View | Details | Raw Unified | Return to bug 26176
Collapse All | Expand All

(-)a/C4/Auth.pm (-6 / +6 lines)
Lines 498-504 sub get_template_and_user { Link Here
498
            advancedMARCEditor           => C4::Context->preference("advancedMARCEditor"),
498
            advancedMARCEditor           => C4::Context->preference("advancedMARCEditor"),
499
            AllowMultipleCovers          => C4::Context->preference('AllowMultipleCovers'),
499
            AllowMultipleCovers          => C4::Context->preference('AllowMultipleCovers'),
500
            AmazonCoverImages            => C4::Context->preference("AmazonCoverImages"),
500
            AmazonCoverImages            => C4::Context->preference("AmazonCoverImages"),
501
            StaffLoginRestrictBranchByIP => C4::Context->preference("StaffLoginRestrictBranchByIP"),
501
            StaffLoginRestrictLibraryByIP => C4::Context->preference("StaffLoginRestrictLibraryByIP"),
502
            can_see_cataloguing_module   => haspermission( $user, get_cataloguing_page_permissions() ) ? 1 : 0,
502
            can_see_cataloguing_module   => haspermission( $user, get_cataloguing_page_permissions() ) ? 1 : 0,
503
            canreservefromotherbranches  => C4::Context->preference('canreservefromotherbranches'),
503
            canreservefromotherbranches  => C4::Context->preference('canreservefromotherbranches'),
504
            EasyAnalyticalRecords        => C4::Context->preference('EasyAnalyticalRecords'),
504
            EasyAnalyticalRecords        => C4::Context->preference('EasyAnalyticalRecords'),
Lines 1216-1222 sub checkauth { Link Here
1216
                    }
1216
                    }
1217
                    if ( $type ne 'opac' ) {
1217
                    if ( $type ne 'opac' ) {
1218
                        my $branches = { map { $_->branchcode => $_->unblessed } Koha::Libraries->search->as_list };
1218
                        my $branches = { map { $_->branchcode => $_->unblessed } Koha::Libraries->search->as_list };
1219
                        if ( C4::Context->preference('StaffLoginRestrictBranchByIP') ) {
1219
                        if ( C4::Context->preference('StaffLoginRestrictLibraryByIP') ) {
1220
                            # we have to check they are coming from the right ip range
1220
                            # we have to check they are coming from the right ip range
1221
                            my $domain = $branches->{$branchcode}->{'branchip'};
1221
                            my $domain = $branches->{$branchcode}->{'branchip'};
1222
                            $domain =~ s|\.\*||g;
1222
                            $domain =~ s|\.\*||g;
Lines 1238-1249 sub checkauth { Link Here
1238
                            # If StaffLoginBranchBasedOnIP is enabled we will try to find a branch
1238
                            # If StaffLoginBranchBasedOnIP is enabled we will try to find a branch
1239
                            # matching your ip, regardless of the choice you have passed in
1239
                            # matching your ip, regardless of the choice you have passed in
1240
                            (
1240
                            (
1241
                                  !C4::Context->preference('StaffLoginRestrictBranchByIP')
1241
                                  !C4::Context->preference('StaffLoginRestrictLibraryByIP')
1242
                                && C4::Context->preference('StaffLoginBranchBasedOnIP')
1242
                                && C4::Context->preference('StaffLoginBranchBasedOnIP')
1243
                            )
1243
                            )
1244
                            # When StaffLoginRestrictBranchByIP is enabled we will not choose a branch matching IP
1244
                            # When StaffLoginRestrictLibraryByIP is enabled we will not choose a branch matching IP
1245
                            # if your selected branch has no IP set
1245
                            # if your selected branch has no IP set
1246
                            || (   C4::Context->preference('StaffLoginRestrictBranchByIP')
1246
                            || (   C4::Context->preference('StaffLoginRestrictLibraryByIP')
1247
                                && $auth_state ne 'failed'
1247
                                && $auth_state ne 'failed'
1248
                                && $branches->{$branchcode}->{'branchip'} )
1248
                                && $branches->{$branchcode}->{'branchip'} )
1249
                            )
1249
                            )
Lines 1444-1450 sub checkauth { Link Here
1444
        IntranetUserCSS                       => C4::Context->preference("IntranetUserCSS"),
1444
        IntranetUserCSS                       => C4::Context->preference("IntranetUserCSS"),
1445
        IntranetUserJS                        => C4::Context->preference("IntranetUserJS"),
1445
        IntranetUserJS                        => C4::Context->preference("IntranetUserJS"),
1446
        IndependentBranches                   => C4::Context->preference("IndependentBranches"),
1446
        IndependentBranches                   => C4::Context->preference("IndependentBranches"),
1447
        StaffLoginRestrictBranchByIP          => C4::Context->preference("StaffLoginRestrictBranchByIP"),
1447
        StaffLoginRestrictLibraryByIP         => C4::Context->preference("StaffLoginRestrictLibraryByIP"),
1448
        wrongip                               => $info{'wrongip'},
1448
        wrongip                               => $info{'wrongip'},
1449
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1449
        PatronSelfRegistration                => C4::Context->preference("PatronSelfRegistration"),
1450
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1450
        PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
(-)a/C4/UsageStats.pm (-1 / +1 lines)
Lines 146-152 sub _shared_preferences { Link Here
146
        noItemTypeImages
146
        noItemTypeImages
147
        OpacNoItemTypeImages
147
        OpacNoItemTypeImages
148
        virtualshelves
148
        virtualshelves
149
        StaffLoginRestrictBranchByIP
149
        StaffLoginRestrictLibraryByIP
150
        IndependentBranches
150
        IndependentBranches
151
        SessionStorage
151
        SessionStorage
152
        Persona
152
        Persona
(-)a/installer/data/mysql/atomicupdate/bug_26176.pl (-5 / +7 lines)
Lines 3-18 use Koha::Installer::Output qw(say_warning say_failure say_success say_info); Link Here
3
3
4
return {
4
return {
5
    bug_number  => "26176",
5
    bug_number  => "26176",
6
    description => "Rename AutoLocation to StaffLoginRestrictBranchByIP",
6
    description => "Rename AutoLocation to StaffLoginRestrictLibraryByIP",
7
    up          => sub {
7
    up          => sub {
8
        my ($args) = @_;
8
        my ($args) = @_;
9
        my ( $dbh, $out ) = @$args{qw(dbh out)};
9
        my ( $dbh, $out ) = @$args{qw(dbh out)};
10
10
11
        $dbh->do(q{
11
        $dbh->do(
12
            UPDATE systempreferences SET variable = "StaffLoginRestrictBranchByIP"
12
            q{
13
            UPDATE systempreferences SET variable = "StaffLoginRestrictLibraryByIP"
13
            WHERE variable = "AutoLocation"
14
            WHERE variable = "AutoLocation"
14
        });
15
        }
16
        );
15
17
16
        say $out "Renamed system preference 'AutoLocation' to 'StaffLoginRestrictBranchByIP'";
18
        say $out "Renamed system preference 'AutoLocation' to 'StaffLoginRestrictLibraryByIP'";
17
    },
19
    },
18
};
20
};
(-)a/installer/data/mysql/mandatory/sysprefs.sql (-1 / +1 lines)
Lines 737-743 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here
737
('StaffLangSelectorMode','footer','top|both|footer','Select the location to display the language selector in staff interface','Choice'),
737
('StaffLangSelectorMode','footer','top|both|footer','Select the location to display the language selector in staff interface','Choice'),
738
('StaffLoginBranchBasedOnIP', '0','', 'Set the logged in library for the user based on their current IP','YesNo'),
738
('StaffLoginBranchBasedOnIP', '0','', 'Set the logged in library for the user based on their current IP','YesNo'),
739
('StaffLoginInstructions', '', NULL, 'HTML to go into the login box for the staff interface','Free'),
739
('StaffLoginInstructions', '', NULL, 'HTML to go into the login box for the staff interface','Free'),
740
('StaffLoginRestrictBranchByIP','0',NULL,'If ON, IP authentication is enabled, blocking access to the staff interface from unauthorized IP addresses based on branch','YesNo'),
740
('StaffLoginRestrictLibraryByIP','0',NULL,'If ON, IP authentication is enabled, blocking access to the staff interface from unauthorized IP addresses based on branch','YesNo'),
741
('StaffSearchResultsDisplayBranch','holdingbranch','holdingbranch|homebranch','Controls the display of the home or holding branch for staff search results','Choice'),
741
('StaffSearchResultsDisplayBranch','holdingbranch','holdingbranch|homebranch','Controls the display of the home or holding branch for staff search results','Choice'),
742
('StaffSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the staff interface','Integer'),
742
('StaffSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the staff interface','Integer'),
743
('staffShibOnly','0','','If ON enables shibboleth only authentication for the staff client','YesNo'),
743
('staffShibOnly','0','','If ON enables shibboleth only authentication for the staff client','YesNo'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc (-2 / +2 lines)
Lines 95-101 Link Here
95
                        [% SET is_superlibrarian = CAN_user_superlibrarian ? 'is_superlibrarian' : '' %]
95
                        [% SET is_superlibrarian = CAN_user_superlibrarian ? 'is_superlibrarian' : '' %]
96
                        <span class="loggedinusername [% is_superlibrarian | html %]">[% logged_in_user.userid | html %]</span>
96
                        <span class="loggedinusername [% is_superlibrarian | html %]">[% logged_in_user.userid | html %]</span>
97
                        <span class="loggedincategorycode content_hidden">[% logged_in_user.categorycode | html %]</span>
97
                        <span class="loggedincategorycode content_hidden">[% logged_in_user.categorycode | html %]</span>
98
                        [% IF ( StaffLoginRestrictBranchByIP ) %]
98
                        [% IF ( StaffLoginRestrictLibraryByIP ) %]
99
                            <brand>
99
                            <brand>
100
                                [% Branches.GetLoggedInBranchname | html %]
100
                                [% Branches.GetLoggedInBranchname | html %]
101
                            </brand>
101
                            </brand>
Lines 133-139 Link Here
133
                        <span class="loggedinusername">[% logged_in_user.userid | html %]</span>
133
                        <span class="loggedinusername">[% logged_in_user.userid | html %]</span>
134
                    </li>
134
                    </li>
135
                    <li class="loggedin-menu-label">
135
                    <li class="loggedin-menu-label">
136
                        [% IF ( StaffLoginRestrictBranchByIP ) %]
136
                        [% IF ( StaffLoginRestrictLibraryByIP ) %]
137
                            <brand>
137
                            <brand>
138
                                [% Branches.GetLoggedInBranchname | html %]
138
                                [% Branches.GetLoggedInBranchname | html %]
139
                            </brand>
139
                            </brand>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref (-2 / +2 lines)
Lines 92-98 Administration: Link Here
92
            - Adding d will specify it in days, e.g. 1d is timeout of one day.
92
            - Adding d will specify it in days, e.g. 1d is timeout of one day.
93
        -
93
        -
94
            - "Limit the libraries staff can select at login to those where their computer's IP address is within the library's specified range or to libraries without an IP restriction: "
94
            - "Limit the libraries staff can select at login to those where their computer's IP address is within the library's specified range or to libraries without an IP restriction: "
95
            - pref: StaffLoginRestrictBranchByIP
95
            - pref: StaffLoginRestrictLibraryByIP
96
              default: 0
96
              default: 0
97
              choices:
97
              choices:
98
                  1: "Yes"
98
                  1: "Yes"
Lines 115-121 Administration: Link Here
115
                  1: "Yes"
115
                  1: "Yes"
116
                  0: "No"
116
                  0: "No"
117
            - "Note: If IPs overlap, the first found match will be used."
117
            - "Note: If IPs overlap, the first found match will be used."
118
            - 'This setting will be overridden by <a href="/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=StaffLoginRestrictBranchByIP">StaffLoginRestrictBranchByIP</a> system preference. In the event of multiple branches with matching IPs, branchcode (alphabetically) will be the tie breaker.'
118
            - 'This setting will be overridden by <a href="/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=StaffLoginRestrictLibraryByIP">StaffLoginRestrictLibraryByIP</a> system preference. In the event of multiple branches with matching IPs, branchcode (alphabetically) will be the tie breaker.'
119
        # PostgreSQL is supported by CGI::Session but not by Koha.
119
        # PostgreSQL is supported by CGI::Session but not by Koha.
120
        -
120
        -
121
            - "Storage of login session information: "
121
            - "Storage of login session information: "
(-)a/t/db_dependent/Auth.t (-13 / +12 lines)
Lines 1298-1305 subtest 'StaffLoginBranchBasedOnIP' => sub { Link Here
1298
1298
1299
    $schema->storage->txn_begin;
1299
    $schema->storage->txn_begin;
1300
1300
1301
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictBranchByIP', 0 );
1301
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictLibraryByIP', 0 );
1302
    t::lib::Mocks::mock_preference( 'StaffLoginBranchBasedOnIP',    0 );
1302
    t::lib::Mocks::mock_preference( 'StaffLoginBranchBasedOnIP',     0 );
1303
1303
1304
    my $patron   = $builder->build_object( { class => 'Koha::Patrons',   value => { flags    => 1 } } );
1304
    my $patron   = $builder->build_object( { class => 'Koha::Patrons',   value => { flags    => 1 } } );
1305
    my $branch   = $builder->build_object( { class => 'Koha::Libraries', value => { branchip => "127.0.0.1" } } );
1305
    my $branch   = $builder->build_object( { class => 'Koha::Libraries', value => { branchip => "127.0.0.1" } } );
Lines 1331-1346 subtest 'StaffLoginBranchBasedOnIP' => sub { Link Here
1331
    $session = C4::Auth::get_session($sessionID);
1331
    $session = C4::Auth::get_session($sessionID);
1332
    is( $session->param('branch'), $branch->branchcode, "Logged in branch is set based on the IP from REMOTE_ADDR " );
1332
    is( $session->param('branch'), $branch->branchcode, "Logged in branch is set based on the IP from REMOTE_ADDR " );
1333
1333
1334
    # StaffLoginRestrictBranchByIP overrides StaffLoginBranchBasedOnIP
1334
    # StaffLoginRestrictLibraryByIP overrides StaffLoginBranchBasedOnIP
1335
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictBranchByIP', 1 );
1335
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictLibraryByIP', 1 );
1336
    ( $userid, $cookie, $sessionID, $flags, $template ) =
1336
    ( $userid, $cookie, $sessionID, $flags, $template ) =
1337
        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
1337
        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
1338
    is(
1338
    is(
1339
        $template->{VARS}->{wrongip}, 1,
1339
        $template->{VARS}->{wrongip}, 1,
1340
        "StaffLoginRestrictBranchByIP prevents StaffLoginBranchBasedOnIP from logging user in to another branch"
1340
        "StaffLoginRestrictLibraryByIP prevents StaffLoginBranchBasedOnIP from logging user in to another branch"
1341
    );
1341
    );
1342
1342
1343
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictBranchByIP', 0 );
1343
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictLibraryByIP', 0 );
1344
    my $other_branch = $builder->build_object(
1344
    my $other_branch = $builder->build_object(
1345
        {
1345
        {
1346
            class => 'Koha::Libraries',
1346
            class => 'Koha::Libraries',
Lines 1357-1369 subtest 'StaffLoginBranchBasedOnIP' => sub { Link Here
1357
1357
1358
};
1358
};
1359
1359
1360
subtest 'StaffLoginRestrictBranchByIP' => sub {
1360
subtest 'StaffLoginRestrictLibraryByIP' => sub {
1361
1361
1362
    plan tests => 12;
1362
    plan tests => 12;
1363
1363
1364
    $schema->storage->txn_begin;
1364
    $schema->storage->txn_begin;
1365
1365
1366
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictBranchByIP', 0 );
1366
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictLibraryByIP', 0 );
1367
1367
1368
    my $patron   = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 1 } } );
1368
    my $patron   = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 1 } } );
1369
    my $password = 'password';
1369
    my $password = 'password';
Lines 1381-1392 subtest 'StaffLoginRestrictBranchByIP' => sub { Link Here
1381
1381
1382
    $ENV{REMOTE_ADDR} = '127.0.0.1';
1382
    $ENV{REMOTE_ADDR} = '127.0.0.1';
1383
    my ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
1383
    my ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
1384
    is( $userid, $patron->userid, "Standard login without StaffLoginRestrictBranchByIP" );
1384
    is( $userid, $patron->userid, "Standard login without StaffLoginRestrictLibraryByIP" );
1385
1385
1386
    my $template;
1386
    my $template;
1387
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictBranchByIP', 1 );
1387
    t::lib::Mocks::mock_preference( 'StaffLoginRestrictLibraryByIP', 1 );
1388
1388
1389
    # StaffLoginRestrictBranchByIP: "Require staff to log in from a computer in the IP address range specified by their library (if any)"
1389
    # StaffLoginRestrictLibraryByIP: "Require staff to log in from a computer in the IP address range specified by their library (if any)"
1390
    $patron->library->branchip('')->store;    # There is none, allow access from anywhere
1390
    $patron->library->branchip('')->store;    # There is none, allow access from anywhere
1391
    ( $userid, $cookie, $sessionID, $flags, $template ) =
1391
    ( $userid, $cookie, $sessionID, $flags, $template ) =
1392
        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
1392
        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
Lines 1423-1429 subtest 'StaffLoginRestrictBranchByIP' => sub { Link Here
1423
    $session = C4::Auth::get_session($sessionID);
1423
    $session = C4::Auth::get_session($sessionID);
1424
    is(
1424
    is(
1425
        $session->param('branch'), $other_library->branchcode,
1425
        $session->param('branch'), $other_library->branchcode,
1426
        "StaffLoginRestrictBranchByIP allows specifying a branch as long as the IP matches"
1426
        "StaffLoginRestrictLibraryByIP allows specifying a branch as long as the IP matches"
1427
    );
1427
    );
1428
1428
1429
    $other_library->branchip('129.0.0.1')->store;
1429
    $other_library->branchip('129.0.0.1')->store;
1430
- 

Return to bug 26176