From 75a361133932c96c85db876492a8ff43aac21d1f Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 27 Jan 2022 12:33:57 +0100 Subject: [PATCH] Bug 29957: Clear cookies on logout Content-Type: text/plain; charset=utf-8 Signed-off-by: Martin Renvoize Signed-off-by: Marcel de Rooy Amended: Reverted the change to $cookies to minimize changes. Fixed Auth.t where checkauth is being mocked. --- C4/Auth.pm | 32 ++++++++++++++++++++------------ t/db_dependent/Auth.t | 2 +- 2 files changed, 21 insertions(+), 13 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 872d5b5365..1a1aebe3e2 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -153,6 +153,7 @@ sub get_template_and_user { my $in = shift; my ( $user, $cookie, $sessionID, $flags ); + $cookie = []; # Get shibboleth login attribute my $shib = C4::Context->config('useshibboleth') && shib_ok(); @@ -242,7 +243,7 @@ sub get_template_and_user { if ($kick_out) { $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} ); - $cookie = $in->{query}->cookie( + push @$cookie, $in->{query}->cookie( -name => 'CGISESSID', -value => '', -expires => '', @@ -654,11 +655,7 @@ sub get_template_and_user { # what to do my $language = C4::Languages::getlanguage( $in->{'query'} ); my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language ); - if ( ref $cookie eq 'ARRAY' ) { - push @{$cookie}, $languagecookie; - } else { - $cookie = [ $cookie, $languagecookie ]; - } + push @{$cookie}, $languagecookie; } return ( $template, $borrowernumber, $cookie, $flags ); @@ -808,6 +805,15 @@ sub _timeout_syspref { return $timeout; } +sub clear_all_cookies { + my ( $query ) = shift; + my @cookies; + for my $cookie_name ( $query->cookie ) { + push @cookies, $query->cookie( -name => $cookie_name, -value => '', -expires => '', -HttpOnly => 1 ); + } + return \@cookies; +} + sub checkauth { my $query = shift; @@ -844,6 +850,7 @@ sub checkauth { my $loggedin = 0; my %info; my ( $userid, $cookie, $sessionID, $flags ); + $cookie = []; my $logout = $query->param('logout.x'); my $anon_search_history; @@ -867,7 +874,7 @@ sub checkauth { if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { # Using Basic Authentication, no cookies required - $cookie = $query->cookie( + push @$cookie, $query->cookie( -name => 'CGISESSID', -value => '', -expires => '', @@ -910,6 +917,7 @@ sub checkauth { my $shibSuccess = C4::Context->userenv->{'shibboleth'}; $session->delete(); $session->flush; + $cookie = clear_all_cookies($query); C4::Context->_unset_userenv($sessionID); if ($cas and $caslogout) { @@ -922,7 +930,7 @@ sub checkauth { } } else { - $cookie = $query->cookie( + push @$cookie, $query->cookie( -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, @@ -968,7 +976,7 @@ sub checkauth { $sessionID = $session->id; C4::Context->_new_userenv($sessionID); - $cookie = $query->cookie( + push @$cookie, $query->cookie( -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, @@ -1168,7 +1176,7 @@ sub checkauth { $domain =~ s|\.\*||g; if ( $ip !~ /^$domain/ ) { $loggedin = 0; - $cookie = $query->cookie( + push @$cookie, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, @@ -1255,8 +1263,8 @@ sub checkauth { if ( $loggedin || $authnotrequired ) { # successful login - unless ($cookie) { - $cookie = $query->cookie( + unless (@$cookie) { + push @$cookie, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t index 187270caae..35185bfffc 100755 --- a/t/db_dependent/Auth.t +++ b/t/db_dependent/Auth.t @@ -228,7 +228,7 @@ subtest 'checkpw lockout tests' => sub { -HttpOnly => 1 ); - return ( $userid, $session_cookie, $sessionID, $flags ); + return ( $userid, [ $session_cookie ], $sessionID, $flags ); } # Mock checkauth, build the scenario -- 2.20.1