From 021a566f80828c54f74da1b6542d2044192554eb Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 24 Sep 2024 15:22:59 +0200 Subject: [PATCH] Bug 40943: Use session_id from userenv instead of cookie for value_builder Content-Type: text/plain; charset=utf-8 Signed-off-by: Marcel de Rooy [EDIT] Inline tidy. Moved set_userenv_from_session before POD of next sub. --- C4/Context.pm | 25 +++++++++++++++---- C4/InstallAuth.pm | 12 +-------- cataloguing/value_builder/barcode_manual.pl | 2 +- cataloguing/value_builder/dateaccessioned.pl | 4 ++- cataloguing/value_builder/marc21_field_005.pl | 4 ++- .../value_builder/marc21_field_245h.pl | 4 ++- .../value_builder/marc21_field_260b.pl | 4 ++- cataloguing/value_builder/marc21_orgcode.pl | 3 ++- cataloguing/value_builder/stocknumber.pl | 2 +- cataloguing/value_builder/upload.pl | 3 ++- 10 files changed, 39 insertions(+), 24 deletions(-) diff --git a/C4/Context.pm b/C4/Context.pm index 7860205516..ab0f82bc2e 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -666,6 +666,20 @@ sub userenv { return $context->{userenv}; } +sub set_userenv_from_session { + my ( $class, $session ) = @_; + return $class->set_userenv( + $session->param('number'), $session->param('id') // '', + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('shibboleth'), + $session->param('desk_id'), $session->param('desk_name'), + $session->param('register_id'), $session->param('register_name'), + $session->id, + ); +} + =head2 set_userenv C4::Context->set_userenv($usernum, $userid, $usercnum, @@ -685,10 +699,10 @@ set_userenv is called in Auth.pm sub set_userenv { shift @_; my ( - $usernum, $userid, $usercnum, $userfirstname, - $usersurname, $userbranch, $branchname, $userflags, - $emailaddress, $shibboleth, $desk_id, $desk_name, - $register_id, $register_name + $usernum, $userid, $usercnum, $userfirstname, + $usersurname, $userbranch, $branchname, $userflags, + $emailaddress, $shibboleth, $desk_id, $desk_name, + $register_id, $register_name, $session_id, ) = @_; my $cell = { @@ -707,7 +721,8 @@ sub set_userenv { "desk_id" => $desk_id, "desk_name" => $desk_name, "register_id" => $register_id, - "register_name" => $register_name + "register_name" => $register_name, + "session_id" => $session_id, }; $context->{userenv} = $cell; return $cell; diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 843ec079a8..c9ea257073 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -254,17 +254,7 @@ sub checkauth { if ($session) { if ( $session->param('cardnumber') ) { - C4::Context->set_userenv( - $session->param('number'), - $session->param('id'), - $session->param('cardnumber'), - $session->param('firstname'), - $session->param('surname'), - $session->param('branch'), - $session->param('branchname'), - $session->param('flags'), - $session->param('emailaddress') - ); + C4::Context->set_userenv_from_session($session); $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl index 88c7a89a2e..4a9a9236f0 100755 --- a/cataloguing/value_builder/barcode_manual.pl +++ b/cataloguing/value_builder/barcode_manual.pl @@ -31,7 +31,7 @@ use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl index a1f90a6bfd..877789823a 100755 --- a/cataloguing/value_builder/dateaccessioned.pl +++ b/cataloguing/value_builder/dateaccessioned.pl @@ -23,9 +23,11 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl index fab701b9e3..a902082e5d 100755 --- a/cataloguing/value_builder/marc21_field_005.pl +++ b/cataloguing/value_builder/marc21_field_005.pl @@ -23,9 +23,11 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl index 13f21f50c7..66cd162e8a 100755 --- a/cataloguing/value_builder/marc21_field_245h.pl +++ b/cataloguing/value_builder/marc21_field_245h.pl @@ -23,9 +23,11 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl index a7836f1483..d9e14a82bb 100755 --- a/cataloguing/value_builder/marc21_field_260b.pl +++ b/cataloguing/value_builder/marc21_field_260b.pl @@ -29,9 +29,11 @@ use C4::Context; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl index e30e7b390f..7fbb8f6950 100755 --- a/cataloguing/value_builder/marc21_orgcode.pl +++ b/cataloguing/value_builder/marc21_orgcode.pl @@ -26,9 +26,10 @@ use C4::Context; use Koha::Libraries; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); + my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl index 2e2b3b3bac..a9aca79be1 100755 --- a/cataloguing/value_builder/stocknumber.pl +++ b/cataloguing/value_builder/stocknumber.pl @@ -25,7 +25,7 @@ use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl index 37867dc95c..be262ec708 100755 --- a/cataloguing/value_builder/upload.pl +++ b/cataloguing/value_builder/upload.pl @@ -32,9 +32,10 @@ use Modern::Perl; use CGI qw ( -utf8 ); use C4::Auth qw( check_cookie_auth ); +use C4::Context; my $input = CGI->new; my ($auth_status) = - check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); + check_cookie_auth( C4::Context->userenv->{session_id}, { catalogue => 1 } ); if ( $auth_status ne "ok" ) { print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); exit 0; -- 2.39.5