From 3fbe8f4fe598611a60eca638319852f5b5df05b0 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Sun, 26 Oct 2025 12:32:43 +0200 Subject: [PATCH] Bug 38363: Use output_html_with_http_headers in C4::Auth The following C4::Auth subroutines - checkauth() - get_template_and_user() were in some cases outputting html outside of C4::Output's output mechanisms. It is important to ensure the consistency of our HTTP responses. Having multiple output mechanisms for what is essentialy the same type of response not only leads to unneccessary code duplication and complexity but possibly even bugs at some point in the future. For these reasons it is better to output only through C4::Output, when possible. This patch does that for the two aforementioned C4::Auth cases. To test unit tests: 1. prove t/db_dependent/Auth.t As for checkauth(), the change only applies to failed logins. To test checkauth: 1. Log in to OPAC with invalid credentials 2. Observe "You entered an incorrect username or password" 3. Log in to staff client with invalid credentials 4. Observe "Invalid username or password" As for get_template_and_user(), the change only applies to SCO/SCI user navigating outside of the self service modules. To test get_template_and_user: 1. Enable system preference WebBasedSelfCheck 2. Create a new test patron and note down their username & password 3. Grant them a permission self_checkout_module (under Self check modules) 4. Navigate to http://OPAC/cgi-bin/koha/sco/sco-main.pl 5. Log in with the test patron 6. Observe successful login (should display "Self-checkout system" page) 7. Navigate to http://OPAC/cgi-bin/koha/opac-main.pl (you can get there by editing the address bar of your web browser) 8. Observe "Log in to your account" page, ie. you have been kicked out 9. Modify your test patron's permissions 10. Remove permission "self_checkout_module" and add "self_checkin_module" 11. Enable system preference SelfCheckInModule 12. Navigate to http://OPAC/cgi-bin/koha/sci/sci-main.pl 13. Log in using your test patron's credentials 14. Observe "Self check-in" page 15. Navigate to http://OPAC/cgi-bin/koha/opac-main.pl (you can get there by editing the address bar of your web browser) 16. Observe "Log in to your account" page, ie. you have been kicked out --- C4/Auth.pm | 20 ++------------------ 1 file changed, 2 insertions(+), 18 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 2b29d1f2d2c..6f66e57cf46 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -333,15 +333,7 @@ sub get_template_and_user { auth_error => $auth_error, ); - print $in->{query}->header( - { - type => 'text/html', - charset => 'utf-8', - cookie => $cookie, - 'X-Frame-Options' => 'SAMEORIGIN' - } - ), - $template->output; + C4::Output::output_html_with_http_headers( $in->{query}, $cookie, $template->output ); safe_exit; } } @@ -1619,15 +1611,7 @@ sub checkauth { return ( undef, undef, undef, undef, $template ); } - print $query->header( - { - type => 'text/html', - charset => 'utf-8', - cookie => $cookie, - 'X-Frame-Options' => 'SAMEORIGIN', - } - ), - $template->output; + C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); safe_exit; } -- 2.34.1