From e5a8dab79e0e1bf5609be0b13b68ba1e0821613b Mon Sep 17 00:00:00 2001 From: Michael Hafen Date: Wed, 7 Feb 2024 15:37:08 -0700 Subject: [PATCH] Bug 36028: With AutoLocation on, show the error when a user is at another branch Content-Type: text/plain; charset="utf-8" When AutoLocation is on the user is supposed to be restricted to logging in at their branch. If the user is at a different branch and logs in, they get past the login page, but any action returns them to the login page. They should be returned directly to the login page with an error message. Test plan: 1. select a branch with branchip set to match the ip you are testing from. 2. select a user at a different branch. 3. login. 4. observe that there is no error, and login appears to succeed, but doesn't actually. 5. apply patch and restart services. 6. login again. 7. observe that the login page comes back immediately with an error message about AutoLocation being on. --- C4/Auth.pm | 1 + t/db_dependent/Auth.t | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 74b73563a4..d38a254d4a 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1201,6 +1201,7 @@ sub checkauth { $domain =~ s|\.\*||g; if ( $ip !~ /^$domain/ ) { $loggedin = 0; + $auth_state = 'failed'; $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t index df79b09e54..64cfd284a5 100755 --- a/t/db_dependent/Auth.t +++ b/t/db_dependent/Auth.t @@ -374,7 +374,7 @@ subtest 'checkauth() tests' => sub { subtest 'loggedinlibrary permission tests' => sub { - plan tests => 3; + plan tests => 5; my $staff_user = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 536870916 } } ); @@ -411,6 +411,14 @@ subtest 'checkauth() tests' => sub { $sesh = C4::Auth::get_session($sessionID); is( $sesh->param('branch'), $branch->branchcode, "If user is superlibrarian, they should be able to choose a branch" ); + t::lib::Mocks::mock_preference( 'AutoLocation', 1 ); + ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired' ); + is( $userid, undef, "Library user at ip not in branch should not be logged in under AutoLocation" ); + + $staff_user->branchcode($branch->branchcode)->store->discard_changes; + $branch->branchip($ENV{REMOTE_ADDR})->store->discard_changes; + ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired' ); + is( $userid, $staff_user->userid, "Library user at ip in branch should be logged in under AutoLocation" ); }; C4::Context->_new_userenv; # For next tests }; -- 2.34.1