From d0d9163fc22ad53be21ad17ab328ebd3fd46ff7a Mon Sep 17 00:00:00 2001 From: Jose-Mario Monteiro-Santos Date: Tue, 19 Mar 2019 11:55:45 -0400 Subject: [PATCH] Bug 22522 - Update API specs' access in Auth.pm With newer versions of Mojolicious and its plugins, endpoints' specs could no longer be accessed, thus bypassing authorization checks and failing to validate query parameters. Test plan: 1. Without being logged in to Koha, access an endpoint directly (such as /api/v1/patrons/{patron_id}) 2. Notice results are received (which is bad since we're not authenticated) 3. Try again with an endpoint that accepts query parameters (such as /api/v1/patrons?firstname=something) 4. Notice that the query is not accepted (even with correct parameters) 5. Apply the patch 6. Repeat step 1 7. Notice that the access is denied 8. Login as a user with proper access rights 9. Repeat step 1 10. Notice that you can now get results 11. Repeat step 3 12. Notice that the query is now accepted 13. Repeat step 3 but with an absurd parameter 14. Notice the query is correctly rejected 15. Ideally, check if other API calls were not broken Signed-off-by: Magnus Enger Upgraded modules with: $ sudo cpanm Mojolicious JSON::Validator Mojolicious::Plugin::OpenAPI@2.14 Before the patch data is returned without being logged in. Not good! After the patch: {"error":"Authentication failure."} --- Koha/REST/V1/Auth.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index 8bffc977da..0b00735869 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -136,7 +136,7 @@ sub authenticate_api_request { my $user; - my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; + my $spec = $c->openapi->spec; my $authorization = $spec->{'x-koha-authorization'}; my $authorization_header = $c->req->headers->authorization; -- 2.11.0