[Bug 33879] New: Cookie_auth overwrites interface set by get_template_and_user
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Bug ID: 33879 Summary: Cookie_auth overwrites interface set by get_template_and_user Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org
From bug 33608
-- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=33608 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #1 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Use case If you logged in via OPAC (sharing same domain with intranet), and then switch to staff side, get_template_and_user gets the correct interface from the staff script but later on checkauth is called and then check_cookie_auth. The last one may override the interface with the interface from the cookie (opac in our example). This is confusing. What would be the side-effects if we decide not to overwrite there but only fill if we have nothing? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #2 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 151928 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=151928&action=edit Bug 33879: Do no longer overwrite interface in cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #3 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Still looking at unit test. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |m.de.rooy@rijksmuseum.nl |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 151931 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=151931&action=edit Bug 33879: Add unit test to show problem Test plan: Run t/db_dependent/Auth.t without second patch. Should fail: # got: 'opac' # expected: 'intranet' Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #151928|0 |1 is obsolete| | --- Comment #5 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 151932 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=151932&action=edit Bug 33879: Do no longer overwrite interface in cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t. Should pass again. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 151933 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=151933&action=edit Bug 33879: Do no longer overwrite interface in check_cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t. Should pass again. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #151932|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Cookie_auth overwrites |Check_cookie_auth |interface set by |overwrites interface set by |get_template_and_user |get_template_and_user -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Product|Koha security |Koha Component|Koha |Authentication QA Contact| |testopia@bugs.koha-communit | |y.org Group|Koha security | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #9 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- That's the description of the test: 'cookie_auth did use interface from cookie' It's confusing IMO. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #9)
That's the description of the test: 'cookie_auth did use interface from cookie'
It's confusing IMO.
Yes, it could certainly be a bit more clear. Second try on the way. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #151931|0 |1 is obsolete| | --- Comment #11 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 152300 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152300&action=edit Bug 33879: Add unit test to show problem Test plan: Run t/db_dependent/Auth.t without second patch. Should fail: # got: 'opac' # expected: 'intranet' Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #151933|0 |1 is obsolete| | --- Comment #12 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 152301 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152301&action=edit Bug 33879: Do no longer overwrite interface in check_cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t. Should pass again. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Björn Nylén <bjorn.nylen@ub.lu.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #152300|0 |1 is obsolete| | Attachment #152301|0 |1 is obsolete| | --- Comment #13 from Björn Nylén <bjorn.nylen@ub.lu.se> --- Created attachment 152328 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152328&action=edit Bug 33879: Add unit test to show problem Test plan: Run t/db_dependent/Auth.t without second patch. Should fail: # got: 'opac' # expected: 'intranet' Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Björn Nylén <bjorn.nylen@ub.lu.se> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #14 from Björn Nylén <bjorn.nylen@ub.lu.se> --- Created attachment 152329 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152329&action=edit Bug 33879: Do no longer overwrite interface in check_cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t. Should pass again. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Björn Nylén <bjorn.nylen@ub.lu.se> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Björn Nylén <bjorn.nylen@ub.lu.se> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bjorn.nylen@ub.lu.se --- Comment #15 from Björn Nylén <bjorn.nylen@ub.lu.se> --- Good thing, we serve intranet and opac on same host with different ports so this will be useful. Was hoping it would solve Bug 31990 too but that is apparently a different issue. Failed a bit when attaching signed off patches but it looks correct now. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Björn Nylén <bjorn.nylen@ub.lu.se> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #16 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Björn Nylén from comment #15)
Good thing, we serve intranet and opac on same host with different ports so this will be useful. Was hoping it would solve Bug 31990 too but that is apparently a different issue.
Failed a bit when attaching signed off patches but it looks correct now.
Yes, patches are fine. Thanks ! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #152328|0 |1 is obsolete| | --- Comment #17 from David Nind <david@davidnind.com> --- Created attachment 152366 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152366&action=edit Bug 33879: Add unit test to show problem Test plan: Run t/db_dependent/Auth.t without second patch. Should fail: # got: 'opac' # expected: 'intranet' Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Björn Nylén <bjorn.nylen@ub.lu.se> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #152329|0 |1 is obsolete| | --- Comment #18 from David Nind <david@davidnind.com> --- Created attachment 152367 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152367&action=edit Bug 33879: Do no longer overwrite interface in check_cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t. Should pass again. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Björn Nylén <bjorn.nylen@ub.lu.se> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com Text to go in the| |This fixes an issue with release notes| |recording the interface for | |the log viewer where | |installations run the OPAC | |and staff interface on the | |same domain name. Before | |this patch, if a user | |logged into the OPAC and | |then went to the staff | |interface and performed a | |logable action (such as a | |checkout), the interface in | |the log was incorrectly | |recorded as the OPAC. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #152366|0 |1 is obsolete| | --- Comment #19 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 152735 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152735&action=edit Bug 33879: Add unit test to show problem Test plan: Run t/db_dependent/Auth.t without second patch. Should fail: # got: 'opac' # expected: 'intranet' Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Björn Nylén <bjorn.nylen@ub.lu.se> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #152367|0 |1 is obsolete| | --- Comment #20 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 152736 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=152736&action=edit Bug 33879: Do no longer overwrite interface in check_cookie_auth This will only have effect on installations running OPAC and staff on the same domain name. In that case an OPAC cookie still allows you to access intranet, and v.v. Test plan: Repeat the following steps WITHOUT this patch and WITH it. Login via OPAC. Go to staff. Perform an action that logs the interface in e.g. the statistics table, like a checkout. Inspect interface in the corresponding table. Observe difference that this patch makes. With this patch: Run t/db_dependent/Auth.t. Should pass again. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Björn Nylén <bjorn.nylen@ub.lu.se> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #21 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Whilst we continue to support same domain using different ports for staff and opac I think this change makes a lot of sense.. Patch works as described, tests are included and passing and the qa scripts are happy. No regressions found in manual testing either.. though I'd will be paying attention throughout the cycle just in case there's some unforeseen issue present. Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Check_cookie_auth |check_cookie_auth |overwrites interface set by |overwrites interface set by |get_template_and_user |get_template_and_user CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |23.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #22 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 23.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable Version(s)|23.11.00 |23.11.00,23.05.02 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #23 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Thanks for all the hard work! Pushed to 23.05.x for the next release -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|23.11.00,23.05.02 |23.11.00,23.05.02,22.11.08 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 --- Comment #24 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Nice work everyone! Pushed to oldstable for 22.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30109 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33879 Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |emily.lamancusa@montgomeryc | |ountymd.gov --- Comment #25 from Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> --- *** Bug 32965 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org