Bug 29914: Make check_cookie_auth compare the userid
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 20 Jan 2022 09:10:05 +0000 (10:10 +0100)
committerVictor Grousset/tuxayo <victor@tuxayo.net>
Mon, 31 Jan 2022 18:15:45 +0000 (19:15 +0100)
commitc986bd983b720966b6012f5f53d0640849fa2640
treeaeec8067af95212b56435491693c0ab2c811bdcd
parent18a88ae4635d65e87e26120eef61ec36097eaa39
Bug 29914: Make check_cookie_auth compare the userid

check_cookie_auth is assuming that the user is authenticated if a cookie exists
and that the login/username exists in the DB.

So basically if you hit the login page, fill the login input with a
valid username, click "login"
=> A cookie will be generated, and the sessions table will contain a
line with this session id.
On the second hit, if the username is in the DB, it will be enough to be
considered authenticated.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7114dc2fb1a1440dd031ee771efee6e50bb86540)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
C4/Auth.pm
Koha/REST/V1/Auth.pm