From 00b638b390c1f0007f7345be4aabca5e73d632ed Mon Sep 17 00:00:00 2001 From: Mark Tompsett Date: Mon, 14 Dec 2015 10:40:03 -0500 Subject: [PATCH] Bug 10988: Dealt with borrower flag issues Removed borrower flag reference in template grab, and emptied it in the checkauth call. Personal retesting worked. Also, made it perlcritic prettier. Test Plan: 0) Back up your database 1) Apply all these patches 2) In your mysql client use your Koha database and execute: > DELETE FROM systempreferences; > SOURCE ~/kohaclone/installer/data/mysql/sysprefs.sql; -- Should be no errors. > SELECT * FROM systempreferences LIKE 'GoogleOAuth%'; -- Should see 4 entries. > QUIT; 3) Restore your database 4) Run ./installer/data/mysql/updatedatabase.pl; 5) In your mysql client use your Koha database and execute: > SELECT * FROM systempreferences LIKE 'GoogleOAuth%'; -- Should see the same 4 entries. 6) Log into the staff client 7) Home -> Koha administration -> Global system preferences 8) -> OPAC -- make sure your OPACBaseURL is set (e.g. https://opac.koha.ca) 9) -> Administration -- There should be a 'Google OAuth2' section with the ability to set those 4 system preferences. 10) In a new tab, go to https://console.developers.google.com/project 11) Click 'Create Project' 12) Type in a project name that won't freak users out, like your library name (e.g. South Pole Library). 13) Click the 'Create' button. 14) Click the 'APIs & auth' in the left frame. 15) Click 'Credentials' 16) Click 'Create new Client ID' 17) Select 'Web application' and click 'Configure consent screen'. 18) Select the Email Address. 19) Put it a meaningful string into the Product Name (e.g. South Pole Library Authentication) 20) Fill in the other fields as desired (or not) 21) Click 'Save' 22) Change the 'AUTHORIZED JAVASCRIPT ORIGINS' to your OPACBaseURL. (http://library.yourDNS.org) 23) Change the 'AUTHORIZED REDIRECT URIS' to point to the new googleoauth2 script (http://library.yourDNS.org/cgi-bin/koha/svc/auth/googleoauth2) 24) Click 'Create Client ID' 25) Copy and paste the 'CLIENT ID' into the GoogleOAuth2ClientID system preference. 26) Copy and paste the 'CLIENT SECRET' into the GoogleOAuth2ClientSecret system preference. 27) Change the GoogleOAuth2 preference to 'Use'. 28) Click 'Save all Administration preferences' 29) In the OPAC, click 'Log in to your account'. -- You should get a confirmation request, if you are already logged in, OR a login screen if you are not. -- You need to have the primary email address set to one authenticated by Google in order to log in. 30) Run koha qa test tools --- opac/svc/auth/googleoauth2 | 45 +++++++++++++++++++++------------------------ 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/opac/svc/auth/googleoauth2 b/opac/svc/auth/googleoauth2 index 07ff084..b5e1405 100755 --- a/opac/svc/auth/googleoauth2 +++ b/opac/svc/auth/googleoauth2 @@ -46,9 +46,9 @@ use LWP::UserAgent; use HTTP::Request::Common qw{ POST }; use JSON; -my $scope = "openid email"; -my $host = C4::Context->preference('OPACBaseURL') // ''; -my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain') // ''; +my $scope = 'openid email'; +my $host = C4::Context->preference('OPACBaseURL') // q{}; +my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain') // q{}; # protocol is assumed in OPACBaseURL see bug 5010. my $redirecturl = $host . '/cgi-bin/koha/svc/auth/googleoauth2'; @@ -56,25 +56,25 @@ my $issuer = 'accounts.google.com'; my $clientid = C4::Context->preference('GoogleOAuth2ClientID'); my $clientsecret = C4::Context->preference('GoogleOAuth2ClientSecret'); -my $query = new CGI; +my $query = CGI->new; sub loginfailed { - my $query = shift; - my $reason = shift; - $query->delete('code'); - $query->param( 'OAuth2Failed' => $reason ); + my $cgi_query = shift; + my $reason = shift; + $cgi_query->delete('code'); + $cgi_query->param( 'OAuth2Failed' => $reason ); my ( $template, $borrowernumber, $cookie ) = get_template_and_user( { template_name => 'opac-user.tt', - query => $query, + query => $cgi_query, type => 'opac', authnotrequired => 0, - flagsrequired => { borrow => 1 }, } ); $template->param( 'invalidOAuth2Login' => $reason ); $template->param( 'loginprompt' => 1 ); - output_html_with_http_headers $query, $cookie, $template->output; + output_html_with_http_headers $cgi_query, $cookie, $template->output; + return; } if ( defined $query->param('error') ) { @@ -111,11 +111,11 @@ elsif ( defined $query->param('code') ) { && exists( $json->{'email'} ) ) { my $email = $json->{'email'}; - my ( $userid, $cookie, $sessionID ) = - checkauth( $query, 1, { borrow => 1 }, 'opac', $email ); + my ( $userid, $cookie, $session_id ) = + checkauth( $query, 1, { }, 'opac', $email ); if ($userid) { # A valid user has logged in - if ( ( $restricttodomain ne '' ) - && ( index( $email, $restricttodomain ) == -1 ) ) + if ( ( $restricttodomain ne q{} ) + && ( index( $email, $restricttodomain ) < 0 ) ) { loginfailed( $query, 'The email you have used is not valid for this library. Email addresses should conclude with ' @@ -148,22 +148,19 @@ elsif ( defined $query->param('code') ) { } else { - my $prompt = ''; - $prompt = $query->param('reauthenticate') - unless not( defined $query->param('reauthenticate') ); + my $prompt = $query->param('reauthenticate') // q{}; my $authorisationurl = 'https://accounts.google.com/o/oauth2/auth?' . 'response_type=code&' . 'redirect_uri=' - . escape($redirecturl) . '&' + . escape($redirecturl) . q{&} . 'client_id=' - . escape($clientid) . '&' + . escape($clientid) . q{&} . 'scope=' - . escape($scope) . '&'; - if ( $query->param('reauthenticate') ) { - $authorisationurl .= - 'prompt=' . escape( $query->param('reauthenticate') ); + . escape($scope) . q{&}; + if ( $prompt || ( defined $prompt && length $prompt > 0 ) ) { + $authorisationurl .= 'prompt=' . escape($prompt); } print $query->redirect($authorisationurl); } -- 2.1.4