In the event that a library has IndependantBranches turned on, as well as AutoLocation turned on and valid IP ranges in place for their branches, the OPAC login will not redirect to the My Summary area; it will instead show another login prompt. The login is indeed successful, and if the patron navigates to other pages, they will find the link to their account in the upper right corner as normal, but this initial prompt is VERY discouraging.
Created attachment 5214 [details] [review] Proposed Patch AutoLocation should only apply to the staff client login, but when IndependantBranches was activated, it applied to the OPAC login, as well. Login was not prevented, but the patron was greeted with another login prompt, instead of the My Summary page. Very confusing. This patch adds a check for whether this is an OPAC login before executing the particular code that was causing this. To test: 1. Enable IndependantBranches & AutoLocation (be sure your branches have IP ranges configured!) 2. Select a staff account, and note the branch 3. Attempt to login to the staff client from within the IP range for the branch: this should work 4. Attempt to login to the staff client from outside the IP range: this should be blocked 5. Attempt to login to the OPAC from within the IP range: this should work 6. Attempt to login to the OPAC from outside the IP range: this should also work
Created attachment 6198 [details] [review] [SIGNED-OFF] Bug 6804: if IndependantBranches & AutoLocation, OPAC login redirect fails AutoLocation should only apply to the staff client login, but when IndependantBranches was activated, it applied to the OPAC login, as well. Login was not prevented, but the patron was greeted with another login prompt, instead of the My Summary page. Very confusing. This patch adds a check for whether this is an OPAC login before executing the particular code that was causing this. To test: 1. Enable IndependantBranches & AutoLocation (be sure your branches have IP ranges configured!) 2. Select a staff account, and note the branch 3. Attempt to login to the staff client from within the IP range for the branch: this should work 4. Attempt to login to the staff client from outside the IP range: this should be blocked 5. Attempt to login to the OPAC from within the IP range: this should work 6. Attempt to login to the OPAC from outside the IP range: this should also work Signed-off-by: Sophie Meynieux <sophie.meynieux@biblibre.com>
I have tested this patch as described. As my koha server is local, the IP address I have to authorize for the site was 127.0.0.1 Laurent Ducos draws our attention on the fact that this IP check can be easily bypassed by IP spoofing
QA Comment: I did not test this patch, but have some comments on the code that is not directly touched by this patch but is in the direct context. I think that the check if ($ip !~ /^$domain/) does not work. If domain is a full IP address it works. But if domain is a subnet mask like 199.1.*, the check will also approve addresses like 199.11.12.13 which it should not (.* will `eat` 1.12.13). From a QA standpoint, I do not like it that the code here takes its regex here directly from the database. The point in the database column is not meant as a regex wildcard. My recommendation therefore is that this patch should also correct this regex, since it directly deals with the if-condition on top of it.
Adding See Also link to bug 3068
Looks like this has completely fallen off the radar... do we know if it's still a bug in current master?
Will be fixed by bug 9569. *** This bug has been marked as a duplicate of bug 9569 ***