View | Details | Raw Unified | Return to bug 31380
Collapse All | Expand All

(-)a/Koha/Auth.pm (+87 lines)
Line 0 Link Here
1
package Koha::Auth;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use C4::Auth qw//;
21
use Koha::Patrons;
22
23
=head1 NAME
24
25
Koha::Auth - Koha class for handling authentication and authorization
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 authenticate
32
33
    my $user = Koha::Auth->authenticate({
34
        sessionID => $sessionID,
35
    });
36
37
Verifies that this user has an authenticated Koha session
38
39
=cut
40
41
sub authenticate {
42
    my ($class,$args) = @_;
43
    my ($auth_user,$auth_session);
44
    my $sessionID = $args->{sessionID};
45
    if ($sessionID){
46
        my $flags;
47
        my ( $return, $session, $more_info) = C4::Auth::check_cookie_auth($sessionID,$flags,
48
            { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
49
        );
50
        if ($return && $return eq 'ok' && $session){
51
            my $userid = $session->param('id');
52
            if ( $userid ){
53
                my $patron = Koha::Patrons->find({ userid => $userid });
54
                if ($patron){
55
                    $auth_user = $patron;
56
                    $auth_session = $session;
57
                }
58
            }
59
        }
60
    }
61
    return ($auth_user,$auth_session);
62
}
63
64
=head3 authorize
65
66
    my $flags = Koha::Auth->authorize({
67
        session => $session,
68
        flagsrequired => { self_check => 'self_checkout_module' },
69
    });
70
71
=cut
72
73
sub authorize {
74
    my ($class,$args) = @_;
75
    my $flags;
76
    my $session = $args->{session};
77
    my $flagsrequired = $args->{flagsrequired};
78
    if ($session){
79
        my $userid = $session->param('id');
80
        if ($userid){
81
            $flags = C4::Auth::haspermission($userid,$flagsrequired);
82
        }
83
    }
84
    return $flags;
85
}
86
87
1;
(-)a/Koha/Mojo/Plugins/Core.pm (+76 lines)
Line 0 Link Here
1
package Koha::Mojo::Plugins::Core;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use Mojo::Base 'Mojolicious::Plugin';
21
22
=head1 NAME
23
24
Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
25
    template helpers for Koha Mojolicious controllers
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 register
32
33
=cut
34
35
sub register {
36
    my ($self, $app, $conf) = @_;
37
38
    $app->helper(
39
        staff_authorize => sub {
40
            my ($c,$args) = @_;
41
            my $session = $c->stash->{__koha_session__};
42
            my $flags = Koha::Auth->authorize({
43
                session => $session,
44
                flagsrequired => $args->{flagsrequired},
45
            });
46
            if($flags){
47
                $c->stash->{__koha_flags__} = $flags;
48
                $c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags({ flags => $flags });
49
                return ($flags,$c->stash->{__koha__user__});
50
            }
51
            else {
52
                $c->render( text => 'Forbidden', status => 403 );
53
                return;
54
            }
55
        }
56
    );
57
58
    $app->helper(
59
        prepare_template => sub {
60
            my ($c,$args) = @_;
61
            my $template_filename = $args->{template_filename};
62
            my $interface = $args->{interface};
63
            my $template = Koha::Template::prepare_template({
64
                template_filename => $template_filename,
65
                interface => $interface,
66
                koha_session => $c->stash->{__koha_session__},
67
                koha_user => $c->stash->{__koha_user__},
68
                koha_authz => $c->stash->{__koha_authz__},
69
            });
70
            return $template;
71
        }
72
    );
73
}
74
75
1;
76
(-)a/Koha/Mojo/Staff.pm (+95 lines)
Line 0 Link Here
1
package Koha::Mojo::Staff;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious';
19
use C4::Context;
20
21
use Koha::Auth;
22
use Koha::Auth::Permissions;
23
use Koha::Template;
24
25
=head1 NAME
26
27
Koha::Mojo::Staff - Mojolicious application for Koha staff interface
28
29
=head1 SYNOPSIS
30
31
=head2 METHODS
32
33
=head3 startup
34
35
=cut
36
37
sub startup {
38
    my $self = shift;
39
40
    #NOTE: Load plugin which sets up core helper methods needed for any Koha app
41
    $self->plugin('Koha::Mojo::Plugins::Core');
42
43
    # Router
44
    my $r = $self->routes;
45
46
    #NOTE: The /login route is public and does not require authentication
47
    #FIXME: Implement a Mojolicious login route
48
    #$r->get('/login')->to( controller => 'login', action => 'index' );
49
50
    #NOTE: All other routes require authentication
51
    my $auth = $r->under('/' => sub {
52
        my $c = shift;
53
        my $sessionID = $c->cookie('CGISESSID');
54
        my ($user,$session) = Koha::Auth->authenticate({
55
            sessionID => $sessionID,
56
        });
57
        if ($user && $session){
58
            $c->stash->{__koha_user__} = $user;
59
            $c->stash->{__koha_session__} = $session;
60
            $c->cookie(
61
                'CGISESSID' => $session->id,
62
                {
63
                    httponly => 1,
64
                    secure => ( C4::Context->https_enabled() ? 1 : 0 ),
65
                    path => '/',
66
                }
67
            );
68
            return 1;
69
        }
70
        else {
71
            #FIXME: In future, redirect to a /login route, or prompt for login here
72
            $c->redirect_to('/index.html');
73
            return;
74
        }
75
    });
76
    my $plugins = $auth->under('plugins');
77
    #NOTE: Mojolicious 9 seems to require explicitly defining all routes (rather than getting :controller and :action from the path...
78
    $plugins->any(['GET','POST'] => '/run')->to(controller => 'Plugins', action => 'run');
79
80
    #NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
81
    $auth->any('/*' => sub {
82
        my $c = shift;
83
        my ($flags,$loggedinuser) = $c->staff_authorize();
84
        my $template = $c->prepare_template({
85
            template_filename => 'errors/errorpage.tt',
86
            interface => 'intranet',
87
        });
88
        $template->{VARS}->{errno} = 404;
89
        $template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
90
        my $status = 404;
91
        $c->render( text => $template->output(), status => $status );
92
    });
93
}
94
95
1;
(-)a/Koha/Mojo/Staff/Controller/Plugins.pm (+52 lines)
Line 0 Link Here
1
package Koha::Mojo::Staff::Controller::Plugins;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious::Controller';
19
20
use C4::Context;
21
use Koha::Plugins::Handler;
22
23
=head1 NAME
24
25
Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 run
32
33
=cut
34
35
sub run {
36
    my $c = shift;
37
    my $class = $c->param('class');
38
    my $method = $c->param('method');
39
    my ($flags,$loggedinuser) = $c->staff_authorize({ flagsrequired => { 'plugins' => $method } });
40
    my $plugins_enabled = C4::Context->config("enable_plugins");
41
    if ( $plugins_enabled ) {
42
        my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
43
    } else {
44
        my $template = $c->prepare_template({
45
            template_filename => 'plugins/plugins-disabled.tt',
46
            interface => 'intranet',
47
        });
48
        $c->render( text => $template->output );
49
    }
50
}
51
52
1;
(-)a/Koha/Template.pm (+64 lines)
Line 0 Link Here
1
package Koha::Template;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use C4::Templates;
21
22
=head1 NAME
23
24
Koha::Template - Koha class for preparing a template for any Koha web view
25
26
=head1 SYNOPSIS
27
28
=head2 METHODS
29
30
=head3 prepare_template
31
32
=cut
33
34
sub prepare_template {
35
    my ($args) = @_;
36
    my $template;
37
    my $session = $args->{koha_session};
38
    my $user = $args->{koha_user};
39
    my $authz = $args->{koha_authz};
40
    my $template_filename = $args->{template_filename};
41
    my $interface = $args->{interface};
42
    if ($template_filename && $interface){
43
        $template = C4::Templates::gettemplate($template_filename,$interface);
44
        if ($template){
45
            if ($session){
46
                $template->{VARS}->{ sessionID } = $session->param('id');
47
            }
48
            if ($user){
49
                $template->{VARS}->{ logged_in_user } = $user;
50
                $template->{VARS}->{ loggedinusernumber } = $user->borrowernumber;
51
                $template->{VARS}->{ loggedinusername } = $user->userid;
52
            }
53
            if ($authz){
54
                foreach my $key ( keys %$authz ){
55
                    $template->{VARS}->{ $key } = $authz->{$key};
56
                }
57
            }
58
            #NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
59
        }
60
    }
61
    return $template;
62
}
63
64
1;
(-)a/debian/templates/plack.psgi (+32 lines)
Lines 66-71 my $apiv1 = builder { Link Here
66
    $server->to_psgi_app;
66
    $server->to_psgi_app;
67
};
67
};
68
68
69
my $staff_interface = builder {
70
    my $server = Mojo::Server::PSGI->new;
71
    $server->build_app('Koha::Mojo::Staff');
72
    my $app = $server->app;
73
    $app->hook( before_dispatch => sub {
74
        my $c = shift;
75
        #NOTE: Rewrite the base path to strip off the mount prefix
76
        my $path = $c->req->url->base->path(Mojo::Path->new);
77
78
    });
79
    $server->to_psgi_app;
80
};
81
69
Koha::Logger->_init;
82
Koha::Logger->_init;
70
83
71
builder {
84
builder {
Lines 114-119 builder { Link Here
114
        }
127
        }
115
        $intranet;
128
        $intranet;
116
    };
129
    };
130
    mount '/intranet/staff' => builder {
131
        #NOTE: it is important that these are relative links
132
        enable 'ErrorDocument',
133
            400 => 'errors/400.pl',
134
            401 => 'errors/401.pl',
135
            402 => 'errors/402.pl',
136
            403 => 'errors/403.pl',
137
            404 => 'errors/404.pl',
138
            500 => 'errors/500.pl',
139
            subrequest => 1;
140
        #NOTE: Without this middleware to catch fatal errors, ErrorDocument won't be able to render a 500 document
141
        #NOTE: This middleware must be closer to the PSGI app than ErrorDocument
142
        enable "HTTPExceptions";
143
        if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){
144
            enable 'Log4perl', category => 'plack-intranet';
145
            enable 'LogWarn';
146
        }
147
        $staff_interface;
148
    };
117
    mount '/api/v1/app.pl' => builder {
149
    mount '/api/v1/app.pl' => builder {
118
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
150
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
119
            enable 'Log4perl', category => 'plack-api';
151
            enable 'Log4perl', category => 'plack-api';
(-)a/staff (-1 / +21 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
require Mojolicious::Commands;
21
Mojolicious::Commands->start_app('Koha::Mojo::Staff');

Return to bug 31380