View | Details | Raw Unified | Return to bug 25360
Collapse All | Expand All

(-)a/C4/Auth.pm (-8 / +8 lines)
Lines 244-250 sub get_template_and_user { Link Here
244
                -value    => '',
244
                -value    => '',
245
                -expires  => '',
245
                -expires  => '',
246
                -HttpOnly => 1,
246
                -HttpOnly => 1,
247
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
247
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
248
            );
248
            );
249
249
250
            $template->param(
250
            $template->param(
Lines 863-869 sub checkauth { Link Here
863
            -value    => '',
863
            -value    => '',
864
            -expires  => '',
864
            -expires  => '',
865
            -HttpOnly => 1,
865
            -HttpOnly => 1,
866
            -secure => ( $ENV{HTTPS} ? 1 : 0 ),
866
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
867
        );
867
        );
868
        $loggedin = 1;
868
        $loggedin = 1;
869
    }
869
    }
Lines 996-1002 sub checkauth { Link Here
996
                -name     => 'CGISESSID',
996
                -name     => 'CGISESSID',
997
                -value    => $session->id,
997
                -value    => $session->id,
998
                -HttpOnly => 1,
998
                -HttpOnly => 1,
999
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
999
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1000
            );
1000
            );
1001
            $session->param( 'lasttime', time() );
1001
            $session->param( 'lasttime', time() );
1002
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
1002
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
Lines 1026-1032 sub checkauth { Link Here
1026
            -name     => 'CGISESSID',
1026
            -name     => 'CGISESSID',
1027
            -value    => $session->id,
1027
            -value    => $session->id,
1028
            -HttpOnly => 1,
1028
            -HttpOnly => 1,
1029
            -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1029
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1030
        );
1030
        );
1031
        my $pki_field = C4::Context->preference('AllowPKIAuth');
1031
        my $pki_field = C4::Context->preference('AllowPKIAuth');
1032
        if ( !defined($pki_field) ) {
1032
        if ( !defined($pki_field) ) {
Lines 1220-1226 sub checkauth { Link Here
1220
                                -name     => 'CGISESSID',
1220
                                -name     => 'CGISESSID',
1221
                                -value    => '',
1221
                                -value    => '',
1222
                                -HttpOnly => 1,
1222
                                -HttpOnly => 1,
1223
                                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1223
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1224
                            );
1224
                            );
1225
                            $info{'wrongip'} = 1;
1225
                            $info{'wrongip'} = 1;
1226
                        }
1226
                        }
Lines 1310-1316 sub checkauth { Link Here
1310
                -name     => 'CGISESSID',
1310
                -name     => 'CGISESSID',
1311
                -value    => '',
1311
                -value    => '',
1312
                -HttpOnly => 1,
1312
                -HttpOnly => 1,
1313
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1313
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1314
            );
1314
            );
1315
        }
1315
        }
1316
1316
Lines 1726-1732 sub check_api_auth { Link Here
1726
                    -name     => 'CGISESSID',
1726
                    -name     => 'CGISESSID',
1727
                    -value    => $session->id,
1727
                    -value    => $session->id,
1728
                    -HttpOnly => 1,
1728
                    -HttpOnly => 1,
1729
                    -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1729
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1730
                );
1730
                );
1731
                $session->param( 'lasttime', time() );
1731
                $session->param( 'lasttime', time() );
1732
                my $flags = haspermission( $userid, $flagsrequired );
1732
                my $flags = haspermission( $userid, $flagsrequired );
Lines 1781-1787 sub check_api_auth { Link Here
1781
                -name     => 'CGISESSID',
1781
                -name     => 'CGISESSID',
1782
                -value    => $sessionID,
1782
                -value    => $sessionID,
1783
                -HttpOnly => 1,
1783
                -HttpOnly => 1,
1784
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1784
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1785
            );
1785
            );
1786
            if ( $return == 1 ) {
1786
            if ( $return == 1 ) {
1787
                my (
1787
                my (
(-)a/C4/Context.pm (+26 lines)
Lines 1119-1124 sub set_remote_address { Link Here
1119
    }
1119
    }
1120
}
1120
}
1121
1121
1122
=head3 https_enabled
1123
1124
https_enabled should be called when checking if a HTTPS connection
1125
is used.
1126
1127
Note that this depends on a HTTPS environmental variable being defined
1128
by the web server. This function may not return the expected result,
1129
if your web server or reverse proxies are not setting the correct
1130
X-Forwarded-Proto headers and HTTPS environmental variable.
1131
1132
Note too that the HTTPS value can vary from web server to web server.
1133
We are relying on the convention of the value being "on" or "ON" here.
1134
1135
=cut
1136
1137
sub https_enabled {
1138
    my $https_enabled = 0;
1139
    my $env_https = $ENV{HTTPS};
1140
    if ($env_https){
1141
        if ($env_https =~ /^ON$/i){
1142
            $https_enabled = 1;
1143
        }
1144
    }
1145
    return $https_enabled;
1146
}
1147
1122
1;
1148
1;
1123
1149
1124
__END__
1150
__END__
(-)a/C4/InstallAuth.pm (-4 / +4 lines)
Lines 267-273 sub checkauth { Link Here
267
                -name     => 'CGISESSID',
267
                -name     => 'CGISESSID',
268
                -value    => $session->id,
268
                -value    => $session->id,
269
                -HttpOnly => 1,
269
                -HttpOnly => 1,
270
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
270
                -secure => ( C4::Context->https_enabled() } ? 1 : 0 ),
271
            );
271
            );
272
            $loggedin = 1;
272
            $loggedin = 1;
273
            $userid   = $session->param('cardnumber');
273
            $userid   = $session->param('cardnumber');
Lines 308-314 sub checkauth { Link Here
308
                -name     => 'CGISESSID',
308
                -name     => 'CGISESSID',
309
                -value    => $sessionID,
309
                -value    => $sessionID,
310
                -HttpOnly => 1,
310
                -HttpOnly => 1,
311
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
311
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
312
            );
312
            );
313
            if ( $return == 2 ) {
313
            if ( $return == 2 ) {
314
314
Lines 355-361 sub checkauth { Link Here
355
                -value   => '',
355
                -value   => '',
356
                -HttpOnly => 1,
356
                -HttpOnly => 1,
357
                -expires => '',
357
                -expires => '',
358
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
358
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
359
            );
359
            );
360
        }
360
        }
361
        if ($envcookie) {
361
        if ($envcookie) {
Lines 398-404 sub checkauth { Link Here
398
        -value   => $sessionID,
398
        -value   => $sessionID,
399
        -HttpOnly => 1,
399
        -HttpOnly => 1,
400
        -expires => '',
400
        -expires => '',
401
        -secure => ( $ENV{HTTPS} ? 1 : 0 ),
401
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
402
    );
402
    );
403
    print $query->header(
403
    print $query->header(
404
        -type    => 'text/html; charset=utf-8',
404
        -type    => 'text/html; charset=utf-8',
(-)a/t/Context.t (-2 / +17 lines)
Lines 18-24 Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use DBI;
20
use DBI;
21
use Test::More tests => 28;
21
use Test::More tests => 34;
22
use Test::MockModule;
22
use Test::MockModule;
23
use Test::Warn;
23
use Test::Warn;
24
use YAML;
24
use YAML;
Lines 104-106 is(C4::Context->interface, 'opac', 'interface still opac'); Link Here
104
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
104
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
105
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
105
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
106
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
106
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
107
- 
107
108
{
109
    local %ENV = %ENV;
110
    delete $ENV{HTTPS};
111
    is( C4::Context->https_enabled, 0, "Undefined HTTPS env returns 0");
112
    $ENV{HTTPS} = '1';
113
    is( C4::Context->https_enabled, 0, "Invalid 1 HTTPS env returns 0");
114
    $ENV{HTTPS} = 'off';
115
    is( C4::Context->https_enabled, 0, "off HTTPS env returns 0");
116
    $ENV{HTTPS} = 'OFF';
117
    is( C4::Context->https_enabled, 0, "OFF HTTPS env returns 0");
118
    $ENV{HTTPS} = 'on';
119
    is( C4::Context->https_enabled, 1, "on HTTPS env returns 1");
120
    $ENV{HTTPS} = 'ON';
121
    is( C4::Context->https_enabled, 1, "ON HTTPS env returns 1");
122
}

Return to bug 25360