From 8e5d44551d286b4fc11a83abb6459843107d7199 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 5 Jan 2021 11:28:16 +0100
Subject: [PATCH] Bug 27342: Remove dbh from C4::Auth

We must not pass $dbh but retrieve it when needed instead
---
 C4/Auth.pm                       | 24 ++++++++++++------------
 C4/Auth_with_cas.pm              |  6 ++++--
 C4/Auth_with_ldap.pm             |  4 ++--
 C4/SIP/ILS/Patron.pm             |  3 +--
 Koha/REST/V1/Auth.pm             |  3 +--
 Koha/REST/V1/Patrons/Password.pm |  3 +--
 opac/sco/sco-main.pl             |  3 +--
 t/db_dependent/Auth.t            | 23 +++++++++++------------
 t/db_dependent/Auth_with_ldap.t  | 25 +++++++++++--------------
 t/db_dependent/Log.t             | 23 ++++++++++-------------
 10 files changed, 54 insertions(+), 63 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 614d33edd49..dd6b2fbc204 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -398,7 +398,6 @@ sub get_template_and_user {
                 # we add them to the logged-in search history
                 my @recentSearches = C4::Search::History::get_from_session( { cgi => $in->{'query'} } );
                 if (@recentSearches) {
-                    my $dbh   = C4::Context->dbh;
                     my $query = q{
                         INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, type,  total, time )
                         VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -835,7 +834,6 @@ sub checkauth {
           @allowed_scripts_for_private_opac;
     }
 
-    my $dbh     = C4::Context->dbh;
     my $timeout = _timeout_syspref();
 
     _version_check( $type, $query );
@@ -994,7 +992,7 @@ sub checkauth {
                 my $retuserid;
 
                 # Do not pass password here, else shib will not be checked in checkpw.
-                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $q_userid, undef, $query );
+                ( $return, $cardnumber, $retuserid ) = checkpw( $q_userid, undef, $query );
                 $userid      = $retuserid;
                 $shibSuccess = $return;
                 $info{'invalidShibLogin'} = 1 unless ($return);
@@ -1005,7 +1003,7 @@ sub checkauth {
                 if ( $cas && $query->param('ticket') ) {
                     my $retuserid;
                     ( $return, $cardnumber, $retuserid, $cas_ticket ) =
-                      checkpw( $dbh, $userid, $password, $query, $type );
+                      checkpw( $userid, $password, $query, $type );
                     $userid = $retuserid;
                     $info{'invalidCasLogin'} = 1 unless ($return);
                 }
@@ -1074,7 +1072,7 @@ sub checkauth {
                     {
 
                         ( $return, $cardnumber, $retuserid, $cas_ticket ) =
-                          checkpw( $dbh, $q_userid, $password, $query, $type );
+                          checkpw( $q_userid, $password, $query, $type );
                         $userid = $retuserid if ($retuserid);
                         $info{'invalid_username_or_password'} = 1 unless ($return);
                     }
@@ -1119,6 +1117,7 @@ sub checkauth {
                     FROM borrowers
                     LEFT JOIN branches on borrowers.branchcode=branches.branchcode
                     ";
+                    my $dbh = C4::Context->dbh;
                     my $sth = $dbh->prepare("$select where userid=?");
                     $sth->execute($userid);
                     unless ( $sth->rows ) {
@@ -1460,7 +1459,6 @@ sub check_api_auth {
 
     my $query         = shift;
     my $flagsrequired = shift;
-    my $dbh     = C4::Context->dbh;
     my $timeout = _timeout_syspref();
 
     unless ( C4::Context->preference('Version') ) {
@@ -1512,7 +1510,7 @@ sub check_api_auth {
 
             # In case of a CAS authentication, we use the ticket instead of the password
             my $PT = $query->param('PT');
-            ( $return, $cardnumber, $userid, $cas_ticket ) = check_api_auth_cas( $dbh, $PT, $query );    # EXTERNAL AUTH
+            ( $return, $cardnumber, $userid, $cas_ticket ) = check_api_auth_cas( $PT, $query );    # EXTERNAL AUTH
         } else {
 
             # User / password auth
@@ -1522,7 +1520,7 @@ sub check_api_auth {
                 return ( "failed", undef, undef );
             }
             my $newuserid;
-            ( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $dbh, $userid, $password, $query );
+            ( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $userid, $password, $query );
         }
 
         if ( $return and haspermission( $userid, $flagsrequired ) ) {
@@ -1543,6 +1541,7 @@ sub check_api_auth {
                     $userflags,      $branchcode, $branchname,
                     $emailaddress
                 );
+                my $dbh = C4::Context->dbh;
                 my $sth =
                   $dbh->prepare(
 "select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where userid=?"
@@ -1798,7 +1797,7 @@ sub get_session {
 # Currently it's only passed from C4::SIP::ILS::Patron::check_password, but
 # not having a userenv defined could cause a crash.
 sub checkpw {
-    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
+    my ( $userid, $password, $query, $type, $no_set_userenv ) = @_;
     $type = 'opac' unless $type;
 
     # Get shibboleth login attribute
@@ -1833,7 +1832,7 @@ sub checkpw {
         # In case of a CAS authentication, we use the ticket instead of the password
         my $ticket = $query->param('ticket');
         $query->delete('ticket');                                   # remove ticket to come back to original URL
-        my ( $retval, $retcard, $retuserid, $cas_ticket ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
+        my ( $retval, $retcard, $retuserid, $cas_ticket ) = checkpw_cas( $ticket, $query, $type );    # EXTERNAL AUTH
         if ( $retval ) {
             @return = ( $retval, $retcard, $retuserid, $cas_ticket );
         } else {
@@ -1865,7 +1864,7 @@ sub checkpw {
 
     # INTERNAL AUTH
     if ( $check_internal_as_fallback ) {
-        @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv);
+        @return = checkpw_internal( $userid, $password, $no_set_userenv);
         $passwd_ok = 1 if $return[0] > 0; # 1 or 2
     }
 
@@ -1888,11 +1887,12 @@ sub checkpw {
 }
 
 sub checkpw_internal {
-    my ( $dbh, $userid, $password, $no_set_userenv ) = @_;
+    my ( $userid, $password, $no_set_userenv ) = @_;
 
     $password = Encode::encode( 'UTF-8', $password )
       if Encode::is_utf8($password);
 
+    my $dbh = C4::Context->dbh;
     my $sth =
       $dbh->prepare(
         "select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where userid=?"
diff --git a/C4/Auth_with_cas.pm b/C4/Auth_with_cas.pm
index 3817a69d700..719df30583c 100644
--- a/C4/Auth_with_cas.pm
+++ b/C4/Auth_with_cas.pm
@@ -99,7 +99,7 @@ sub login_cas_url {
 # Checks for password correctness
 # In our case : is there a ticket, is it valid and does it match one of our users ?
 sub checkpw_cas {
-    my ($dbh, $ticket, $query, $type) = @_;
+    my ($ticket, $query, $type) = @_;
     my $retnumber;
     my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
 
@@ -117,6 +117,7 @@ sub checkpw_cas {
             # we should store the CAS ticekt too, we need this for single logout https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#233-single-logout
 
             # Does it match one of our users ?
+            my $dbh = C4::Context->dbh;
             my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
             $sth->execute($userid);
             if ( $sth->rows ) {
@@ -147,7 +148,7 @@ sub checkpw_cas {
 
 # Proxy CAS auth
 sub check_api_auth_cas {
-    my ($dbh, $PT, $query, $type) = @_;
+    my ($PT, $query, $type) = @_;
     my $retnumber;
     my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
 
@@ -164,6 +165,7 @@ sub check_api_auth_cas {
             # we should store the CAS ticket too, we need this for single logout https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#233-single-logout
 
             # Does it match one of our users ?
+            my $dbh = C4::Context->dbh;
             my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
             $sth->execute($userid);
             if ( $sth->rows ) {
diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm
index 7f6c99a9a46..8bb14c32537 100644
--- a/C4/Auth_with_ldap.pm
+++ b/C4/Auth_with_ldap.pm
@@ -109,7 +109,7 @@ sub search_method {
 }
 
 sub checkpw_ldap {
-    my ($dbh, $userid, $password) = @_;
+    my ($userid, $password) = @_;
     my @hosts = split(',', $prefhost);
     my $db = Net::LDAP->new(\@hosts);
     unless ( $db ) {
@@ -355,7 +355,7 @@ sub _do_changepassword {
     #warn "changing local password for borrowernumber=$borrowerid to '$digest'\n";
     Koha::Patrons->find($borrowerid)->set_password({ password => $password, skip_validation => 1 });
 
-    my ($ok, $cardnum) = checkpw_internal(C4::Context->dbh, $userid, $password);
+    my ($ok, $cardnum) = checkpw_internal($userid, $password);
     return $cardnum if $ok;
 
     warn "Password mismatch after update to borrowernumber=$borrowerid";
diff --git a/C4/SIP/ILS/Patron.pm b/C4/SIP/ILS/Patron.pm
index 95166d3da80..dc7fc58ec3c 100644
--- a/C4/SIP/ILS/Patron.pm
+++ b/C4/SIP/ILS/Patron.pm
@@ -268,9 +268,8 @@ sub check_password {
     # If the record has a NULL password, accept '' as match
     return $pwd eq q{} unless $self->{password};
 
-    my $dbh = C4::Context->dbh;
     my $ret = 0;
-    ($ret) = checkpw( $dbh, $self->{userid}, $pwd, undef, undef, 1 ); # dbh, userid, query, type, no_set_userenv
+    ($ret) = checkpw( $self->{userid}, $pwd, undef, undef, 1 ); # userid, query, type, no_set_userenv
     return $ret;
 }
 
diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
index 7bbf97fc057..8c960ab213b 100644
--- a/Koha/REST/V1/Auth.pm
+++ b/Koha/REST/V1/Auth.pm
@@ -486,8 +486,7 @@ sub _basic_auth {
     my $decoded_credentials = decode_base64( $credentials );
     my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 );
 
-    my $dbh = C4::Context->dbh;
-    unless ( checkpw_internal($dbh, $user_id, $password ) ) {
+    unless ( checkpw_internal($user_id, $password ) ) {
         Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Invalid password' );
     }
 
diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm
index 35379edf187..96f259c3816 100644
--- a/Koha/REST/V1/Patrons/Password.pm
+++ b/Koha/REST/V1/Patrons/Password.pm
@@ -119,8 +119,7 @@ sub set_public {
     }
 
     return try {
-        my $dbh = C4::Context->dbh;
-        unless ( checkpw_internal($dbh, $user->userid, $old_password ) ) {
+        unless ( checkpw_internal($user->userid, $old_password ) ) {
             return $c->render(
                 status  => 400,
                 openapi => { error => "Invalid password" }
diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index 7e056fa34e0..0ed84092351 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -118,8 +118,7 @@ my $issuer   = Koha::Patrons->find( $issuerid )->unblessed;
 my $patronid = $jwt ? Koha::Token->new->decode_jwt({ token => $jwt }) : undef;
 unless ( $patronid ) {
     if ( C4::Context->preference('SelfCheckoutByLogin') ) {
-        my $dbh = C4::Context->dbh;
-        ( undef, $patronid ) = checkpw( $dbh, $patronlogin, $patronpw );
+        ( undef, $patronid ) = checkpw( $patronlogin, $patronpw );
     }
     else {    # People should not do that unless they know what they are doing!
               # SelfCheckAllowByIPRanges MUST be configured
diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index 187270caaeb..30d3846fc64 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -26,7 +26,6 @@ BEGIN {
 
 my $schema  = Koha::Database->schema;
 my $builder = t::lib::TestBuilder->new;
-my $dbh     = C4::Context->dbh;
 
 # FIXME: SessionStorage defaults to mysql, but it seems to break transaction
 # handling
@@ -164,14 +163,14 @@ subtest 'no_set_userenv parameter tests' => sub {
     t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
     $patron->set_password({ password => $password });
 
-    ok( checkpw( $dbh, $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
+    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
     is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
     C4::Context->_new_userenv('DUMMY SESSION');
     C4::Context->set_userenv(0,0,0,'firstname','surname', $library->branchcode, 'Library 1', 0, '', '');
     is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv gives correct branch' );
-    ok( checkpw( $dbh, $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
+    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
     is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv branch is preserved if no_set_userenv is true' );
-    ok( checkpw( $dbh, $patron->userid, $password, undef, undef, 0 ), 'checkpw still returns true' );
+    ok( checkpw( $patron->userid, $password, undef, undef, 0 ), 'checkpw still returns true' );
     isnt( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv branch is overwritten if no_set_userenv is false' );
 };
 
@@ -186,15 +185,15 @@ subtest 'checkpw lockout tests' => sub {
     t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
     $patron->set_password({ password => $password });
 
-    my ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->cardnumber, $password, undef, undef, 1 );
+    my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
     ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' );
-    ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->userid, "wrong_password", undef, undef, 1 );
+    ( $checkpw, undef, undef ) = checkpw( $patron->userid, "wrong_password", undef, undef, 1 );
     is( $checkpw, 0, 'checkpw returns false when given wrong password' );
     $patron = $patron->get_from_storage;
     is( $patron->account_locked, 1, "Account is locked from failed login");
-    ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->userid, $password, undef, undef, 1 );
+    ( $checkpw, undef, undef ) = checkpw( $patron->userid, $password, undef, undef, 1 );
     is( $checkpw, undef, 'checkpw returns undef with right password when account locked' );
-    ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->cardnumber, $password, undef, undef, 1 );
+    ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
     is( $checkpw, undef, 'checkpw returns undefwith right password when logging in via cardnumber if account locked' );
 
 };
@@ -392,7 +391,7 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     $patron->password('123')->store; # yes, deliberately not hashed
 
     is( $patron->account_locked, 0, 'Patron not locked' );
-    my @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    my @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
         # Note: 123 will not be hashed to 123 !
     is( $test[0], 0, 'checkpw should have failed' );
     $patron->discard_changes; # refresh
@@ -400,7 +399,7 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     is( $patron->account_locked, 1, 'Check locked status' );
 
     # And another try to go over the limit: different return value!
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( @test, 0, 'checkpw failed again and returns nothing now' );
     $patron->discard_changes; # refresh
     is( $patron->login_attempts, 3, 'Login attempts not increased anymore' );
@@ -410,11 +409,11 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     my $auth = Test::MockModule->new( 'C4::Auth' );
     $auth->mock( 'checkpw_hash', sub { return 1; } ); # not for production :)
     $patron->login_attempts(0)->store;
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( $test[0], 1, 'Build confidence in the mock' );
     $patron->login_attempts(-1)->store;
     is( $patron->account_locked, 1, 'Check administrative lockout' );
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( @test, 0, 'checkpw gave red' );
     $patron->discard_changes; # refresh
     is( $patron->login_attempts, -1, 'Still locked out' );
diff --git a/t/db_dependent/Auth_with_ldap.t b/t/db_dependent/Auth_with_ldap.t
index 39f6e8ef022..df385e1569f 100755
--- a/t/db_dependent/Auth_with_ldap.t
+++ b/t/db_dependent/Auth_with_ldap.t
@@ -28,8 +28,6 @@ use C4::Context;
 
 use Koha::Patrons;
 
-my $dbh = '';
-
 # Start transaction
 my $schema = Koha::Database->new->schema;
 $schema->storage->txn_begin();
@@ -131,12 +129,11 @@ subtest 'checkpw_ldap tests' => sub {
 
     plan tests => 4;
 
-    my $dbh = C4::Context->dbh;
     ## Connection fail tests
     $desired_connection_result = 'error';
     warning_is {
         $ret =
-          C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' );
+          C4::Auth_with_ldap::checkpw_ldap( 'hola', password => 'hey' );
     }
     'LDAP connexion failed',
       'checkpw_ldap prints correct warning if LDAP conexion fails';
@@ -158,7 +155,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/Anonymous LDAP bind failed: LDAP error #1: error_name/,
@@ -171,7 +168,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
@@ -204,7 +201,7 @@ subtest 'checkpw_ldap tests' => sub {
             }
         );
 
-        C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' );
+        C4::Auth_with_ldap::checkpw_ldap( 'hola', password => 'hey' );
         ok(
             Koha::Patrons->find($borrower->{borrowernumber})->extended_attributes->count,
             'Extended attributes are not deleted'
@@ -219,7 +216,7 @@ subtest 'checkpw_ldap tests' => sub {
         $patron->delete;
         reload_ldap_module();
         is(
-            C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' ),
+            C4::Auth_with_ldap::checkpw_ldap( 'hola', password => 'hey' ),
             0,
             'checkpw_ldap returns 0 if user lookup returns 0'
         );
@@ -228,7 +225,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
@@ -246,7 +243,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
@@ -271,7 +268,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/,
@@ -286,7 +283,7 @@ qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: er
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP Auth rejected : invalid password for user 'hola'./,
@@ -300,7 +297,7 @@ qr/LDAP Auth rejected : invalid password for user 'hola'./,
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/,
@@ -313,7 +310,7 @@ qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: er
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP Auth rejected : invalid password for user 'hola'./,
diff --git a/t/db_dependent/Log.t b/t/db_dependent/Log.t
index 0e46eea4c90..fd821252d31 100755
--- a/t/db_dependent/Log.t
+++ b/t/db_dependent/Log.t
@@ -30,7 +30,6 @@ use t::lib::TestBuilder;
 # Make sure we can rollback.
 our $schema  = Koha::Database->new->schema;
 $schema->storage->txn_begin;
-our $dbh = C4::Context->dbh;
 
 subtest 'Existing tests' => sub {
     plan tests => 3;
@@ -47,17 +46,15 @@ subtest 'Existing tests' => sub {
     ok($success, "logaction seemed to work");
 
     # We want numbers to be the same between runs.
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
 
     t::lib::Mocks::mock_preference('CronjobLog',0);
     cronlogaction();
-    my $cronJobCount = $dbh->selectrow_array("SELECT COUNT(*) FROM action_logs WHERE module='CRONJOBS';",{});
-    is($cronJobCount,0,"Cronjob not logged as expected.");
+    is(Koha::ActionLogs->search({ module => 'CRONJOBS' })->count,0,"Cronjob not logged as expected.");
 
     t::lib::Mocks::mock_preference('CronjobLog',1);
     cronlogaction();
-    $cronJobCount = $dbh->selectrow_array("SELECT COUNT(*) FROM action_logs WHERE module='CRONJOBS';",{});
-    is($cronJobCount,1,"Cronjob logged as expected.");
+    is(Koha::ActionLogs->search({ module => 'CRONJOBS' })->count,0,"Cronjob logged as expected.");
 };
 
 subtest 'logaction(): interface is correctly logged' => sub {
@@ -65,28 +62,28 @@ subtest 'logaction(): interface is correctly logged' => sub {
     plan tests => 4;
 
     # No interface passed, using C4::Context->interface
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'commandline' );
     logaction( "MEMBERS", "MODIFY", 1, "test operation");
     my $log = Koha::ActionLogs->search->next;
     is( $log->interface, 'commandline', 'Interface correctly deduced (commandline)');
 
     # No interface passed, using C4::Context->interface
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'opac' );
     logaction( "MEMBERS", "MODIFY", 1, "test operation");
     $log = Koha::ActionLogs->search->next;
     is( $log->interface, 'opac', 'Interface correctly deduced (opac)');
 
     # Explicit interfaces
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'intranet' );
     logaction( "MEMBERS", "MODIFY", 1, 'test info', 'intranet');
     $log = Koha::ActionLogs->search->next;
     is( $log->interface, 'intranet', 'Passed interface is respected (intranet)');
 
     # Explicit interfaces
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'sip' );
     logaction( "MEMBERS", "MODIFY", 1, 'test info', 'sip');
     $log = Koha::ActionLogs->search->next;
@@ -114,7 +111,7 @@ subtest 'GDPR logging' => sub {
     t::lib::Mocks::mock_preference('AuthFailureLog', 1);
     my $strong_password = 'N0tStr0ngAnyM0reN0w:)';
     $patron->set_password({ password => $strong_password });
-    my @ret = checkpw( $dbh, $patron->userid, 'WrongPassword', undef, undef, 1);
+    my @ret = checkpw( $patron->userid, 'WrongPassword', undef, undef, 1);
     is( $ret[0], 0, 'Authentication failed' );
     # Look for auth failure but NOT on patron id, pass userid in info parameter
     $logs = Koha::ActionLogs->search(
@@ -126,7 +123,7 @@ subtest 'GDPR logging' => sub {
     );
     is( $logs->count, 1, 'We should find one auth failure with this userid' );
     t::lib::Mocks::mock_preference('AuthFailureLog', 0);
-    @ret = checkpw( $dbh, $patron->userid, 'WrongPassword', undef, undef, 1);
+    @ret = checkpw( $patron->userid, 'WrongPassword', undef, undef, 1);
     $logs = Koha::ActionLogs->search(
         {
             module => 'AUTH',
@@ -136,7 +133,7 @@ subtest 'GDPR logging' => sub {
     );
     is( $logs->count, 1, 'Still only one failure with this userid' );
     t::lib::Mocks::mock_preference('AuthSuccessLog', 1);
-    @ret = checkpw( $dbh, $patron->userid, $strong_password, undef, undef, 1);
+    @ret = checkpw( $patron->userid, $strong_password, undef, undef, 1);
     is( $ret[0], 1, 'Authentication succeeded' );
     # Now we can look for patron id
     $logs = Koha::ActionLogs->search(
-- 
2.25.1