From 572af2979bea86d4914d7684924588e7f14dc9fb Mon Sep 17 00:00:00 2001 From: Baptiste Date: Fri, 25 Oct 2024 15:24:35 +0200 Subject: [PATCH] Bug 38258: Force scalar context for cookie calls (part 1) To reproduce : 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected I'm not sure about the exact mechanism leading to a disconnection, but this is due to : > check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); If cookie is empty, the scalar context cannot be deduced properly and it results in a disconnection of opened sessions. Forcing a scalar context solves the issue. This is true for all the results of: > git grep "check_cookie_auth.*cookie.*CGISESSID" Correct all the calls for cookies extracted from $input->cookie('CGISESSID') TEST PLAN: 1 - Log in to Koha intranet keep the browser open 2 - Run in a terminal: curl --verbose 'http://YOUR_KOHA_INSTANCE/cgi-bin/koha/catalogue/image.pl?thumbnail=1&biblionumber=288730' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0' -H 'Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5' -H 'Accept-Language: fr-FR,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate, br, zstd' Note: there is no need to have a valid thumbnail and biblionumber 3 - Go back to your browser and click any link: you have been disconnected 4 - Apply patch 5 - Repeat 1-3 and see you do not have been disconnected --- acqui/check_uniqueness.pl | 3 ++- catalogue/image.pl | 3 ++- cataloguing/plugin_launcher.pl | 3 ++- cataloguing/value_builder/barcode.pl | 3 ++- cataloguing/value_builder/barcode_manual.pl | 3 ++- cataloguing/value_builder/dateaccessioned.pl | 3 ++- cataloguing/value_builder/marc21_field_005.pl | 3 ++- cataloguing/value_builder/marc21_field_245h.pl | 3 ++- cataloguing/value_builder/marc21_field_260b.pl | 3 ++- cataloguing/value_builder/marc21_orgcode.pl | 3 ++- cataloguing/value_builder/stocknumber.pl | 3 ++- cataloguing/value_builder/upload.pl | 3 ++- cataloguing/ysearch.pl | 3 ++- plugins/plugins-enable.pl | 3 ++- serials/create-numberpattern.pl | 3 ++- serials/subscription-frequency.pl | 3 ++- serials/subscription-numberpattern.pl | 3 ++- svc/barcode | 3 ++- svc/cataloguing/automatic_linker.pl | 3 ++- svc/checkin | 3 ++- svc/checkouts | 3 ++- svc/holds | 3 ++- svc/mana/increment | 3 ++- svc/mana/share | 3 ++- svc/mana/use | 3 ++- svc/recall | 3 ++- svc/renew | 3 ++- svc/return_claims | 3 ++- tools/batch_records_ajax.pl | 3 ++- 29 files changed, 58 insertions(+), 29 deletions(-) diff --git a/acqui/check_uniqueness.pl b/acqui/check_uniqueness.pl index aece6aac55b..c6c52c0c64d 100755 --- a/acqui/check_uniqueness.pl +++ b/acqui/check_uniqueness.pl @@ -38,8 +38,9 @@ use C4::Items qw( SearchItems ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/catalogue/image.pl b/catalogue/image.pl index af950a65346..f28750e2978 100755 --- a/catalogue/image.pl +++ b/catalogue/image.pl @@ -34,8 +34,9 @@ use Koha::CoverImages; $| = 1; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/plugin_launcher.pl b/cataloguing/plugin_launcher.pl index b31ca52c893..33352960f7e 100755 --- a/cataloguing/plugin_launcher.pl +++ b/cataloguing/plugin_launcher.pl @@ -24,8 +24,9 @@ use C4::Auth qw( check_cookie_auth ); use Koha::FrameworkPlugin; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/barcode.pl b/cataloguing/value_builder/barcode.pl index 5ec7dbece4b..79863332cad 100755 --- a/cataloguing/value_builder/barcode.pl +++ b/cataloguing/value_builder/barcode.pl @@ -32,8 +32,9 @@ use Algorithm::CheckDigits qw( CheckDigits ); use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl index 67891789e31..7fa558971aa 100755 --- a/cataloguing/value_builder/barcode_manual.pl +++ b/cataloguing/value_builder/barcode_manual.pl @@ -30,8 +30,9 @@ use Koha::DateUtils qw( dt_from_string ); use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl index 65c806b29c8..531d669f809 100755 --- a/cataloguing/value_builder/dateaccessioned.pl +++ b/cataloguing/value_builder/dateaccessioned.pl @@ -24,8 +24,9 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl index 6428bd61a99..e08956424c3 100755 --- a/cataloguing/value_builder/marc21_field_005.pl +++ b/cataloguing/value_builder/marc21_field_005.pl @@ -24,8 +24,9 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl index 4fe4a2f1e75..741252bbb3e 100755 --- a/cataloguing/value_builder/marc21_field_245h.pl +++ b/cataloguing/value_builder/marc21_field_245h.pl @@ -24,8 +24,9 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl index e9a74a07ba4..27c16051119 100755 --- a/cataloguing/value_builder/marc21_field_260b.pl +++ b/cataloguing/value_builder/marc21_field_260b.pl @@ -30,8 +30,9 @@ use C4::Context; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl index 0dd985803c9..d3ac8343959 100755 --- a/cataloguing/value_builder/marc21_orgcode.pl +++ b/cataloguing/value_builder/marc21_orgcode.pl @@ -27,8 +27,9 @@ use Koha::Libraries; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl index 61885d12b05..37acc705be4 100755 --- a/cataloguing/value_builder/stocknumber.pl +++ b/cataloguing/value_builder/stocknumber.pl @@ -24,8 +24,9 @@ use C4::Context; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl index eeb422d5258..571d2a578b1 100755 --- a/cataloguing/value_builder/upload.pl +++ b/cataloguing/value_builder/upload.pl @@ -33,8 +33,9 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( $session_cookie, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/ysearch.pl b/cataloguing/ysearch.pl index 22cebedda3e..76e4fb094fd 100755 --- a/cataloguing/ysearch.pl +++ b/cataloguing/ysearch.pl @@ -35,6 +35,7 @@ my $input = CGI->new; my $query = $input->param('term'); my $table = $input->param('table'); my $field = $input->param('field'); +my $session_cookie = $input->cookie('CGISESSID'); # Prevent from disclosing data die() unless ( $table eq "biblioitems" ); @@ -43,7 +44,7 @@ die() unless ( $field eq 'publishercode' || $field eq 'collectiontitle' ); binmode STDOUT, ":encoding(UTF-8)"; print $input->header( -type => 'text/plain', -charset => 'UTF-8' ); -my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { editcatalogue => '*' } ); +my ( $auth_status ) = check_cookie_auth( $session_cookie, { editcatalogue => '*' } ); if ( $auth_status ne "ok" ) { exit 0; } diff --git a/plugins/plugins-enable.pl b/plugins/plugins-enable.pl index 79cd88af880..2f631096e95 100755 --- a/plugins/plugins-enable.pl +++ b/plugins/plugins-enable.pl @@ -26,8 +26,9 @@ use Koha::Plugins::Handler; die("Koha plugins are disabled!") unless C4::Context->config("enable_plugins"); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); -my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } ); +my ( $auth_status ) = check_cookie_auth( $session_cookie, { plugins => 'manage' } ); if( $auth_status ne 'ok' ) { print CGI::header( '-status' => '401' ); exit 0; diff --git a/serials/create-numberpattern.pl b/serials/create-numberpattern.pl index a28ef0d4155..9f01403474d 100755 --- a/serials/create-numberpattern.pl +++ b/serials/create-numberpattern.pl @@ -27,8 +27,9 @@ use C4::Serials::Numberpattern qw( use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); -my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' }); +my ($auth_status) = check_cookie_auth( $session_cookie, { serials => '*' }); if ($auth_status ne "ok") { print $input->header(-type => 'text/plain', -status => '403 Forbidden'); exit 0; diff --git a/serials/subscription-frequency.pl b/serials/subscription-frequency.pl index 4d5208e8981..da122c1501b 100755 --- a/serials/subscription-frequency.pl +++ b/serials/subscription-frequency.pl @@ -25,8 +25,9 @@ use C4::Auth qw( check_cookie_auth ); use JSON qw( to_json ); my $input=CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my $frqid=$input->param("frequency_id"); -my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' }); +my ($auth_status) = check_cookie_auth( $session_cookie, { serials => '*' }); if ($auth_status ne "ok") { exit 0; } diff --git a/serials/subscription-numberpattern.pl b/serials/subscription-numberpattern.pl index 645f6af04d7..a3488e29ed2 100755 --- a/serials/subscription-numberpattern.pl +++ b/serials/subscription-numberpattern.pl @@ -24,8 +24,9 @@ use C4::Auth qw( check_cookie_auth ); use JSON qw( to_json ); my $input=CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); -my ($auth_status) = check_cookie_auth($input->cookie('CGISESSID'), { serials => '*' }); +my ($auth_status) = check_cookie_auth( $session_cookie, { serials => '*' } ); if ($auth_status ne "ok") { print $input->header(-type => 'text/plain', -status => '403 Forbidden'); exit 0; diff --git a/svc/barcode b/svc/barcode index e54e6e6d17f..6e26f636bbf 100755 --- a/svc/barcode +++ b/svc/barcode @@ -105,8 +105,9 @@ my %type_mapping = ( ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); -my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } ); +my ( $auth_status ) = check_cookie_auth( $session_cookie, { catalogue => '*' } ); if ( $auth_status ne "ok" ) { exit 0; diff --git a/svc/cataloguing/automatic_linker.pl b/svc/cataloguing/automatic_linker.pl index c132fe24736..935bea315d7 100755 --- a/svc/cataloguing/automatic_linker.pl +++ b/svc/cataloguing/automatic_linker.pl @@ -25,11 +25,12 @@ use C4::Biblio qw( BiblioAutoLink TransformHtmlToMarc ); use C4::Context; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); print $input->header('application/json'); # Check the user's permissions my ( $auth_status ) = - C4::Auth::check_cookie_auth( $input->cookie('CGISESSID'), { + C4::Auth::check_cookie_auth( $session_cookie, { editauthorities => 1, editcatalogue => 'edit_catalogue' }); diff --git a/svc/checkin b/svc/checkin index 48fa7185432..7f93d1dcd4e 100755 --- a/svc/checkin +++ b/svc/checkin @@ -30,9 +30,10 @@ use Koha::Checkouts; use Koha::Items; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), + check_cookie_auth( $session_cookie, { circulate => 'circulate_remaining_permissions' } ); my $op = $input->param('op') || q{}; diff --git a/svc/checkouts b/svc/checkouts index dd8d1d0f820..a669402c61f 100755 --- a/svc/checkouts +++ b/svc/checkouts @@ -33,8 +33,9 @@ use Koha::Items; use Koha::ItemTypes; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); -my ( $auth_status, $session ) = check_cookie_auth( $input->cookie('CGISESSID')); +my ( $auth_status, $session ) = check_cookie_auth( $session_cookie ); if( $auth_status ne 'ok' ) { print CGI::header( '-status' => '401' ); exit 0; diff --git a/svc/holds b/svc/holds index eb40d2f2c70..73b9f29a3cf 100755 --- a/svc/holds +++ b/svc/holds @@ -32,9 +32,10 @@ use Koha::ItemTypes; use Koha::Libraries; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), + check_cookie_auth( $session_cookie, { circulate => 'circulate_remaining_permissions' } ); if ( $auth_status ne "ok" ) { diff --git a/svc/mana/increment b/svc/mana/increment index ed7d401f2db..f8ec5db61e4 100755 --- a/svc/mana/increment +++ b/svc/mana/increment @@ -28,11 +28,12 @@ use JSON; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); binmode STDOUT, ":encoding(UTF-8)"; print $input->header( -type => 'application/json', -charset => 'UTF-8' ); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), + check_cookie_auth( $session_cookie, { serials => 'create_subscription' } ); if ( $auth_status ne "ok" || $input->request_method ne "POST" ) { diff --git a/svc/mana/share b/svc/mana/share index 548a56797b0..266141125c9 100755 --- a/svc/mana/share +++ b/svc/mana/share @@ -27,11 +27,12 @@ use CGI; use JSON; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); binmode STDOUT, ":encoding(UTF-8)"; print $input->header( -type => 'application/json', -charset => 'UTF-8' ); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), + check_cookie_auth( $session_cookie, { serials => 'create_subscription' } ); if ( $auth_status ne "ok" || $input->request_method ne "POST" ) { diff --git a/svc/mana/use b/svc/mana/use index 3b405549d59..d06dd6af36e 100755 --- a/svc/mana/use +++ b/svc/mana/use @@ -29,11 +29,12 @@ use JSON; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); binmode STDOUT, ":encoding(UTF-8)"; print $input->header( -type => 'application/json', -charset => 'UTF-8' ); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), + check_cookie_auth( $session_cookie, { serials => 'create_subscription' } ); if ( $auth_status ne "ok" || $input->request_method ne "POST" ) { diff --git a/svc/recall b/svc/recall index 02e2d8fa4b9..6ce7cf7b115 100755 --- a/svc/recall +++ b/svc/recall @@ -28,9 +28,10 @@ use C4::Circulation qw(AddReturn); use Koha::Recalls; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my $json = encode_json({ success => 0 }); -my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID'), { recall => 'manage_recalls' } ); +my ( $auth_status, $sessionID ) = check_cookie_auth( $session_cookie, { recall => 'manage_recalls' } ); if ( $auth_status ne "ok" ) { print $input->header(-type => 'application/json', -status => '403 Forbidden'); diff --git a/svc/renew b/svc/renew index 67a658b0703..b1e923123d7 100755 --- a/svc/renew +++ b/svc/renew @@ -30,9 +30,10 @@ use C4::Auth qw(check_cookie_auth); use Koha::DateUtils qw(output_pref dt_from_string); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), + check_cookie_auth( $session_cookie, { circulate => 'circulate_remaining_permissions' } ); if ( $auth_status ne "ok" ) { diff --git a/svc/return_claims b/svc/return_claims index 42e48c55d53..421645f8a58 100755 --- a/svc/return_claims +++ b/svc/return_claims @@ -30,8 +30,9 @@ use Koha::DateUtils qw( dt_from_string output_pref ); use Koha::Patrons; my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); -my ( $auth_status, $session ) = check_cookie_auth( $input->cookie('CGISESSID') ); +my ( $auth_status, $session ) = check_cookie_auth( $session_cookie ); if( $auth_status ne 'ok' ) { print CGI::header( '-status' => '401' ); exit 0; diff --git a/tools/batch_records_ajax.pl b/tools/batch_records_ajax.pl index bcf97e06bd5..7d3d9a37d25 100755 --- a/tools/batch_records_ajax.pl +++ b/tools/batch_records_ajax.pl @@ -39,6 +39,7 @@ use C4::Auth qw( check_cookie_auth ); use C4::ImportBatch qw( GetImportBatch GetImportRecordsRange GetImportRecordMatches ); my $input = CGI->new; +my $session_cookie = $input->cookie('CGISESSID'); my @sort_columns = qw/import_record_id title status overlay_status overlay_status/; @@ -56,7 +57,7 @@ binmode STDOUT, ":encoding(UTF-8)"; print $input->header( -type => 'text/plain', -charset => 'UTF-8' ); my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), { tools => 'manage_staged_marc' } ); + check_cookie_auth( $session_cookie, { tools => 'manage_staged_marc' } ); if ( $auth_status ne "ok" ) { exit 0; } -- 2.30.2