View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-2 / +2 lines)
Lines 138-145 Link Here
138
[% END %]
138
[% END %]
139
139
140
[% IF ( nopermission ) %]
140
[% IF ( nopermission ) %]
141
    <p><a href="javascript:window.history.back()">[Previous page]</a>
141
    <p><a id="previous_page" href="javascript:window.history.back()">[Previous page]</a>
142
    <a href="/">[Main page]</a></p>
142
    <a id="mainpage" href="/">[Main page]</a></p>
143
[% END %]
143
[% END %]
144
144
145
145
(-)a/t/db_dependent/selenium/authentication.t (-4 / +127 lines)
Lines 3-9 Link Here
3
# This file is part of Koha.
3
# This file is part of Koha.
4
#
4
#
5
# Copyright (C) 2017  Catalyst IT
5
# Copyright (C) 2017  Catalyst IT
6
# Copyright 2018 Koha Development team
6
# Copyright 2021 Koha Development team
7
#
7
#
8
# Koha is free software; you can redistribute it and/or modify it
8
# Koha is free software; you can redistribute it and/or modify it
9
# under the terms of the GNU General Public License as published by
9
# under the terms of the GNU General Public License as published by
Lines 42-48 SKIP: { Link Here
42
    my $driver   = $s->driver;
42
    my $driver   = $s->driver;
43
43
44
    subtest 'Staff interface authentication' => sub {
44
    subtest 'Staff interface authentication' => sub {
45
        plan tests => 5;
45
        plan tests => 6;
46
        my $mainpage = $s->base_url . q|mainpage.pl|;
46
        my $mainpage = $s->base_url . q|mainpage.pl|;
47
        $driver->get($mainpage);
47
        $driver->get($mainpage);
48
        like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form');
48
        like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form');
Lines 68-78 SKIP: { Link Here
68
        $s->auth( $patron->userid, $password );
68
        $s->auth( $patron->userid, $password );
69
        like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' );
69
        like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' );
70
70
71
        subtest 'not authorized' => sub {
72
            plan tests => 17;
73
74
            # First, logout!
75
            $driver->get($mainpage . q|?logout.x=1|);
76
            $patron->flags(4)->store; # Patron has only catalogue permission
77
            like( $driver->get_title, qr(Log in to Koha), 'Patron should hit the login form after logout' );
78
            # Login!
79
            $s->fill_form({ userid => $patron->userid, password => $password });
80
            $s->driver->find_element('//input[@id="submit-button"]')->click;
81
82
            my $cookie = $driver->get_cookie_named('CGISESSID');
83
            my $first_sessionID = $cookie->{value};
84
85
            # Patron is logged in and got a CGISESSID cookie, miam
86
            like( $driver->get_title, qr(Koha staff interface), 'Patron is logged in' );
87
            $cookie = $driver->get_cookie_named('CGISESSID');
88
            is( $cookie->{value}, $first_sessionID, 'no new session after login, the session has been upgraded' );
89
90
            # Authorized page can be accessed, cookie does not change
91
            $driver->get( $s->base_url . q|catalogue/search.pl| );
92
            like( $driver->get_title, qr(Advanced search), 'Patron can access advanced search' );
93
            $cookie = $driver->get_cookie_named('CGISESSID');
94
            is( $cookie->{value}, $first_sessionID, 'no new session after hit' );
95
96
            # Unauthorized page redirect to the login form
97
            $driver->get( $s->base_url . q|circ/circulation.pl| );
98
            like( $driver->get_title, qr(Access denied), 'Patron cannot access the circulation module' );
99
            # But the patron does not lose the CGISESSID cookie!
100
            $cookie = $driver->get_cookie_named('CGISESSID');
101
            is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' );
102
103
            # Luckily mainpage can still be accessed
104
            $s->click( { id => 'mainpage', main_class => 'main container-fluid' } );
105
            like( $driver->get_title, qr(Koha staff interface), 'Patron can come back to the mainpage' );
106
            $cookie = $driver->get_cookie_named('CGISESSID');
107
            is( $cookie->{value}, $first_sessionID, 'no new session if back to the mainpage' );
108
109
            # As well as the search
110
            $driver->get( $s->base_url . q|catalogue/search.pl| );
111
            like( $driver->get_title, qr(Advanced search), 'Patron can access advanced search' );
112
            # But circulation module is prohibided!
113
            $driver->get( $s->base_url . q|circ/circulation.pl| );
114
            like( $driver->get_title, qr(Access denied), 'Patron cannot access the circulation module' );
115
            # Still can reuse the same cookie
116
            $cookie = $driver->get_cookie_named('CGISESSID');
117
            is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' );
118
119
            # This is the "previous page" using the back() JS
120
            $s->click( { id => 'previous_page', main_class => 'main container-fluid' } );
121
            like( $driver->get_title, qr(Advanced search), 'Patron can come back to the previous page' );
122
            $cookie = $driver->get_cookie_named('CGISESSID');
123
            is( $cookie->{value}, $first_sessionID, 'no new session if back to the previous page' );
124
125
            # Check with a script that is using check_cookie_auth, session must not be deleted!
126
            $driver->get( $s->base_url . q|svc/checkouts| );
127
            #FIXME - 500 is the current behaviour, but it's not nice. It could be improved.
128
            like( $driver->get_title, qr(Error 500), 'Patron cannot access svc script where circulate permissions are required');
129
            $driver->get( $s->base_url . q|catalogue/search.pl| );
130
            like( $driver->get_title, qr(Advanced search), 'Patron can reuse the cookie after a script that used check_cookie_auth' );
131
            $cookie = $driver->get_cookie_named('CGISESSID');
132
            is( $cookie->{value}, $first_sessionID, 'no new session if unauthorized page is hit' );
133
        };
71
        push @data_to_cleanup, $patron, $patron->category, $patron->library;
134
        push @data_to_cleanup, $patron, $patron->category, $patron->library;
72
    };
135
    };
73
136
74
    subtest 'OPAC interface authentication' => sub {
137
    subtest 'OPAC interface authentication' => sub {
75
        plan tests => 6;
138
        plan tests => 7;
76
139
77
        my $mainpage = $s->opac_base_url . q|opac-main.pl|;
140
        my $mainpage = $s->opac_base_url . q|opac-main.pl|;
78
141
Lines 149-154 SKIP: { Link Here
149
        $driver->find_element('//a[@id="logout"]')->click;
212
        $driver->find_element('//a[@id="logout"]')->click;
150
        $driver->find_element('//div[@id="login"]'); # logged out
213
        $driver->find_element('//div[@id="login"]'); # logged out
151
214
215
        subtest 'not authorized' => sub {
216
            plan tests => 13;
217
218
            $driver->get($mainpage . q|?logout.x=1|);
219
            $driver->get($mainpage);
220
            my $cookie = $driver->get_cookie_named('CGISESSID');
221
            my $first_sessionID = $cookie->{value};
222
223
            # User is not logged in, navigation does not generate a new cookie
224
            $driver->get( $s->opac_base_url . q|opac-search.pl| );
225
            like( $driver->get_title, qr(Advanced search) );
226
            $cookie = $driver->get_cookie_named('CGISESSID');
227
            is( $cookie->{value}, $first_sessionID, );
228
229
            # Login
230
            $driver->get($mainpage);
231
            $s->fill_form( { userid => $patron->userid, password => $password } );
232
            $s->submit_form;
233
234
            # After logged in, the same cookie is reused
235
            like( $driver->get_title, qr(Your library home) );
236
            $cookie = $driver->get_cookie_named('CGISESSID');
237
            is( $cookie->{value}, $first_sessionID, );
238
            $driver->get( $s->opac_base_url . q|opac-search.pl| );
239
            like( $driver->get_title, qr(Advanced search) );
240
            $cookie = $driver->get_cookie_named('CGISESSID');
241
            is( $cookie->{value}, $first_sessionID, );
242
243
            # Logged in user can place holds
244
            $driver->get( $s->opac_base_url . q|opac-reserve.pl| ); # We may need to pass a biblionumber here in the future
245
            like( $driver->get_title, qr(Placing a hold) );
246
            $cookie = $driver->get_cookie_named('CGISESSID');
247
            is( $cookie->{value}, $first_sessionID, );
248
249
            $driver->get($mainpage . q|?logout.x=1|);
250
251
            # FIXME This new get should not be needed, but the cookie is not modified right after logout
252
            # However it's not the behavour when testing the UI
253
            $driver->get($mainpage);
254
255
            # After logout a new cookie is generated, the previous session has been deleted
256
            $cookie = $driver->get_cookie_named('CGISESSID');
257
            isnt( $cookie->{value}, $first_sessionID, );
258
            $first_sessionID = $cookie->{value};
259
260
            $driver->get( $s->opac_base_url . q|svc/checkout_notes| );
261
            #FIXME - 500 is the current behaviour, but it's not nice. It could be improved.
262
            like( $driver->get_title, qr(An error has occurred), 'Patron cannot access svc');
263
            # No new cookie generated
264
            $cookie = $driver->get_cookie_named('CGISESSID');
265
            is( $cookie->{value}, $first_sessionID, );
266
267
            $driver->get( $s->opac_base_url . q|opac-reserve.pl| );
268
            like( $driver->get_title, qr(Log in to your account) );
269
270
            # Still no new cookie generated
271
            $driver->get($mainpage);
272
            $cookie = $driver->get_cookie_named('CGISESSID');
273
            is( $cookie->{value}, $first_sessionID, );
274
        };
275
152
        push @data_to_cleanup, $patron, $patron->category, $patron->library;
276
        push @data_to_cleanup, $patron, $patron->category, $patron->library;
153
    };
277
    };
154
278
155
- 

Return to bug 29915