Lines 23-28
use Carp qw( croak );
Link Here
|
23 |
|
23 |
|
24 |
use Digest::MD5 qw( md5_base64 ); |
24 |
use Digest::MD5 qw( md5_base64 ); |
25 |
use CGI::Session; |
25 |
use CGI::Session; |
|
|
26 |
use CGI::Session::ErrorHandler; |
26 |
use URI; |
27 |
use URI; |
27 |
use URI::QueryParam; |
28 |
use URI::QueryParam; |
28 |
|
29 |
|
Lines 885-891
sub checkauth {
Link Here
|
885 |
$anon_search_history = $session->param('search_history'); |
886 |
$anon_search_history = $session->param('search_history'); |
886 |
$session->delete(); |
887 |
$session->delete(); |
887 |
$session->flush; |
888 |
$session->flush; |
888 |
C4::Context->_unset_userenv($sessionID); |
889 |
C4::Context::_unset_userenv($sessionID); |
889 |
} |
890 |
} |
890 |
elsif ($logout) { |
891 |
elsif ($logout) { |
891 |
|
892 |
|
Lines 894-900
sub checkauth {
Link Here
|
894 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
895 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
895 |
$session->delete(); |
896 |
$session->delete(); |
896 |
$session->flush; |
897 |
$session->flush; |
897 |
C4::Context->_unset_userenv($sessionID); |
898 |
C4::Context::_unset_userenv($sessionID); |
898 |
|
899 |
|
899 |
if ($cas and $caslogout) { |
900 |
if ($cas and $caslogout) { |
900 |
logout_cas($query, $type); |
901 |
logout_cas($query, $type); |
Lines 1087-1093
sub checkauth {
Link Here
|
1087 |
} |
1088 |
} |
1088 |
else { |
1089 |
else { |
1089 |
$info{'nopermission'} = 1; |
1090 |
$info{'nopermission'} = 1; |
1090 |
C4::Context->_unset_userenv($sessionID); |
1091 |
C4::Context::_unset_userenv($sessionID); |
1091 |
} |
1092 |
} |
1092 |
my ( $borrowernumber, $firstname, $surname, $userflags, |
1093 |
my ( $borrowernumber, $firstname, $surname, $userflags, |
1093 |
$branchcode, $branchname, $emailaddress, $desk_id, |
1094 |
$branchcode, $branchname, $emailaddress, $desk_id, |
Lines 1205-1211
sub checkauth {
Link Here
|
1205 |
else { |
1206 |
else { |
1206 |
if ($userid) { |
1207 |
if ($userid) { |
1207 |
$info{'invalid_username_or_password'} = 1; |
1208 |
$info{'invalid_username_or_password'} = 1; |
1208 |
C4::Context->_unset_userenv($sessionID); |
1209 |
C4::Context::_unset_userenv($sessionID); |
1209 |
} |
1210 |
} |
1210 |
$session->param( 'lasttime', time() ); |
1211 |
$session->param( 'lasttime', time() ); |
1211 |
$session->param( 'ip', $session->remote_addr() ); |
1212 |
$session->param( 'ip', $session->remote_addr() ); |
Lines 1663-1719
sub check_cookie_auth {
Link Here
|
1663 |
# however, if a userid parameter is present (i.e., from |
1664 |
# however, if a userid parameter is present (i.e., from |
1664 |
# a form submission, assume that any current cookie |
1665 |
# a form submission, assume that any current cookie |
1665 |
# is to be ignored |
1666 |
# is to be ignored |
1666 |
unless ( defined $sessionID and $sessionID ) { |
1667 |
unless ( $sessionID ) { |
1667 |
return ( "failed", undef ); |
1668 |
return ( "failed", undef ); |
1668 |
} |
1669 |
} |
|
|
1670 |
C4::Context::_unset_userenv($sessionID); # remove old userenv first |
1669 |
my $session = get_session($sessionID); |
1671 |
my $session = get_session($sessionID); |
1670 |
C4::Context->_new_userenv($sessionID); |
|
|
1671 |
if ($session) { |
1672 |
if ($session) { |
1672 |
C4::Context->interface($session->param('interface')); |
|
|
1673 |
C4::Context->set_userenv( |
1674 |
$session->param('number'), $session->param('id') // '', |
1675 |
$session->param('cardnumber'), $session->param('firstname'), |
1676 |
$session->param('surname'), $session->param('branch'), |
1677 |
$session->param('branchname'), $session->param('flags'), |
1678 |
$session->param('emailaddress'), $session->param('shibboleth'), |
1679 |
$session->param('desk_id'), $session->param('desk_name'), |
1680 |
$session->param('register_id'), $session->param('register_name') |
1681 |
); |
1682 |
|
1683 |
my $userid = $session->param('id'); |
1673 |
my $userid = $session->param('id'); |
1684 |
my $ip = $session->param('ip'); |
1674 |
my $ip = $session->param('ip'); |
1685 |
my $lasttime = $session->param('lasttime'); |
1675 |
my $lasttime = $session->param('lasttime'); |
1686 |
my $timeout = _timeout_syspref(); |
1676 |
my $timeout = _timeout_syspref(); |
1687 |
|
1677 |
|
1688 |
if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { |
1678 |
if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { |
1689 |
|
|
|
1690 |
# time out |
1679 |
# time out |
1691 |
$session->delete(); |
1680 |
$session->delete(); |
1692 |
$session->flush; |
1681 |
$session->flush; |
1693 |
C4::Context->_unset_userenv($sessionID); |
|
|
1694 |
return ("expired", undef); |
1682 |
return ("expired", undef); |
1695 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { |
|
|
1696 |
|
1683 |
|
|
|
1684 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { |
1697 |
# IP address changed |
1685 |
# IP address changed |
1698 |
$session->delete(); |
1686 |
$session->delete(); |
1699 |
$session->flush; |
1687 |
$session->flush; |
1700 |
C4::Context->_unset_userenv($sessionID); |
|
|
1701 |
return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); |
1688 |
return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); |
|
|
1689 |
|
1702 |
} elsif ( $userid ) { |
1690 |
} elsif ( $userid ) { |
1703 |
$session->param( 'lasttime', time() ); |
1691 |
$session->param( 'lasttime', time() ); |
1704 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1692 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1705 |
if ($flags) { |
1693 |
if ($flags) { |
|
|
1694 |
C4::Context->_new_userenv($sessionID); |
1695 |
C4::Context->interface($session->param('interface')); |
1696 |
C4::Context->set_userenv( |
1697 |
$session->param('number'), $session->param('id') // '', |
1698 |
$session->param('cardnumber'), $session->param('firstname'), |
1699 |
$session->param('surname'), $session->param('branch'), |
1700 |
$session->param('branchname'), $session->param('flags'), |
1701 |
$session->param('emailaddress'), $session->param('shibboleth'), |
1702 |
$session->param('desk_id'), $session->param('desk_name'), |
1703 |
$session->param('register_id'), $session->param('register_name') |
1704 |
); |
1706 |
return ( "ok", $session ); |
1705 |
return ( "ok", $session ); |
|
|
1706 |
} else { |
1707 |
$session->delete(); |
1708 |
$session->flush; |
1709 |
return ( "failed", undef ); |
1707 |
} |
1710 |
} |
|
|
1711 |
|
1708 |
} else { |
1712 |
} else { |
|
|
1713 |
C4::Context->_new_userenv($sessionID); |
1714 |
C4::Context->interface($session->param('interface')); |
1715 |
C4::Context->set_userenv( undef, q{} ); |
1709 |
return ( "anon", $session ); |
1716 |
return ( "anon", $session ); |
1710 |
} |
1717 |
} |
1711 |
# If here user was logged in, but doesn't have correct permissions |
|
|
1712 |
# could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors |
1713 |
$session->delete(); |
1714 |
$session->flush; |
1715 |
C4::Context->_unset_userenv($sessionID); |
1716 |
return ( "failed", undef ); |
1717 |
} else { |
1718 |
} else { |
1718 |
return ( "expired", undef ); |
1719 |
return ( "expired", undef ); |
1719 |
} |
1720 |
} |
Lines 1759-1767
sub _get_session_params {
Link Here
|
1759 |
sub get_session { |
1760 |
sub get_session { |
1760 |
my $sessionID = shift; |
1761 |
my $sessionID = shift; |
1761 |
my $params = _get_session_params(); |
1762 |
my $params = _get_session_params(); |
1762 |
my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); |
1763 |
my $session; |
1763 |
if ( ! $session ){ |
1764 |
if( $sessionID ) { # find existing |
1764 |
die CGI::Session->errstr(); |
1765 |
CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463 |
|
|
1766 |
$session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} ); |
1767 |
} else { |
1768 |
$session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); |
1769 |
# $session->flush; |
1765 |
} |
1770 |
} |
1766 |
return $session; |
1771 |
return $session; |
1767 |
} |
1772 |
} |
1768 |
- |
|
|