Bug 40653 - plugins/run.pl controller drops authentication if logging in to that route
Summary: plugins/run.pl controller drops authentication if logging in to that route
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Plugin architecture (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Pedro Amorim
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-08-14 15:04 UTC by Pedro Amorim
Modified: 2025-08-26 23:07 UTC (History)
5 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40653: Add cookie to output_html (1.61 KB, patch)
2025-08-14 15:05 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 40653: Add cookie to output_html (1.67 KB, patch)
2025-08-18 08:36 UTC, Pedro Amorim
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pedro Amorim 2025-08-14 15:04:22 UTC
A plugin that requires POSTing to plugins/run.pl will prompt authentication, but after authentication is performed, it gets dropped after the next subsequent page navigation thus causing the whole thing to fail.
Comment 1 Pedro Amorim 2025-08-14 15:05:44 UTC
Created attachment 185399 [details] [review]
Bug 40653: Add cookie to output_html

Test plan, k-t-d, don't apply patch yet:
1) Install a plugin that sends the cookie to output_html e.g.:
https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.3.8
2) Log out. Access this plugin's tool link directly:
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AIncDocs&method=tool
3) Notice you're presented the login screen. Login using koha:koha
4) Notice you're shown the plugin's respective tool page. It looks like you're authenticated but you're not. Click on any of the top links e.g. 'Circulation' or 'Patrons'.
5) Notice you're shown the login page again.
6) Apply patch. Repeat. Step 5 should no longer show the login page but instead the page you clicked on.
Comment 2 Pedro Amorim 2025-08-18 08:36:21 UTC
Created attachment 185493 [details] [review]
Bug 40653: Add cookie to output_html

Test plan, k-t-d, don't apply patch yet:
1) Install a plugin that sends the cookie to output_html e.g.:
https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.3.8
2) Log out. Access this plugin's tool link directly:
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AIncDocs&method=tool
3) Notice you're presented the login screen. Login using koha:koha
4) Notice you're shown the plugin's respective tool page. It looks like you're authenticated but you're not. Click on any of the top links e.g. 'Circulation' or 'Patrons'.
5) Notice you're shown the login page again.
6) Apply patch. Repeat. Step 5 should no longer show the login page but instead the page you clicked on.

Signed-off-by: Tomas Jiglind <tomas.jiglind@mariestad.se>