View | Details | Raw Unified | Return to bug 27849
Collapse All | Expand All

(-)a/Koha/Token.pm (-11 / +7 lines)
Lines 60-65 use Koha::Exceptions::Token; Link Here
60
use base qw(Class::Accessor);
60
use base qw(Class::Accessor);
61
use constant HMAC_SHA1_LENGTH => 20;
61
use constant HMAC_SHA1_LENGTH => 20;
62
use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days..
62
use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days..
63
use constant DEFA_SESSION_ID => 0;
64
use constant DEFA_SESSION_USERID => 'anonymous';
63
65
64
=head1 METHODS
66
=head1 METHODS
65
67
Lines 212-228 sub decode_jwt { Link Here
212
214
213
sub _add_default_csrf_params {
215
sub _add_default_csrf_params {
214
    my ( $params ) = @_;
216
    my ( $params ) = @_;
215
    $params->{session_id} //= '';
217
    $params->{session_id} //= DEFA_SESSION_ID;
216
    if( !$params->{id} ) {
218
    my $userenv = C4::Context->userenv // { id => DEFA_SESSION_USERID };
217
        if( defined( C4::Context->userenv ) ) {
219
    $params->{id} //= Encode::encode( 'UTF-8', $userenv->{id} );
218
            $params->{id} = Encode::encode( 'UTF-8', C4::Context->userenv->{id} . $params->{session_id} );
220
    $params->{id} .= '_' . $params->{session_id};
219
        } else {
221
220
            $params->{id} = Encode::encode( 'UTF-8', $params->{session_id} );
221
        }
222
    } else {
223
        $params->{id} .= $params->{session_id};
224
    }
225
    $params->{id} //= Encode::encode( 'UTF-8', C4::Context->userenv->{id} );
226
    my $pw = C4::Context->config('pass');
222
    my $pw = C4::Context->config('pass');
227
    $params->{secret} //= md5_base64( Encode::encode( 'UTF-8', $pw ) ),
223
    $params->{secret} //= md5_base64( Encode::encode( 'UTF-8', $pw ) ),
228
    return $params;
224
    return $params;
(-)a/t/Token.t (-2 / +18 lines)
Lines 20-28 Link Here
20
# along with Koha; if not, see <http://www.gnu.org/licenses>.
20
# along with Koha; if not, see <http://www.gnu.org/licenses>.
21
21
22
use Modern::Perl;
22
use Modern::Perl;
23
use Test::More tests => 12;
23
use Test::More tests => 13;
24
use Test::Exception;
24
use Test::Exception;
25
use Time::HiRes qw|usleep|;
25
use Time::HiRes qw|usleep|;
26
26
use C4::Context;
27
use C4::Context;
27
use Koha::Token;
28
use Koha::Token;
28
29
Lines 117-119 subtest 'JWT' => sub { Link Here
117
    my $retrieved_id = $tokenizer->decode_jwt({ token => $jwt });
118
    my $retrieved_id = $tokenizer->decode_jwt({ token => $jwt });
118
    is( $retrieved_id, $id, 'id stored in jwt should be correct' );
119
    is( $retrieved_id, $id, 'id stored in jwt should be correct' );
119
};
120
};
120
- 
121
122
subtest 'testing _add_default_csrf_params with/without userenv (bug 27849)' => sub {
123
    plan tests => 5;
124
125
    # Current userenv: userid == 42
126
    my $result = Koha::Token::_add_default_csrf_params({ session_id => '567' });
127
    is( $result->{session_id}, 567, 'Check session id' );
128
    is( $result->{id}, '42_567', 'Check userid' );
129
130
    # Clear userenv
131
    C4::Context::_unset_userenv('DUMMY SESSION');
132
    is( C4::Context::userenv, undef, 'No userenv anymore' );
133
    $result = Koha::Token::_add_default_csrf_params({}); # pass no session_id
134
    is( $result->{session_id}, Koha::Token::DEFA_SESSION_ID, 'Check session id' );
135
    is( $result->{id}, Koha::Token::DEFA_SESSION_USERID. '_'. $result->{session_id}, 'Check userid' );
136
};

Return to bug 27849