offline_circ/service.pl currently returns a "200 OK" HTTP status with a "Authentication failed" string. We need a valid status code in this case (401). We also need a nocookie option in this script. We added a test button in Koct FF extention that check if the entered login/password are correct. But if the user is currently authenticated on Koha, the script will use the cookie authentication which can be misleading. With nocookie parameter set to true, only the login/password will be checked. Patch is coming
Created attachment 69511 [details] [review] offline_circ/service.pl return HTTP status 401 when authentication failed and add option nocookie. test plan: - Apply this patch, - log in to Koha, - go to cgi-bin/koha/offline_circ/service.pl with no valid user and password as parameters and nocookie set to 1. i.e: cgi-bin/koha/offline_circ/service.pl?user=alex&password=wrongpass&nocookie=1, - auth should fail - check that the response code is 401
Hey Alex, I only get a 404 code and not 401 in the opac. and I got nothing by using your link/path with the intranet. Am I missing some steps? Thanks, Maksim Sen
Hi Maksim, service.pl is indeed an intranet page. What do you mean you got nothing? A blank page? Keep in mind that service.pl is meant to be called as a webservice, so it's not abnormal nothing is displayed in the page itself. However, you'll be able to display the HTTP status code using firefox's debug tool (F12 key, then Network tab, then load the page) By the way, I've tested this, and it behaves correctly: I have a 200 error code following the test plan before applying the patch, and a 401 error code with the patch.
I had the FireFox Rester tool installed. On a kohadevbox with Offline Circulation enabled. Something is weird I think with the $lasttime and $timeout check in the function call.
Created attachment 73799 [details] [review] offline_circ/service.pl return HTTP status 401 when authentication failed and add option nocookie. test plan: - Apply this patch, - log in to Koha, - go to cgi-bin/koha/offline_circ/service.pl with no valid user and password as parameters and nocookie set to 1. i.e: cgi-bin/koha/offline_circ/service.pl?user=alex&password=wrongpass&nocookie=1, - auth should fail - check that the response code is 401 https://bugs.koha-community.org/show_bug.cgi?id=19752 Signed-off-by: Maksim Sen <maksim.sen@inlibro.com>
I don't know why it showed this link at the end of my sign off: https://bugs.koha-community.org/show_bug.cgi?id=19752 Anyway, I tried it with the dev tools, Matthias, and it works!
Test plan passes, but shouldn't the right credentials give me a 200? It seems I always get a 401. Alex, can you extend the test plan a bit to explain the expected outcomes? - What happens with and without nocookie? - What happens with and without the right credentials?
If I'm correct, the following behavior is expected: - right credentials, with a cookie, without the nocookie option: 200 - wrong credentials, with a cookie, without the nocookie option: 200 - right credentials, with a cookie, with the nocookie option: 200 - wrong credentials, with a cookie, with the nocookie option: 401 - right credentials, without a cookie, without the nocookie option: 200 - wrong credentials, without a cookie, without the nocookie option: 401 - right credentials, without a cookie, with the nocookie option: 200 - wrong credentials, without a cookie, with the nocookie option: 401
The second line: - wrong credentials, with a cookie, without the nocookie option: 200 is the current behavior in Koha, and is the reason the nocookie option is introduced, in order the be able to have this behavior: - wrong credentials, with a cookie, with the nocookie option: 401
Hi Matts, can you maybe check if it works for you? My test was nocookie=1 with correct credentials and I still got a 401.
You're right Katrin, there is a problem: - right credentials, without a cookie, with the nocookie option returns 401 instead of 200. (check_api_auth returns status="expired")
I found the problem, the test plan was incorrect, the parameter to use is userid and not user: cgi-bin/koha/offline_circ/service.pl?userid=alex&password=wrongpass&nocookie=1 When using the correct parameters, it works as expected.
We need to remember to fix the commit message then. Could you do it?
Created attachment 74712 [details] [review] offline_circ/service.pl return HTTP status 401 when authentication failed and add option nocookie. test plan: - Apply this patch, - log in to Koha, - go to cgi-bin/koha/offline_circ/service.pl with no valid user and password as parameters and nocookie set to 1. i.e: cgi-bin/koha/offline_circ/service.pl?userid=alex&password=wrongpass&nocookie=1, - auth should fail - check that the response code is 401 https://bugs.koha-community.org/show_bug.cgi?id=19752 Signed-off-by: Maksim Sen <maksim.sen@inlibro.com>
Created attachment 74776 [details] [review] Bug 19752: offline_circ/service.pl - Return HTTP status 401 when authentication failed and add option nocookie Test plan: - Apply this patch, - log in to Koha, - go to cgi-bin/koha/offline_circ/service.pl with no valid user and password as parameters and nocookie set to 1. i.e: cgi-bin/koha/offline_circ/service.pl?userid=alex&password=wrongpass&nocookie=1, - auth should fail - check that the response code is 401 https://bugs.koha-community.org/show_bug.cgi?id=19752 Signed-off-by: Maksim Sen <maksim.sen@inlibro.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Since KOCT 0.4.5, that's it? Maybe we should add a comment close to the parameter explaining where does it comes from?
Yes, that's right, since 0.4.5 I'll add a comment to explain.
Created attachment 74814 [details] [review] Bug 19752: offline_circ/service.pl - Return HTTP status 401 when authentication failed and add option nocookie Test plan: - Apply this patch, - log in to Koha, - go to cgi-bin/koha/offline_circ/service.pl with no valid user and password as parameters and nocookie set to 1. i.e: cgi-bin/koha/offline_circ/service.pl?userid=alex&password=wrongpass&nocookie=1, - auth should fail - check that the response code is 401 https://bugs.koha-community.org/show_bug.cgi?id=19752 Signed-off-by: Maksim Sen <maksim.sen@inlibro.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Thanks Matts!
Pushed to master for 18.05, thanks to everybody involved!