From 65dd68fb80daafc317456bb96747193dcf254178 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 27 Jun 2022 04:43:12 +0000 Subject: [PATCH] Bug 31050: C4::Context->setup_session() standardizes user session setup Test plan: 0. Apply patch and koha-plack --restart kohadev 1. Log into http://localhost:8081/cgi-bin/koha/mainpage.pl using "koha" user 2. Note the login is successful 3. koha-mysql kohadev 3a. select * from sessions; Session in MySQL sets parameters like surname, flags, interface, ip, lasttime, etc 3b. select * from systempreferences where variable = 'Version'; 3c. update systempreferences set value = '' where variable = 'Version'; 4. koha-plack --restart kohadev 5. echo 'flush_all' | nc -q 1 memcached 11211 6. Visit http://localhost:8081/ and do the upgrade 6b. Note that the authentication and upgrade works without a problem 7. curl http://localhost:8081/cgi-bin/koha/svc/authentication -d 'userid=&password=' 8. koha-mysql kohadev 8a. select * from sessions; Session in MySQL sets parameters like surname, flags, interface, ip, lasttime, etc Signed-off-by: Martin Renvoize --- C4/Auth.pm | 77 +++++++++++++++++++++++++++-------------------- C4/Context.pm | 53 ++++++++++++++++++++++++++++++++ C4/InstallAuth.pm | 29 ++++++++++-------- 3 files changed, 115 insertions(+), 44 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index a44cd09767..b915a4a687 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1247,20 +1247,25 @@ sub checkauth { $is_sco_user = 1; } - $session->param( 'number', $borrowernumber ); - $session->param( 'id', $userid ); - $session->param( 'cardnumber', $cardnumber ); - $session->param( 'firstname', $firstname ); - $session->param( 'surname', $surname ); - $session->param( 'branch', $branchcode ); - $session->param( 'branchname', $branchname ); + C4::Context->setup_session({ + session => $session, + data => { + 'number', $borrowernumber, + 'id', $userid, + 'cardnumber', $cardnumber, + 'firstname', $firstname, + 'surname', $surname, + 'branch', $branchcode, + 'branchname', $branchname, + 'flags', $userflags, + 'emailaddress', $emailaddress, + 'interface', $type, + }, + }); + + #NOTE: Additional session data needed for this authentication method $session->param( 'desk_id', $desk_id); $session->param( 'desk_name', $desk_name); - $session->param( 'flags', $userflags ); - $session->param( 'emailaddress', $emailaddress ); - $session->param( 'ip', $session->remote_addr() ); - $session->param( 'lasttime', time() ); - $session->param( 'interface', $type); $session->param( 'shibboleth', $shibSuccess ); $session->param( 'register_id', $register_id ); $session->param( 'register_name', $register_name ); @@ -1285,10 +1290,12 @@ sub checkauth { $info{'invalid_username_or_password'} = 1; C4::Context::_unset_userenv($sessionID); } - $session->param( 'lasttime', time() ); - $session->param( 'ip', $session->remote_addr() ); - $session->param( 'sessiontype', 'anon' ); - $session->param( 'interface', $type); + C4::Context->setup_anon_session({ + session => $session, + data => { + interface => $type, + }, + }); } } # END if ( $q_userid elsif ( $type eq "opac" ) { @@ -1296,10 +1303,12 @@ sub checkauth { # anonymous sessions are created only for the OPAC # setting a couple of other session vars... - $session->param( 'ip', $session->remote_addr() ); - $session->param( 'lasttime', time() ); - $session->param( 'sessiontype', 'anon' ); - $session->param( 'interface', $type); + C4::Context->setup_anon_session({ + session => $session, + data => { + interface => $type, + }, + }); } $session->flush; } # END unless ($userid) @@ -1675,18 +1684,22 @@ sub check_api_auth { $branchname = $branches->{$br}->{'branchname'}; } } - $session->param( 'number', $borrowernumber ); - $session->param( 'id', $userid ); - $session->param( 'cardnumber', $cardnumber ); - $session->param( 'firstname', $firstname ); - $session->param( 'surname', $surname ); - $session->param( 'branch', $branchcode ); - $session->param( 'branchname', $branchname ); - $session->param( 'flags', $userflags ); - $session->param( 'emailaddress', $emailaddress ); - $session->param( 'ip', $session->remote_addr() ); - $session->param( 'lasttime', time() ); - $session->param( 'interface', 'api' ); + + C4::Context->setup_session({ + session => $session, + data => { + 'number', $borrowernumber, + 'id', $userid, + 'cardnumber', $cardnumber, + 'firstname', $firstname, + 'surname', $surname, + 'branch', $branchcode, + 'branchname', $branchname, + 'flags', $userflags, + 'emailaddress', $emailaddress, + 'interface', 'api', + }, + }); } $session->param( 'cas_ticket', $cas_ticket); C4::Context->set_userenv( diff --git a/C4/Context.pm b/C4/Context.pm index 8cb9bdefe7..42f6afbb81 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -1012,6 +1012,59 @@ sub is_internal_PSGI_request { return $is_internal; } +=head3 setup_session + +This function dictates what session parameters a Koha user session needs +as a bare minimum. + +=cut + +sub setup_session { + my ($class,$args) = @_; + my $rv = 0; + my $session = $args->{'session'}; + my $data = $args->{'data'}; + if ( $session && $data ){ + #NOTE: At some point, we might want to use data from a Koha::Patron object instead of many of these fields... + $session->param( 'number', $data->{number} ); #borrowernumber + $session->param( 'id', $data->{id} ); + $session->param( 'cardnumber', $data->{cardnumber} ); + $session->param( 'firstname', $data->{firstname} ); + $session->param( 'surname', $data->{surname} ); + $session->param( 'branch', $data->{branch} ); #branchcode + $session->param( 'branchname', $data->{branchname} ); + $session->param( 'flags', $data->{flags} ); #userflags + $session->param( 'emailaddress', $data->{emailaddress} ); + $session->param( 'ip', $session->remote_addr() ); + $session->param( 'lasttime', time() ); + $session->param( 'interface', $data->{interface} ); + $rv = 1; + } + return $rv; +} + +=head3 setup_anon_session + +This function dictates what session parameters an anonymous session needs +as a bare minimum. + +=cut + +sub setup_anon_session { + my ($class,$args) = @_; + my $rv = 0; + my $session = $args->{session}; + my $data = $args->{data}; + if ( $session && $data ){ + $session->param( 'ip', $session->remote_addr() ); + $session->param( 'lasttime', time() ); + $session->param( 'interface', $data->{interface}); + $session->param( 'sessiontype', 'anon' ); + $rv = 1; + } + return $rv; +} + __END__ =head1 ENVIRONMENT diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 56dd8e3260..1507549bb5 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -317,19 +317,24 @@ sub checkauth { "NO_LIBRARY_SET", 1, "" ); - $session->param( 'number', 0 ); - $session->param( 'id', C4::Context->config('user') ); - $session->param( 'cardnumber', C4::Context->config('user') ); - $session->param( 'firstname', C4::Context->config('user') ); - $session->param( 'surname', C4::Context->config('user'), ); - $session->param( 'branch', 'NO_LIBRARY_SET' ); - $session->param( 'branchname', 'NO_LIBRARY_SET' ); - $session->param( 'flags', 1 ); - $session->param( 'emailaddress', - C4::Context->preference('KohaAdminEmailAddress') ); - $session->param( 'ip', $session->remote_addr() ); - $session->param( 'lasttime', time() ); + $userid = C4::Context->config('user'); + + C4::Context->setup_session({ + session => $session, + data => { + 'number', 0, + 'id', $userid, + 'cardnumber', $userid, + 'firstname', $userid, + 'surname', $userid, + 'branch', 'NO_LIBRARY_SET', + 'branchname', 'NO_LIBRARY_SET', + 'flags', 1, + 'emailaddress', C4::Context->preference('KohaAdminEmailAddress'), + 'interface', undef, + }, + }); } } else { -- 2.20.1