From dbd0497268849dc838ffb33d63edd835a2300ad5 Mon Sep 17 00:00:00 2001 From: David Cook Date: Sun, 5 Jan 2025 23:47:37 +0000 Subject: [PATCH] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the , , and tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: " -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=&login_password=" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: " \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml --- C4/Auth.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 0ee06104a4..b13f2589a6 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1635,7 +1635,7 @@ sub check_api_auth { -secure => ( C4::Context->https_enabled() ? 1 : 0 ), -sameSite => 'Lax' ); - return ( $return, $cookie, $session ); # return == 'ok' here + return ( $return, $cookie, $session->id ); # return == 'ok' here } else { -- 2.39.5