Bug 36308 - SIP2 login broken by CSRF changes
Summary: SIP2 login broken by CSRF changes
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: Nick Clemens (kidclamp)
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 36102
Blocks:
  Show dependency tree / graph
 
Reported: 2024-03-13 17:50 UTC by Nick Clemens (kidclamp)
Modified: 2024-12-23 08:06 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:

Attachments
Bug 36308: Update sip login parameters (1.14 KB, patch)
2024-03-13 17:52 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Bug 36308: Update sip login parameters (1.18 KB, patch)
2024-03-13 21:53 UTC, David Nind 		Details | Diff | Splinter Review
Bug 36308: Update sip login parameters (1.28 KB, patch)
2024-03-15 07:38 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-03-13 17:50:35 UTC 
bug 36102 changed the login parameters from 'userid'/'password' to 'login_userid'/'login_password'

SIP authentication was missed in the update
Comment 1 Nick Clemens (kidclamp) 2024-03-13 17:52:18 UTC 
Created attachment 163117 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds
Comment 2 Nick Clemens (kidclamp) 2024-03-13 17:53:02 UTC 
Probably we also need test coverage for this login
Comment 3 David Nind 2024-03-13 21:53:04 UTC 
Created attachment 163123 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 David Cook 2024-03-13 22:10:27 UTC 
That api_auth() function... yikes. One day we'll do better at AuthN and AuthZ...

This looks like an easy win. I'll look at QAing it a bit later this morning...
Comment 5 Marcel de Rooy 2024-03-15 07:33:30 UTC 
Looking here
Comment 6 Marcel de Rooy 2024-03-15 07:38:02 UTC 
Created attachment 163161 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Katrin Fischer 2024-03-15 08:40:26 UTC 
Pushed for 24.05!

Well done everyone, thank you!
Comment 8 Fridolin Somers 2024-03-18 09:04:04 UTC 
Depends on Bug 36102 not in 23.11.x