From 483efc8ab988ac471f47ddef1deb2c7c190aa4c5 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 27 Jan 2022 15:12:40 +0100 Subject: [PATCH] Bug 29915: Add a note for tests Signed-off-by: Jonathan Druart Signed-off-by: Nick Clemens --- t/db_dependent/Auth.t | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t index 6e82bd4182f..5228254ab87 100755 --- a/t/db_dependent/Auth.t +++ b/t/db_dependent/Auth.t @@ -602,6 +602,11 @@ subtest 'checkauth & check_cookie_auth' => sub { ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, { borrowers => 1 } ); is( $auth_status, 'expired', 'Session no longer exists' ); + # NOTE: It is not what the UI is doing. + # From the UI we are allowed to hit an unauthorized page then reuse the session to hit back authorized area. + # It is because check_cookie_auth is ALWAYS called from checkauth WITHOUT $flagsrequired + # It then return "ok", when the previous called got "failed" + # Try reusing the deleted session: since it does not exist, we should get a new one now when passing correct permissions $cgi->cookie( -name => 'CGISESSID', value => $first_sessionID ); ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}); -- 2.25.1