The session's ID is not passed to the template and not stored in the context when we are on the authentication page. It can be problematic, for instance we will not be able to generate a CSRF token for the login form.
Created attachment 162139 [details] [review] Bug 36092: Add test
Created attachment 162140 [details] [review] Bug 36092: Pass the sessionID from checkauth if we hit auth If we hit the auth page we were not passing sessionID to the template
Created attachment 162141 [details] [review] Bug 36092: Pass sessionID at the end of get_template_and_user It seems safer to pass the logged in user and session info at the end of the sub.
Do not trust me
Created attachment 162142 [details] [review] Bug 36092: Add test
Created attachment 162143 [details] [review] Bug 36092: Pass the sessionID from checkauth if we hit auth If we hit the auth page we were not passing sessionID to the template
Created attachment 162144 [details] [review] Bug 36092: Pass sessionID at the end of get_template_and_user It seems safer to pass the logged in user and session info at the end of the sub.
I'm getting a sha1 error when applying the patches: Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 36092: Add test error: sha1 information is lacking or useless (t/db_dependent/Auth.t). error: could not build fake ancestor Patch failed at 0001 Bug 36092: Add test I was going to make sure that the tests (prove prove t/db_dependent/Auth.t) pass before and after the patches are applied. Is there anything else required to sign off/test?
Created attachment 162158 [details] [review] Bug 36092: Add test Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 162160 [details] [review] Bug 36092: Pass the sessionID from checkauth if we hit auth If we hit the auth page we were not passing sessionID to the template Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 162161 [details] [review] Bug 36092: Pass sessionID at the end of get_template_and_user It seems safer to pass the logged in user and session info at the end of the sub. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 162189 [details] [review] Bug 36092: Add test Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 162190 [details] [review] Bug 36092: Pass the sessionID from checkauth if we hit auth If we hit the auth page we were not passing sessionID to the template Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 162191 [details] [review] Bug 36092: Pass sessionID at the end of get_template_and_user It seems safer to pass the logged in user and session info at the end of the sub. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This makes a lot of sense and is well covered by tests. I'm happy I couldn't find any regressions. QA scripts are happy too. Passing QA
Pushed to master for 24.05.00
Pushed to 23.11.03
In 23.05.09
I see it in 22.05.x but not in 22.11.x