Bugzilla – Attachment 66845 Details for
Bug 16694
Limit SIP2 auth by patron attribute
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 16694 - Limit SIP2 auth by patron attribute
Bug-16694---Limit-SIP2-auth-by-patron-attribute.patch (text/plain), 4.19 KB, created by
Benjamin Rokseth
on 2017-09-05 12:14:33 UTC
(
hide
)
Description:
Bug 16694 - Limit SIP2 auth by patron attribute
Filename:
MIME Type:
Creator:
Benjamin Rokseth
Created:
2017-09-05 12:14:33 UTC
Size:
4.19 KB
patch
obsolete
>From 9fa84ac2220438e6b1be0e275a70ad315f68d318 Mon Sep 17 00:00:00 2001 >From: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> >Date: Fri, 26 Aug 2016 10:19:36 +0000 >Subject: [PATCH] Bug 16694 - Limit SIP2 auth by patron attribute > >The main use case of this bug is to use patron attributes to grant special >privileges, e.g. to open a door to an unmanned library. > >This patch adds an extra check against patron attributes if login account >in SIPconfig.xml has a key validate_patron_attribute set to some patron attribute. > >If a patron information request is sent (63), and patron has proper rights in the >given attribute: (a value of 1/true or some authorised value mapping to 1) >The user will be allowed access (in SIP: charge and/or renewal ok). >Otherwise denied. > >Please note that this is specific to the SIP login account, so self checkout >machines can be handled differently than e.g. a door card terminal. > >To test: >0) you need to debug using telnet or the koha provided sip_client >1) add validate_patron_attribute="testattribute" to some login account in SIPconfig.xml >2) add a patron attribute "testattribute" >3) edit some patron and set "testattribute" to "1" >4) do a sip login with the given login account from SIPconfig.xml >5) do a patron information request (63) on the patron >6) observe that no charge or renewal denied is given in the response (64 ) >7) try all or any of the following: > - set patron attribute to anything but "1" > - delete the patron attribute > - map the patron attribute to an authorized list, e.g. (YES_NO) and > set it to a value that doesn't map to "1", e.g. "No". >8) do a patron information request (63) again >9) observe that charge and renewal is now denied in the SIP response (64YY) >10) thank yourself if noone else does and grab a coffee > >Signed-off-by: Magnus Enger <magnus@libriotech.no> >Took me a while to remember I was on a gitified setup and needed to do >sudo cp C4/SIP/Sip/MsgType.pm /usr/share/koha/lib/C4/SIP/Sip/MsgType.pm >before I could test properly. Works as expected. I have a Swedish customer >running a similar hack in production, so looking forward to getting this >into Koha proper. >--- > C4/SIP/Sip/MsgType.pm | 15 ++++++++++++++- > etc/SIPconfig.xml | 1 + > 2 files changed, 15 insertions(+), 1 deletion(-) > >diff --git a/C4/SIP/Sip/MsgType.pm b/C4/SIP/Sip/MsgType.pm >index dded51e..8ca72be 100644 >--- a/C4/SIP/Sip/MsgType.pm >+++ b/C4/SIP/Sip/MsgType.pm >@@ -932,6 +932,20 @@ sub handle_patron_info { > > $resp = (PATRON_INFO_RESP); > if ($patron) { >+ # Bug 16694 - Limit SIP2 auth by patron attribute >+ # If login account has validate_patron_attribute set, it will check if patron has this attribute set >+ # If set to 1 or authorized value mapped to 1, allow access (charge and renewal privileges ok) >+ if ($server->{account}->{validate_patron_attribute}) { >+ my $attr = C4::Members::Attributes::GetBorrowerAttributeValue($patron->{borrowernumber}, $server->{account}->{validate_patron_attribute}); >+ if ($attr && $attr == "1") { >+ $patron->{charge_ok} = "1"; >+ $patron->{renew_ok} = "1"; >+ } else { >+ $patron->{charge_ok} = 0; >+ $patron->{renew_ok} = 0; >+ } >+ } >+ > $resp .= patron_status_string($patron); > $resp .= ( defined($lang) and length($lang) == 3 ) ? $lang : $patron->language; > $resp .= timestamp(); >@@ -1606,4 +1620,3 @@ sub api_auth { > > 1; > __END__ >- >diff --git a/etc/SIPconfig.xml b/etc/SIPconfig.xml >index f51f093..7a36cf4 100644 >--- a/etc/SIPconfig.xml >+++ b/etc/SIPconfig.xml >@@ -46,6 +46,7 @@ > <accounts> > <login id="term1" password="term1" delimiter="|" error-detect="enabled" institution="CPL" encoding="ascii" checked_in_ok="1" payment_type_writeoff="06" /> > <login id="koha" password="koha" delimiter="|" error-detect="enabled" institution="kohalibrary" encoding="utf8" /> >+ <login id="sc-door" password="koha" institution="kohalibrary" encoding="utf8" validate_patron_attribute="sc-door-access" /> > <login id="koha2" password="koha" institution="kohalibrary2" terminator="CR" /> > <login id="lpl-sc" password="1234" institution="LPL" /> > <login id="lpl-sc-beacock" password="xyzzy" >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16694
:
54920
|
56068
|
56442
|
56579
|
66845
|
66846
|
66847
|
66848
|
66849
|
67956
|
80702
|
80703