]> git.koha-community.org Git - koha.git/commit
Bug 29543: Enforce authentication for self-checkout
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 5 Jan 2022 11:47:10 +0000 (12:47 +0100)
committerAndrew Fuerste-Henry <andrew@bywatersolutions.com>
Tue, 25 Jan 2022 21:00:05 +0000 (21:00 +0000)
commit84f79b52723265957f09642a4c67184f988bc428
tree004027bbb035f3d01dcc6e85f775238068e08c1e
parent4008d7261a472fb6d0e484c1d2309ae0e7e2c8ff
Bug 29543: Enforce authentication for self-checkout

The self-checkout feature is assuming a patron is logged in if patronid
is passed. It also assumes that "We're in a controlled environment; we
trust the user", which is terribly wrong!

This patch is suggesting to generate a JSON Web Token (JWT) to store in
a cookie and only allow action (renew, check in/out) is the token is
valid. The token is only generated once the user has been authenticated
And is removed when the user finish the session/logout.

Test plan:
You must know exactly how the self-checkout feature works to test this patch.
The 4 following sysprefs must be tested:
 SelfCheckoutByLogin, AutoSelfCheckAllowed, AutoSelfCheckID, AutoSelfCheckPass
Confirm that you can renew, checkin for the items you own, and checkout new items.
Confirm that you are not allowed to access other account's info.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 77e21f30062dc23edb2c79f609d854d553e67f7c)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit f57465ad024e461bb00b2c0aeebff4adb1a651b5)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
opac/sco/sco-main.pl