View | Details | Raw Unified | Return to bug 22132
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-3 / +47 lines)
Lines 21-27 use Modern::Perl; Link Here
21
21
22
use Mojo::Base 'Mojolicious::Controller';
22
use Mojo::Base 'Mojolicious::Controller';
23
23
24
use C4::Auth qw( check_cookie_auth get_session haspermission );
24
use C4::Auth qw( check_cookie_auth checkpw_internal get_session haspermission );
25
use C4::Context;
25
use C4::Context;
26
26
27
use Koha::ApiKeys;
27
use Koha::ApiKeys;
Lines 37-42 use Koha::Exceptions; Link Here
37
use Koha::Exceptions::Authentication;
37
use Koha::Exceptions::Authentication;
38
use Koha::Exceptions::Authorization;
38
use Koha::Exceptions::Authorization;
39
39
40
use MIME::Base64;
40
use Module::Load::Conditional;
41
use Module::Load::Conditional;
41
use Scalar::Util qw( blessed );
42
use Scalar::Util qw( blessed );
42
use Try::Tiny;
43
use Try::Tiny;
Lines 78-84 sub under { Link Here
78
            return $c->render(status => 401, json => { error => $_->error });
79
            return $c->render(status => 401, json => { error => $_->error });
79
        }
80
        }
80
        elsif ($_->isa('Koha::Exceptions::Authentication')) {
81
        elsif ($_->isa('Koha::Exceptions::Authentication')) {
81
            return $c->render(status => 500, json => { error => $_->error });
82
            return $c->render(status => 401, json => { error => $_->error });
82
        }
83
        }
83
        elsif ($_->isa('Koha::Exceptions::BadParameter')) {
84
        elsif ($_->isa('Koha::Exceptions::BadParameter')) {
84
            return $c->render(status => 400, json => $_->error );
85
            return $c->render(status => 400, json => $_->error );
Lines 89-94 sub under { Link Here
89
                required_permissions => $_->required_permissions,
90
                required_permissions => $_->required_permissions,
90
            });
91
            });
91
        }
92
        }
93
        elsif ($_->isa('Koha::Exceptions::Authorization')) {
94
            return $c->render(status => 403, json => $_->error);
95
        }
92
        elsif ($_->isa('Koha::Exceptions')) {
96
        elsif ($_->isa('Koha::Exceptions')) {
93
            return $c->render(status => 500, json => { error => $_->error });
97
            return $c->render(status => 500, json => { error => $_->error });
94
        }
98
        }
Lines 151-156 sub authenticate_api_request { Link Here
151
            );
155
            );
152
        }
156
        }
153
    }
157
    }
158
    elsif ( $authorization_header and $authorization_header =~ /^Basic / ) {
159
        unless ( C4::Context->preference('RESTBasicAuth') ) {
160
            Koha::Exceptions::Authentication::Required->throw(
161
                error => 'Basic authentication disabled'
162
            );
163
        }
164
        $user = $c->_basic_auth( $authorization_header );
165
        unless ( $user ) {
166
            # If we have "Authorization: Basic" header and authentication
167
            # failed, do not try other authentication means
168
            Koha::Exceptions::Authentication::Required->throw(
169
                error => 'Authentication failure.'
170
            );
171
        }
172
    }
154
    else {
173
    else {
155
174
156
        my $cookie = $c->cookie('CGISESSID');
175
        my $cookie = $c->cookie('CGISESSID');
Lines 390-393 sub _object_ownership_by_reserve_id { Link Here
390
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
409
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
391
}
410
}
392
411
412
=head3 _basic_auth
413
414
Internal method that performs Basic authentication.
415
416
=cut
417
418
sub _basic_auth {
419
    my ( $c, $authorization_header ) = @_;
420
421
    my ( $type, $credentials ) = split / /, $authorization_header;
422
423
    unless ($credentials) {
424
        Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' );
425
    }
426
427
    my $decoded_credentials = decode_base64( $credentials );
428
    my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 );
429
430
    my $dbh = C4::Context->dbh;
431
    unless ( checkpw_internal($dbh, $user_id, $password ) ) {
432
        Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Invalid password' );
433
    }
434
435
    return Koha::Patrons->find({ userid => $user_id });
436
}
437
393
1;
438
1;
394
- 

Return to bug 22132