From d92122bcbaa10b082c98cc14d5d2aff54e029932 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Wed, 22 May 2024 10:43:03 -0400 Subject: [PATCH] Bug 36928: Patron authentication / password validation will fail with 500 error for local users if LDAP is enabled If LDAP is enabled, and use of /api/v1/auth/password/validation will fail with a 500 internal server error like: Can't call method "cardnumber" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/Auth/Password.pm line 83, line 1490. This is because the valid patron object is being overwritten with an undefined value if there is no LDAP patron returned. Since a failed LDAP query falls back to local user auth, we try to use the now undefined patron object thus generating an error. Test Plan: 1) Set up and enable LDAP 2) POST JSON to /api/v1/auth/password/validation like: { "userid": "koha", "password": "koha" } 3) Note the 500 erorr 4) Apply this patch 5) Restart all the things! 6) POST the data again 7) It works! --- C4/Auth.pm | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index e3478ea6913..863769cd609 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1982,10 +1982,10 @@ sub checkpw { # Nothing to check, account is locked } elsif ( $ldap && defined($password) ) { - my ( $retval, $retcard, $retuserid ); - ( $retval, $retcard, $retuserid, $patron ) = checkpw_ldap(@_); # EXTERNAL AUTH + my ( $retval, $retcard, $retuserid, $ldap_patron ); + ( $retval, $retcard, $retuserid, $ldap_patron ) = checkpw_ldap(@_); # EXTERNAL AUTH if ( $retval == 1 ) { - @return = ( $retval, $retcard, $retuserid, $patron ); + @return = ( $retval, $retcard, $retuserid, $ldap_patron ); $passwd_ok = 1; } $check_internal_as_fallback = 1 if $retval == 0; -- 2.30.2