View | Details | Raw Unified | Return to bug 31380
Collapse All | Expand All

(-)a/Koha/Auth.pm (+130 lines)
Line 0 Link Here
1
package Koha::Auth;
2
3
use Modern::Perl;
4
5
use C4::Auth qw//;
6
use C4::Context qw//;
7
8
=head2 authenticate
9
10
    my $user = Koha::Auth->authenticate({
11
        sessionID => $sessionID,
12
    });
13
14
Verifies that this user has an authenticated Koha session
15
16
=cut
17
18
sub authenticate {
19
    my ($class,$args) = @_;
20
    my ($auth_user,$auth_session);
21
    my $sessionID = $args->{sessionID};
22
    if ($sessionID){
23
        my $flags;
24
        my ( $return, $session, $more_info) = C4::Auth::check_cookie_auth($sessionID,$flags,
25
            { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
26
        );
27
        if ($return && $return eq 'ok' && $session){
28
            my $userid = $session->param('id');
29
            if ( $userid ){
30
                my $patron = Koha::Patrons->find({ userid => $userid });
31
                if ($patron){
32
                    $auth_user = $patron;
33
                    $auth_session = $session;
34
                }
35
            }
36
        }
37
    }
38
    return ($auth_user,$auth_session);
39
}
40
41
=head2 authorize
42
43
    my $flags = Koha::Auth->authorize({
44
        session => $session,
45
        flagsrequired => { self_check => 'self_checkout_module' },
46
    });
47
48
=cut
49
50
sub authorize {
51
    my ($class,$args) = @_;
52
    my $flags;
53
    my $session = $args->{session};
54
    my $flagsrequired = $args->{flagsrequired};
55
    if ($session && $flagsrequired){
56
        my $userid = $session->param('id');
57
        if ($userid){
58
            $flags = C4::Auth::haspermission($userid,$flagsrequired);
59
        }
60
    }
61
    return $flags;
62
}
63
64
sub get_authz_from_flags {
65
    my ($args) = @_;
66
    my $flags = $args->{flags};
67
    my $authz;
68
69
    #FIXME: Replace using BZ 31389
70
    #FIXME: This contains a lot of copy/paste from C4::Auth
71
    my $all_perms = C4::Auth::get_all_subpermissions();
72
73
    if ($flags){
74
        if ( $flags->{superlibrarian} == 1 ){
75
            #NOTE: These are similar but slightly different to @flagroots...
76
            my @perms = qw/
77
                circulate
78
                catalogue
79
                parameters
80
                borrowers
81
                permissions
82
                reserveforothers
83
                editcatalogue
84
                updatecharges
85
                acquisition
86
                tools
87
                editauthorities
88
                serials
89
                reports
90
                staffaccess
91
                plugins
92
                coursereserves
93
                clubs
94
                ill
95
                stockrotation
96
                problem_reports
97
            /;
98
            foreach my $perm (@perms){
99
                $authz->{ "CAN_user_${perm}" } = 1;
100
            }
101
            foreach my $module ( keys %$all_perms ) {
102
                foreach my $subperm ( keys %{ $all_perms->{$module} } ) {
103
                    $authz->{ "CAN_user_${module}_${subperm}" } = 1;
104
                }
105
            }
106
        }
107
        else {
108
            foreach my $module ( keys %$all_perms ) {
109
                if ( defined($flags->{$module}) && $flags->{$module} == 1 ) {
110
                    foreach my $subperm ( keys %{ $all_perms->{$module} } ) {
111
                        $authz->{ "CAN_user_${module}_${subperm}" } = 1;
112
                    }
113
                } elsif ( ref( $flags->{$module} ) ) {
114
                    foreach my $subperm ( keys %{ $flags->{$module} } ) {
115
                        $authz->{ "CAN_user_${module}_${subperm}" } = 1;
116
                    }
117
                }
118
            }
119
            foreach my $module ( keys %$flags ) {
120
                if ( $flags->{$module} == 1 or ref( $flags->{$module} ) ) {
121
                    $authz->{ "CAN_user_$module" } = 1;
122
                }
123
            }
124
        }
125
    }
126
127
    return $authz;
128
}
129
130
1;
(-)a/Koha/Staff.pm (+88 lines)
Line 0 Link Here
1
package Koha::Staff;
2
3
use Mojo::Base 'Mojolicious';
4
use C4::Context;
5
6
use Koha::Auth;
7
use Koha::Template;
8
9
sub startup {
10
    my $self = shift;
11
12
    #FIXME: Move into a plugin?
13
    $self->helper(
14
        staff_authorize => sub {
15
            my ($c,$args) = @_;
16
            my $session = $c->stash->{__koha_session__};
17
            my $flags = Koha::Auth->authorize({
18
                session => $session,
19
                flagsrequired => $args->{flagsrequired},
20
            });
21
            if($flags){
22
                $c->stash->{__koha_flags__} = $flags;
23
                $c->stash->{__koha_authz__} = Koha::Auth::get_authz_from_flags({ flags => $flags });
24
                return ($flags,$c->stash->{__koha__user__});
25
            }
26
            else {
27
                $c->render( text => 'Forbidden', status => 403 );
28
                return;
29
            }
30
        }
31
    );
32
    #FIXME: Move into a plugin?
33
    $self->helper(
34
        prepare_template => sub {
35
            my ($c,$args) = @_;
36
            my $template_filename = $args->{template_filename};
37
            my $interface = $args->{interface};
38
            my $template = Koha::Template::prepare_template({
39
                template_filename => $template_filename,
40
                interface => $interface,
41
                koha_session => $c->stash->{__koha_session__},
42
                koha_user => $c->stash->{__koha_user__},
43
                koha_authz => $c->stash->{__koha_authz__},
44
            });
45
            return $template;
46
        }
47
    );
48
49
    # Router
50
    my $r = $self->routes;
51
52
    #NOTE: The /login route is public and does not require authentication
53
    #FIXME: Implement a Mojolicious login route
54
    #$r->get('/login')->to( controller => 'login', action => 'index' );
55
56
    #NOTE: All other routes require authentication
57
    my $auth = $r->under('/' => sub {
58
        my $c = shift;
59
        my $sessionID = $c->cookie('CGISESSID');
60
        my ($user,$session) = Koha::Auth->authenticate({
61
            sessionID => $sessionID,
62
        });
63
        if ($user && $session){
64
            $c->stash->{__koha_user__} = $user;
65
            $c->stash->{__koha_session__} = $session;
66
            $c->cookie(
67
                'CGISESSID' => $session->id,
68
                {
69
                    httponly => 1,
70
                    secure => ( C4::Context->https_enabled() ? 1 : 0 ),
71
                    path => '/',
72
                }
73
            );
74
            return 1;
75
        }
76
        else {
77
            #FIXME: In future, redirect to a /login route
78
            $c->redirect_to('/index.html');
79
            return;
80
        }
81
    });
82
    my $plugins = $auth->under('plugins');
83
    #NOTE: Mojolicious 9 seems to require explicitly defining all routes (rather than getting :controller and :action from the path...
84
    $plugins->any(['GET','POST'] => '/run')->to(controller => 'Plugins', action => 'run');
85
    #FIXME: handle 404 errors with catch all routes
86
}
87
88
1;
(-)a/Koha/Staff/Controller/Plugins.pm (+40 lines)
Line 0 Link Here
1
package Koha::Staff::Controller::Plugins;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious::Controller';
19
20
use C4::Context;
21
use Koha::Plugins::Handler;
22
23
sub run {
24
    my $c = shift;
25
    my $class = $c->param('class');
26
    my $method = $c->param('method');
27
    my ($flags,$loggedinuser) = $c->staff_authorize({ flagsrequired => { 'plugins' => $method } });
28
    my $plugins_enabled = C4::Context->config("enable_plugins");
29
    if ( $plugins_enabled ) {
30
        my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
31
    } else {
32
        my $template = $c->prepare_template({
33
            template_filename => 'plugins/plugins-disabled.tt',
34
            interface => 'intranet',
35
        });
36
        $c->render( text => $template->output );
37
    }
38
}
39
40
1;
(-)a/Koha/Template.pm (+41 lines)
Line 0 Link Here
1
package Koha::Template;
2
3
use strict;
4
use warnings;
5
6
use C4::Templates;
7
8
sub prepare_template {
9
    my ($args) = @_;
10
    my $template;
11
    my $session = $args->{koha_session};
12
    my $user = $args->{koha_user};
13
    my $authz = $args->{koha_authz};
14
    my $template_filename = $args->{template_filename};
15
    my $interface = $args->{interface};
16
    if ($template_filename && $interface){
17
        #FIXME: See Bug 27293 about refactoring C4::Templates::gettemplate for providing the "language" param and "KohaOpacLanguage" cookie
18
        $template = C4::Templates::gettemplate($template_filename,$interface);
19
        if ($template){
20
            if ($session){
21
                $template->{VARS}->{ sessionID } = $session->param('id');
22
            }
23
            if ($user){
24
                $template->{VARS}->{ logged_in_user } = $user;
25
                $template->{VARS}->{ loggedinusernumber } = $user->borrowernumber;
26
                $template->{VARS}->{ loggedinusername } = $user->userid;
27
            }
28
            if ($authz){
29
                foreach my $key ( keys %$authz ){
30
                    $template->{VARS}->{ $key } = $authz->{$key};
31
                }
32
            }
33
34
            #NOTE: You could include all the syspref stuff here that exists in C4::Auth,
35
            #but I rather avoid it, and have templates update to use the Koha.Preference mechanism instead.
36
        }
37
    }
38
    return $template;
39
}
40
41
1;
(-)a/debian/templates/plack.psgi (+32 lines)
Lines 66-71 my $apiv1 = builder { Link Here
66
    $server->to_psgi_app;
66
    $server->to_psgi_app;
67
};
67
};
68
68
69
my $staff_interface = builder {
70
    my $server = Mojo::Server::PSGI->new;
71
    $server->build_app('Koha::Staff');
72
    my $app = $server->app;
73
    $app->hook( before_dispatch => sub {
74
        my $c = shift;
75
        #NOTE: Rewrite the base path to strip off the mount prefix
76
        my $path = $c->req->url->base->path(Mojo::Path->new);
77
78
    });
79
    $server->to_psgi_app;
80
};
81
69
Koha::Logger->_init;
82
Koha::Logger->_init;
70
83
71
builder {
84
builder {
Lines 114-119 builder { Link Here
114
        }
127
        }
115
        $intranet;
128
        $intranet;
116
    };
129
    };
130
    mount '/intranet/staff' => builder {
131
        #NOTE: it is important that these are relative links
132
        enable 'ErrorDocument',
133
            400 => 'errors/400.pl',
134
            401 => 'errors/401.pl',
135
            402 => 'errors/402.pl',
136
            403 => 'errors/403.pl',
137
            404 => 'errors/404.pl',
138
            500 => 'errors/500.pl',
139
            subrequest => 1;
140
        #NOTE: Without this middleware to catch fatal errors, ErrorDocument won't be able to render a 500 document
141
        #NOTE: This middleware must be closer to the PSGI app than ErrorDocument
142
        enable "HTTPExceptions";
143
        if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){
144
            enable 'Log4perl', category => 'plack-intranet';
145
            enable 'LogWarn';
146
        }
147
        $staff_interface;
148
    };
117
    mount '/api/v1/app.pl' => builder {
149
    mount '/api/v1/app.pl' => builder {
118
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
150
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
119
            enable 'Log4perl', category => 'plack-api';
151
            enable 'Log4perl', category => 'plack-api';
(-)a/staff (-1 / +21 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
require Mojolicious::Commands;
21
Mojolicious::Commands->start_app('Koha::Staff');

Return to bug 31380