Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 34478: (follow-up) Manual fix - Make Koha::Token use session id not userenv id

Browse source 
See comment 174.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2024-02-28 13:15:14 +01:00
parent f859c30704
commit c9375e746b
Signed by: jonathan.druart
GPG key ID: A085E712BEF0E0F0
1 changed files with 2 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
t/Token.t
View file

@ -20,7 +20,7 @@
# along with Koha; if not, see <http://www.gnu.org/licenses>.
use Modern::Perl;
use Test::More tests => 13;
use Test::More tests => 12;
use Test::Exception;
use Time::HiRes qw|usleep|;
@ -62,20 +62,6 @@ $result = $tokenizer->check_csrf({
});
isnt( $result, 1, "CSRF token expired after one second" );
subtest 'Same id (cookie CGISESSID) with an other logged in user' => sub {
plan tests => 2;
$csrftoken = $tokenizer->generate_csrf({ session_id => $id });
$result = $tokenizer->check_csrf({
session_id => $id, token => $csrftoken,
});
is( $result, 1, "CSRF token verified" );
C4::Context->set_userenv(0,43,0,'firstname','surname', 'CPL', 'Library 1', 0, '');
$result = $tokenizer->check_csrf({
session_id => $id, token => $csrftoken,
});
is( $result, '', "CSRF token is not verified if another logged in user is using the same id" );
};
subtest 'Same logged in user with another session (cookie CGISESSID)' => sub {
plan tests => 2;
C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, '');
@ -125,7 +111,7 @@ subtest 'testing _add_default_csrf_params with/without userenv (bug 27849)' => s
# Current userenv: userid == 42
my $result = Koha::Token::_add_default_csrf_params({ session_id => '567' });
is( $result->{session_id}, 567, 'Check session id' );
is( $result->{id}, '42_567', 'Check userid' );
is( $result->{id}, 'anonymous_567', 'Check userid' );
# Clear userenv
C4::Context::_unset_userenv('DUMMY SESSION');