|
Lines 23-28
use Carp qw( croak );
Link Here
|
| 23 |
|
23 |
|
| 24 |
use Digest::MD5 qw( md5_base64 ); |
24 |
use Digest::MD5 qw( md5_base64 ); |
| 25 |
use CGI::Session; |
25 |
use CGI::Session; |
|
|
26 |
use CGI::Session::ErrorHandler; |
| 26 |
use URI; |
27 |
use URI; |
| 27 |
use URI::QueryParam; |
28 |
use URI::QueryParam; |
| 28 |
|
29 |
|
|
Lines 901-907
sub checkauth {
Link Here
|
| 901 |
$anon_search_history = $session->param('search_history'); |
902 |
$anon_search_history = $session->param('search_history'); |
| 902 |
$session->delete(); |
903 |
$session->delete(); |
| 903 |
$session->flush; |
904 |
$session->flush; |
| 904 |
C4::Context->_unset_userenv($sessionID); |
905 |
C4::Context::_unset_userenv($sessionID); |
| 905 |
} |
906 |
} |
| 906 |
elsif ($logout) { |
907 |
elsif ($logout) { |
| 907 |
|
908 |
|
|
Lines 910-916
sub checkauth {
Link Here
|
| 910 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
911 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
| 911 |
$session->delete(); |
912 |
$session->delete(); |
| 912 |
$session->flush; |
913 |
$session->flush; |
| 913 |
C4::Context->_unset_userenv($sessionID); |
914 |
C4::Context::_unset_userenv($sessionID); |
| 914 |
|
915 |
|
| 915 |
if ($cas and $caslogout) { |
916 |
if ($cas and $caslogout) { |
| 916 |
logout_cas($query, $type); |
917 |
logout_cas($query, $type); |
|
Lines 1103-1109
sub checkauth {
Link Here
|
| 1103 |
} |
1104 |
} |
| 1104 |
else { |
1105 |
else { |
| 1105 |
$info{'nopermission'} = 1; |
1106 |
$info{'nopermission'} = 1; |
| 1106 |
C4::Context->_unset_userenv($sessionID); |
1107 |
C4::Context::_unset_userenv($sessionID); |
| 1107 |
} |
1108 |
} |
| 1108 |
my ( $borrowernumber, $firstname, $surname, $userflags, |
1109 |
my ( $borrowernumber, $firstname, $surname, $userflags, |
| 1109 |
$branchcode, $branchname, $emailaddress, $desk_id, |
1110 |
$branchcode, $branchname, $emailaddress, $desk_id, |
|
Lines 1228-1234
sub checkauth {
Link Here
|
| 1228 |
else { |
1229 |
else { |
| 1229 |
if ($userid) { |
1230 |
if ($userid) { |
| 1230 |
$info{'invalid_username_or_password'} = 1; |
1231 |
$info{'invalid_username_or_password'} = 1; |
| 1231 |
C4::Context->_unset_userenv($sessionID); |
1232 |
C4::Context::_unset_userenv($sessionID); |
| 1232 |
} |
1233 |
} |
| 1233 |
$session->param( 'lasttime', time() ); |
1234 |
$session->param( 'lasttime', time() ); |
| 1234 |
$session->param( 'ip', $session->remote_addr() ); |
1235 |
$session->param( 'ip', $session->remote_addr() ); |
|
Lines 1686-1742
sub check_cookie_auth {
Link Here
|
| 1686 |
# however, if a userid parameter is present (i.e., from |
1687 |
# however, if a userid parameter is present (i.e., from |
| 1687 |
# a form submission, assume that any current cookie |
1688 |
# a form submission, assume that any current cookie |
| 1688 |
# is to be ignored |
1689 |
# is to be ignored |
| 1689 |
unless ( defined $sessionID and $sessionID ) { |
1690 |
unless ( $sessionID ) { |
| 1690 |
return ( "failed", undef ); |
1691 |
return ( "failed", undef ); |
| 1691 |
} |
1692 |
} |
|
|
1693 |
C4::Context::_unset_userenv($sessionID); # remove old userenv first |
| 1692 |
my $session = get_session($sessionID); |
1694 |
my $session = get_session($sessionID); |
| 1693 |
C4::Context->_new_userenv($sessionID); |
|
|
| 1694 |
if ($session) { |
1695 |
if ($session) { |
| 1695 |
C4::Context->interface($session->param('interface')); |
|
|
| 1696 |
C4::Context->set_userenv( |
| 1697 |
$session->param('number'), $session->param('id') // '', |
| 1698 |
$session->param('cardnumber'), $session->param('firstname'), |
| 1699 |
$session->param('surname'), $session->param('branch'), |
| 1700 |
$session->param('branchname'), $session->param('flags'), |
| 1701 |
$session->param('emailaddress'), $session->param('shibboleth'), |
| 1702 |
$session->param('desk_id'), $session->param('desk_name'), |
| 1703 |
$session->param('register_id'), $session->param('register_name') |
| 1704 |
); |
| 1705 |
|
| 1706 |
my $userid = $session->param('id'); |
1696 |
my $userid = $session->param('id'); |
| 1707 |
my $ip = $session->param('ip'); |
1697 |
my $ip = $session->param('ip'); |
| 1708 |
my $lasttime = $session->param('lasttime'); |
1698 |
my $lasttime = $session->param('lasttime'); |
| 1709 |
my $timeout = _timeout_syspref(); |
1699 |
my $timeout = _timeout_syspref(); |
| 1710 |
|
1700 |
|
| 1711 |
if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { |
1701 |
if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { |
| 1712 |
|
|
|
| 1713 |
# time out |
1702 |
# time out |
| 1714 |
$session->delete(); |
1703 |
$session->delete(); |
| 1715 |
$session->flush; |
1704 |
$session->flush; |
| 1716 |
C4::Context->_unset_userenv($sessionID); |
|
|
| 1717 |
return ("expired", undef); |
1705 |
return ("expired", undef); |
| 1718 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { |
|
|
| 1719 |
|
1706 |
|
|
|
1707 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { |
| 1720 |
# IP address changed |
1708 |
# IP address changed |
| 1721 |
$session->delete(); |
1709 |
$session->delete(); |
| 1722 |
$session->flush; |
1710 |
$session->flush; |
| 1723 |
C4::Context->_unset_userenv($sessionID); |
|
|
| 1724 |
return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); |
1711 |
return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); |
|
|
1712 |
|
| 1725 |
} elsif ( $userid ) { |
1713 |
} elsif ( $userid ) { |
| 1726 |
$session->param( 'lasttime', time() ); |
1714 |
$session->param( 'lasttime', time() ); |
| 1727 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1715 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
| 1728 |
if ($flags) { |
1716 |
if ($flags) { |
|
|
1717 |
C4::Context->_new_userenv($sessionID); |
| 1718 |
C4::Context->interface($session->param('interface')); |
| 1719 |
C4::Context->set_userenv( |
| 1720 |
$session->param('number'), $session->param('id') // '', |
| 1721 |
$session->param('cardnumber'), $session->param('firstname'), |
| 1722 |
$session->param('surname'), $session->param('branch'), |
| 1723 |
$session->param('branchname'), $session->param('flags'), |
| 1724 |
$session->param('emailaddress'), $session->param('shibboleth'), |
| 1725 |
$session->param('desk_id'), $session->param('desk_name'), |
| 1726 |
$session->param('register_id'), $session->param('register_name') |
| 1727 |
); |
| 1729 |
return ( "ok", $session ); |
1728 |
return ( "ok", $session ); |
|
|
1729 |
} else { |
| 1730 |
$session->delete(); |
| 1731 |
$session->flush; |
| 1732 |
return ( "failed", undef ); |
| 1730 |
} |
1733 |
} |
|
|
1734 |
|
| 1731 |
} else { |
1735 |
} else { |
|
|
1736 |
C4::Context->_new_userenv($sessionID); |
| 1737 |
C4::Context->interface($session->param('interface')); |
| 1738 |
C4::Context->set_userenv( undef, q{} ); |
| 1732 |
return ( "anon", $session ); |
1739 |
return ( "anon", $session ); |
| 1733 |
} |
1740 |
} |
| 1734 |
# If here user was logged in, but doesn't have correct permissions |
|
|
| 1735 |
# could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors |
| 1736 |
$session->delete(); |
| 1737 |
$session->flush; |
| 1738 |
C4::Context->_unset_userenv($sessionID); |
| 1739 |
return ( "failed", undef ); |
| 1740 |
} else { |
1741 |
} else { |
| 1741 |
return ( "expired", undef ); |
1742 |
return ( "expired", undef ); |
| 1742 |
} |
1743 |
} |
|
Lines 1782-1790
sub _get_session_params {
Link Here
|
| 1782 |
sub get_session { |
1783 |
sub get_session { |
| 1783 |
my $sessionID = shift; |
1784 |
my $sessionID = shift; |
| 1784 |
my $params = _get_session_params(); |
1785 |
my $params = _get_session_params(); |
| 1785 |
my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); |
1786 |
my $session; |
| 1786 |
if ( ! $session ){ |
1787 |
if( $sessionID ) { # find existing |
| 1787 |
die CGI::Session->errstr(); |
1788 |
CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463 |
|
|
1789 |
$session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} ); |
| 1790 |
} else { |
| 1791 |
$session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} ); |
| 1792 |
# $session->flush; |
| 1788 |
} |
1793 |
} |
| 1789 |
return $session; |
1794 |
return $session; |
| 1790 |
} |
1795 |
} |
| 1791 |
- |
|
|