From 2dc3a28a5bccfb6699bba18ff1db7ae4d9a74025 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Fri, 11 Oct 2024 09:44:52 +0000 Subject: [PATCH] Bug 37041: Use check_value_builder_caller in two value builder plugins Content-Type: text/plain; charset=utf-8 Test plan: Verify if item editor and tools/batchmod work as expected. Directly hit a value builder plugin like: https://YOUR_STAFF_SERVER/cgi-bin/koha/cataloguing/value_builder/barcode.pl Verify that you get a 403 page regardless of being logged in or not. Run t/db_dependent/FrameworkPlugin.t Run xt/find-missing-auth_checks.t Signed-off-by: Marcel de Rooy --- cataloguing/value_builder/barcode.pl | 22 +++++++------------- cataloguing/value_builder/dateaccessioned.pl | 12 +++-------- t/db_dependent/FrameworkPlugin.t | 11 +++++++++- 3 files changed, 20 insertions(+), 25 deletions(-) diff --git a/cataloguing/value_builder/barcode.pl b/cataloguing/value_builder/barcode.pl index 5ec7dbece4..8e4658792d 100755 --- a/cataloguing/value_builder/barcode.pl +++ b/cataloguing/value_builder/barcode.pl @@ -21,23 +21,15 @@ # along with Koha; if not, see . use Modern::Perl; - -use C4::Context; -use C4::Barcodes::ValueBuilder; -use C4::Biblio qw( GetMarcFromKohaField ); -use Koha::DateUtils qw( dt_from_string ); - use Algorithm::CheckDigits qw( CheckDigits ); -use CGI qw ( -utf8 ); -use C4::Auth qw( check_cookie_auth ); -my $input = CGI->new; -my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); -if ( $auth_status ne "ok" ) { - print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); - exit 0; -} +use C4::Auth qw(); +use C4::Context qw(); +use C4::Barcodes::ValueBuilder qw(); +use C4::Biblio qw( GetMarcFromKohaField ); +use Koha::DateUtils qw( dt_from_string ); + +C4::Auth::check_value_builder_caller(); my $builder = sub { my ( $params ) = @_; diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl index 65c806b29c..ee10f5228e 100755 --- a/cataloguing/value_builder/dateaccessioned.pl +++ b/cataloguing/value_builder/dateaccessioned.pl @@ -21,15 +21,9 @@ # along with Koha; if not, see . use Modern::Perl; -use CGI qw ( -utf8 ); -use C4::Auth qw( check_cookie_auth ); -my $input = CGI->new; -my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); -if ( $auth_status ne "ok" ) { - print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); - exit 0; -} +use C4::Auth (); + +C4::Auth::check_value_builder_caller(); my $builder = sub { my ( $params ) = @_; diff --git a/t/db_dependent/FrameworkPlugin.t b/t/db_dependent/FrameworkPlugin.t index 731f97df6d..08eb87235b 100755 --- a/t/db_dependent/FrameworkPlugin.t +++ b/t/db_dependent/FrameworkPlugin.t @@ -1,9 +1,11 @@ +#!/usr/bin/perl + use Modern::Perl; use CGI; use File::Temp qw/tempfile/; use Getopt::Long; -use Test::More tests => 7; +use Test::More tests => 8; use Test::MockModule; use Test::Warn; @@ -75,6 +77,13 @@ subtest 'Test07 -- validate input' => sub { }; +subtest 'Test08 -- check_value_builder_caller' => sub { + plan tests => 1; + + # This is very trivial; note that previous ->build and ->launch calls trigger this routine also. + is( C4::Auth::check_value_builder_caller( { exit => 0 } ), undef, 'Returns undef in unit test' ); +}; + $schema->storage->txn_rollback; sub test01 { -- 2.39.5