Bug 16492 - Checkouts ( and possibly checkins and other actions ) will use the patron...

[koha.git] / C4 / Auth.pm

diff --git a/C4/Auth.pm b/C4/Auth.pm
index d7be1d8..a5cf72c 100644 (file)
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -20,6 +20,7 @@ package C4::Auth;
 use strict;
 use warnings;
 use Digest::MD5 qw(md5_base64);
+use File::Spec;
 use JSON qw/encode_json/;
 use URI::Escape;
 use CGI::Session;
@@ -32,12 +33,14 @@ use C4::Branch;       # GetBranches
 use C4::Search::History;
 use Koha;
 use Koha::AuthUtils qw(hash_password);
+use Koha::LibraryCategories;
+use Koha::Libraries;
 use POSIX qw/strftime/;
 use List::MoreUtils qw/ any /;
 use Encode qw( encode is_utf8);
 
 # use utf8;
-use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
+use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
 
 BEGIN {
     sub psgi_env { any { /^psgi\./ } keys %ENV }
@@ -46,7 +49,6 @@ BEGIN {
         if   (psgi_env) { die 'psgi:exit' }
         else            { exit }
     }
-    $VERSION = 3.07.00.049;    # set version for version checking
 
     $debug     = $ENV{DEBUG};
     @ISA       = qw(Exporter);
@@ -190,11 +192,16 @@ sub get_template_and_user {
                 -HttpOnly => 1,
             );
 
-            $template->param( loginprompt => 1 );
+            $template->param(
+                loginprompt => 1,
+                script_name => _get_script_name(),
+            );
             print $in->{query}->header(
-                -type    => 'text/html',
-                -charset => 'utf-8',
-                -cookie  => $cookie,
+                {   type              => 'text/html',
+                    charset           => 'utf-8',
+                    cookie            => $cookie,
+                    'X-Frame-Options' => 'SAMEORIGIN'
+                }
               ),
             $template->output;
             safe_exit;
@@ -396,7 +403,7 @@ sub get_template_and_user {
         $template->param( dateformat => C4::Context->preference('dateformat') );
     }
 
-    $template->param(auth_forwarded_hash => $in->{'query'}->param('auth_forwarded_hash'));
+    $template->param(auth_forwarded_hash => scalar $in->{'query'}->param('auth_forwarded_hash'));
 
     # these template parameters are set the same regardless of $in->{'type'}
 
@@ -420,7 +427,7 @@ sub get_template_and_user {
         hide_marc       => C4::Context->preference("hide_marc"),
         item_level_itypes  => C4::Context->preference('item-level_itypes'),
         patronimages       => C4::Context->preference("patronimages"),
-        singleBranchMode   => C4::Context->preference("singleBranchMode"),
+        singleBranchMode   => ( Koha::Libraries->search->count == 1 ),
         XSLTDetailsDisplay => C4::Context->preference("XSLTDetailsDisplay"),
         XSLTResultsDisplay => C4::Context->preference("XSLTResultsDisplay"),
         using_https        => $using_https,
@@ -501,12 +508,13 @@ sub get_template_and_user {
             $opac_name = C4::Context->userenv->{'branch'};
         }
 
+        my $library_categories = Koha::LibraryCategories->search({categorytype => 'searchdomain', show_in_pulldown => 1}, { order_by => ['categorytype', 'categorycode']});
         $template->param(
             OpacAdditionalStylesheet                   => C4::Context->preference("OpacAdditionalStylesheet"),
             AnonSuggestions                       => "" . C4::Context->preference("AnonSuggestions"),
-            AuthorisedValueImages                 => C4::Context->preference("AuthorisedValueImages"),
             BranchesLoop                          => GetBranchesLoop($opac_name),
-            BranchCategoriesLoop                  => GetBranchCategories( 'searchdomain', 1, $opac_name ),
+            BranchCategoriesLoop                  => $library_categories,
+            opac_name                             => $opac_name,
             LibraryName                           => "" . C4::Context->preference("LibraryName"),
             LibraryNameTitle                      => "" . $LibraryNameTitle,
             LoginBranchname                       => C4::Context->userenv ? C4::Context->userenv->{"branchname"} : "",
@@ -545,6 +553,7 @@ sub get_template_and_user {
             opacreadinghistory                    => C4::Context->preference("opacreadinghistory"),
             OPACUserJS                            => C4::Context->preference("OPACUserJS"),
             opacuserlogin                         => "" . C4::Context->preference("opacuserlogin"),
+            OpenLibrarySearch                     => C4::Context->preference("OpenLibrarySearch"),
             ShowReviewer                          => C4::Context->preference("ShowReviewer"),
             ShowReviewerPhoto                     => C4::Context->preference("ShowReviewerPhoto"),
             suggestion                            => "" . C4::Context->preference("suggestion"),
@@ -1202,6 +1211,7 @@ sub checkauth {
         opaclayoutstylesheet                  => C4::Context->preference("opaclayoutstylesheet"),
         login                                 => 1,
         INPUTS                                => \@inputs,
+        script_name                           => _get_script_name(),
         casAuthentication                     => C4::Context->preference("casAuthentication"),
         shibbolethAuthentication              => $shib,
         SessionRestrictionByIP                => C4::Context->preference("SessionRestrictionByIP"),
@@ -1242,6 +1252,7 @@ sub checkauth {
         opac_css_override                     => $ENV{'OPAC_CSS_OVERRIDE'},
     );
 
+    $template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
     $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
     $template->param( loginprompt => 1 ) unless $info{'nopermission'};
 
@@ -1287,6 +1298,13 @@ sub checkauth {
         );
     }
 
+    if (C4::Context->preference('GoogleOpenIDConnect')) {
+        if ($query->param("OpenIDConnectFailed")) {
+            my $reason = $query->param('OpenIDConnectFailed');
+            $template->param(invalidGoogleOpenIDConnectLogin => $reason);
+        }
+    }
+
     $template->param(
         LibraryName => C4::Context->preference("LibraryName"),
     );
@@ -1295,9 +1313,11 @@ sub checkauth {
     #    $cookie = $query->cookie(CGISESSID => $session->id
     #   );
     print $query->header(
-        -type    => 'text/html',
-        -charset => 'utf-8',
-        -cookie  => $cookie
+        {   type              => 'text/html',
+            charset           => 'utf-8',
+            cookie            => $cookie,
+            'X-Frame-Options' => 'SAMEORIGIN'
+        }
       ),
       $template->output;
     safe_exit;
@@ -1710,13 +1730,15 @@ sub get_session {
     }
     else {
         # catch all defaults to tmp should work on all systems
-        $session = new CGI::Session( "driver:File;serializer:yaml;id:md5", $sessionID, { Directory => '/tmp' } );
+        my $dir = File::Spec->tmpdir;
+        my $instance = C4::Context->config( 'database' ); #actually for packages not exactly the instance name, but generally safer to leave it as it is
+        $session = new CGI::Session( "driver:File;serializer:yaml;id:md5", $sessionID, { Directory => "$dir/cgisess_$instance" } );
     }
     return $session;
 }
 
 sub checkpw {
-    my ( $dbh, $userid, $password, $query, $type ) = @_;
+    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
     $type = 'opac' unless $type;
     if ($ldap) {
         $debug and print STDERR "## checkpw - checking LDAP\n";
@@ -1756,11 +1778,11 @@ sub checkpw {
     }
 
     # INTERNAL AUTH
-    return checkpw_internal(@_)
+    return checkpw_internal( $dbh, $userid, $password, $no_set_userenv);
 }
 
 sub checkpw_internal {
-    my ( $dbh, $userid, $password ) = @_;
+    my ( $dbh, $userid, $password, $no_set_userenv ) = @_;
 
     $password = Encode::encode( 'UTF-8', $password )
       if Encode::is_utf8($password);
@@ -1790,7 +1812,7 @@ sub checkpw_internal {
         if ( checkpw_hash( $password, $stored_hash ) ) {
 
             C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
-                $firstname, $surname, $branchcode, $branchname, $flags );
+                $firstname, $surname, $branchcode, $branchname, $flags ) unless $no_set_userenv;
             return 1, $cardnumber, $userid;
         }
     }
@@ -1807,7 +1829,7 @@ sub checkpw_internal {
         if ( checkpw_hash( $password, $stored_hash ) ) {
 
             C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber,
-                $firstname, $surname, $branchcode, $branchname, $flags );
+                $firstname, $surname, $branchcode, $branchname, $flags ) unless $no_set_userenv;
             return 1, $cardnumber, $userid;
         }
     }
@@ -2023,6 +2045,24 @@ sub getborrowernumber {
     return 0;
 }
 
+=head2 _get_script_name
+
+This returns the correct script name, for use in redirecting back to the correct page after showing
+the login screen. It depends on details of the package Plack configuration, and should not be used
+outside this context.
+
+=cut
+
+sub _get_script_name {
+    # This is the method about.pl uses to detect Plack; now that two places use it, it MUST be
+    # right.
+    if ( ( any { /(^psgi\.|^plack\.)/i } keys %ENV ) && $ENV{SCRIPT_NAME} =~ m,^/(intranet|opac)(.*), ) {
+        return '/cgi-bin/koha' . $2;
+    } else {
+        return $ENV{SCRIPT_NAME};
+    }
+}
+
 END { }    # module clean-up code here (global destructor)
 1;
 __END__