| Summary: | Shibboleth login url with query has double encoded '?' %3F | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
| Component: | Authentication | Assignee: | Bugs List <koha-bugs> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | dpavlin, fridolin.somers, lucas, matthias.meusburger |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
19.11.00,19.05.04
|
|
| Circulation function: | |||
| Attachments: |
Bug 23526: Don't use encoded question mark in shib_login_url
Bug 23526: Don't use encoded question mark in shib_login_url |
||
Created attachment 92699 [details] [review] Bug 23526: Don't use encoded question mark in shib_login_url To test: 1 - Enable shib 2 - Do a search 3 - Try to login from search 4 - Get an error 5 - Apply patch 6 - Retry Note: You don't haveto really enable shib, you can simply enable it in koha-conf.xml and check the URLs Created attachment 92939 [details] [review] Bug 23526: Don't use encoded question mark in shib_login_url To test: 1 - Enable shib 2 - Do a search 3 - Try to login from search 4 - Get an error 5 - Apply patch 6 - Retry Note: You don't haveto really enable shib, you can simply enable it in koha-conf.xml and check the URLs Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com> I am moving this PQA as the change is tiny and I trust Nick and Matthias. Also our RM is a Shibboleth pro. Nice work! Pushed to master for 19.11.00 Pushed to 19.05.x for 19.05.04 Oh but UT needs to be fixed :
Auth_with_shibboleth.t "login shib url" calls :
is(
login_shib_url($query),
'https://testopac.com'
. '/Shibboleth.sso/Login?target='
. 'https://testopac.com/cgi-bin/koha/opac-user.pl' . '%3F'
. $query_string,
"login shib url"
);
(In reply to Fridolin SOMERS from comment #6) > Oh but UT needs to be fixed : > > Auth_with_shibboleth.t "login shib url" calls : > > is( > login_shib_url($query), > 'https://testopac.com' > . '/Shibboleth.sso/Login?target=' > . 'https://testopac.com/cgi-bin/koha/opac-user.pl' . '%3F' > . $query_string, > "login shib url" > ); Corrected by : Bug 23526: (RM follow-up) Fix failing test Perfect [U+1F44C] backported to 18.11.x for 18.11.11 |
In login_shib_url we place an encoded '?' into the login url: 65 if ( $query->query_string() ) { 66 $param = $param . '%3F' . $query->query_string(); 67 } Then in the templates we filter that using the URL filter: <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl | url %]">click here to login</a>.</p> The URL filter turns the % into %25 and the string comes out as https://anykoha.bywatersolutions.com/Shibboleth.sso/Login?target=https://anykoha.bywatersolutions.com/cgi-bin/koha/opac-search.pl%253Fq=cats This returns a 4040 on successful login