From db4e9bf0c764bb70a93d15314345b49ccc2ae0cf Mon Sep 17 00:00:00 2001 From: Bernardo Gonzalez Kriegel Date: Sat, 16 Mar 2013 02:45:52 -0300 Subject: [PATCH] Bug 9827: remove 'insecure' system preference This patch removes 'insecure' system preference. Also removes remaining code that make use of the preference. It's broken anyway. Only remains a reference in POD of C4/Boolean.pm To test: 1) If you like, enable 'insecure' syspref. Broken system. WARN: be prepared to revert value in database. 2) Apply the patch 3) Run updatedatabase.pl 4) Check that Staff login proceeds as usual. 5) Check that 'insecure' syspref is no more. --- C4/Auth.pm | 14 ++++++-------- C4/Context.pm | 14 ++------------ C4/Members.pm | 4 +--- installer/data/mysql/sysprefs.sql | 1 - installer/data/mysql/updatedatabase.pl | 7 +++++++ .../prog/en/modules/admin/preferences/admin.pref | 7 ------- serials/member-search.pl | 2 +- t/db_dependent/Search.t | 2 +- 8 files changed, 18 insertions(+), 33 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index efe1200..99d6e24 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -145,8 +145,7 @@ sub get_template_and_user { } my $borrowernumber; - my $insecure = C4::Context->preference('insecure'); - if ($user or $insecure) { + if ($user) { require C4::Members; # It's possible for $user to be the borrowernumber if they don't have a # userid defined (and are logging in through some other method, such @@ -186,7 +185,7 @@ sub get_template_and_user { # We are going to use the $flags returned by checkauth # to create the template's parameters that will indicate # which menus the user can access. - if (( $flags && $flags->{superlibrarian}==1) or $insecure==1) { + if ( $flags && $flags->{superlibrarian}==1 ) { $template->param( CAN_user_circulate => 1 ); $template->param( CAN_user_catalogue => 1 ); $template->param( CAN_user_parameters => 1 ); @@ -195,7 +194,7 @@ sub get_template_and_user { $template->param( CAN_user_reserveforothers => 1 ); $template->param( CAN_user_borrow => 1 ); $template->param( CAN_user_editcatalogue => 1 ); - $template->param( CAN_user_updatecharges => 1 ); + $template->param( CAN_user_updatecharges => 1 ); $template->param( CAN_user_acquisition => 1 ); $template->param( CAN_user_management => 1 ); $template->param( CAN_user_tools => 1 ); @@ -320,7 +319,7 @@ sub get_template_and_user { GoogleJackets => C4::Context->preference("GoogleJackets"), OpenLibraryCovers => C4::Context->preference("OpenLibraryCovers"), KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"), - LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{"branch"}:"insecure"), + LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{"branch"}:undef), LoginFirstname => (C4::Context->userenv?C4::Context->userenv->{"firstname"}:"Bel"), LoginSurname => C4::Context->userenv?C4::Context->userenv->{"surname"}:"Inconnu", emailaddress => C4::Context->userenv?C4::Context->userenv->{"emailaddress"}:undef, @@ -349,7 +348,7 @@ sub get_template_and_user { IntranetNav => C4::Context->preference("IntranetNav"), IntranetmainUserblock => C4::Context->preference("IntranetmainUserblock"), LibraryName => C4::Context->preference("LibraryName"), - LoginBranchname => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:"insecure"), + LoginBranchname => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:undef), advancedMARCEditor => C4::Context->preference("advancedMARCEditor"), canreservefromotherbranches => C4::Context->preference('canreservefromotherbranches'), intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"), @@ -957,10 +956,9 @@ sub checkauth { $session->param('sessiontype','anon'); } } # END unless ($userid) - my $insecure = C4::Context->boolean_preference('insecure'); # finished authentification, now respond - if ( $loggedin || $authnotrequired || ( defined($insecure) && $insecure ) ) + if ( $loggedin || $authnotrequired ) { # successful login unless ($cookie) { diff --git a/C4/Context.pm b/C4/Context.pm index c2b5233..bad64fd 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -1037,18 +1037,8 @@ Cuserenv> twice, you will get the same hash without real DB ac #' sub userenv { my $var = $context->{"activeuser"}; - return $context->{"userenv"}->{$var} if (defined $var and defined $context->{"userenv"}->{$var}); - # insecure=1 management - if ($context->{"dbh"} && $context->preference('insecure') eq 'yes') { - my %insecure; - $insecure{flags} = '16382'; - $insecure{branchname} ='Insecure'; - $insecure{number} ='0'; - $insecure{cardnumber} ='0'; - $insecure{id} = 'insecure'; - $insecure{branch} = 'INS'; - $insecure{emailaddress} = 'test@mode.insecure.com'; - return \%insecure; + if (defined $var and defined $context->{"userenv"}->{$var}) { + return $context->{"userenv"}->{$var}; } else { return; } diff --git a/C4/Members.pm b/C4/Members.pm index 8042840..3d468c8 100644 --- a/C4/Members.pm +++ b/C4/Members.pm @@ -258,9 +258,7 @@ sub Search { if ( C4::Context->preference("IndependantBranches") ) { # && !$showallbranches){ if ( my $userenv = C4::Context->userenv ) { my $branch = $userenv->{'branch'}; - if ( ($userenv->{flags} % 2 !=1) && - $branch && $branch ne "insecure" ){ - + if ( ($userenv->{flags} % 2 !=1) && $branch ){ if (my $fr = ref $filter) { if ( $fr eq "HASH" ) { $filter->{branchcode} = $branch; diff --git a/installer/data/mysql/sysprefs.sql b/installer/data/mysql/sysprefs.sql index 9c66df0..d107418 100644 --- a/installer/data/mysql/sysprefs.sql +++ b/installer/data/mysql/sysprefs.sql @@ -32,7 +32,6 @@ INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('hide_marc',0,'If ON, disables display of MARC fields, subfield codes & indicators (still shows data)',NULL,'YesNo'); INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('WaitingNotifyAtCheckin',0,'If ON, notify librarians of waiting holds for the patron whose items they are checking in.',NULL,'YesNo'); INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('IndependantBranches',0,'If ON, increases security between libraries',NULL,'YesNo'); -INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('insecure',0,'If ON, bypasses all authentication. Be careful!',NULL,'YesNo'); INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('IntranetBiblioDefaultView','normal','Choose the default detail view in the staff interface; choose between normal, labeled_marc, marc or isbd','normal|marc|isbd|labeled_marc','Choice'); INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('intranetcolorstylesheet','','Define the color stylesheet to use in the Staff Client','50','free'); INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES('IntranetmainUserblock','','Add a block of HTML that will display on the intranet home page','70|10','Textarea'); diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl index 9b4aa8e..94dc492 100755 --- a/installer/data/mysql/updatedatabase.pl +++ b/installer/data/mysql/updatedatabase.pl @@ -6512,6 +6512,13 @@ if ( CheckVersion($DBversion) ) { SetVersion($DBversion); } +$DBversion = "3.11.00.XXX"; +if ( CheckVersion($DBversion) ) { + $dbh->do("DELETE FROM systempreferences WHERE variable = 'insecure';"); + print "Upgrade to $DBversion done (Bug 9827 - Remove 'insecure' system preference)\n"; + SetVersion($DBversion); +} + =head1 FUNCTIONS =head2 TableExists($table) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index afffb3a..bb5c546 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -42,13 +42,6 @@ Administration: - staff and patrons to create and view saved lists of books. Login options: - - - pref: insecure - default: 0 - choices: - yes: Allow - no: "Don't allow" - - staff to access the staff client without logging in. Enabling this is dangerous, and should not be done in production environments. - - - Automatically log out users after - pref: timeout class: integer diff --git a/serials/member-search.pl b/serials/member-search.pl index f027df5..ecbb94f 100755 --- a/serials/member-search.pl +++ b/serials/member-search.pl @@ -84,7 +84,7 @@ my ($count,$results); if (C4::Context->preference("IndependantBranches")){ if (C4::Context->userenv && C4::Context->userenv->{flags} % 2 !=1 && C4::Context->userenv->{'branch'}){ - $$patron{branchcode}=C4::Context->userenv->{'branch'} unless (C4::Context->userenv->{'branch'} eq "insecure"); + $$patron{branchcode}=C4::Context->userenv->{'branch'}; } } $$patron{firstname}.="\%" if ($$patron{firstname}); diff --git a/t/db_dependent/Search.t b/t/db_dependent/Search.t index 6d3d7a3..2a2a6f8 100644 --- a/t/db_dependent/Search.t +++ b/t/db_dependent/Search.t @@ -63,7 +63,7 @@ $contextmodule->mock('preference', sub { return '490av'; } else { warn "The syspref $pref was requested but I don't know what to say; this indicates that the test requires updating" - unless $pref =~ m/(XSLT|item|branch|holding|image|insecure)/i; + unless $pref =~ m/(XSLT|item|branch|holding|image)/i; return 0; } }); -- 1.7.9.5