From 6e72c93557a1c2ed42a726fff86cfb9378b954e8 Mon Sep 17 00:00:00 2001 From: Baptiste Wojtkowski Date: Thu, 20 Apr 2017 12:09:37 +0000 Subject: [PATCH] Bug 17047 security token agst flooding for Mana-KB Rework messages from Mana-KB. - Add A syspref contains an authentication token. The token will be used to prevent anaonymous flooding of Mana-KB - To get an Authentication token, you have to fill a form and validate your e-mail address - Messages return codes are now correctly displayed and there shouldn't be any crash when Mana-KB webservices return a wrong answer or doesn't answer Test plan: 1 - Apply Patch + update database 2 - Copy the three lines about mana config in etc/koha-conf.xml in ../etc/koha-conf.xml (after for example) https://mana-kb.koha-community.org 3 - Check Mana syspref and AutoShareWithMana syspref are not activated 4 - Search the syspref ManaToken and follow the instructions 5 - subscriptions - Try create a new subscription for a first serial => Mana-KB shouldn't show you anything (except if the base hase been filled) - Share this serial with Mana-KB (on the serial individual's page there must be a Share button) - Try to create a new subscription for serial nr1 => a message should appear when you click on "next", click on "use", the fields should automaticaly appear - Activate AutoShareWithMana => Subscriptions - Create a new subscription for a second serial - There shouldn't be any Share button - Create a second subscription => the message should appear, click again on use 6 - SQL Report - Create a new SQL report, without notes. - On the table with all report (reports > use saved), there should be the action "Share" - If you click on share, you have an error message - Create a new report, with a title and notes longer than 20 characters - You can share it with mana => you will have a success message - On (report > use saved), there must be a message inviting you to search on Mana-KB for more results, enter a few word from title, notes, type of the report you shared, it should appear. You can use it, it will load it into your report list. 7 - Report mistakes. - On any table containing Mana-KB search results, you can report a mistake and add a comment. 8 - For each previous test, try to send wrong data, to delete the security token, to send nothing: it should show a correct warning message. Signed-off-by: Brendan A Gallagher Signed-off-by: Kyle M Hall Rebased-by: Alex Arnaud (2018-07-04) --- Koha/SharedContent.pm | 42 +++++--- .../mysql/atomicupdate/mana_04-add_mana_token.sql | 2 + koha-tmpl/intranet-tmpl/lib/jquery/activatemana.js | 20 ++++ .../en/includes/mana/mana-report-search-result.inc | 90 +++++++++-------- .../mana/mana-subscription-search-result.inc | 112 +++++++++++---------- .../prog/en/includes/serials-toolbar.inc | 1 + .../en/modules/admin/preferences/web_services.pref | 5 + .../en/modules/reports/guided_reports_start.tt | 8 +- .../prog/en/modules/serials/subscription-add.tt | 2 +- .../prog/en/modules/serials/subscription-detail.tt | 6 +- .../intranet-tmpl/prog/js/subscription-add.js | 2 +- reports/guided_reports.pl | 6 +- serials/subscription-add.pl | 4 +- serials/subscription-detail.pl | 2 +- svc/mana/getToken | 55 ++++++++++ svc/mana/search | 2 + 16 files changed, 226 insertions(+), 133 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/mana_04-add_mana_token.sql create mode 100644 koha-tmpl/intranet-tmpl/lib/jquery/activatemana.js create mode 100755 svc/mana/getToken diff --git a/Koha/SharedContent.pm b/Koha/SharedContent.pm index 7ac12f4..9bd4d09 100644 --- a/Koha/SharedContent.pm +++ b/Koha/SharedContent.pm @@ -24,23 +24,33 @@ use LWP::UserAgent; use Koha::Serials; use Koha::Reports; +use C4::Context; our $MANA_IP = C4::Context->config('mana_config'); sub manaRequest { my $mana_request = shift; my $result; - $mana_request->content_type('application/json'); my $userAgent = LWP::UserAgent->new; + if ( $mana_request->method eq "POST" ){ + my $content; + if ($mana_request->content) {$content = from_json( $mana_request->content )}; + $content->{securitytoken} = C4::Context->preference("ManaToken"); + $mana_request->content( to_json($content) ); + } + my $response = $userAgent->request($mana_request); - if ( $response->code ne "204" ) { - $result = from_json( $response->decoded_content ); - } + eval { $result = from_json( $response->decoded_content ); }; $result->{code} = $response->code; - - return $result if ( $response->code =~ /^2..$/ ); + if ( $@ ){ + $result->{msg} = $response->{_msg}; + } + if ($response->is_error){ + $result->{msg} = "An error occurred, mana server returned: ".$result->{msg}; + } + return $result ; } sub manaIncrementRequest { @@ -71,7 +81,6 @@ sub manaPostRequest { $content->{bulk_import} = 0; my $json = to_json( $content, { utf8 => 1 } ); $request->content($json); - return manaRequest($request); } @@ -88,13 +97,15 @@ sub manaShareInfos{ my $mana_email; if ( $loggedinuser ne 0 ) { my $borrower = Koha::Patrons->find($loggedinuser); - $mana_email = $borrower->email - if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); - $mana_email = $borrower->emailpro - if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); - $mana_email = - Koha::Libraries->find( C4::Context->userenv->{'branch'} )->branchemail - if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); + if ($borrower){ + $mana_email = $borrower->email + if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); + $mana_email = $borrower->emailpro + if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); + $mana_email = + Koha::Libraries->find( C4::Context->userenv->{'branch'} )->branchemail + if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); + } } $mana_email = C4::Context->preference('KohaAdminEmailAddress') if ( ( not defined($mana_email) ) or ( $mana_email eq '' ) ); @@ -114,8 +125,9 @@ sub manaShareInfos{ my $result = Koha::SharedContent::manaPostRequest( $ressourcetype, $ressource_mana_info ); + if ( $result and ($result->{code} eq "200" or $result->{code} eq "201") ) { - $ressource->set( { mana_id => $result->{id} } )->store; + eval { $ressource->set( { mana_id => $result->{id} } )->store }; } return $result; } diff --git a/installer/data/mysql/atomicupdate/mana_04-add_mana_token.sql b/installer/data/mysql/atomicupdate/mana_04-add_mana_token.sql new file mode 100644 index 0000000..200f3e5 --- /dev/null +++ b/installer/data/mysql/atomicupdate/mana_04-add_mana_token.sql @@ -0,0 +1,2 @@ +INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `type` ) VALUES +('ManaToken','',NULL,'Security token used for authentication on Mana KB service (anti spam)','Textarea'); diff --git a/koha-tmpl/intranet-tmpl/lib/jquery/activatemana.js b/koha-tmpl/intranet-tmpl/lib/jquery/activatemana.js new file mode 100644 index 0000000..b1cb9c9 --- /dev/null +++ b/koha-tmpl/intranet-tmpl/lib/jquery/activatemana.js @@ -0,0 +1,20 @@ +$(document).ready(function(){ + $("#activatemana").on("click", function(){ + var mylastname = $("#lastname").val() + var myfirstname = $("#firstname").val() + var myemail = $("#email").val() + $.ajax( { + type: "POST", + url: "/cgi-bin/koha/svc/mana/getToken", + data: { lastname: mylastname, firstname: myfirstname, email: myemail}, + dataType: "json", + }) + .done(function(result){ + console.log(result.token); + $("#pref_ManaToken").val(result.token); + $("#pref_ManaToken").trigger("input"); + }).fail( function( result ){ + }); + return false; + }); +}); diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-report-search-result.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-report-search-result.inc index 7f74257..455f453 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-report-search-result.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-report-search-result.inc @@ -3,32 +3,31 @@ [% USE AuthorisedValues %] [% USE Branches %] - - - - - - - - - - [% UNLESS search_only %] - - [% END %] - - - - [% FOREACH report IN reports %] - [% UNLESS report.cannotdisplay %] - highWarned %] - class = "high-warned-row" - [% ELSIF report.nbofcomment > warned %] - class = "warned-row" - [% ELSIF report.nbofcomment > lowWarned %] - class = "highlighted-row" - [% END %] - > +[% IF statuscode == "200" AND reports %] +
Report NameNotesType# of usersLast import Comments Actions
+ + + + + + + + + [% UNLESS search_only %] + + [% END %] + + + + [% FOREACH report IN reports %] + [% UNLESS report.cannotdisplay %] + [% IF report.nbofcomment > highWarned %] + + [% ELSIF report.nbofcomment > warned %] + + [% ELSIF report.nbofcomment > lowWarned %] + + [% END %] + Show Less [% END %] - + [% UNLESS search_only %] - + [% END %] - + + [% END %] [% END %] - [% END %] - -
Report NameNotesType# of usersLast import Comments Actions
[% IF ( report.report_name ) %][% report.report_name %][% END %]
@@ -37,32 +36,35 @@ [% END %] [% report.notes %] [% IF report.notes.length > 200 %] - Show Less
 [% report.type %] [% IF ( report.nbofusers ) %][% report.nbofusers %][% END %] [% report.lastimport | $KohaDates %][% FOREACH comment IN report.comments %][% comment.message %] ([% comment.nb %])
[% END %]		[% FOREACH comment IN report.comments %][% comment.message %] ([% comment.nb %])
[% END %]		 - - - - - + + + + +
+ + +[% ELSE %] +

[% msg %] statuscode: [% statuscode %]

+[% END %]