Bug 29132 - API access denied after update to 19.11.22 due to not executed atomicupdate for api keys
Summary: API access denied after update to 19.11.22 due to not executed atomicupdate f...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: 19.11
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Tomás Cohen Arazi
URL:
Keywords:
Depends on: 28772
Blocks:
  Show dependency treegraph
 
Reported: 2021-09-29 07:34 UTC by Alexander Borkowski
Modified: 2022-12-12 21:24 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.24


Attachments
Bug 28772: DBRev 19.11.23.001 (3.47 KB, patch)
2021-11-23 11:31 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 28772: DBRev 19.11.23.001 (3.52 KB, patch)
2021-11-23 11:54 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 28772: DBRev 19.11.23.001 (3.61 KB, patch)
2021-11-23 22:34 UTC, wainuiwitikapark
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Borkowski 2021-09-29 07:34:52 UTC
After updating from 19.11.21 to 19.11.22, API access to our Koha instance failed. The reason was that the installer/data/mysql/atomicupdate/bug_28772_api_keys.pl was not executed, likely due to the fact that installer/data/mysql/updatedatabase.pl only executes files that end in .perl or .sql, while the new one ends in .pl. Manually executing the equivalent code (hashing the API-keys) fixes the problem.
Comment 1 Alexander Borkowski 2021-09-29 08:22:57 UTC
Just renaming installer/data/mysql/atomicupdate/bug_28772_api_keys.pl to installer/data/mysql/atomicupdate/bug_28772_api_keys.perl is not enough to fix this. I did that, built local packages and now at least I get "DEV atomic update: bug_28772_api_keys.perl" when I install the updated package, but the API key secrets still remain unhashed.

As I wrote earlier extracting the relevant parts from that installer/data/mysql/atomicupdate/bug_28772_api_keys.pl and executing them in a short wrapper script (mainly for getting att C4::Context->dbh) works for me.
Comment 2 Jonathan Druart 2021-11-19 13:31:42 UTC
Wainui, did you see this bug report? You forgot to move the atomicupdate to the updatedatabase.pl script.
Comment 3 Jonathan Druart 2021-11-23 11:31:59 UTC
Created attachment 127946 [details] [review]
Bug 28772: DBRev 19.11.23.001

Note that this added back the following patch: "Bug 28772: Do not hash secrets twice"
Comment 4 Jonathan Druart 2021-11-23 11:32:54 UTC
Wainui, this patch is moving the dbrev to the updatedatabase.pl script.

Note that it also added back a commit you reverted. Do you remember why?
Comment 5 Jonathan Druart 2021-11-23 11:33:20 UTC
Tomas, can you have a look please?
Comment 6 Tomás Cohen Arazi 2021-11-23 11:54:47 UTC
Created attachment 127948 [details] [review]
Bug 28772: DBRev 19.11.23.001

Note that this added back the following patch: "Bug 28772: Do not hash secrets twice"

https://bugs.koha-community.org/show_bug.cgi?id=29132
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 7 Tomás Cohen Arazi 2021-11-23 11:59:02 UTC
Tested before the 28772 patches then the upgrade and then this patch. All works as expected.
Comment 8 wainuiwitikapark 2021-11-23 22:13:35 UTC
Sorry about this everyone, I do not remember why the patch reverted.

Thanks so much!!
Comment 9 wainuiwitikapark 2021-11-23 22:34:55 UTC
Created attachment 127967 [details] [review]
Bug 28772: DBRev 19.11.23.001

Note that this added back the following patch: "Bug 28772: Do not hash secrets twice"

https://bugs.koha-community.org/show_bug.cgi?id=29132
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 10 wainuiwitikapark 2021-11-23 22:37:41 UTC
I have added this patch to the 19.11.x branch, however I am unsure if I should release this this month as it is the only new patch. 19.11.x is LTS, so only really backporting security patches.
Comment 11 Tomás Cohen Arazi 2021-11-23 22:43:20 UTC
(In reply to wainuiwitikapark from comment #10)
> I have added this patch to the 19.11.x branch, however I am unsure if I
> should release this this month as it is the only new patch. 19.11.x is LTS,
> so only really backporting security patches.

 ...and important fixes, in my opinion. If a feature got broken, and doesn't introduce new strings, I'd release even out of schedule.
Comment 12 Fridolin Somers 2021-12-02 07:44:42 UTC
I see the commit has been pushed to 19.11.x

I propose we set status to revolved.
Comment 13 Alexander Borkowski 2021-12-02 08:32:27 UTC
I built local packages from the latest 19.11.x and installed them on our test server. All works as expected (already hashed secrets remained untouched and plain ones I created for testing where hashed afterwards). Setting status to resolved now - many thanks to all involved!
Comment 14 wainuiwitikapark 2021-12-02 23:55:59 UTC
Cool, yes this will be in 19.11.24.

Thanks everyone.