Bug 29914: Make check_cookie_auth compare the userid
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 20 Jan 2022 09:10:05 +0000 (10:10 +0100)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 3 Feb 2022 07:05:29 +0000 (21:05 -1000)
commit95097d1cc2752715fea099940face25949d3b204
tree7c73a6e83825566a8d7debb7d8352b5eb6f0ac48
parentdd4800f08d688de940f61d50085ff178992f0628
Bug 29914: Make check_cookie_auth compare the userid

check_cookie_auth is assuming that the user is authenticated if a cookie exists
and that the login/username exists in the DB.

So basically if you hit the login page, fill the login input with a
valid username, click "login"
=> A cookie will be generated, and the sessions table will contain a
line with this session id.
On the second hit, if the username is in the DB, it will be enough to be
considered authenticated.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
C4/Auth.pm
Koha/REST/V1/Auth.pm