View | Details | Raw Unified | Return to bug 31380
Collapse All | Expand All

(-)a/Koha/Auth.pm (+87 lines)
Line 0 Link Here
1
package Koha::Auth;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use C4::Auth qw//;
21
use Koha::Patrons;
22
23
=head1 NAME
24
25
Koha::Auth - Koha class for handling authentication and authorization
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 authenticate
32
33
    my $user = Koha::Auth->authenticate({
34
        sessionID => $sessionID,
35
    });
36
37
Verifies that this user has an authenticated Koha session
38
39
=cut
40
41
sub authenticate {
42
    my ($class,$args) = @_;
43
    my ($auth_user,$auth_session);
44
    my $sessionID = $args->{sessionID};
45
    if ($sessionID){
46
        my $flags;
47
        my ( $return, $session, $more_info) = C4::Auth::check_cookie_auth($sessionID,$flags,
48
            { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
49
        );
50
        if ($return && $return eq 'ok' && $session){
51
            my $userid = $session->param('id');
52
            if ( $userid ){
53
                my $patron = Koha::Patrons->find({ userid => $userid });
54
                if ($patron){
55
                    $auth_user = $patron;
56
                    $auth_session = $session;
57
                }
58
            }
59
        }
60
    }
61
    return ($auth_user,$auth_session);
62
}
63
64
=head3 authorize
65
66
    my $flags = Koha::Auth->authorize({
67
        session => $session,
68
        flagsrequired => { self_check => 'self_checkout_module' },
69
    });
70
71
=cut
72
73
sub authorize {
74
    my ($class,$args) = @_;
75
    my $flags;
76
    my $session = $args->{session};
77
    my $flagsrequired = $args->{flagsrequired};
78
    if ($session){
79
        my $userid = $session->param('id');
80
        if ($userid){
81
            $flags = C4::Auth::haspermission($userid,$flagsrequired);
82
        }
83
    }
84
    return $flags;
85
}
86
87
1;
(-)a/Koha/Mojo/Plugins/Core.pm (+79 lines)
Line 0 Link Here
1
package Koha::Mojo::Plugins::Core;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use Mojo::Base 'Mojolicious::Plugin';
21
22
use Koha::Auth;
23
use Koha::Auth::Permissions;
24
use Koha::Template;
25
26
=head1 NAME
27
28
Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
29
    template helpers for Koha Mojolicious controllers
30
31
=head1 SYNOPSIS
32
33
=head2 METHODS
34
35
=head3 register
36
37
=cut
38
39
sub register {
40
    my ($self, $app, $conf) = @_;
41
42
    $app->helper(
43
        staff_authorize => sub {
44
            my ($c,$args) = @_;
45
            my $session = $c->stash->{__koha_session__};
46
            my $flags = Koha::Auth->authorize({
47
                session => $session,
48
                flagsrequired => $args->{flagsrequired},
49
            });
50
            if($flags){
51
                $c->stash->{__koha_flags__} = $flags;
52
                $c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags({ flags => $flags });
53
                return ($flags,$c->stash->{__koha__user__});
54
            }
55
            else {
56
                $c->render( text => 'Forbidden', status => 403 );
57
                return;
58
            }
59
        }
60
    );
61
62
    $app->helper(
63
        prepare_template => sub {
64
            my ($c,$args) = @_;
65
            my $template_filename = $args->{template_filename};
66
            my $interface = $args->{interface};
67
            my $template = Koha::Template::prepare_template({
68
                template_filename => $template_filename,
69
                interface => $interface,
70
                koha_session => $c->stash->{__koha_session__},
71
                koha_user => $c->stash->{__koha_user__},
72
                koha_authz => $c->stash->{__koha_authz__},
73
            });
74
            return $template;
75
        }
76
    );
77
}
78
79
1;
(-)a/Koha/Mojo/Staff.pm (+93 lines)
Line 0 Link Here
1
package Koha::Mojo::Staff;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious';
19
20
use C4::Context;
21
use Koha::Auth;
22
23
=head1 NAME
24
25
Koha::Mojo::Staff - Mojolicious application for Koha staff interface
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 startup
32
33
=cut
34
35
sub startup {
36
    my $self = shift;
37
38
    #NOTE: Load plugin which sets up core helper methods needed for any Koha app
39
    $self->plugin('Koha::Mojo::Plugins::Core');
40
41
    # Router
42
    my $r = $self->routes;
43
44
    #NOTE: The /login route is public and does not require authentication
45
    #FIXME: Implement a Mojolicious login route
46
    #$r->get('/login')->to( controller => 'login', action => 'index' );
47
48
    #NOTE: All other routes require authentication
49
    my $auth = $r->under('/' => sub {
50
        my $c = shift;
51
        my $sessionID = $c->cookie('CGISESSID');
52
        my ($user,$session) = Koha::Auth->authenticate({
53
            sessionID => $sessionID,
54
        });
55
        if ($user && $session){
56
            $c->stash->{__koha_user__} = $user;
57
            $c->stash->{__koha_session__} = $session;
58
            $c->cookie(
59
                'CGISESSID' => $session->id,
60
                {
61
                    httponly => 1,
62
                    secure => ( C4::Context->https_enabled() ? 1 : 0 ),
63
                    path => '/',
64
                }
65
            );
66
            return 1;
67
        }
68
        else {
69
            #FIXME: In future, redirect to a /login route, or prompt for login here
70
            $c->redirect_to('/index.html');
71
            return;
72
        }
73
    });
74
    my $plugins = $auth->under('plugins');
75
    #NOTE: Mojolicious 9 seems to require explicitly defining all routes (rather than getting :controller and :action from the path...
76
    $plugins->any(['GET','POST'] => '/run')->to(controller => 'Plugins', action => 'run');
77
78
    #NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
79
    $auth->any('/*' => sub {
80
        my $c = shift;
81
        my ($flags,$loggedinuser) = $c->staff_authorize();
82
        my $template = $c->prepare_template({
83
            template_filename => 'errors/errorpage.tt',
84
            interface => 'intranet',
85
        });
86
        $template->{VARS}->{errno} = 404;
87
        $template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
88
        my $status = 404;
89
        $c->render( text => $template->output(), status => $status );
90
    });
91
}
92
93
1;
(-)a/Koha/Mojo/Staff/Controller/Plugins.pm (+52 lines)
Line 0 Link Here
1
package Koha::Mojo::Staff::Controller::Plugins;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious::Controller';
19
20
use C4::Context;
21
use Koha::Plugins::Handler;
22
23
=head1 NAME
24
25
Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 run
32
33
=cut
34
35
sub run {
36
    my $c = shift;
37
    my $class = $c->param('class');
38
    my $method = $c->param('method');
39
    my ($flags,$loggedinuser) = $c->staff_authorize({ flagsrequired => { 'plugins' => $method } });
40
    my $plugins_enabled = C4::Context->config("enable_plugins");
41
    if ( $plugins_enabled ) {
42
        my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
43
    } else {
44
        my $template = $c->prepare_template({
45
            template_filename => 'plugins/plugins-disabled.tt',
46
            interface => 'intranet',
47
        });
48
        $c->render( text => $template->output );
49
    }
50
}
51
52
1;
(-)a/Koha/Template.pm (+64 lines)
Line 0 Link Here
1
package Koha::Template;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use C4::Templates;
21
22
=head1 NAME
23
24
Koha::Template - Koha class for preparing a template for any Koha web view
25
26
=head1 SYNOPSIS
27
28
=head2 METHODS
29
30
=head3 prepare_template
31
32
=cut
33
34
sub prepare_template {
35
    my ($args) = @_;
36
    my $template;
37
    my $session = $args->{koha_session};
38
    my $user = $args->{koha_user};
39
    my $authz = $args->{koha_authz};
40
    my $template_filename = $args->{template_filename};
41
    my $interface = $args->{interface};
42
    if ($template_filename && $interface){
43
        $template = C4::Templates::gettemplate($template_filename,$interface);
44
        if ($template){
45
            if ($session){
46
                $template->{VARS}->{ sessionID } = $session->param('id');
47
            }
48
            if ($user){
49
                $template->{VARS}->{ logged_in_user } = $user;
50
                $template->{VARS}->{ loggedinusernumber } = $user->borrowernumber;
51
                $template->{VARS}->{ loggedinusername } = $user->userid;
52
            }
53
            if ($authz){
54
                foreach my $key ( keys %$authz ){
55
                    $template->{VARS}->{ $key } = $authz->{$key};
56
                }
57
            }
58
            #NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
59
        }
60
    }
61
    return $template;
62
}
63
64
1;
(-)a/debian/templates/plack.psgi (+32 lines)
Lines 66-71 my $apiv1 = builder { Link Here
66
    $server->to_psgi_app;
66
    $server->to_psgi_app;
67
};
67
};
68
68
69
my $staff_interface = builder {
70
    my $server = Mojo::Server::PSGI->new;
71
    $server->build_app('Koha::Mojo::Staff');
72
    my $app = $server->app;
73
    $app->hook( before_dispatch => sub {
74
        my $c = shift;
75
        #NOTE: Rewrite the base path to strip off the mount prefix
76
        my $path = $c->req->url->base->path(Mojo::Path->new);
77
78
    });
79
    $server->to_psgi_app;
80
};
81
69
Koha::Logger->_init;
82
Koha::Logger->_init;
70
83
71
builder {
84
builder {
Lines 114-119 builder { Link Here
114
        }
127
        }
115
        $intranet;
128
        $intranet;
116
    };
129
    };
130
    mount '/intranet/staff' => builder {
131
        #NOTE: it is important that these are relative links
132
        enable 'ErrorDocument',
133
            400 => 'errors/400.pl',
134
            401 => 'errors/401.pl',
135
            402 => 'errors/402.pl',
136
            403 => 'errors/403.pl',
137
            404 => 'errors/404.pl',
138
            500 => 'errors/500.pl',
139
            subrequest => 1;
140
        #NOTE: Without this middleware to catch fatal errors, ErrorDocument won't be able to render a 500 document
141
        #NOTE: This middleware must be closer to the PSGI app than ErrorDocument
142
        enable "HTTPExceptions";
143
        if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){
144
            enable 'Log4perl', category => 'plack-intranet';
145
            enable 'LogWarn';
146
        }
147
        $staff_interface;
148
    };
117
    mount '/api/v1/app.pl' => builder {
149
    mount '/api/v1/app.pl' => builder {
118
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
150
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
119
            enable 'Log4perl', category => 'plack-api';
151
            enable 'Log4perl', category => 'plack-api';
(-)a/staff (-1 / +21 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
require Mojolicious::Commands;
21
Mojolicious::Commands->start_app('Koha::Mojo::Staff');

Return to bug 31380