( C4::Context->userenv, undef, 'Environment should be cleared again' );
650
};
651
598
$schema->storage->txn_rollback;
652
$schema->storage->txn_rollback;
599
- 

Return to bug 29915