Bug 36308

Summary: SIP2 login broken by CSRF changes
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: SIP2Assignee: Nick Clemens (kidclamp) <nick>
Status: RESOLVED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: critical    
Priority: P5 - low CC: dcook, fridolin.somers, jonathan.druart, m.de.rooy
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Bug Depends on: 36102    
Bug Blocks:    
Attachments: Bug 36308: Update sip login parameters
Bug 36308: Update sip login parameters
Bug 36308: Update sip login parameters

Description Nick Clemens (kidclamp) 2024-03-13 17:50:35 UTC
bug 36102 changed the login parameters from 'userid'/'password' to 'login_userid'/'login_password'

SIP authentication was missed in the update
Comment 1 Nick Clemens (kidclamp) 2024-03-13 17:52:18 UTC
Created attachment 163117 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds
Comment 2 Nick Clemens (kidclamp) 2024-03-13 17:53:02 UTC
Probably we also need test coverage for this login
Comment 3 David Nind 2024-03-13 21:53:04 UTC
Created attachment 163123 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 David Cook 2024-03-13 22:10:27 UTC
That api_auth() function... yikes. One day we'll do better at AuthN and AuthZ...

This looks like an easy win. I'll look at QAing it a bit later this morning...
Comment 5 Marcel de Rooy 2024-03-15 07:33:30 UTC
Looking here
Comment 6 Marcel de Rooy 2024-03-15 07:38:02 UTC
Created attachment 163161 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Katrin Fischer 2024-03-15 08:40:26 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 8 Fridolin Somers 2024-03-18 09:04:04 UTC
Depends on Bug 36102 not in 23.11.x