View | Details | Raw Unified | Return to bug 29957
Collapse All | Expand All

(-)a/C4/Auth.pm (-23 / +28 lines)
Lines 152-158 Output.pm module. Link Here
152
sub get_template_and_user {
152
sub get_template_and_user {
153
153
154
    my $in = shift;
154
    my $in = shift;
155
    my ( $user, $cookie, $sessionID, $flags );
155
    my ( $user, $cookies, $sessionID, $flags );
156
156
157
    # Get shibboleth login attribute
157
    # Get shibboleth login attribute
158
    my $shib = C4::Context->config('useshibboleth') && shib_ok();
158
    my $shib = C4::Context->config('useshibboleth') && shib_ok();
Lines 170-176 sub get_template_and_user { Link Here
170
    );
170
    );
171
171
172
    if ( $in->{'template_name'} !~ m/maintenance/ ) {
172
    if ( $in->{'template_name'} !~ m/maintenance/ ) {
173
        ( $user, $cookie, $sessionID, $flags ) = checkauth(
173
        ( $user, $cookies, $sessionID, $flags ) = checkauth(
174
            $in->{'query'},
174
            $in->{'query'},
175
            $in->{'authnotrequired'},
175
            $in->{'authnotrequired'},
176
            $in->{'flagsrequired'},
176
            $in->{'flagsrequired'},
Lines 192-198 sub get_template_and_user { Link Here
192
            given_on => { '!=', undef },
192
            given_on => { '!=', undef },
193
        })->next;
193
        })->next;
194
        if( !$consent ) {
194
        if( !$consent ) {
195
            print $in->{query}->redirect(-uri => '/cgi-bin/koha/opac-patron-consent.pl', -cookie => $cookie);
195
            print $in->{query}->redirect(-uri => '/cgi-bin/koha/opac-patron-consent.pl', -cookie => $cookies);
196
            safe_exit;
196
            safe_exit;
197
        }
197
        }
198
    }
198
    }
Lines 230-236 sub get_template_and_user { Link Here
230
        if ($kick_out) {
230
        if ($kick_out) {
231
            $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac',
231
            $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac',
232
                $in->{query} );
232
                $in->{query} );
233
            $cookie = $in->{query}->cookie(
233
            push @$cookies, $in->{query}->cookie(
234
                -name     => 'CGISESSID',
234
                -name     => 'CGISESSID',
235
                -value    => '',
235
                -value    => '',
236
                -expires  => '',
236
                -expires  => '',
Lines 247-253 sub get_template_and_user { Link Here
247
                {
247
                {
248
                    type              => 'text/html',
248
                    type              => 'text/html',
249
                    charset           => 'utf-8',
249
                    charset           => 'utf-8',
250
                    cookie            => $cookie,
250
                    cookie            => $cookies,
251
                    'X-Frame-Options' => 'SAMEORIGIN'
251
                    'X-Frame-Options' => 'SAMEORIGIN'
252
                }
252
                }
253
              ),
253
              ),
Lines 638-651 sub get_template_and_user { Link Here
638
        # what to do
638
        # what to do
639
        my $language = C4::Languages::getlanguage( $in->{'query'} );
639
        my $language = C4::Languages::getlanguage( $in->{'query'} );
640
        my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language );
640
        my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language );
641
        if ( ref $cookie eq 'ARRAY' ) {
641
        push @{$cookies}, $languagecookie;
642
            push @{$cookie}, $languagecookie;
643
        } else {
644
            $cookie = [ $cookie, $languagecookie ];
645
        }
646
    }
642
    }
647
643
648
    return ( $template, $borrowernumber, $cookie, $flags );
644
    return ( $template, $borrowernumber, $cookies, $flags );
649
}
645
}
650
646
651
=head2 checkauth
647
=head2 checkauth
Lines 792-797 sub _timeout_syspref { Link Here
792
    return $timeout;
788
    return $timeout;
793
}
789
}
794
790
791
sub clear_all_cookies {
792
    my ( $query ) = shift;
793
    my @cookies;
794
    for my $cookie_name ( $query->cookie ) {
795
        push @cookies, $query->cookie( -name => $cookie_name, -value => '', -expires => '', -HttpOnly => 1 );
796
    }
797
    return \@cookies;
798
}
799
795
sub checkauth {
800
sub checkauth {
796
    my $query = shift;
801
    my $query = shift;
797
802
Lines 827-835 sub checkauth { Link Here
827
    # state variables
832
    # state variables
828
    my $loggedin = 0;
833
    my $loggedin = 0;
829
    my %info;
834
    my %info;
830
    my ( $userid, $cookie, $sessionID, $flags );
835
    my ( $userid, $sessionID, $flags );
836
    my $cookies = [];
831
    my $logout = $query->param('logout.x');
837
    my $logout = $query->param('logout.x');
832
833
    my $anon_search_history;
838
    my $anon_search_history;
834
    my $cas_ticket = '';
839
    my $cas_ticket = '';
835
    # This parameter is the name of the CAS server we want to authenticate against,
840
    # This parameter is the name of the CAS server we want to authenticate against,
Lines 851-857 sub checkauth { Link Here
851
    if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) {
856
    if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) {
852
857
853
        # Using Basic Authentication, no cookies required
858
        # Using Basic Authentication, no cookies required
854
        $cookie = $query->cookie(
859
        push @$cookies, $query->cookie(
855
            -name     => 'CGISESSID',
860
            -name     => 'CGISESSID',
856
            -value    => '',
861
            -value    => '',
857
            -expires  => '',
862
            -expires  => '',
Lines 894-899 sub checkauth { Link Here
894
                my $shibSuccess = C4::Context->userenv->{'shibboleth'};
899
                my $shibSuccess = C4::Context->userenv->{'shibboleth'};
895
                $session->delete();
900
                $session->delete();
896
                $session->flush;
901
                $session->flush;
902
                $cookies = clear_all_cookies($query);
897
                C4::Context->_unset_userenv($sessionID);
903
                C4::Context->_unset_userenv($sessionID);
898
904
899
                if ($cas and $caslogout) {
905
                if ($cas and $caslogout) {
Lines 906-912 sub checkauth { Link Here
906
                }
912
                }
907
            } else {
913
            } else {
908
914
909
                $cookie = $query->cookie(
915
                push @$cookies, $query->cookie(
910
                    -name     => 'CGISESSID',
916
                    -name     => 'CGISESSID',
911
                    -value    => $session->id,
917
                    -value    => $session->id,
912
                    -HttpOnly => 1,
918
                    -HttpOnly => 1,
Lines 952-958 sub checkauth { Link Here
952
958
953
        $sessionID = $session->id;
959
        $sessionID = $session->id;
954
        C4::Context->_new_userenv($sessionID);
960
        C4::Context->_new_userenv($sessionID);
955
        $cookie = $query->cookie(
961
        push @$cookies, $query->cookie(
956
            -name     => 'CGISESSID',
962
            -name     => 'CGISESSID',
957
            -value    => $sessionID,
963
            -value    => $sessionID,
958
            -HttpOnly => 1,
964
            -HttpOnly => 1,
Lines 1152-1158 sub checkauth { Link Here
1152
                        $domain =~ s|\.\*||g;
1158
                        $domain =~ s|\.\*||g;
1153
                        if ( $ip !~ /^$domain/ ) {
1159
                        if ( $ip !~ /^$domain/ ) {
1154
                            $loggedin = 0;
1160
                            $loggedin = 0;
1155
                            $cookie = $query->cookie(
1161
                            push @$cookies, $query->cookie(
1156
                                -name     => 'CGISESSID',
1162
                                -name     => 'CGISESSID',
1157
                                -value    => '',
1163
                                -value    => '',
1158
                                -HttpOnly => 1,
1164
                                -HttpOnly => 1,
Lines 1232-1239 sub checkauth { Link Here
1232
    if ( $loggedin || $authnotrequired )
1238
    if ( $loggedin || $authnotrequired )
1233
    {
1239
    {
1234
        # successful login
1240
        # successful login
1235
        unless ($cookie) {
1241
        unless (@$cookies) {
1236
            $cookie = $query->cookie(
1242
            push @$cookies, $query->cookie(
1237
                -name     => 'CGISESSID',
1243
                -name     => 'CGISESSID',
1238
                -value    => '',
1244
                -value    => '',
1239
                -HttpOnly => 1,
1245
                -HttpOnly => 1,
Lines 1251-1261 sub checkauth { Link Here
1251
            $uri->query_param_delete('userid');
1257
            $uri->query_param_delete('userid');
1252
            $uri->query_param_delete('password');
1258
            $uri->query_param_delete('password');
1253
            $uri->query_param_delete('koha_login_context');
1259
            $uri->query_param_delete('koha_login_context');
1254
            print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other');
1260
            print $query->redirect(-uri => $uri->as_string, -cookie => $cookies, -status=>'303 See other');
1255
            exit;
1261
            exit;
1256
        }
1262
        }
1257
1263
1258
        return ( $userid, $cookie, $sessionID, $flags );
1264
        return ( $userid, $cookies, $sessionID, $flags );
1259
    }
1265
    }
1260
1266
1261
    #
1267
    #
Lines 1389-1395 sub checkauth { Link Here
1389
    print $query->header(
1395
    print $query->header(
1390
        {   type              => 'text/html',
1396
        {   type              => 'text/html',
1391
            charset           => 'utf-8',
1397
            charset           => 'utf-8',
1392
            cookie            => $cookie,
1398
            cookie            => $cookies,
1393
            'X-Frame-Options' => 'SAMEORIGIN'
1399
            'X-Frame-Options' => 'SAMEORIGIN'
1394
        }
1400
        }
1395
      ),
1401
      ),
1396
- 

Return to bug 29957