t/db_dependent/Auth.t

   1 #!/usr/bin/perl
   2 #
   3 # This Koha test module is a stub!
   4 # Add more tests here!!!
   5
   6 use Modern::Perl;
   7
   8 use CGI qw ( -utf8 );
   9
  10 use Test::MockObject;
  11 use Test::MockModule;
  12 use List::MoreUtils qw/all any none/;
  13 use Test::More tests => 21;
  14 use Test::Warn;
  15 use t::lib::Mocks;
  16 use t::lib::TestBuilder;
  17
  18 use C4::Auth qw(checkpw);
  19 use C4::Members;
  20 use Koha::AuthUtils qw/hash_password/;
  21 use Koha::Database;
  22 use Koha::Patrons;
  23
  24 BEGIN {
  25     use_ok('C4::Auth');
  26 }
  27
  28 my $schema  = Koha::Database->schema;
  29 my $builder = t::lib::TestBuilder->new;
  30 my $dbh     = C4::Context->dbh;
  31
  32 $schema->storage->txn_begin;
  33
  34 subtest 'checkauth() tests' => sub {
  35
  36     plan tests => 1;
  37
  38     my $patron = $builder->build({ source => 'Borrower', value => { flags => undef } })->{userid};
  39
  40     # Mock a CGI object with real userid param
  41     my $cgi = Test::MockObject->new();
  42     $cgi->mock( 'param', sub { return $patron; } );
  43     $cgi->mock( 'cookie', sub { return; } );
  44
  45     my $authnotrequired = 1;
  46     my ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, $authnotrequired );
  47
  48     is( $userid, undef, 'checkauth() returns undef for userid if no logged in user (Bug 18275)' );
  49
  50 };
  51
  52 my $hash1 = hash_password('password');
  53 my $hash2 = hash_password('password');
  54
  55 { # tests no_set_userenv parameter
  56     my $patron = $builder->build( { source => 'Borrower' } );
  57     Koha::Patrons->find( $patron->{borrowernumber} )->update_password( $patron->{userid}, $hash1 );
  58     my $library = $builder->build(
  59         {
  60             source => 'Branch',
  61         }
  62     );
  63
  64     ok( checkpw( $dbh, $patron->{userid}, 'password', undef, undef, 1 ), 'checkpw returns true' );
  65     is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
  66     C4::Context->_new_userenv('DUMMY SESSION');
  67     C4::Context->set_userenv(0,0,0,'firstname','surname', $library->{branchcode}, 'Library 1', 0, '', '');
  68     is( C4::Context->userenv->{branch}, $library->{branchcode}, 'Userenv gives correct branch' );
  69     ok( checkpw( $dbh, $patron->{userid}, 'password', undef, undef, 1 ), 'checkpw returns true' );
  70     is( C4::Context->userenv->{branch}, $library->{branchcode}, 'Userenv branch is preserved if no_set_userenv is true' );
  71     ok( checkpw( $dbh, $patron->{userid}, 'password', undef, undef, 0 ), 'checkpw still returns true' );
  72     isnt( C4::Context->userenv->{branch}, $library->{branchcode}, 'Userenv branch is overwritten if no_set_userenv is false' );
  73 }
  74
  75 # get_template_and_user tests
  76
  77 {   # Tests for the language URL parameter
  78
  79     sub MockedCheckauth {
  80         my ($query,$authnotrequired,$flagsrequired,$type) = @_;
  81         # return vars
  82         my $userid = 'cobain';
  83         my $sessionID = 234;
  84         # we don't need to bother about permissions for this test
  85         my $flags = {
  86             superlibrarian    => 1, acquisition       => 0,
  87             borrowers         => 0,
  88             catalogue         => 1, circulate         => 0,
  89             coursereserves    => 0, editauthorities   => 0,
  90             editcatalogue     => 0, management        => 0,
  91             parameters        => 0, permissions       => 0,
  92             plugins           => 0, reports           => 0,
  93             reserveforothers  => 0, serials           => 0,
  94             staffaccess       => 0, tools             => 0,
  95             updatecharges     => 0
  96         };
  97
  98         my $session_cookie = $query->cookie(
  99             -name => 'CGISESSID',
 100             -value    => 'nirvana',
 101             -HttpOnly => 1
 102         );
 103
 104         return ( $userid, $session_cookie, $sessionID, $flags );
 105     }
 106
 107     # Mock checkauth, build the scenario
 108     my $auth = new Test::MockModule( 'C4::Auth' );
 109     $auth->mock( 'checkauth', \&MockedCheckauth );
 110
 111     # Make sure 'EnableOpacSearchHistory' is set
 112     t::lib::Mocks::mock_preference('EnableOpacSearchHistory',1);
 113     # Enable es-ES for the OPAC and staff interfaces
 114     t::lib::Mocks::mock_preference('opaclanguages','en,es-ES');
 115     t::lib::Mocks::mock_preference('language','en,es-ES');
 116
 117     # we need a session cookie
 118     $ENV{"SERVER_PORT"} = 80;
 119     $ENV{"HTTP_COOKIE"} = 'CGISESSID=nirvana';
 120
 121     my $query = new CGI;
 122     $query->param('language','es-ES');
 123
 124     my ( $template, $loggedinuser, $cookies ) = get_template_and_user(
 125         {
 126             template_name   => "about.tt",
 127             query           => $query,
 128             type            => "opac",
 129             authnotrequired => 1,
 130             flagsrequired   => { catalogue => 1 },
 131             debug           => 1
 132         }
 133     );
 134
 135     ok ( ( all { ref($_) eq 'CGI::Cookie' } @$cookies ),
 136             'BZ9735: the cookies array is flat' );
 137
 138     # new query, with non-existent language (we only have en and es-ES)
 139     $query->param('language','tomas');
 140
 141     ( $template, $loggedinuser, $cookies ) = get_template_and_user(
 142         {
 143             template_name   => "about.tt",
 144             query           => $query,
 145             type            => "opac",
 146             authnotrequired => 1,
 147             flagsrequired   => { catalogue => 1 },
 148             debug           => 1
 149         }
 150     );
 151
 152     ok( ( none { $_->name eq 'KohaOpacLanguage' and $_->value eq 'tomas' } @$cookies ),
 153         'BZ9735: invalid language, it is not set');
 154
 155     ok( ( any { $_->name eq 'KohaOpacLanguage' and $_->value eq 'en' } @$cookies ),
 156         'BZ9735: invalid language, then default to en');
 157
 158     for my $template_name (
 159         qw(
 160             ../../../../../../../../../../../../../../../etc/passwd
 161             test/../../../../../../../../../../../../../../etc/passwd
 162             /etc/passwd
 163             test/does_not_finished_by_tt_t
 164         )
 165     ) {
 166         eval {
 167             ( $template, $loggedinuser, $cookies ) = get_template_and_user(
 168                 {
 169                     template_name   => $template_name,
 170                     query           => $query,
 171                     type            => "intranet",
 172                     authnotrequired => 1,
 173                     flagsrequired   => { catalogue => 1 },
 174                 }
 175             );
 176         };
 177         like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );
 178     }
 179     ( $template, $loggedinuser, $cookies ) = get_template_and_user(
 180         {
 181             template_name   => 'errors/errorpage.tt',
 182             query           => $query,
 183             type            => "intranet",
 184             authnotrequired => 1,
 185             flagsrequired   => { catalogue => 1 },
 186         }
 187     );
 188     my $file_exists = ( -f $template->{filename} ) ? 1 : 0;
 189     is ( $file_exists, 1, 'The file errors/errorpage.tt should be accessible (contains integers)' );
 190 }
 191
 192 # Check that there is always an OPACBaseURL set.
 193 my $input = CGI->new();
 194 my ( $template1, $borrowernumber, $cookie );
 195 ( $template1, $borrowernumber, $cookie ) = get_template_and_user(
 196     {
 197         template_name => "opac-detail.tt",
 198         type => "opac",
 199         query => $input,
 200         authnotrequired => 1,
 201     }
 202 );
 203
 204 ok( ( any { 'OPACBaseURL' eq $_ } keys %{$template1->{VARS}} ),
 205     'OPACBaseURL is in OPAC template' );
 206
 207 my ( $template2 );
 208 ( $template2, $borrowernumber, $cookie ) = get_template_and_user(
 209     {
 210         template_name => "catalogue/detail.tt",
 211         type => "intranet",
 212         query => $input,
 213         authnotrequired => 1,
 214     }
 215 );
 216
 217 ok( ( any { 'OPACBaseURL' eq $_ } keys %{$template2->{VARS}} ),
 218     'OPACBaseURL is in Staff template' );
 219
 220 ok(C4::Auth::checkpw_hash('password', $hash1), 'password validates with first hash');
 221 ok(C4::Auth::checkpw_hash('password', $hash2), 'password validates with second hash');