From adb624d49599df3e00a7747396c2d11590be7099 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 25 Jun 2015 12:48:05 +0800 Subject: [PATCH] Bug 14407 - Allow web-based self-checkout to be limited to only certain IPs or IP ranges Test plan: 0) Back up your databse 1) Apply this patch 2) In your mysql client use your Koha database and execute: > DELETE FROM systempreferences; > SOURCE ~/kohaclone/installer/data/mysql/sysprefs.sql; -- Should be no errors. > SELECT * FROM systempreferences WHERE variable='SelfCheckAllowByIPRanges'; -- Should see 1 entry > QUIT; 3) Restore your database 4) Run installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql 5) In your mysql client, using your Koha database, execute: > SELECT * FROM systempreferences WHERE variable='SelfCheckAllowByIPRanges'; -- should see the same entry as above 6) Try access the Self-checkout, self-checkout help, and self-checkout patron images. It should work. 7) Log into the staff client 8) Home -> Koha administration -> Global system preferences 9) -> CIRCULATION Make sure that SelfCheckAllowByIPRanges is set to a computer you can test on 10) Try access the Self-checkout, self-checkout help, and self-checkout patron images from a computer with an IP in the range above. It should work. 11) Try access the Self-checkout, self-checkout help, and self-checkout patron images from a computer with an IP outside of the range above. It should *not* work. --- installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql | 2 ++ installer/data/mysql/sysprefs.sql | 1 + .../prog/en/modules/admin/preferences/circulation.pref | 4 ++++ opac/sco/help.pl | 10 ++++++++++ opac/sco/sco-main.pl | 9 +++++++++ opac/sco/sco-patron-image.pl | 11 +++++++++++ 6 files changed, 37 insertions(+) create mode 100644 installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql diff --git a/installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql b/installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql new file mode 100644 index 0000000..7548d78 --- /dev/null +++ b/installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql @@ -0,0 +1,2 @@ +INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES + ('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.)','Short'); diff --git a/installer/data/mysql/sysprefs.sql b/installer/data/mysql/sysprefs.sql index 84ba363..abfdee6 100644 --- a/installer/data/mysql/sysprefs.sql +++ b/installer/data/mysql/sysprefs.sql @@ -55,6 +55,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('AutoSelfCheckAllowed','0','','For corporate and special libraries which want web-based self-check available from any PC without the need for a manual staff login. Most libraries will want to leave this turned off. If on, requires self-check ID and password to be entered in AutoSelfCheckID and AutoSelfCheckPass sysprefs.','YesNo'), ('AutoSelfCheckID','','','Staff ID with circulation rights to be used for automatic web-based self-check. Only applies if AutoSelfCheckAllowed syspref is turned on.','free'), ('AutoSelfCheckPass','','','Password to be used for automatic web-based self-check. Only applies if AutoSelfCheckAllowed syspref is turned on.','free'), +('SelfCheckAllowByIPRanges','',NULL,('Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.)','Short'), ('Babeltheque','0','','Turn ON Babeltheque content - See babeltheque.com to subscribe to this service','YesNo'), ('Babeltheque_url_js','','','Url for Babeltheque javascript (e.g. http://www.babeltheque.com/bw_XX.js)','Free'), ('Babeltheque_url_update','','','Url for Babeltheque update (E.G. http://www.babeltheque.com/.../file.csv.bz2)','Free'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref index f9cd822..d08acba 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref @@ -681,6 +681,10 @@ Circulation: yes: Show no: "Don't show" - "the print receipt popup dialog when self checkout is finished" + - + - pref: SelfCheckAllowByIPRanges + class: short + - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.) Course Reserves: - diff --git a/opac/sco/help.pl b/opac/sco/help.pl index c41d737..d1b6121 100755 --- a/opac/sco/help.pl +++ b/opac/sco/help.pl @@ -24,11 +24,21 @@ use strict; use warnings; use CGI qw ( -utf8 ); +use Net::IP::Match::XS; use C4::Auth qw(get_template_and_user); use C4::Output qw(output_html_with_http_headers); my $query = new CGI; + +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (match_ip($ENV{'REMOTE_ADDR'}, @allowedipranges)) { + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; + } +} + my ($template, $borrowernumber, $cookie) = get_template_and_user({ template_name => "sco/help.tt", query => $query, diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index b214f54..5758bbf 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -36,6 +36,7 @@ use warnings; use CGI qw ( -utf8 ); use Digest::MD5 qw(md5_base64); +use Net::IP::Match::XS; use C4::Auth qw(get_template_and_user checkpw); use C4::Koha; @@ -54,6 +55,14 @@ unless (C4::Context->preference('WebBasedSelfCheck')) { exit; } +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (match_ip($ENV{'REMOTE_ADDR'}, @allowedipranges)) { + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; + } +} + if (C4::Context->preference('AutoSelfCheckAllowed')) { my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID'); diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl index c6c0a19..fa1c4df 100755 --- a/opac/sco/sco-patron-image.pl +++ b/opac/sco/sco-patron-image.pl @@ -19,6 +19,8 @@ use strict; use warnings; +use Net::IP::Match::XS; + use C4::Service; use C4::Members; @@ -33,6 +35,15 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { exit; } +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (match_ip($ENV{'REMOTE_ADDR'}, @allowedipranges)) { + print $query->header(status => '403 Forbidden - functionality not available from your location'); + exit; + } +} + + my ($borrowernumber) = C4::Service->require_params('borrowernumber'); my ($imagedata, $dberror) = GetPatronImage($borrowernumber); -- 2.1.0