View | Details | Raw Unified | Return to bug 25360
Collapse All | Expand All

(-)a/C4/Auth.pm (-4 / +12 lines)
Lines 230-235 sub get_template_and_user { Link Here
230
                -value    => '',
230
                -value    => '',
231
                -expires  => '',
231
                -expires  => '',
232
                -HttpOnly => 1,
232
                -HttpOnly => 1,
233
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
233
            );
234
            );
234
235
235
            $template->param(
236
            $template->param(
Lines 826-831 sub checkauth { Link Here
826
            -value    => '',
827
            -value    => '',
827
            -expires  => '',
828
            -expires  => '',
828
            -HttpOnly => 1,
829
            -HttpOnly => 1,
830
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
829
        );
831
        );
830
        $loggedin = 1;
832
        $loggedin = 1;
831
    }
833
    }
Lines 926-932 sub checkauth { Link Here
926
            $cookie = $query->cookie(
928
            $cookie = $query->cookie(
927
                -name     => 'CGISESSID',
929
                -name     => 'CGISESSID',
928
                -value    => $session->id,
930
                -value    => $session->id,
929
                -HttpOnly => 1
931
                -HttpOnly => 1,
932
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
930
            );
933
            );
931
            $session->param( 'lasttime', time() );
934
            $session->param( 'lasttime', time() );
932
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
935
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
Lines 955-961 sub checkauth { Link Here
955
        $cookie = $query->cookie(
958
        $cookie = $query->cookie(
956
            -name     => 'CGISESSID',
959
            -name     => 'CGISESSID',
957
            -value    => $session->id,
960
            -value    => $session->id,
958
            -HttpOnly => 1
961
            -HttpOnly => 1,
962
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
959
        );
963
        );
960
        my $pki_field = C4::Context->preference('AllowPKIAuth');
964
        my $pki_field = C4::Context->preference('AllowPKIAuth');
961
        if ( !defined($pki_field) ) {
965
        if ( !defined($pki_field) ) {
Lines 1126-1132 sub checkauth { Link Here
1126
                            $cookie = $query->cookie(
1130
                            $cookie = $query->cookie(
1127
                                -name     => 'CGISESSID',
1131
                                -name     => 'CGISESSID',
1128
                                -value    => '',
1132
                                -value    => '',
1129
                                -HttpOnly => 1
1133
                                -HttpOnly => 1,
1134
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1130
                            );
1135
                            );
1131
                            $info{'wrongip'} = 1;
1136
                            $info{'wrongip'} = 1;
1132
                        }
1137
                        }
Lines 1207-1213 sub checkauth { Link Here
1207
            $cookie = $query->cookie(
1212
            $cookie = $query->cookie(
1208
                -name     => 'CGISESSID',
1213
                -name     => 'CGISESSID',
1209
                -value    => '',
1214
                -value    => '',
1210
                -HttpOnly => 1
1215
                -HttpOnly => 1,
1216
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1211
            );
1217
            );
1212
        }
1218
        }
1213
1219
Lines 1474-1479 sub check_api_auth { Link Here
1474
                    -name     => 'CGISESSID',
1480
                    -name     => 'CGISESSID',
1475
                    -value    => $session->id,
1481
                    -value    => $session->id,
1476
                    -HttpOnly => 1,
1482
                    -HttpOnly => 1,
1483
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1477
                );
1484
                );
1478
                $session->param( 'lasttime', time() );
1485
                $session->param( 'lasttime', time() );
1479
                my $flags = haspermission( $userid, $flagsrequired );
1486
                my $flags = haspermission( $userid, $flagsrequired );
Lines 1528-1533 sub check_api_auth { Link Here
1528
                -name     => 'CGISESSID',
1535
                -name     => 'CGISESSID',
1529
                -value    => $sessionID,
1536
                -value    => $sessionID,
1530
                -HttpOnly => 1,
1537
                -HttpOnly => 1,
1538
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1531
            );
1539
            );
1532
            if ( $return == 1 ) {
1540
            if ( $return == 1 ) {
1533
                my (
1541
                my (
(-)a/C4/Context.pm (+26 lines)
Lines 1072-1077 sub set_remote_address { Link Here
1072
    }
1072
    }
1073
}
1073
}
1074
1074
1075
=head3 https_enabled
1076
1077
https_enabled should be called when checking if a HTTPS connection
1078
is used.
1079
1080
Note that this depends on a HTTPS environmental variable being defined
1081
by the web server. This function may not return the expected result,
1082
if your web server or reverse proxies are not setting the correct
1083
X-Forwarded-Proto headers and HTTPS environmental variable.
1084
1085
Note too that the HTTPS value can vary from web server to web server.
1086
We are relying on the convention of the value being "on" or "ON" here.
1087
1088
=cut
1089
1090
sub https_enabled {
1091
    my $https_enabled = 0;
1092
    my $env_https = $ENV{HTTPS};
1093
    if ($env_https){
1094
        if ($env_https =~ /^ON$/i){
1095
            $https_enabled = 1;
1096
        }
1097
    }
1098
    return $https_enabled;
1099
}
1100
1075
1;
1101
1;
1076
1102
1077
=head3 needs_install
1103
=head3 needs_install
(-)a/C4/InstallAuth.pm (-2 / +6 lines)
Lines 261-266 sub checkauth { Link Here
261
                -name     => 'CGISESSID',
261
                -name     => 'CGISESSID',
262
                -value    => $session->id,
262
                -value    => $session->id,
263
                -HttpOnly => 1,
263
                -HttpOnly => 1,
264
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
264
            );
265
            );
265
            $loggedin = 1;
266
            $loggedin = 1;
266
            $userid   = $session->param('cardnumber');
267
            $userid   = $session->param('cardnumber');
Lines 300-305 sub checkauth { Link Here
300
                -name     => 'CGISESSID',
301
                -name     => 'CGISESSID',
301
                -value    => $sessionID,
302
                -value    => $sessionID,
302
                -HttpOnly => 1,
303
                -HttpOnly => 1,
304
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
303
            );
305
            );
304
            if ( $return == 2 ) {
306
            if ( $return == 2 ) {
305
307
Lines 345-351 sub checkauth { Link Here
345
                -name    => 'CGISESSID',
347
                -name    => 'CGISESSID',
346
                -value   => '',
348
                -value   => '',
347
                -HttpOnly => 1,
349
                -HttpOnly => 1,
348
                -expires => ''
350
                -expires => '',
351
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
349
            );
352
            );
350
        }
353
        }
351
        if ($envcookie) {
354
        if ($envcookie) {
Lines 387-393 sub checkauth { Link Here
387
        -name    => 'CGISESSID',
390
        -name    => 'CGISESSID',
388
        -value   => $sessionID,
391
        -value   => $sessionID,
389
        -HttpOnly => 1,
392
        -HttpOnly => 1,
390
        -expires => ''
393
        -expires => '',
394
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
391
    );
395
    );
392
    print $query->header(
396
    print $query->header(
393
        -type    => 'text/html; charset=utf-8',
397
        -type    => 'text/html; charset=utf-8',
(-)a/t/Context.t (-2 / +17 lines)
Lines 18-24 Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use DBI;
20
use DBI;
21
use Test::More tests => 29;
21
use Test::More tests => 35;
22
use Test::MockModule;
22
use Test::MockModule;
23
use Test::Warn;
23
use Test::Warn;
24
use YAML;
24
use YAML;
Lines 117-119 is(C4::Context->interface, 'opac', 'interface still opac'); Link Here
117
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
117
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
118
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
118
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
119
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
119
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
120
- 
120
121
{
122
    local %ENV = %ENV;
123
    delete $ENV{HTTPS};
124
    is( C4::Context->https_enabled, 0, "Undefined HTTPS env returns 0");
125
    $ENV{HTTPS} = '1';
126
    is( C4::Context->https_enabled, 0, "Invalid 1 HTTPS env returns 0");
127
    $ENV{HTTPS} = 'off';
128
    is( C4::Context->https_enabled, 0, "off HTTPS env returns 0");
129
    $ENV{HTTPS} = 'OFF';
130
    is( C4::Context->https_enabled, 0, "OFF HTTPS env returns 0");
131
    $ENV{HTTPS} = 'on';
132
    is( C4::Context->https_enabled, 1, "on HTTPS env returns 1");
133
    $ENV{HTTPS} = 'ON';
134
    is( C4::Context->https_enabled, 1, "ON HTTPS env returns 1");
135
}

Return to bug 25360