[koha-commits] main Koha release repository branch 19.05.x updated. v19.05.12-2-gbc82200948

[Git repo owner]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "main Koha release repository".

The branch, 19.05.x has been updated
       via  bc822009481b7ad38db06c2d55b64ec7e0c25ae9 (commit)
       via  9484adb366738ce82c877ddf4fb84afad2daf1b8 (commit)
      from  185fb939c303990a7eb45f5a0e579b8417697b9f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit bc822009481b7ad38db06c2d55b64ec7e0c25ae9
Author: Tomas Cohen Arazi <tomascohen at theke.io>
Date:   Fri Mar 13 12:03:03 2020 -0300

    Bug 24862: Handle annonymous sessions gracefuly
    
    This patch introduces code to detect (cookie) annonymous sessions and
    act as expected.
    
    Right now, as check_cookie_auth is not passed the required permissions
    (because there aren't always required permissions, and the code to check
    permissions is shared with other authentication mechanisms) it returns
    'ok' and the session id. This use case was overlooked when this was
    coded, and yeilds unexpected error codes (500) when the user logs out
    and the annonymous session cookie is used to hit the API. The end result
    doesn't pose any security issue (i.e. the resource access is rejected)
    but the returned error code is not correct and should be fixed.
    
    This patch verifies for an anonymous session (and avoids querying the
    corresponding patron) and then verifies if there is an authorization
    config on the route and if the patron object is defined.
    
    To test:
    1. Apply the tests patch
    2. Run:
       $ kshell
      k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
    => FAIL: Tests fail, 500 instead of the expected 401
    3. Apply this patch
    4. Repeat 2
    => SUCCESS: Tests pass!
    5. Repeat the original 'steps to reproduce' from the bug report using
       the browser
    => SUCCESS: Problem solved!
    6. Sign off :-D
    
    Sponsored-by: ByWater Solutions
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    Signed-off-by: David Nind <david at davidnind.com>
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Martin Renvoize <martin.renvoize at ptfs-europe.com>
    (cherry picked from commit de07356028d5b98af3a7cd7cbae02a7ad6402a43)
    
    Signed-off-by: Aleisha Amohia <aleishaamohia at hotmail.com>
    
    (cherry picked from commit 99a3d1193ebfcb1ae5046bf36d60b1e53f8c2e93)
    Signed-off-by: Victor Grousset/tuxayo <victor at tuxayo.net>

commit 9484adb366738ce82c877ddf4fb84afad2daf1b8
Author: Tomas Cohen Arazi <tomascohen at theke.io>
Date:   Fri Mar 13 11:44:03 2020 -0300

    Bug 24862: Regression tests
    
    This patch introduces tests for the expected behaviour on API routes
    that expect a logged in user, but the request is made with an anonymous
    session cookie.
    
    To test:
    1. Apply this patch
    2. Run:
       $ kshell
      k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
    => FAIL: Tests fail because the situation is not handled correctly in
    the code
    
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    Signed-off-by: David Nind <david at davidnind.com>
    Signed-off-by: Martin Renvoize <martin.renvoize at ptfs-europe.com>
    (cherry picked from commit 0547ad34dfe01ca7d7660df59e29bc30fdf3cf1d)
    
    Signed-off-by: Aleisha Amohia <aleishaamohia at hotmail.com>
    
    (cherry picked from commit 8d2255bddcdfad75d8b40daf47bb24c0fd13a9ed)
    Signed-off-by: Victor Grousset/tuxayo <victor at tuxayo.net>

-----------------------------------------------------------------------

Summary of changes:
 Koha/REST/V1/Auth.pm                                | 17 +++++++++++++----
 .../api/v1/auth_authenticate_api_request.t          | 21 ++++++++++++++++++++-
 2 files changed, 33 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
main Koha release repository