As I discovered while troubleshooting an issue with bug 37060, it appears that C4::Auth::check_api_auth sometimes returns $session and sometimes returns $sessionID. After grepping through the code, it seems that the only file that uses the $sessionID return value from C4::Auth::check_api_auth is svc/authentication so it looks like it's the only affected file. Note: $sessionID is returned on a successful login, while $session is returned when we have a cookie for an authenticated session.
Created attachment 176145 [details] [review] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=<USERID>&login_password=<PASSWORD>" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml
Note: This bug causes the Csrf-Token returned by svc/authentication to be incorrect when the user sends a cookie for an authenticated session, since it's using something like "CGI::Session=HASH(0x5592c03f5508)" instead of the actual session ID to create the token.
Created attachment 176164 [details] [review] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=<USERID>&login_password=<PASSWORD>" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Updating severity as I believe that will help to fix the KOCT plugin?
Created attachment 176187 [details] [review] Bug 38826: Make check_api_auth $sessionID consistent This change makes $sessionID consistently return using the session ID and not sometimes the session object. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies 3. Note the Csrf-Token header value 4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step using the appropriate values (eg the CSRF-TOKEN is from the previous step) 5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \ -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \ 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ -d "login_userid=<USERID>&login_password=<PASSWORD>" \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies > rec.marcxml 7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \ --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies 8. Note the Csrf-Token header value 9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \ -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \ --cookie /tmp/test.cookies --data @rec.marcxml Signed-off-by: Jan Kissig <bibliothek@th-wildau.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Nice mix of people here! :)
Pushed for 25.05! Well done everyone, thank you!
I had a go at a release note, but I'm having understanding the "why" and the "effect" of this change - where this would be noticed. Only the KOCT browser addon?
(In reply to David Nind from comment #8) > I had a go at a release note, but I'm having understanding the "why" and the > "effect" of this change - where this would be noticed. Only the KOCT browser > addon? Thanks, David. I'll take a look.
(In reply to David Nind from comment #8) > I had a go at a release note, but I'm having understanding the "why" and the > "effect" of this change - where this would be noticed. Only the KOCT browser > addon? The release text looks good to me. At the moment, it only affects any third-party integration that uses the svc/authentication API to check an authenticated session. I'm guessing not many integrations do it, or they've been not working and no one has said anything.
(In reply to Katrin Fischer from comment #4) > Updating severity as I believe that will help to fix the KOCT plugin? That's true. We should probably backport it back to 24.11 and 24.05 as well then.
Adding Paul for 24.11 backport. Paul, could you please backport this to 24.11 first? Then we can look to backport to 24.05.
Nice work everyone! Pushed to 24.11.x for 24.11.03
Nice work everyone! Pushed to 24.05.x for 24.05.08
Pushed to 23.11.x for 23.11.13
Pushed to 22.11.x. Will be in next point release. 22.11.25