View | Details | Raw Unified | Return to bug 36304
Collapse All | Expand All

(-)a/Koha/Middleware/RealIP.pm (-11 / +50 lines)
Lines 79-85 sub get_real_ip { Link Here
79
    my @forwarded_for = $header =~ /([^,\s]+)/g;
79
    my @forwarded_for = $header =~ /([^,\s]+)/g;
80
    return $remote_addr unless @forwarded_for;
80
    return $remote_addr unless @forwarded_for;
81
81
82
    my $trusted_proxies = get_trusted_proxies();
82
    my $trusted_proxies; 
83
    # Cache the trusted proxies list
84
    my $cache = Koha::Caches->get_instance();
85
    my $cache_active = $cache->is_cache_active;
86
    my $cache_key = "trustedproxylist";
87
    if ($cache_active) {
88
        $trusted_proxies = $cache->get_from_cache($cache_key);
89
    }
90
    unless ($trusted_proxies) {
91
        $trusted_proxies = get_trusted_proxies();        
92
        if ($cache_active) {
93
            $cache->set_in_cache( $cache_key, $trusted_proxies);
94
        }
95
    }
83
96
84
    #X-Forwarded-For: <client>, <proxy1>, <proxy2>
97
    #X-Forwarded-For: <client>, <proxy1>, <proxy2>
85
    my $real_ip = shift @forwarded_for;
98
    my $real_ip = shift @forwarded_for;
Lines 105-122 the trusted proxies given to Koha. Link Here
105
118
106
sub get_trusted_proxies {
119
sub get_trusted_proxies {
107
    my $proxies_conf = C4::Context->config('koha_trusted_proxies');
120
    my $proxies_conf = C4::Context->config('koha_trusted_proxies');
108
    return unless $proxies_conf;
121
    my $external_proxies_list_file = C4::Context->config('koha_trusted_proxies_external_list');
109
    my @trusted_proxies_ip = split( / /, $proxies_conf );
122
123
    return unless ( $external_proxies_list_file || $proxies_conf );
124
    
110
    my @trusted_proxies = ();
125
    my @trusted_proxies = ();
111
    foreach my $ip (@trusted_proxies_ip){
126
112
        my $mask = Net::Netmask->new2($ip);
127
    if ($external_proxies_list_file && (-f $external_proxies_list_file)) {
113
        if ($mask){
128
        if (open my $in, "<", $external_proxies_list_file) {
114
            push(@trusted_proxies,$mask);
129
            while (my $line = <$in>) {
115
        }
130
                chomp $line;
116
        else {
131
                my $finalmask = Net::Netmask->new2($line);
117
            warn "$Net::Netmask::error";
132
                if ($finalmask) {
118
        }
133
                    push(@trusted_proxies, $finalmask);
134
                }
135
                else {
136
                    warn "$Net::Netmask::error";
137
                }
138
            }
139
            close $in;
140
        } else {
141
            warn "Could not read external proxy list $external_proxies_list_file"
142
        } 
119
    }
143
    }
144
145
    if ($proxies_conf) {
146
        my @trusted_proxies_ip = split( / /, $proxies_conf );
147
        foreach my $ip (@trusted_proxies_ip){
148
            my $mask = Net::Netmask->new2($ip);
149
            if ($mask){
150
                push(@trusted_proxies,$mask);
151
            }
152
            else {
153
                warn "$Net::Netmask::error";
154
            }
155
        }
156
    } 
157
120
    return \@trusted_proxies;
158
    return \@trusted_proxies;
121
}
159
}
122
160
Lines 124-129 sub get_trusted_proxies { Link Here
124
=head1 AUTHORS
162
=head1 AUTHORS
125
163
126
Kyle M Hall <kyle@bywatersolutions.com>
164
Kyle M Hall <kyle@bywatersolutions.com>
165
Nicholas van Oudtshoorn, 2024 <nicholas@pbc.wa.edu.au>
127
166
128
=cut
167
=cut
129
168
(-)a/etc/koha-conf.xml (+4 lines)
Lines 158-165 Link Here
158
 <plack_workers>2</plack_workers>
158
 <plack_workers>2</plack_workers>
159
159
160
 <!-- Configuration for X-Forwarded-For -->
160
 <!-- Configuration for X-Forwarded-For -->
161
 <!-- The external list allows for a cronjob to automatically update proxy lists for things like CloudFlare -->
162
 <!-- The sample cronjob update_external_trusted_proxies_list.sh is available. It should be edited to point to the file referenced below.
163
      It should be set to run as a user with permission to update this file. -->
161
 <!--
164
 <!--
162
 <koha_trusted_proxies>1.2.3.4 2.3.4.5 3.4.5.6</koha_trusted_proxies>
165
 <koha_trusted_proxies>1.2.3.4 2.3.4.5 3.4.5.6</koha_trusted_proxies>
166
 <koha_trusted_proxies_external_list>__KOHA_CONF_DIR__/trusted_proxies<koha_trusted_proxies_external_list>
163
 -->
167
 -->
164
168
165
 <!-- Elasticsearch Configuration -->
169
 <!-- Elasticsearch Configuration -->
(-)a/misc/cronjobs/update_external_trusted_proxies_list.sh (-1 / +48 lines)
Line 0 Link Here
0
- 
1
#!/bin/bash
2
#-----------------------------------
3
# Copyright 2024 Nicholas van Oudtshoorn
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
# This cron job should be run as a user that has write access to the IP_LIST_FILE
21
# The IP_LIST_FILE should be the same as that referenced in the koha-conf.xml file.
22
RESTART_KOHA_IF_NEEDED=1
23
24
IP_LIST_FILE=__KOHA_CONF_DIR__/trusted_proxies
25
echo "Updating external proxy list: $IP_LIST_FILE"
26
CURRENT_LIST=$(cat $IP_LIST_FILE)
27
echo $OLD_LIST
28
29
echo "Downloading cloudflare proxy list";
30
curl -sS "https://www.cloudflare.com/ips-v4" > $IP_LIST_FILE
31
echo >> $IP_LIST_FILE # Make sure there is a new-line at the end of the ip-v4 list
32
curl -sS "https://www.cloudflare.com/ips-v6" >> $IP_LIST_FILE
33
34
NEW_LIST=$(cat $IP_LIST_FILE)
35
echo
36
echo "List contents:"
37
echo -n "$NEW_LIST"
38
echo
39
40
if [ "$OLD_LIST" != "$NEW_LIST" ]; then
41
    echo "List contents have changed. Koha needs to be restarted."
42
    if [ $RESTART_KOHA_IF_NEEDED -eq 1 ]; then
43
        echo "Restarting koha-common, if it is already running."
44
        systemctl is-active --quiet koha-common && systemctl restart koha-common && echo "The service is now:" `systemctl is-active koha-common`
45
        echo "Clearing caches"
46
        koha-foreach /usr/share/koha/bin/clear_cache.pl
47
    fi
48
fi

Return to bug 36304