I updated our koha server to the latest 3.4.x via git and noticed that
ldap authentication was broken for the staff side.
In our environment our userid != cardnumber. During debugging I noticed
the getuserflags function was actually comparing against the cardnumber
and not the permission bits. This happens when the query in
haspermission() does not return any rows.
The second patch removes part of the patch for bug 5995. If I am
understanding that bug correctly this ok as long as haspermission is fixed.
Chad Billman
>From 27cb2fcf869c0ab2ca7f4eeb81fc8ab1092b374b Mon Sep 17 00:00:00 2001
From: Chad Billman <[email protected]>
Date: Wed, 29 Jun 2011 12:30:15 -0400
Subject: [PATCH 1/2] Make sure haspermission function does not pass along a null value
---
C4/Auth.pm | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/C4/Auth.pm b/C4/Auth.pm
index b416449..2569ff1 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1580,7 +1580,12 @@ sub haspermission {
my ($userid, $flagsrequired) = @_;
my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
$sth->execute($userid);
- my $flags = getuserflags($sth->fetchrow(), $userid);
+
+ # Make sure the query returns a value before passing to getuserflags
+ my $flags = $sth->fetchrow();
+ if( !$flags ) { $flags = 0; }
+
+ $flags = getuserflags($flags, $userid);
if ( $userid eq C4::Context->config('user') ) {
# Super User Account from /etc/koha.conf
$flags->{'superlibrarian'} = 1;
--
1.7.4.1
>From b70cbde84aaddd90e351e848253f3c1e8f2db4a1 Mon Sep 17 00:00:00 2001
From: Chad Billman <[email protected]>
Date: Wed, 29 Jun 2011 12:45:18 -0400
Subject: [PATCH 2/2] Back out part of bug 5995 - do not change userid to cardnumber
---
C4/Auth.pm | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/C4/Auth.pm b/C4/Auth.pm
index 2569ff1..a483630 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -737,8 +737,7 @@ sub checkauth {
$info{'invalidCasLogin'} = 1 unless ($return);
} else {
my $retuserid;
- ( $return, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
- $userid = $retuserid if ($retuserid ne '');
+ ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
}
if ($return) {
_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
--
1.7.4.1
_______________________________________________
Koha-patches mailing list
[email protected]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-patches
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
