Jonathan Druart
df23f6c345
The userenv (logged in user's info) are stored in $C4::Context->context->{activeuser}, which persists in plack worker's memory. It's really bad in theory as we are not cleaning it before or after the HTTP request, but only when set_userenv is called (what we are doing commonly in C4::Auth::get_template_and_user). If C4::Context->userenv is called before set_userenv we should get undef, not the userenv from the previous request! In practice this should not be a problem, but well... who really knows? This patch suggests to have a middleware to deal with removing the userenv at the beginning of each request (maybe it should be after, right? - FIXME). To test: 1 - Edit /etc/koha/sites/kohadev/koha-conf.xml to set <plack_workers>1</plack_workers> 2 - Edit about.pl and add a line after: CGI->new: warn Data::Dumper::Dumper( C4::Cointext->userenv() ); 3 - tail -f /var/log/koha/kohadev/*.log 4 - View about.pl in staff interface, should get a "somethign's wrong" warning 5 - Reload, you get current user info 6 - Open an incognito tab, sign in as a different user and click some stuff 7 - Reload about.pl in other window 8 - You get the opac user info 9 - Apply patch 10 - Edit /etc/koha/sites/kohadev/plack.psgi and add the middleware after "RealIP": enable "+Koha::Middleware::UserEnv"; 11 - Restart all 12 - Reload about.pl - you get a "Something's wrong" warning 13 - Click things in opac on incognito window 14 - Reload about.pl - only "Something's wrong" - you no longer see any user info Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> |
||
---|---|---|
.. | ||
apache-shared-disable.conf | ||
apache-shared-intranet-plack.conf | ||
apache-shared-intranet.conf | ||
apache-shared-opac-plack.conf | ||
apache-shared-opac.conf | ||
apache-shared.conf | ||
apache-site-https.conf.in | ||
apache-site.conf.in | ||
koha-common.conf | ||
koha-conf-site.xml.in | ||
koha-core.conf | ||
koha-sites.conf | ||
koha-worker@.service | ||
log4perl-site.conf.in | ||
marc21-retrieval-info-auth-dom.xml | ||
marc21-retrieval-info-bib-dom.xml | ||
plack.psgi | ||
SIPconfig.xml | ||
unimarc-retrieval-info-auth-dom.xml | ||
unimarc-retrieval-info-bib-dom.xml | ||
zebra-authorities-dom-site.cfg.in | ||
zebra-biblios-dom-site.cfg.in | ||
zebra.passwd.in |