View | Details | Raw Unified | Return to bug 22132
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-3 / +44 lines)
Lines 19-25 package Koha::REST::V1::Auth; Link Here
19
19
20
use Mojo::Base 'Mojolicious::Controller';
20
use Mojo::Base 'Mojolicious::Controller';
21
21
22
use C4::Auth qw( check_cookie_auth get_session haspermission );
22
use C4::Auth qw( check_cookie_auth checkpw_internal get_session haspermission );
23
use C4::Context;
23
use C4::Context;
24
24
25
use Koha::ApiKeys;
25
use Koha::ApiKeys;
Lines 35-40 use Koha::Exceptions; Link Here
35
use Koha::Exceptions::Authentication;
35
use Koha::Exceptions::Authentication;
36
use Koha::Exceptions::Authorization;
36
use Koha::Exceptions::Authorization;
37
37
38
use MIME::Base64;
38
use Module::Load::Conditional;
39
use Module::Load::Conditional;
39
use Scalar::Util qw( blessed );
40
use Scalar::Util qw( blessed );
40
use Try::Tiny;
41
use Try::Tiny;
Lines 87-93 sub under { Link Here
87
            return $c->render(status => 401, json => { error => $_->error });
88
            return $c->render(status => 401, json => { error => $_->error });
88
        }
89
        }
89
        elsif ($_->isa('Koha::Exceptions::Authentication')) {
90
        elsif ($_->isa('Koha::Exceptions::Authentication')) {
90
            return $c->render(status => 500, json => { error => $_->error });
91
            return $c->render(status => 401, json => { error => $_->error });
91
        }
92
        }
92
        elsif ($_->isa('Koha::Exceptions::BadParameter')) {
93
        elsif ($_->isa('Koha::Exceptions::BadParameter')) {
93
            return $c->render(status => 400, json => $_->error );
94
            return $c->render(status => 400, json => $_->error );
Lines 163-168 sub authenticate_api_request { Link Here
163
            );
164
            );
164
        }
165
        }
165
    }
166
    }
167
    elsif ( $authorization_header and $authorization_header =~ /^Basic / ) {
168
        unless ( C4::Context->preference('RESTBasicAuth') ) {
169
            Koha::Exceptions::Authentication::Required->throw(
170
                error => 'Basic authentication disabled'
171
            );
172
        }
173
        $user = $c->_basic_auth( $authorization_header );
174
        unless ( $user ) {
175
            # If we have "Authorization: Basic" header and authentication
176
            # failed, do not try other authentication means
177
            Koha::Exceptions::Authentication::Required->throw(
178
                error => 'Authentication failure.'
179
            );
180
        }
181
    }
166
    else {
182
    else {
167
183
168
        my $cookie = $c->cookie('CGISESSID');
184
        my $cookie = $c->cookie('CGISESSID');
Lines 402-405 sub _object_ownership_by_reserve_id { Link Here
402
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
418
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
403
}
419
}
404
420
421
=head3 _basic_auth
422
423
Internal method that performs Basic authentication.
424
425
=cut
426
427
sub _basic_auth {
428
    my ( $c, $authorization_header ) = @_;
429
430
    my ( $type, $credentials ) = split / /, $authorization_header;
431
432
    unless ($credentials) {
433
        Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' );
434
    }
435
436
    my $decoded_credentials = decode_base64( $credentials );
437
    my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 );
438
439
    my $dbh = C4::Context->dbh;
440
    unless ( checkpw_internal($dbh, $user_id, $password ) ) {
441
        Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Invalid password' );
442
    }
443
444
    return Koha::Patrons->find({ userid => $user_id });
445
}
446
405
1;
447
1;
406
- 

Return to bug 22132