From 253915a661a0a7dc6fd5e243f339230a82da3870 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 8 Mar 2024 16:06:11 +0100
Subject: [PATCH] Bug 36149: Unset userenv from middleware

The userenv (logged in user's info) are stored in
$C4::Context->context->{activeuser}, which persists in plack worker's
memory.
It's really bad in theory as we are not cleaning it before or after the
HTTP request, but only when set_userenv is called (what we are doing
commonly in C4::Auth::get_template_and_user).
If C4::Context->userenv is called before set_userenv we should get undef,
not the userenv from the previous request!
In practice this should not be a problem, but well... who really knows?

This patch suggests to have a middleware to deal with removing the
userenv at the beginning of each request (maybe it should be after, right? - FIXME).
---
 C4/Context.pm               |  3 +--
 Koha/Middleware/UserEnv.pm  | 18 ++++++++++++++++++
 debian/templates/plack.psgi |  1 +
 3 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 Koha/Middleware/UserEnv.pm

diff --git a/C4/Context.pm b/C4/Context.pm
index 0169b10f85e..bc1633313d0 100644
--- a/C4/Context.pm
+++ b/C4/Context.pm
@@ -853,8 +853,7 @@ Destroys the hash for activeuser user environment variables.
 
 sub _unset_userenv
 {
-    my ($sessionID)= @_;
-    undef $context->{activeuser} if $sessionID && $context->{activeuser} && $context->{activeuser} eq $sessionID;
+    delete $context->{activeuser};
 }
 
 
diff --git a/Koha/Middleware/UserEnv.pm b/Koha/Middleware/UserEnv.pm
new file mode 100644
index 00000000000..03d515fdcff
--- /dev/null
+++ b/Koha/Middleware/UserEnv.pm
@@ -0,0 +1,18 @@
+package Koha::Middleware::UserEnv;
+use Modern::Perl;
+
+use parent qw(Plack::Middleware);
+
+use C4::Context;
+
+sub call {
+    my ( $self, $env ) =@_;
+
+    my $req = Plack::Request->new($env);
+
+    C4::Context->_unset_userenv;
+
+    return $self->app->($env);
+}
+
+1;
diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi
index 530c3b0962b..bf31ecf152f 100644
--- a/debian/templates/plack.psgi
+++ b/debian/templates/plack.psgi
@@ -73,6 +73,7 @@ builder {
     enable "Plack::Middleware::Static";
 
     # + is required so Plack doesn't try to prefix Plack::Middleware::
+    enable "+Koha::Middleware::UserEnv";
     enable "+Koha::Middleware::SetEnv";
     enable "+Koha::Middleware::RealIP";
 
-- 
2.34.1