Bug 36092

Summary: sessionID not passed to the template on auth.tt
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: Pushed to oldstable --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: david, fridolin.somers
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.03,23.05.09
Circulation function:
Bug Depends on: 35890    
Bug Blocks: 34478    
Attachments: Bug 36092: Add test
Bug 36092: Pass the sessionID from checkauth if we hit auth
Bug 36092: Pass sessionID at the end of get_template_and_user
Bug 36092: Add test
Bug 36092: Pass the sessionID from checkauth if we hit auth
Bug 36092: Pass sessionID at the end of get_template_and_user
Bug 36092: Add test
Bug 36092: Pass the sessionID from checkauth if we hit auth
Bug 36092: Pass sessionID at the end of get_template_and_user
Bug 36092: Add test
Bug 36092: Pass the sessionID from checkauth if we hit auth
Bug 36092: Pass sessionID at the end of get_template_and_user

Description Jonathan Druart 2024-02-14 09:53:03 UTC
The session's ID is not passed to the template and not stored in the context when we are on the authentication page.

It can be problematic, for instance we will not be able to generate a CSRF token for the login form.
Comment 1 Jonathan Druart 2024-02-14 10:48:09 UTC
Created attachment 162139 [details] [review]
Bug 36092: Add test
Comment 2 Jonathan Druart 2024-02-14 10:48:11 UTC
Created attachment 162140 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template
Comment 3 Jonathan Druart 2024-02-14 10:48:13 UTC
Created attachment 162141 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.
Comment 4 Jonathan Druart 2024-02-14 10:58:33 UTC
Do not trust me
Comment 5 Jonathan Druart 2024-02-14 11:27:36 UTC
Created attachment 162142 [details] [review]
Bug 36092: Add test
Comment 6 Jonathan Druart 2024-02-14 11:27:39 UTC
Created attachment 162143 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template
Comment 7 Jonathan Druart 2024-02-14 11:27:41 UTC
Created attachment 162144 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.
Comment 8 David Nind 2024-02-14 13:56:21 UTC
I'm getting a sha1 error when applying the patches:

Apply? [(y)es, (n)o, (i)nteractive] y
Applying: Bug 36092: Add test
error: sha1 information is lacking or useless (t/db_dependent/Auth.t).
error: could not build fake ancestor
Patch failed at 0001 Bug 36092: Add test

I was going to make sure that the tests (prove prove t/db_dependent/Auth.t) pass before and after the patches are applied. Is there anything else required to sign off/test?
Comment 9 Kyle M Hall (khall) 2024-02-14 16:59:13 UTC
Created attachment 162158 [details] [review]
Bug 36092: Add test

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Kyle M Hall (khall) 2024-02-14 16:59:26 UTC
Created attachment 162160 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 11 Kyle M Hall (khall) 2024-02-14 16:59:28 UTC
Created attachment 162161 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 12 Martin Renvoize (ashimema) 2024-02-15 09:38:01 UTC
Created attachment 162189 [details] [review]
Bug 36092: Add test

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 13 Martin Renvoize (ashimema) 2024-02-15 09:38:03 UTC
Created attachment 162190 [details] [review]
Bug 36092: Pass the sessionID from checkauth if we hit auth

If we hit the auth page we were not passing sessionID to the template

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 14 Martin Renvoize (ashimema) 2024-02-15 09:38:06 UTC
Created attachment 162191 [details] [review]
Bug 36092: Pass sessionID at the end of get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 15 Martin Renvoize (ashimema) 2024-02-15 09:38:48 UTC
This makes a lot of sense and is well covered by tests. I'm happy I couldn't find any regressions. QA scripts are happy too.

Passing QA
Comment 16 Martin Renvoize (ashimema) 2024-02-15 09:49:29 UTC
Pushed to master for 24.05.00
Comment 17 Fridolin Somers 2024-03-11 08:57:09 UTC
Pushed to 23.11.03
Comment 18 Fridolin Somers 2024-03-11 08:57:57 UTC
In 23.05.09
Comment 19 Fridolin Somers 2024-03-11 08:58:29 UTC
I see it in 22.05.x but not in 22.11.x