Bug 36308 - SIP2 login broken by CSRF changes
Summary: SIP2 login broken by CSRF changes
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical (vote)
Assignee: Nick Clemens (kidclamp)
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 36102
Blocks:
  Show dependency treegraph
 
Reported: 2024-03-13 17:50 UTC by Nick Clemens (kidclamp)
Modified: 2024-03-18 09:04 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00


Attachments
Bug 36308: Update sip login parameters (1.14 KB, patch)
2024-03-13 17:52 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36308: Update sip login parameters (1.18 KB, patch)
2024-03-13 21:53 UTC, David Nind
Details | Diff | Splinter Review
Bug 36308: Update sip login parameters (1.28 KB, patch)
2024-03-15 07:38 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-03-13 17:50:35 UTC
bug 36102 changed the login parameters from 'userid'/'password' to 'login_userid'/'login_password'

SIP authentication was missed in the update
Comment 1 Nick Clemens (kidclamp) 2024-03-13 17:52:18 UTC
Created attachment 163117 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds
Comment 2 Nick Clemens (kidclamp) 2024-03-13 17:53:02 UTC
Probably we also need test coverage for this login
Comment 3 David Nind 2024-03-13 21:53:04 UTC
Created attachment 163123 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 David Cook 2024-03-13 22:10:27 UTC
That api_auth() function... yikes. One day we'll do better at AuthN and AuthZ...

This looks like an easy win. I'll look at QAing it a bit later this morning...
Comment 5 Marcel de Rooy 2024-03-15 07:33:30 UTC
Looking here
Comment 6 Marcel de Rooy 2024-03-15 07:38:02 UTC
Created attachment 163161 [details] [review]
Bug 36308: Update sip login parameters

To test:
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login fails
Apply patch, restart all
perl misc/sip_cli_emulator.pl -a localhost -p 6001 -su term1 -sp term1 -l CPL -m patron_information --patron=koha
Login succeeds

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Katrin Fischer 2024-03-15 08:40:26 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 8 Fridolin Somers 2024-03-18 09:04:04 UTC
Depends on Bug 36102 not in 23.11.x