Attachment #163515 for bug #36304

View | Details | Raw Unified | Return to bug 36304
Collapse All | Expand All




=cut

sub get_trusted_proxies {
    my $trustcloudflare = C4::Context->preference('TrustCloudFlare');
    my $proxies_conf = C4::Context->config('koha_trusted_proxies');
    return unless (($trustcloudflare eq '1') || $proxies_conf);

    my @trusted_proxies = ();
    
    if ($trustcloudflare eq '1') {
        # Get the list of CloudFlare proxies from their api, and add them to the trusted_proxies
        my $ua       = LWP::UserAgent->new();
        my $response = $ua->get('https://api.cloudflare.com/client/v4/ips');
        if ( $response->is_success ) {
            my $json = decode_json( $response->decoded_content );
            if (exists( $json->{'result'})) {
                if (exists( $json->{'result'}->{'ipv4_cidrs'} ) ) {
                    my $masks = $json->{'result'}->{'ipv4_cidrs'};
                    for my $item( @{$masks} ) {
                        my $finalmask = Net::Netmask->new2($item);
                        if ($finalmask) {
                            push(@trusted_proxies, $finalmask);
                        }
                        else {
                            warn "$Net::Netmask::error";
                        }
                    }
                }
                if (exists( $json->{'result'}->{'ipv6_cidrs'} ) ) {
                    my $masks = $json->{'result'}->{'ipv6_cidrs'};
                    for my $item( @{$masks} ) {
                        my $finalmask = Net::Netmask->new2($item);
                        if ($finalmask) {
                            push(@trusted_proxies, $finalmask);
                        }
                        else {
                            warn "$Net::Netmask::error";
                        }
                    }
                }
            }
        } 
        else {
            warn "Could not get CloudFlare ip list";
        }
    }

    my @trusted_proxies_ip = split( / /, $proxies_conf );
    foreach my $ip (@trusted_proxies_ip){
        my $mask = Net::Netmask->new2($ip);
        if ($mask){




use Modern::Perl;

return {
    bug_number  => "36304",
    description => "A single line description",
    up          => sub {
        my ($args) = @_;
        my ( $dbh, $out ) = @$args{qw(dbh out)};

        # Do you stuffs here
        $dbh->do(
            q{ INSERT IGNORE INTO systempreferences (variable,value,options,explanation,type) VALUES ('TrustCloudFlare', '0', NULL, 'If enabled, cloudflare is considered a trusted proxy, and CF_CONNECTING_IP is used to determine the real IP.', 'YesNo') }
            );

        say $out "Added new system preference 'TrustCloudFlare'";
        
    },
};

Lines 780-785 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here

(-)a/installer/data/mysql/mandatory/sysprefs.sql (+1 lines)
780	('TransferWhenCancelAllWaitingHolds','0',NULL,'Transfer items when cancelling all waiting holds','YesNo'),	780	('TransferWhenCancelAllWaitingHolds','0',NULL,'Transfer items when cancelling all waiting holds','YesNo'),
781	('TranslateNotices','0',NULL, 'Allow notices to be translated','YesNo'),	781	('TranslateNotices','0',NULL, 'Allow notices to be translated','YesNo'),
782	('TrapHoldsOnOrder','1',NULL,'If enabled, Koha will trap holds for on order items ( notforloan < 0 )','YesNo'),	782	('TrapHoldsOnOrder','1',NULL,'If enabled, Koha will trap holds for on order items ( notforloan < 0 )','YesNo'),
		783	('TrustCloudFlare', '0', NULL, 'If enabled, cloudflare is considered a trusted proxy, and CF_CONNECTING_IP is used to determine the real IP.', 'YesNo'),
783	('TwoFactorAuthentication', 'disabled', 'enforced\|enabled\|disabled', 'Enables two-factor authentication', 'Choice'),	784	('TwoFactorAuthentication', 'disabled', 'enforced\|enabled\|disabled', 'Enables two-factor authentication', 'Choice'),
784	('UNIMARCAuthorityField100','afrey50 ba0',NULL,'Define the contents of UNIMARC authority control field 100 position 08-35','Textarea'),	785	('UNIMARCAuthorityField100','afrey50 ba0',NULL,'Define the contents of UNIMARC authority control field 100 position 08-35','Textarea'),
785	('UNIMARCAuthorsFacetsSeparator',', ',NULL,'UNIMARC authors facets separator','short'),	786	('UNIMARCAuthorsFacetsSeparator',', ',NULL,'UNIMARC authors facets separator','short'),

Lines 5-10 Web services: Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/web_services.pref (-1 / +6 lines)
5	- pref: 'AccessControlAllowOrigin'	5	- pref: 'AccessControlAllowOrigin'
6	class: Text	6	class: Text
7	- "."	7	- "."
		8	-
		9	- pref: 'TrustCloudFlare'
		10	choices:
		11	1: "Enable"
		12	0: "Disable"
		13	- "cloudflare as a trusted proxy."
8	REST API:	14	REST API:
9	-	15	-
10	- pref: RESTBasicAuth	16	- pref: RESTBasicAuth
11	-

Return to bug 36304

Lines 104-113 the trusted proxies given to Koha. Link Here

(-)a/Koha/Middleware/RealIP.pm (-2 / +43 lines)
104	=cut	104	=cut
105		105
106	sub get_trusted_proxies {	106	sub get_trusted_proxies {
		107	my $trustcloudflare = C4::Context->preference('TrustCloudFlare');
107	my $proxies_conf = C4::Context->config('koha_trusted_proxies');	108	my $proxies_conf = C4::Context->config('koha_trusted_proxies');
108	return unless $proxies_conf;	109	return unless (($trustcloudflare eq '1') \|\| $proxies_conf);
109	my @trusted_proxies_ip = split( / /, $proxies_conf );	110
110	my @trusted_proxies = ();	111	my @trusted_proxies = ();
		112
		113	if ($trustcloudflare eq '1') {
		114	# Get the list of CloudFlare proxies from their api, and add them to the trusted_proxies
		115	my $ua = LWP::UserAgent->new();
		116	my $response = $ua->get('https://api.cloudflare.com/client/v4/ips');
		117	if ( $response->is_success ) {
		118	my $json = decode_json( $response->decoded_content );
		119	if (exists( $json->{'result'})) {
		120	if (exists( $json->{'result'}->{'ipv4_cidrs'} ) ) {
		121	my $masks = $json->{'result'}->{'ipv4_cidrs'};
		122	for my $item( @{$masks} ) {
		123	my $finalmask = Net::Netmask->new2($item);
		124	if ($finalmask) {
		125	push(@trusted_proxies, $finalmask);
		126	}
		127	else {
		128	warn "$Net::Netmask::error";
		129	}
		130	}
		131	}
		132	if (exists( $json->{'result'}->{'ipv6_cidrs'} ) ) {
		133	my $masks = $json->{'result'}->{'ipv6_cidrs'};
		134	for my $item( @{$masks} ) {
		135	my $finalmask = Net::Netmask->new2($item);
		136	if ($finalmask) {
		137	push(@trusted_proxies, $finalmask);
		138	}
		139	else {
		140	warn "$Net::Netmask::error";
		141	}
		142	}
		143	}
		144	}
		145	}
		146	else {
		147	warn "Could not get CloudFlare ip list";
		148	}
		149	}
		150
		151	my @trusted_proxies_ip = split( / /, $proxies_conf );
111	foreach my $ip (@trusted_proxies_ip){	152	foreach my $ip (@trusted_proxies_ip){
112	my $mask = Net::Netmask->new2($ip);	153	my $mask = Net::Netmask->new2($ip);
113	if ($mask){	154	if ($mask){

Line 0 Link Here

(-)a/installer/data/mysql/atomicupdate/bug_36304-add_trustcloudlfare_syspref.pl (+18 lines)
	1	use Modern::Perl;
	2
	3	return {
	4	bug_number => "36304",
	5	description => "A single line description",
	6	up => sub {
	7	my ($args) = @_;
	8	my ( $dbh, $out ) = @$args{qw(dbh out)};
	9
	10	# Do you stuffs here
	11	$dbh->do(
	12	q{ INSERT IGNORE INTO systempreferences (variable,value,options,explanation,type) VALUES ('TrustCloudFlare', '0', NULL, 'If enabled, cloudflare is considered a trusted proxy, and CF_CONNECTING_IP is used to determine the real IP.', 'YesNo') }
	13	);
	14
	15	say $out "Added new system preference 'TrustCloudFlare'";
	16
	17	},
	18	};