| Summary: | Suggestions form crashes on Unknown column 'auth_forwarded_hash' when logging in | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
| Component: | Staff interface | Assignee: | Marcel de Rooy <m.de.rooy> |
| Status: | CLOSED FIXED | QA Contact: | Katrin Fischer <katrin.fischer> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | david, fridolin.somers, gmcharlt |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: |
This fixes an issue when trying to directly access the suggestions management page in the staff interface ([YOURDOMAIN]/cgi-bin/koha/suggestion/suggestion.pl) when you are logged out. Previously, if you were logged out, tried to access the suggestions management page, and then entered your credentials, you would get an error trace.
|
Version(s) released in: |
23.11.00,23.05.06,22.11.12
|
| Circulation function: | |||
| Attachments: |
Bug 35276: Remove authentication params from suggestion hash
Bug 35276: Remove authentication params from suggestion hash Bug 35276: Remove authentication params from suggestion hash |
||
|
Description
Marcel de Rooy
2023-11-07 12:37:57 UTC
And I am seeing a similar friend: DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'koha_login_context' in 'where clause' at /usr/share/koha/Koha/Objects.pm line 394 at /usr/share/perl5/DBIx/Class/Exception.pm line 77 Very similar issue actually. Fix is underway.
When you login on the suggestion/suggestion.pl url, Auth will add a few params which are copied into the Koha Objects->as_list call. We need to remove them.
The fact that this only happens when directly hitting the URL when not logged in, makes me keep the current severity.
Some crash details:
DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'auth_forwarded_hash' in 'where clause' at /usr/share/koha/Koha/Objects.pm line 394
at /usr/share/perl5/DBIx/Class/Exception.pm line 77
DBIx::Class::Storage::DBI::_dbh_execute('DBIx::Class::Storage::DBI::mysql=HASH(0x5564b8285490)', 'DBI::db=HASH(0x5564baa26de0)', 'SELECT `me`.`suggestionid`, `me`.`suggestedby`, `me`.`suggesteddate`, `me`.`managedby`, `me`.`manageddate`, `me`.`acceptedby`, `me`.`accepteddate`, `me`.`rejectedby`, `me`.`rejecteddate`, `me`.`lastmodificationby`, `me`.`lastmodificationdate`, `me`.`STATUS`, `me`.`archived`, `me`.`note`, `me`.`staff_note`, `me`.`author`, `me`.`title`, `me`.`copyrightdate`, `me`.`publishercode`, `me`.`date`, `me`.`volumedesc`, `me`.`publicationyear`, `me`.`place`, `me`.`isbn`, `me`.`biblionumber`, `me`.`reason`, `me`.`patronreason`, `me`.`budgetid`, `me`.`branchcode`, `me`.`collectiontitle`, `me`.`itemtype`, `me`.`quantity`, `me`.`currency`, `me`.`price`, `me`.`total` FROM `suggestions` `me` WHERE ( ( `STATUS` = ? AND `archived` = ? AND `auth_forwarded_hash` = ? AND `branchcode` = ? AND `koha_login_context` = ? AND `password` = ? AND `userid` = ? ) )', 'ARRAY(0x5564b85a9e98)', 'ARRAY(0x5564bb7fc430)') called at /usr/share/perl5/DBIx/Class/Storage/DBI.pm line 856
Koha::Objects::as_list('Koha::Suggestions=HASH(0x5564bd270de8)') called at /usr/share/koha/suggestion/suggestion.pl line 426
eval {...} at /usr/share/koha/suggestion/suggestion.pl line 564
=> Look at the WHERE clause and note the presence of auth_forwarded_hash, koha_login_context, password and userid.
Actually, the suggestion code could be improved further. This should not be done really:
my $suggestion_ref = { %{$input->Vars} }; # Copying, otherwise $input will be modified
Here we get the additional cruft from Auth into our suggestion hash.
The fix simply removes them without a complete refactor of the script.
Created attachment 158595 [details] [review] Bug 35276: Remove authentication params from suggestion hash These would be forwarded to Koha::Objects->as_list and crash on unknown column. Test plan: Logout from staff. Enter URL /suggestion/suggestion.pl Without this patch, it crashes. Now it does not. Note: The crash may show auth_forwarded_hash but I also saw koha_login_context passing by. Same issue. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 158620 [details] [review] Bug 35276: Remove authentication params from suggestion hash These would be forwarded to Koha::Objects->as_list and crash on unknown column. Test plan: Logout from staff. Enter URL /suggestion/suggestion.pl Without this patch, it crashes. Now it does not. Note: The crash may show auth_forwarded_hash but I also saw koha_login_context passing by. Same issue. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Testing notes (using KTD): 1. Make sure you are logged out of the staff interface. 2. Enter the URL: http://127.0.0.1:8081/cgi-bin/koha/suggestion/suggestion.pl 3. Enter your login details 4. You get an error trace: DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'koha_login_context' in 'where clause' at /kohadevbox/koha/Koha/Objects.pm line 399 at /usr/share/perl5/DBIx/Class/Exception.pm line 77 ... 5. Apply the patch, flush_memcached, restart_all, etc. 6. Repeat steps 1-3. 7. You now safely arrive at the suggestions management page. Created attachment 158821 [details] [review] Bug 35276: Remove authentication params from suggestion hash These would be forwarded to Koha::Objects->as_list and crash on unknown column. Test plan: Logout from staff. Enter URL /suggestion/suggestion.pl Without this patch, it crashes. Now it does not. Note: The crash may show auth_forwarded_hash but I also saw koha_login_context passing by. Same issue. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to master for 23.11. Nice work everyone, thanks! Pushed to 23.05.x for 23.05.06 Nice work everyone! Pushed to oldstable for 22.11.x |