From fb63af58450659746227115a81b019317748b805 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 8 Oct 2013 09:33:54 +0530 Subject: [PATCH 1/2] Bug - 5511: Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently. To Test: 1) Enable the system preference SessionRestrictionByIP 2) Change your system IP. It will not checkout your system IP or signout. --- C4/Auth.pm | 5 +++-- .../prog/en/modules/admin/preferences/admin.pref | 7 +++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 156be9d..088fe27 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1009,6 +1009,7 @@ sub checkauth { login => 1, INPUTS => \@inputs, casAuthentication => C4::Context->preference("casAuthentication"), + SessionRestrictionByIP => C4::Context->preference("SessionRestrictionByIP"), suggestion => C4::Context->preference("suggestion"), virtualshelves => C4::Context->preference("virtualshelves"), LibraryName => "" . C4::Context->preference("LibraryName"), @@ -1188,7 +1189,7 @@ sub check_api_auth { $userid = undef; $sessionID = undef; return ("expired", undef, undef); - } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { # IP address changed $session->delete(); C4::Context->_unset_userenv($sessionID); @@ -1427,7 +1428,7 @@ sub check_cookie_auth { $userid = undef; $sessionID = undef; return ("expired", undef); - } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { # IP address changed $session->delete(); C4::Context->_unset_userenv($sessionID); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index 1215ac1..aa6be3c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -53,6 +53,13 @@ Administration: yes: Require no: "Don't require" - staff to log in from a computer in the IP address range specified by their library (if any). + - + - pref: SessionRestrictionByIP + default: 0 + choices: + yes: Enable + no: "Disable" + - Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently. # PostgreSQL is supported by CGI::Session but not by Koha. - - Store login session information -- 1.7.9.5