View | Details | Raw Unified | Return to bug 9102
Collapse All | Expand All

(-)a/C4/Auth.pm (-10 / +23 lines)
Lines 633-645 sub checkauth { Link Here
633
    if ( $userid = $ENV{'REMOTE_USER'} ) {
633
    if ( $userid = $ENV{'REMOTE_USER'} ) {
634
        # Using Basic Authentication, no cookies required
634
        # Using Basic Authentication, no cookies required
635
        $cookie = $query->cookie(
635
        $cookie = $query->cookie(
636
            -name    => 'CGISESSID',
636
            -name     => 'CGISESSID',
637
            -value   => '',
637
            -value    => '',
638
            -expires => ''
638
            -expires  => '',
639
            -HttpOnly => 1,
639
        );
640
        );
640
        $loggedin = 1;
641
        $loggedin = 1;
641
    }
642
    }
642
    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison
643
    elsif ( $sessionID = $query->cookie("CGISESSID") )
644
    {    # assignment, not comparison
643
        my $session = get_session($sessionID);
645
        my $session = get_session($sessionID);
644
        C4::Context->_new_userenv($sessionID);
646
        C4::Context->_new_userenv($sessionID);
645
        my ($ip, $lasttime, $sessiontype);
647
        my ($ip, $lasttime, $sessiontype);
Lines 705-712 sub checkauth { Link Here
705
            $userid    = undef;
707
            $userid    = undef;
706
        }
708
        }
707
        else {
709
        else {
708
            $cookie = $query->cookie( CGISESSID => $session->id );
710
            $cookie = $query->cookie(
709
            $session->param('lasttime',time());
711
                -name     => 'CGISESSID',
712
                -value    => $session->id,
713
                -HttpOnly => 1
714
            );
715
            $session->param( 'lasttime', time() );
710
            unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
716
            unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
711
                $flags = haspermission($userid, $flagsrequired);
717
                $flags = haspermission($userid, $flagsrequired);
712
                if ($flags) {
718
                if ($flags) {
Lines 722-729 sub checkauth { Link Here
722
        my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
728
        my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
723
        my $sessionID = $session->id;
729
        my $sessionID = $session->id;
724
        C4::Context->_new_userenv($sessionID);
730
        C4::Context->_new_userenv($sessionID);
725
        $cookie = $query->cookie( CGISESSID => $sessionID );
731
        $cookie = $query->cookie(
726
        $userid = $query->param('userid');
732
            -name     => 'CGISESSID',
733
            -value    => $session->id,
734
            -HttpOnly => 1
735
        );
736
    $userid = $query->param('userid');
727
        if (   ( $cas && $query->param('ticket') )
737
        if (   ( $cas && $query->param('ticket') )
728
            || $userid
738
            || $userid
729
            || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne
739
            || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne
Lines 914-920 sub checkauth { Link Here
914
    {
924
    {
915
        # successful login
925
        # successful login
916
        unless ($cookie) {
926
        unless ($cookie) {
917
            $cookie = $query->cookie( CGISESSID => '' );
927
            $cookie = $query->cookie(
928
                -name     => 'CGISESSID',
929
                -value    => '',
930
                -HttpOnly => 1
931
            );
918
        }
932
        }
919
        return ( $userid, $cookie, $sessionID, $flags );
933
        return ( $userid, $cookie, $sessionID, $flags );
920
    }
934
    }
921
- 

Return to bug 9102