From 280ab99d9310c2b959401740d060c62663b5f1a4 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 24 Sep 2024 15:22:59 +0200 Subject: [PATCH] Bug 37041: Use session_id from userenv instead of cookie for value_builder --- C4/Context.pm | 18 ++++++++++++++++-- C4/InstallAuth.pm | 12 +----------- cataloguing/value_builder/barcode_manual.pl | 2 +- cataloguing/value_builder/dateaccessioned.pl | 4 +++- cataloguing/value_builder/marc21_field_005.pl | 4 +++- cataloguing/value_builder/marc21_field_245h.pl | 4 +++- cataloguing/value_builder/marc21_field_260b.pl | 4 +++- cataloguing/value_builder/marc21_orgcode.pl | 3 ++- cataloguing/value_builder/stocknumber.pl | 2 +- cataloguing/value_builder/upload.pl | 3 ++- 10 files changed, 35 insertions(+), 21 deletions(-) diff --git a/C4/Context.pm b/C4/Context.pm index 8d49feda7c4..8798416d3c0 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -662,13 +662,26 @@ set_userenv is called in Auth.pm =cut #' +sub set_userenv_from_session { + my ( $class, $session ) = @_; + return $class->set_userenv( + $session->param('number'), $session->param('id') // '', + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('shibboleth'), + $session->param('desk_id'), $session->param('desk_name'), + $session->param('register_id'), $session->param('register_name'), + $session->id, + ); +} sub set_userenv { shift @_; my ( $usernum, $userid, $usercnum, $userfirstname, $usersurname, $userbranch, $branchname, $userflags, $emailaddress, $shibboleth, $desk_id, $desk_name, - $register_id, $register_name + $register_id, $register_name, $session_id, ) = @_; my $cell = { @@ -687,7 +700,8 @@ sub set_userenv { "desk_id" => $desk_id, "desk_name" => $desk_name, "register_id" => $register_id, - "register_name" => $register_name + "register_name" => $register_name, + "session_id" => $session_id, }; $context->{userenv} = $cell; return $cell; diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index fa52cbcfc56..49114917ac9 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -253,17 +253,7 @@ sub checkauth { if ( $session ) { if ( $session->param('cardnumber') ) { - C4::Context->set_userenv( - $session->param('number'), - $session->param('id'), - $session->param('cardnumber'), - $session->param('firstname'), - $session->param('surname'), - $session->param('branch'), - $session->param('branchname'), - $session->param('flags'), - $session->param('emailaddress') - ); + C4::Context->set_userenv_from_session($session); $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl index 67891789e31..cbc2990139c 100755 --- a/cataloguing/value_builder/barcode_manual.pl +++ b/cataloguing/value_builder/barcode_manual.pl @@ -31,7 +31,7 @@ use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl index 65c806b29c8..939bb345d7d 100755 --- a/cataloguing/value_builder/dateaccessioned.pl +++ b/cataloguing/value_builder/dateaccessioned.pl @@ -23,9 +23,11 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl index 6428bd61a99..4d2b5cbedd4 100755 --- a/cataloguing/value_builder/marc21_field_005.pl +++ b/cataloguing/value_builder/marc21_field_005.pl @@ -23,9 +23,11 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl index 4fe4a2f1e75..55888510edb 100755 --- a/cataloguing/value_builder/marc21_field_245h.pl +++ b/cataloguing/value_builder/marc21_field_245h.pl @@ -23,9 +23,11 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl index e9a74a07ba4..c7703712d55 100755 --- a/cataloguing/value_builder/marc21_field_260b.pl +++ b/cataloguing/value_builder/marc21_field_260b.pl @@ -29,9 +29,11 @@ use C4::Context; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl index 0dd985803c9..65e0d2efc4e 100755 --- a/cataloguing/value_builder/marc21_orgcode.pl +++ b/cataloguing/value_builder/marc21_orgcode.pl @@ -26,9 +26,10 @@ use C4::Context; use Koha::Libraries; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl index 61885d12b05..4358ffb1d7d 100755 --- a/cataloguing/value_builder/stocknumber.pl +++ b/cataloguing/value_builder/stocknumber.pl @@ -25,7 +25,7 @@ use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl index eeb422d5258..e79e650647e 100755 --- a/cataloguing/value_builder/upload.pl +++ b/cataloguing/value_builder/upload.pl @@ -32,9 +32,10 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; -- 2.34.1