Summary: | C4::Auth::check_api_auth sometimes returns $session and sometimes returns $sessionID | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Authentication | Assignee: | David Cook <dcook> |
Status: | Pushed to main --- | QA Contact: | Nick Clemens (kidclamp) <nick> |
Severity: | major | ||
Priority: | P5 - low | CC: | david, dpavlin, nick |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37060 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: |
This fixes authentication checking so that the $sessionID is consistently returned (sometimes it was returning the session object). (Note: $sessionID is returned on a successful login, while $session is returned when there is a cookie for an authenticated session.)
|
Version(s) released in: |
25.05.00
|
Circulation function: | |||
Attachments: |
Bug 38826: Make check_api_auth $sessionID consistent
Bug 38826: Make check_api_auth $sessionID consistent Bug 38826: Make check_api_auth $sessionID consistent |
Description
David Cook
2025-01-05 23:42:05 UTC
Created attachment 176145 [details] [review] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=<USERID>&login_password=<PASSWORD>" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml Note: This bug causes the Csrf-Token returned by svc/authentication to be incorrect when the user sends a cookie for an authenticated session, since it's using something like "CGI::Session=HASH(0x5592c03f5508)" instead of the actual session ID to create the token. Created attachment 176164 [details] [review] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=<USERID>&login_password=<PASSWORD>" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml Signed-off-by: Jan Kissig <bibliothek@th-wildau.de> Updating severity as I believe that will help to fix the KOCT plugin? Created attachment 176187 [details] [review] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=<USERID>&login_password=<PASSWORD>" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml Signed-off-by: Jan Kissig <bibliothek@th-wildau.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Nice mix of people here! :) Pushed for 25.05! Well done everyone, thank you! I had a go at a release note, but I'm having understanding the "why" and the "effect" of this change - where this would be noticed. Only the KOCT browser addon? (In reply to David Nind from comment #8) > I had a go at a release note, but I'm having understanding the "why" and the > "effect" of this change - where this would be noticed. Only the KOCT browser > addon? Thanks, David. I'll take a look. (In reply to David Nind from comment #8) > I had a go at a release note, but I'm having understanding the "why" and the > "effect" of this change - where this would be noticed. Only the KOCT browser > addon? The release text looks good to me. At the moment, it only affects any third-party integration that uses the svc/authentication API to check an authenticated session. I'm guessing not many integrations do it, or they've been not working and no one has said anything. (In reply to Katrin Fischer from comment #4) > Updating severity as I believe that will help to fix the KOCT plugin? That's true. We should probably backport it back to 24.11 and 24.05 as well then. |