Browse Source
This patch makes the sandboxing of the selfcheckout more robust by adding a "sco_user" session variable which is turned on when logging into the self-checkout (either by AutoSelfCheckAllowed or manually). If a user with this session variable turned on tries to access other parts of the system (like the rest of the OPAC), it will "kick out", so that the browser user will lose the authenticated session. Test plan: 1) Apply the patch 2) koha-plack --restart kohadev 3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4) Note that you are logged into the self-checkout So you see the login screen specific to the self-checkout. To log with the actual patron. It's a nested auth. 5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 6) Note that you are not logged into the OPAC 7) Log into the staff interface and disable the system preference AutoSelfCheckAllowed 8) Log out of the staff interface (this step is very important) 9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 10) Note that you are prompted to log into Koha 11) Login using the "koha" user (when using koha-testing-docker) 12) Note that you are logged into the self-checkout 13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl 14) Note that you are not logged into the OPAC Without the patch you would still be logged as "koha" 15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 16) Note that you will need to log in again as you've lost your session cookie Without the patch you will still be logged in the self-checkout Voila! Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>22.05.x
1 changed files with 21 additions and 2 deletions
Loading…
Reference in new issue