From 73a7c0dc73ae493d7df5e1d7ced46399ee7c2c27 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Wed, 16 Mar 2022 12:43:07 +0000 Subject: [PATCH] Bug 29957: Adjust push @$cookie statements in Auth Content-Type: text/plain; charset=utf-8 We can now use $cookie_mgr->replace_in_list instead. This effectively removes duplicates and keeps the newest cookie. NOTE: The test plan below includes adding two Koha cookies which are not HttpOnly cookies. Which has an interesting side-effect: logging out clears them as HttpOnly cookies, but this blocks new occurrences of those as non-HttpOnly cookies within the same session. Closing the browser does resolve that. We can surely add further logic for that, but I would propose to do that on a follow-up report. Since you can control which cookies you clear, you might decide to do that only for HttpOnly cookies. Test plan: Run t/db_dependent/Auth.t Add removable_cookie entries in koha-conf for: form_serialized, form_serialized_limits Login at OPAC. If you are using the same domain, check if you are logged in on the staff client too. Go back to OPAC, perform an Advanced search. Check cookies on browser dev console. Look for the form_ cookies. Go to staff. Logout Go to OPAC. Check cookies in dev console. Are you logged out? Login at staff again. Hit some pages in the staff client and verify that they respond as expected. Signed-off-by: Marcel de Rooy --- C4/Auth.pm | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index e690fc473d..d5ee7d9573 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -156,6 +156,8 @@ sub get_template_and_user { my ( $user, $cookie, $sessionID, $flags ); $cookie = []; + my $cookie_mgr = Koha::CookieManager->new; + # Get shibboleth login attribute my $shib = C4::Context->config('useshibboleth') && shib_ok(); my $shib_login = $shib ? get_login_shib() : undef; @@ -244,13 +246,12 @@ sub get_template_and_user { if ($kick_out) { $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} ); - push @$cookie, $in->{query}->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $in->{query}->cookie( -name => 'CGISESSID', -value => '', - -expires => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); $template->param( loginprompt => 1, @@ -656,7 +657,7 @@ sub get_template_and_user { # what to do my $language = C4::Languages::getlanguage( $in->{'query'} ); my $languagecookie = C4::Templates::getlanguagecookie( $in->{'query'}, $language ); - push @{$cookie}, $languagecookie; + $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie ); } return ( $template, $borrowernumber, $cookie, $flags ); @@ -868,13 +869,12 @@ sub checkauth { if ( !$shib and defined( $ENV{'REMOTE_USER'} ) and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { # Using Basic Authentication, no cookies required - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', - -expires => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); $loggedin = 1; } elsif ( $emailaddress) { @@ -924,12 +924,12 @@ sub checkauth { } } else { - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); my $sessiontype = $session->param('sessiontype') || ''; unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... @@ -970,12 +970,12 @@ sub checkauth { $sessionID = $session->id; C4::Context->_new_userenv($sessionID); - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { print STDERR "ERROR: Missing system preference AllowPKIAuth.\n"; @@ -1170,12 +1170,12 @@ sub checkauth { $domain =~ s|\.\*||g; if ( $ip !~ /^$domain/ ) { $loggedin = 0; - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); $info{'wrongip'} = 1; } } @@ -1258,12 +1258,12 @@ sub checkauth { { # successful login unless (@$cookie) { - push @$cookie, $query->cookie( + $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), - ); + )); } track_login_daily( $userid ); -- 2.20.1