Bugzilla – Attachment 37595 Details for
Bug 12954
Questionable logic regarding session handling in C4::Auth::checkauth()
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 12954: Failed login should retain anonymous session (3.16.x)
Bug-12954-Failed-login-should-retain-anonymous-ses.patch (text/plain), 2.38 KB, created by
Mason James
on 2015-04-09 03:34:59 UTC
(
hide
)
Description:
Bug 12954: Failed login should retain anonymous session (3.16.x)
Filename:
MIME Type:
Creator:
Mason James
Created:
2015-04-09 03:34:59 UTC
Size:
2.38 KB
patch
obsolete
>From 7f504acc13a361ba93504917498ae955b82ed430 Mon Sep 17 00:00:00 2001 >From: Mason James <mtj@kohaaloha.com> >Date: Thu, 9 Apr 2015 15:33:02 +1200 >Subject: [PATCH] Bug 12954: Failed login should retain anonymous session > (3.16.x) >Content-Type: text/plain; charset="utf-8" > >A failed login should not leave the user in a half logged authenticated >state, but rather return them to an anonymouse session as per the >pre-login attempt state. > >To replicate error: >1. Try to log in with some nonexisting user id or wrong password in the > OPAC >2. Go directly to /opac-user.pl (e.g., enter it in the browser address > bar, or just click on the "Log in" link) >3. Observe a DBI error displayed on the screen >4. You are now in the "deadloop" of sorts (opac/opac-user.pl refuses to > display the login screen, no matter how many times you try to reload > it); to break the deadloop, one needs to: > - remove session cookie from the browser (or cause the session to > expire in some other way - closing browser window would be probably > enough for that) > - remove offending session on the server (from mysql sessions table, > ..) > - log in with proper credentials using some other page (like > opac/opac-main.pl right-side panel), which does not involve > opac/opac-user.pl being called without "userid" CGI parameter. > >To test: >1. Test as above, the DBI error should no longer be present >2. Check that search history works across failed and sucessful login > attempts > >Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> >Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> >Signed-off-by: Mason James <mtj@kohaaloha.com> >--- > C4/Auth.pm | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index e00ac71..34d6312 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -990,12 +990,14 @@ sub checkauth { > > } > else { >+ $debug and warn "Login failed, resetting anonymous session..."; > if ($userid) { > $info{'invalid_username_or_password'} = 1; > C4::Context->_unset_userenv($sessionID); > } > $session->param('lasttime',time()); > $session->param('ip',$session->remote_addr()); >+ $session->param('sessiontype','anon'); > } > } # END if ( $userid = $query->param('userid') ) > elsif ($type eq "opac") { >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 12954
:
31698
|
34551
|
34829
|
35341
|
35412
| 37595