Bug 40653

Summary: plugins/run.pl controller drops authentication if logging in to that route
Product: Koha Reporter: Pedro Amorim <pedro.amorim>
Component: Plugin architectureAssignee: Pedro Amorim <pedro.amorim>
Status: Passed QA --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: andreas.jonsson, dcook, johan.sahlberg, martin.renvoize, pedro.amorim
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 40653: Add cookie to output_html
Bug 40653: Add cookie to output_html
Bug 40653: Add cookie to output_html

Description Pedro Amorim 2025-08-14 15:04:22 UTC
A plugin that requires POSTing to plugins/run.pl will prompt authentication, but after authentication is performed, it gets dropped after the next subsequent page navigation thus causing the whole thing to fail.
Comment 1 Pedro Amorim 2025-08-14 15:05:44 UTC
Created attachment 185399 [details] [review]
Bug 40653: Add cookie to output_html

Test plan, k-t-d, don't apply patch yet:
1) Install a plugin that sends the cookie to output_html e.g.:
https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.3.8
2) Log out. Access this plugin's tool link directly:
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AIncDocs&method=tool
3) Notice you're presented the login screen. Login using koha:koha
4) Notice you're shown the plugin's respective tool page. It looks like you're authenticated but you're not. Click on any of the top links e.g. 'Circulation' or 'Patrons'.
5) Notice you're shown the login page again.
6) Apply patch. Repeat. Step 5 should no longer show the login page but instead the page you clicked on.
Comment 2 Pedro Amorim 2025-08-18 08:36:21 UTC
Created attachment 185493 [details] [review]
Bug 40653: Add cookie to output_html

Test plan, k-t-d, don't apply patch yet:
1) Install a plugin that sends the cookie to output_html e.g.:
https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.3.8
2) Log out. Access this plugin's tool link directly:
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AIncDocs&method=tool
3) Notice you're presented the login screen. Login using koha:koha
4) Notice you're shown the plugin's respective tool page. It looks like you're authenticated but you're not. Click on any of the top links e.g. 'Circulation' or 'Patrons'.
5) Notice you're shown the login page again.
6) Apply patch. Repeat. Step 5 should no longer show the login page but instead the page you clicked on.

Signed-off-by: Tomas Jiglind <tomas.jiglind@mariestad.se>
Comment 3 David Cook 2025-08-28 03:12:35 UTC
I don't really see the point of having output_html in Koha/Plugins/Base.pm, but since we do... I think this is a reasonable change.
Comment 4 David Cook 2025-08-28 03:14:53 UTC
Created attachment 185845 [details] [review]
Bug 40653: Add cookie to output_html

Test plan, k-t-d, don't apply patch yet:
1) Install a plugin that sends the cookie to output_html e.g.:
https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.3.8
2) Log out. Access this plugin's tool link directly:
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AIncDocs&method=tool
3) Notice you're presented the login screen. Login using koha:koha
4) Notice you're shown the plugin's respective tool page. It looks like you're authenticated but you're not. Click on any of the top links e.g. 'Circulation' or 'Patrons'.
5) Notice you're shown the login page again.
6) Apply patch. Repeat. Step 5 should no longer show the login page but instead the page you clicked on.

Signed-off-by: Tomas Jiglind <tomas.jiglind@mariestad.se>
Signed-off-by: David Cook <dcook@prosentient.com.au>