Lines 678-683
sub _version_check {
Link Here
|
678 |
} |
678 |
} |
679 |
} |
679 |
} |
680 |
|
680 |
|
|
|
681 |
=head2 get_header |
682 |
|
683 |
my $header_val = get_header($header); |
684 |
|
685 |
This retrieves the HTTP header from the CGI request. Note that this seems to |
686 |
not work with regular CGI (those values end up in the environment anyway), but |
687 |
it does work with plack. |
688 |
|
689 |
If there is no matching header, C<undef> is returned. |
690 |
|
691 |
=cut |
692 |
|
693 |
sub get_header { |
694 |
my ($header) = @_; |
695 |
|
696 |
my $q = CGI->new(); |
697 |
# Prepend HTTP_ as that's how they come through |
698 |
my $h_val = $q->http('HTTP_' . $header); |
699 |
return $h_val; |
700 |
} |
701 |
|
681 |
sub _session_log { |
702 |
sub _session_log { |
682 |
(@_) or return 0; |
703 |
(@_) or return 0; |
683 |
open my $fh, '>>', "/tmp/sessionlog" or warn "ERROR: Cannot append to /tmp/sessionlog"; |
704 |
open my $fh, '>>', "/tmp/sessionlog" or warn "ERROR: Cannot append to /tmp/sessionlog"; |
Lines 723-728
sub checkauth {
Link Here
|
723 |
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml |
744 |
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml |
724 |
my $casparam = $query->param('cas'); |
745 |
my $casparam = $query->param('cas'); |
725 |
my $q_userid = $query->param('userid') // ''; |
746 |
my $q_userid = $query->param('userid') // ''; |
|
|
747 |
my $trusted_header = C4::Context->config('trusted_header'); |
748 |
my $trust_head_val = get_header($trusted_header) if $trusted_header; |
726 |
|
749 |
|
727 |
# Basic authentication is incompatible with the use of Shibboleth, |
750 |
# Basic authentication is incompatible with the use of Shibboleth, |
728 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
751 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
Lines 744-755
sub checkauth {
Link Here
|
744 |
); |
767 |
); |
745 |
$loggedin = 1; |
768 |
$loggedin = 1; |
746 |
} |
769 |
} |
|
|
770 |
elsif ( $userid = $trust_head_val ) { |
771 |
|
772 |
# This uses something like |
773 |
# <trusted_header>X_REMOTE_USER</trusted_header> |
774 |
# in koha-conf.xml, and checks that header on the incoming request. |
775 |
# If it is there and contains a user ID, we believe it and log the |
776 |
# user in with that. This is intended for things like plack behind a |
777 |
# reverse proxy that does auth, and puts the user ID into a header. |
778 |
# |
779 |
# Basically, we treat it just like basic auth. |
780 |
$cookie = $query->cookie( |
781 |
-name => 'CGISESSID', |
782 |
-value => '', |
783 |
-expires => '', |
784 |
-HttpOnly => 1, |
785 |
); |
786 |
$loggedin = check_user_exists($userid); |
787 |
} |
747 |
elsif ($persona) { |
788 |
elsif ($persona) { |
748 |
|
789 |
|
749 |
# we dont want to set a session because we are being called by a persona callback |
790 |
# we dont want to set a session because we are being called by a persona callback |
750 |
} |
791 |
} |
751 |
elsif ( $sessionID = $query->cookie("CGISESSID") ) |
792 |
elsif ( $sessionID = $query->cookie("CGISESSID") ) { # assignment, not comparison |
752 |
{ # assignment, not comparison |
|
|
753 |
my $session = get_session($sessionID); |
793 |
my $session = get_session($sessionID); |
754 |
C4::Context->_new_userenv($sessionID); |
794 |
C4::Context->_new_userenv($sessionID); |
755 |
my ( $ip, $lasttime, $sessiontype ); |
795 |
my ( $ip, $lasttime, $sessiontype ); |
Lines 884-890
sub checkauth {
Link Here
|
884 |
|| $userid |
924 |
|| $userid |
885 |
|| ( $shib && $shib_login ) |
925 |
|| ( $shib && $shib_login ) |
886 |
|| $pki_field ne 'None' |
926 |
|| $pki_field ne 'None' |
887 |
|| $persona ) |
927 |
|| $persona |
|
|
928 |
|| $trusted_header ) |
888 |
{ |
929 |
{ |
889 |
my $password = $query->param('password'); |
930 |
my $password = $query->param('password'); |
890 |
my $shibSuccess = 0; |
931 |
my $shibSuccess = 0; |
Lines 1798-1803
sub checkpw_hash {
Link Here
|
1798 |
return $hash eq $stored_hash; |
1839 |
return $hash eq $stored_hash; |
1799 |
} |
1840 |
} |
1800 |
|
1841 |
|
|
|
1842 |
=head2 check_user_exists |
1843 |
|
1844 |
my $exists = check_user_exists($userid); |
1845 |
|
1846 |
This does a very simple check to see if a user could log in with the provided |
1847 |
userid. That is, does the userid exist as a person's userid or cardnumber |
1848 |
in the database. Returns a true value if it does, false otherwise. |
1849 |
|
1850 |
This is to allow koha to ensure that third party auth systems give us a real |
1851 |
user ID for a user, not just assuming they're real. |
1852 |
|
1853 |
=cut |
1854 |
|
1855 |
sub check_user_exists { |
1856 |
my ($userid) = @_; |
1857 |
|
1858 |
my $dbh = C4::Context->dbh(); |
1859 |
my $sth = $dbh->prepare('SELECT userid FROM borrowers WHERE userid=? OR cardnumber=? LIMIT 1'); |
1860 |
$sth->execute($userid, $userid); |
1861 |
return !!$sth->fetchrow_arrayref(); # coerce to boolean |
1862 |
} |
1863 |
|
1801 |
=head2 getuserflags |
1864 |
=head2 getuserflags |
1802 |
|
1865 |
|
1803 |
my $authflags = getuserflags($flags, $userid, [$dbh]); |
1866 |
my $authflags = getuserflags($flags, $userid, [$dbh]); |
1804 |
- |
|
|