View | Details | Raw Unified | Return to bug 9102
Collapse All | Expand All

(-)a/C4/Auth.pm (-10 / +23 lines)
Lines 635-647 sub checkauth { Link Here
635
    if ( $userid = $ENV{'REMOTE_USER'} ) {
635
    if ( $userid = $ENV{'REMOTE_USER'} ) {
636
        # Using Basic Authentication, no cookies required
636
        # Using Basic Authentication, no cookies required
637
        $cookie = $query->cookie(
637
        $cookie = $query->cookie(
638
            -name    => 'CGISESSID',
638
            -name     => 'CGISESSID',
639
            -value   => '',
639
            -value    => '',
640
            -expires => ''
640
            -expires  => '',
641
            -HttpOnly => 1,
641
        );
642
        );
642
        $loggedin = 1;
643
        $loggedin = 1;
643
    }
644
    }
644
    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison
645
    elsif ( $sessionID = $query->cookie("CGISESSID") )
646
    {    # assignment, not comparison
645
        my $session = get_session($sessionID);
647
        my $session = get_session($sessionID);
646
        C4::Context->_new_userenv($sessionID);
648
        C4::Context->_new_userenv($sessionID);
647
        my ($ip, $lasttime, $sessiontype);
649
        my ($ip, $lasttime, $sessiontype);
Lines 707-714 sub checkauth { Link Here
707
            $userid    = undef;
709
            $userid    = undef;
708
        }
710
        }
709
        else {
711
        else {
710
            $cookie = $query->cookie( CGISESSID => $session->id );
712
            $cookie = $query->cookie(
711
            $session->param('lasttime',time());
713
                -name     => 'CGISESSID',
714
                -value    => $session->id,
715
                -HttpOnly => 1
716
            );
717
            $session->param( 'lasttime', time() );
712
            unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
718
            unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
713
                $flags = haspermission($userid, $flagsrequired);
719
                $flags = haspermission($userid, $flagsrequired);
714
                if ($flags) {
720
                if ($flags) {
Lines 724-731 sub checkauth { Link Here
724
        my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
730
        my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
725
        my $sessionID = $session->id;
731
        my $sessionID = $session->id;
726
        C4::Context->_new_userenv($sessionID);
732
        C4::Context->_new_userenv($sessionID);
727
        $cookie = $query->cookie( CGISESSID => $sessionID );
733
        $cookie = $query->cookie(
728
        $userid = $query->param('userid');
734
            -name     => 'CGISESSID',
735
            -value    => $session->id,
736
            -HttpOnly => 1
737
        );
738
    $userid = $query->param('userid');
729
        if (   ( $cas && $query->param('ticket') )
739
        if (   ( $cas && $query->param('ticket') )
730
            || $userid
740
            || $userid
731
            || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne
741
            || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne
Lines 916-922 sub checkauth { Link Here
916
    {
926
    {
917
        # successful login
927
        # successful login
918
        unless ($cookie) {
928
        unless ($cookie) {
919
            $cookie = $query->cookie( CGISESSID => '' );
929
            $cookie = $query->cookie(
930
                -name     => 'CGISESSID',
931
                -value    => '',
932
                -HttpOnly => 1
933
            );
920
        }
934
        }
921
        return ( $userid, $cookie, $sessionID, $flags );
935
        return ( $userid, $cookie, $sessionID, $flags );
922
    }
936
    }
923
- 

Return to bug 9102