From a1f9a6d94c9872dedec9e8c3063d62374f510720 Mon Sep 17 00:00:00 2001 From: Alex Arnaud Date: Tue, 5 Dec 2017 10:43:05 +0000 Subject: [PATCH] Bug 19752: offline_circ/service.pl - Return HTTP status 401 when authentication failed and add option nocookie Test plan: - Apply this patch, - log in to Koha, - go to cgi-bin/koha/offline_circ/service.pl with no valid user and password as parameters and nocookie set to 1. i.e: cgi-bin/koha/offline_circ/service.pl?userid=alex&password=wrongpass&nocookie=1, - auth should fail - check that the response code is 401 https://bugs.koha-community.org/show_bug.cgi?id=19752 Signed-off-by: Maksim Sen Signed-off-by: Katrin Fischer --- offline_circ/service.pl | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/offline_circ/service.pl b/offline_circ/service.pl index b36162f..a64fbd5 100755 --- a/offline_circ/service.pl +++ b/offline_circ/service.pl @@ -28,9 +28,13 @@ use DateTime::TimeZone; my $cgi = CGI->new; +# used by the KOCT firefox extension +# (or any third-party that doesn't want to rely on cookies for authentication) +my $nocookie = $cgi->param('nocookie') || 0; + # get the status of the user, this will check his credentials and rights my ($status, $cookie, $sessionId) = C4::Auth::check_api_auth($cgi, undef); -($status, $sessionId) = C4::Auth::check_cookie_auth($cgi, undef) if ($status ne 'ok'); +($status, $sessionId) = C4::Auth::check_cookie_auth($cgi, undef) if ($status ne 'ok' && !$nocookie); my $result; @@ -76,9 +80,11 @@ if ($status eq 'ok') { # if authentication is ok } ); } -} else { - $result = "Authentication failed." + + print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8'); + print $result; + exit; } -print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8'); +print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8', '-status' => '401 Unauthorized'); print $result; -- 2.7.4