|
Lines 633-638
sub checkauth {
Link Here
|
| 633 |
$timeout = $1 * 86400; |
633 |
$timeout = $1 * 86400; |
| 634 |
}; |
634 |
}; |
| 635 |
$timeout = 600 unless $timeout; |
635 |
$timeout = 600 unless $timeout; |
|
|
636 |
my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor')); |
| 636 |
|
637 |
|
| 637 |
_version_check($type,$query); |
638 |
_version_check($type,$query); |
| 638 |
# state variables |
639 |
# state variables |
|
Lines 707-716
sub checkauth {
Link Here
|
| 707 |
$userid = undef; |
708 |
$userid = undef; |
| 708 |
$sessionID = undef; |
709 |
$sessionID = undef; |
| 709 |
} |
710 |
} |
| 710 |
elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { |
711 |
elsif ($ip ne $clientip) { |
| 711 |
# Different ip than originally logged in from |
712 |
# Different ip than originally logged in from |
| 712 |
$info{'oldip'} = $ip; |
713 |
$info{'oldip'} = $ip; |
| 713 |
$info{'newip'} = $ENV{'REMOTE_ADDR'}; |
714 |
$info{'newip'} = $clientip; |
| 714 |
$info{'different_ip'} = 1; |
715 |
$info{'different_ip'} = 1; |
| 715 |
$session->delete(); |
716 |
$session->delete(); |
| 716 |
C4::Context->_unset_userenv($sessionID); |
717 |
C4::Context->_unset_userenv($sessionID); |
|
Lines 752-758
sub checkauth {
Link Here
|
| 752 |
$userid = $retuserid if ($retuserid ne ''); |
753 |
$userid = $retuserid if ($retuserid ne ''); |
| 753 |
} |
754 |
} |
| 754 |
if ($return) { |
755 |
if ($return) { |
| 755 |
_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
756 |
_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$clientip,(strftime '%c', localtime)); |
| 756 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
757 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
| 757 |
$loggedin = 1; |
758 |
$loggedin = 1; |
| 758 |
} |
759 |
} |
|
Lines 800-806
sub checkauth {
Link Here
|
| 800 |
# launch a sequence to check if we have a ip for the branch, i |
801 |
# launch a sequence to check if we have a ip for the branch, i |
| 801 |
# if we have one we replace the branchcode of the userenv by the branch bound in the ip. |
802 |
# if we have one we replace the branchcode of the userenv by the branch bound in the ip. |
| 802 |
|
803 |
|
| 803 |
my $ip = $ENV{'REMOTE_ADDR'}; |
|
|
| 804 |
# if they specify at login, use that |
804 |
# if they specify at login, use that |
| 805 |
if ($query->param('branch')) { |
805 |
if ($query->param('branch')) { |
| 806 |
$branchcode = $query->param('branch'); |
806 |
$branchcode = $query->param('branch'); |
|
Lines 810-816
sub checkauth {
Link Here
|
| 810 |
if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ |
810 |
if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ |
| 811 |
# we have to check they are coming from the right ip range |
811 |
# we have to check they are coming from the right ip range |
| 812 |
my $domain = $branches->{$branchcode}->{'branchip'}; |
812 |
my $domain = $branches->{$branchcode}->{'branchip'}; |
| 813 |
if ($ip !~ /^$domain/){ |
813 |
if ($clientip !~ /^$domain/){ |
| 814 |
$loggedin=0; |
814 |
$loggedin=0; |
| 815 |
$info{'wrongip'} = 1; |
815 |
$info{'wrongip'} = 1; |
| 816 |
} |
816 |
} |
|
Lines 820-826
sub checkauth {
Link Here
|
| 820 |
foreach my $br ( keys %$branches ) { |
820 |
foreach my $br ( keys %$branches ) { |
| 821 |
# now we work with the treatment of ip |
821 |
# now we work with the treatment of ip |
| 822 |
my $domain = $branches->{$br}->{'branchip'}; |
822 |
my $domain = $branches->{$br}->{'branchip'}; |
| 823 |
if ( $domain && $ip =~ /^$domain/ ) { |
823 |
if ( $domain && $clientip =~ /^$domain/ ) { |
| 824 |
$branchcode = $branches->{$br}->{'branchcode'}; |
824 |
$branchcode = $branches->{$br}->{'branchcode'}; |
| 825 |
|
825 |
|
| 826 |
# new op dev : add the branchprinter and branchname in the cookie |
826 |
# new op dev : add the branchprinter and branchname in the cookie |
|
Lines 837-843
sub checkauth {
Link Here
|
| 837 |
$session->param('branchname',$branchname); |
837 |
$session->param('branchname',$branchname); |
| 838 |
$session->param('flags',$userflags); |
838 |
$session->param('flags',$userflags); |
| 839 |
$session->param('emailaddress',$emailaddress); |
839 |
$session->param('emailaddress',$emailaddress); |
| 840 |
$session->param('ip',$session->remote_addr()); |
840 |
$session->param('ip',$clientip); |
| 841 |
$session->param('lasttime',time()); |
841 |
$session->param('lasttime',time()); |
| 842 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
842 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
| 843 |
} |
843 |
} |
|
Lines 853-859
sub checkauth {
Link Here
|
| 853 |
$session->param('branchname','NO_LIBRARY_SET'); |
853 |
$session->param('branchname','NO_LIBRARY_SET'); |
| 854 |
$session->param('flags',1); |
854 |
$session->param('flags',1); |
| 855 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
855 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
| 856 |
$session->param('ip',$session->remote_addr()); |
856 |
$session->param('ip',$clientip); |
| 857 |
$session->param('lasttime',time()); |
857 |
$session->param('lasttime',time()); |
| 858 |
} |
858 |
} |
| 859 |
C4::Context::set_userenv( |
859 |
C4::Context::set_userenv( |
|
Lines 904-910
sub checkauth {
Link Here
|
| 904 |
C4::Context::set_shelves_userenv('tot',$total); |
904 |
C4::Context::set_shelves_userenv('tot',$total); |
| 905 |
|
905 |
|
| 906 |
# setting a couple of other session vars... |
906 |
# setting a couple of other session vars... |
| 907 |
$session->param('ip',$session->remote_addr()); |
907 |
$session->param('ip',$clientip); |
| 908 |
$session->param('lasttime',time()); |
908 |
$session->param('lasttime',time()); |
| 909 |
$session->param('sessiontype','anon'); |
909 |
$session->param('sessiontype','anon'); |
| 910 |
} |
910 |
} |
|
Lines 1074-1079
sub check_api_auth {
Link Here
|
| 1074 |
my $dbh = C4::Context->dbh; |
1074 |
my $dbh = C4::Context->dbh; |
| 1075 |
my $timeout = C4::Context->preference('timeout'); |
1075 |
my $timeout = C4::Context->preference('timeout'); |
| 1076 |
$timeout = 600 unless $timeout; |
1076 |
$timeout = 600 unless $timeout; |
|
|
1077 |
my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor')); |
| 1077 |
|
1078 |
|
| 1078 |
unless (C4::Context->preference('Version')) { |
1079 |
unless (C4::Context->preference('Version')) { |
| 1079 |
# database has not been installed yet |
1080 |
# database has not been installed yet |
|
Lines 1125-1131
sub check_api_auth {
Link Here
|
| 1125 |
$userid = undef; |
1126 |
$userid = undef; |
| 1126 |
$sessionID = undef; |
1127 |
$sessionID = undef; |
| 1127 |
return ("expired", undef, undef); |
1128 |
return ("expired", undef, undef); |
| 1128 |
} elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { |
1129 |
} elsif ( $ip ne $clientip ) { |
| 1129 |
# IP address changed |
1130 |
# IP address changed |
| 1130 |
$session->delete(); |
1131 |
$session->delete(); |
| 1131 |
C4::Context->_unset_userenv($sessionID); |
1132 |
C4::Context->_unset_userenv($sessionID); |
|
Lines 1215-1221
sub check_api_auth {
Link Here
|
| 1215 |
} |
1216 |
} |
| 1216 |
} |
1217 |
} |
| 1217 |
|
1218 |
|
| 1218 |
my $ip = $ENV{'REMOTE_ADDR'}; |
|
|
| 1219 |
# if they specify at login, use that |
1219 |
# if they specify at login, use that |
| 1220 |
if ($query->param('branch')) { |
1220 |
if ($query->param('branch')) { |
| 1221 |
$branchcode = $query->param('branch'); |
1221 |
$branchcode = $query->param('branch'); |
|
Lines 1226-1232
sub check_api_auth {
Link Here
|
| 1226 |
foreach my $br ( keys %$branches ) { |
1226 |
foreach my $br ( keys %$branches ) { |
| 1227 |
# now we work with the treatment of ip |
1227 |
# now we work with the treatment of ip |
| 1228 |
my $domain = $branches->{$br}->{'branchip'}; |
1228 |
my $domain = $branches->{$br}->{'branchip'}; |
| 1229 |
if ( $domain && $ip =~ /^$domain/ ) { |
1229 |
if ( $domain && $clientip =~ /^$domain/ ) { |
| 1230 |
$branchcode = $branches->{$br}->{'branchcode'}; |
1230 |
$branchcode = $branches->{$br}->{'branchcode'}; |
| 1231 |
|
1231 |
|
| 1232 |
# new op dev : add the branchprinter and branchname in the cookie |
1232 |
# new op dev : add the branchprinter and branchname in the cookie |
|
Lines 1243-1249
sub check_api_auth {
Link Here
|
| 1243 |
$session->param('branchname',$branchname); |
1243 |
$session->param('branchname',$branchname); |
| 1244 |
$session->param('flags',$userflags); |
1244 |
$session->param('flags',$userflags); |
| 1245 |
$session->param('emailaddress',$emailaddress); |
1245 |
$session->param('emailaddress',$emailaddress); |
| 1246 |
$session->param('ip',$session->remote_addr()); |
1246 |
$session->param('ip',$clientip); |
| 1247 |
$session->param('lasttime',time()); |
1247 |
$session->param('lasttime',time()); |
| 1248 |
} elsif ( $return == 2 ) { |
1248 |
} elsif ( $return == 2 ) { |
| 1249 |
#We suppose the user is the superlibrarian |
1249 |
#We suppose the user is the superlibrarian |
|
Lines 1256-1262
sub check_api_auth {
Link Here
|
| 1256 |
$session->param('branchname','NO_LIBRARY_SET'); |
1256 |
$session->param('branchname','NO_LIBRARY_SET'); |
| 1257 |
$session->param('flags',1); |
1257 |
$session->param('flags',1); |
| 1258 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
1258 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
| 1259 |
$session->param('ip',$session->remote_addr()); |
1259 |
$session->param('ip',$clientip); |
| 1260 |
$session->param('lasttime',time()); |
1260 |
$session->param('lasttime',time()); |
| 1261 |
} |
1261 |
} |
| 1262 |
C4::Context::set_userenv( |
1262 |
C4::Context::set_userenv( |
|
Lines 1307-1312
sub check_cookie_auth {
Link Here
|
| 1307 |
my $dbh = C4::Context->dbh; |
1307 |
my $dbh = C4::Context->dbh; |
| 1308 |
my $timeout = C4::Context->preference('timeout'); |
1308 |
my $timeout = C4::Context->preference('timeout'); |
| 1309 |
$timeout = 600 unless $timeout; |
1309 |
$timeout = 600 unless $timeout; |
|
|
1310 |
my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor')); |
| 1310 |
|
1311 |
|
| 1311 |
unless (C4::Context->preference('Version')) { |
1312 |
unless (C4::Context->preference('Version')) { |
| 1312 |
# database has not been installed yet |
1313 |
# database has not been installed yet |
|
Lines 1357-1363
sub check_cookie_auth {
Link Here
|
| 1357 |
$userid = undef; |
1358 |
$userid = undef; |
| 1358 |
$sessionID = undef; |
1359 |
$sessionID = undef; |
| 1359 |
return ("expired", undef); |
1360 |
return ("expired", undef); |
| 1360 |
} elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { |
1361 |
} elsif ( $ip ne $clientip ) { |
| 1361 |
# IP address changed |
1362 |
# IP address changed |
| 1362 |
$session->delete(); |
1363 |
$session->delete(); |
| 1363 |
C4::Context->_unset_userenv($sessionID); |
1364 |
C4::Context->_unset_userenv($sessionID); |
|
Lines 1382-1387
sub check_cookie_auth {
Link Here
|
| 1382 |
} |
1383 |
} |
| 1383 |
} |
1384 |
} |
| 1384 |
|
1385 |
|
|
|
1386 |
=head2 get_clientip |
| 1387 |
|
| 1388 |
my $clientip = get_clientip($remote_addr, $forwarded_for, $require_routable); |
| 1389 |
|
| 1390 |
Parses the remote IP address (passed to the function in $remote_addr), the |
| 1391 |
X-Forwarded-For header (passed to the function in $forwarded_for), and retrieves |
| 1392 |
the IP address of the client, returning a string representation of the IP |
| 1393 |
address. If $require_routable is set to "first", this function will always |
| 1394 |
return the most-distant IP address. If $require_routable is set to "routable", |
| 1395 |
this function will choose the first routable IP address in the list of relays, |
| 1396 |
or the address immediately before the closest proxy. If $require_routable is set |
| 1397 |
to "ignore", this function will always return the most recent hop (i.e. the |
| 1398 |
remote address). "Ignore" is the default. |
| 1399 |
|
| 1400 |
=cut |
| 1401 |
|
| 1402 |
sub get_clientip { |
| 1403 |
my $remote_addr = shift; |
| 1404 |
my $forwarded_for = shift; |
| 1405 |
my $require_routable = shift; |
| 1406 |
my $clientip; |
| 1407 |
|
| 1408 |
$require_routable ||= 'ignore'; |
| 1409 |
|
| 1410 |
if ($require_routable eq 'ignore' || !length $forwarded_for) { |
| 1411 |
$clientip = $remote_addr; |
| 1412 |
} else { |
| 1413 |
my @ips = split(', ', $forwarded_for); |
| 1414 |
$ips[$#ips + 1] = $remote_addr; |
| 1415 |
if ($require_routable eq 'first') { |
| 1416 |
$clientip = $ips[0]; |
| 1417 |
} else { # $require_routable eq 'routable' |
| 1418 |
foreach (@ips) { |
| 1419 |
if ( $_ !~ /^(192\.|10\.|127\.|0\.|169\.254\.|2([345][0-9|2[4-9])\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/) { |
| 1420 |
$clientip = $_; |
| 1421 |
last; |
| 1422 |
# We've found the client if the IP is not in any of: |
| 1423 |
# * 192.0.0.0/8 |
| 1424 |
# * 10.0.0.0/8 |
| 1425 |
# * 127.0.0.0/8 |
| 1426 |
# * 169.254.0.0/16 |
| 1427 |
# * 224.0.0.0/4 or 240.0.0.0/4 |
| 1428 |
# * 172.16.0.0/12 |
| 1429 |
} |
| 1430 |
} |
| 1431 |
if (!length $clientip) { |
| 1432 |
$clientip = $ips[$#ips - 1]; |
| 1433 |
} |
| 1434 |
} |
| 1435 |
} |
| 1436 |
|
| 1437 |
return $clientip; |
| 1438 |
} |
| 1439 |
|
| 1385 |
=head2 get_session |
1440 |
=head2 get_session |
| 1386 |
|
1441 |
|
| 1387 |
use CGI::Session; |
1442 |
use CGI::Session; |