Attachment #5185 for bug #6800

View | Details | Raw Unified | Return to bug 6800
Collapse All | Expand All




        $timeout = $1 * 86400;
    };
    $timeout = 600 unless $timeout;
    my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor'));

    _version_check($type,$query);
    # state variables

            $userid    = undef;
            $sessionID = undef;
        }
        elsif ($ip ne $clientip) {
            # Different ip than originally logged in from
            $info{'oldip'}        = $ip;
            $info{'newip'}        = $clientip;
            $info{'different_ip'} = 1;
            $session->delete();
            C4::Context->_unset_userenv($sessionID);

		    $userid = $retuserid if ($retuserid ne '');
		}
		if ($return) {
               _session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$clientip,(strftime '%c', localtime));
            	if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
					$loggedin = 1;
            	}

# launch a sequence to check if we have a ip for the branch, i
# if we have one we replace the branchcode of the userenv by the branch bound in the ip.

					my $ip       = $ENV{'REMOTE_ADDR'};
					# if they specify at login, use that
					if ($query->param('branch')) {
						$branchcode  = $query->param('branch');

					if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){
						# we have to check they are coming from the right ip range
						my $domain = $branches->{$branchcode}->{'branchip'};
						if ($clientip !~ /^$domain/){
							$loggedin=0;
							$info{'wrongip'} = 1;
						}

					foreach my $br ( keys %$branches ) {
						#     now we work with the treatment of ip
						my $domain = $branches->{$br}->{'branchip'};
						if ( $domain && $clientip =~ /^$domain/ ) {
							$branchcode = $branches->{$br}->{'branchcode'};

							# new op dev : add the branchprinter and branchname in the cookie

					$session->param('branchname',$branchname);
					$session->param('flags',$userflags);
					$session->param('emailaddress',$emailaddress);
					$session->param('ip',$clientip);
					$session->param('lasttime',time());
					$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
				}

					$session->param('branchname','NO_LIBRARY_SET');
					$session->param('flags',1);
					$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
					$session->param('ip',$clientip);
					$session->param('lasttime',time());
				}
				C4::Context::set_userenv(

			C4::Context::set_shelves_userenv('tot',$total);

			# setting a couple of other session vars...
            $session->param('ip',$clientip);
			$session->param('lasttime',time());
			$session->param('sessiontype','anon');
		}

    my $dbh     = C4::Context->dbh;
    my $timeout = C4::Context->preference('timeout');
    $timeout = 600 unless $timeout;
    my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor'));

    unless (C4::Context->preference('Version')) {
        # database has not been installed yet

                $userid    = undef;
                $sessionID = undef;
                return ("expired", undef, undef);
            } elsif ( $ip ne $clientip ) {
                # IP address changed
                $session->delete();
                C4::Context->_unset_userenv($sessionID);

                    }
                }

                my $ip       = $ENV{'REMOTE_ADDR'};
                # if they specify at login, use that
                if ($query->param('branch')) {
                    $branchcode  = $query->param('branch');

                foreach my $br ( keys %$branches ) {
                    #     now we work with the treatment of ip
                    my $domain = $branches->{$br}->{'branchip'};
                    if ( $domain && $clientip =~ /^$domain/ ) {
                        $branchcode = $branches->{$br}->{'branchcode'};

                        # new op dev : add the branchprinter and branchname in the cookie

                $session->param('branchname',$branchname);
                $session->param('flags',$userflags);
                $session->param('emailaddress',$emailaddress);
                $session->param('ip',$clientip);
                $session->param('lasttime',time());
            } elsif ( $return == 2 ) {
                #We suppose the user is the superlibrarian

                $session->param('branchname','NO_LIBRARY_SET');
                $session->param('flags',1);
                $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
                $session->param('ip',$clientip);
                $session->param('lasttime',time());
            }
            C4::Context::set_userenv(

    my $dbh     = C4::Context->dbh;
    my $timeout = C4::Context->preference('timeout');
    $timeout = 600 unless $timeout;
    my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor'));

    unless (C4::Context->preference('Version')) {
        # database has not been installed yet

            $userid    = undef;
            $sessionID = undef;
            return ("expired", undef);
        } elsif ( $ip ne $clientip ) {
            # IP address changed
            $session->delete();
            C4::Context->_unset_userenv($sessionID);

    }
}

=head2 get_clientip

  my $clientip = get_clientip($remote_addr, $forwarded_for, $require_routable);

Parses the remote IP address (passed to the function in $remote_addr), the
X-Forwarded-For header (passed to the function in $forwarded_for), and retrieves
the IP address of the client, returning a string representation of the IP
address. If $require_routable is set to "first", this function will always
return the most-distant IP address. If $require_routable is set to "routable",
this function will choose the first routable IP address in the list of relays,
or the address immediately before the closest proxy. If $require_routable is set
to "ignore", this function will always return the most recent hop (i.e. the
remote address). "Ignore" is the default.

=cut

sub get_clientip {
    my $remote_addr = shift;
    my $forwarded_for = shift;
    my $require_routable = shift;
    my $clientip;

    $require_routable ||= 'ignore';

    if ($require_routable eq 'ignore' || !length $forwarded_for) {
        $clientip = $remote_addr;
    } else {
        my @ips = split(', ', $forwarded_for);
        $ips[$#ips + 1] = $remote_addr;
        if ($require_routable eq 'first') {
            $clientip = $ips[0];
        } else { # $require_routable eq 'routable'
            foreach (@ips) {
                if  ( $_ !~ /^(192\.|10\.|127\.|0\.|169\.254\.|2([345][0-9|2[4-9])\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/) {
                    $clientip = $_;
                    last;
                    # We've found the client if the IP is not in any of:
                    # * 192.0.0.0/8
                    # * 10.0.0.0/8
                    # * 127.0.0.0/8
                    # * 169.254.0.0/16
                    # * 224.0.0.0/4 or 240.0.0.0/4
                    # * 172.16.0.0/12
                }
            }
            if (!length $clientip) {
                $clientip = $ips[$#ips - 1];
            }
        }
    }

    return $clientip;
}

=head2 get_session

  use CGI::Session;

Lines 317-320 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/de-DE/mandatory/sysprefs.sql (-1 / +1 lines)
317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0, 'If ON Openlibrary book covers will be show',NULL,'YesNo');	319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0, 'If ON Openlibrary book covers will be show',NULL,'YesNo');
320		320	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 317-319 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/en/mandatory/sysprefs.sql (+1 lines)
317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');	319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');
		320	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 317-319 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/es-ES/mandatory/sysprefs.sql (+1 lines)
317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');	319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');
		320	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 318-321 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/fr-FR/1-Obligatoire/unimarc_standard_systemprefs.sql (-1 / +1 lines)
318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	318	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
319	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	319	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
320	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');	320	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');
321		321	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 304-307 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/it-IT/necessari/sysprefs.sql (-1 / +1 lines)
304	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	304	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
305	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	305	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
306	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');	306	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');
307		307	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 316-318 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/pl-PL/mandatory/sysprefs.sql (+1 lines)
316	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	316	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	317	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
318	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0, 'If ON Openlibrary book covers will be show',NULL,'YesNo');	318	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0, 'If ON Openlibrary book covers will be show',NULL,'YesNo');
		319	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 371-373 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/ru-RU/mandatory/system_preferences_full_optimal_for_install_only.sql (+1 lines)
371	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	371	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
372	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	372	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
373	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');	373	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0,'If ON Openlibrary book covers will be show',NULL,'YesNo');
		374	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 396-399 INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ( Link Here

(-)a/installer/data/mysql/uk-UA/mandatory/system_preferences_full_optimal_for_install_only.sql (-1 / +1 lines)
396	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');	396	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('BasketConfirmations', '1', 'When closing or reopening a basket,', 'always ask for confirmation.\|do not ask for confirmation.', 'Choice');
397	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');	397	INSERT INTO `systempreferences` (variable,value,explanation,options,type) VALUES ('MARCAuthorityControlField008', '\|\| aca\|\|aabn \| a\|a d', NULL, NULL, 'Textarea');
398	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0, 'If ON Openlibrary book covers will be show',NULL,'YesNo');	398	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('OpenLibraryCovers',0, 'If ON Openlibrary book covers will be show',NULL,'YesNo');
399		399	INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');

Lines 4439-4444 if (C4::Context->preference("Version") < TransformToNum($DBversion)) { Link Here

(-)a/installer/data/mysql/updatedatabase.pl (+7 lines)
4439	SetVersion($DBversion);	4439	SetVersion($DBversion);
4440	}	4440	}
4441		4441
		4442	$DBversion = "3.05.00.XXX";
		4443	if (C4::Context->preference("Version") < TransformToNum($DBversion)) {
		4444	$dbh->do("INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES('HandleXForwardedFor','ignore','Specify how to handle client IPs and the X-Forwarded-For header.','ignore\|first\|routable','Choice');");
		4445	print "Upgrade to $DBversion done (add HandleXForwardedFor syspref- change if you are using a reverse proxy or load balancer)\n";
		4446	SetVersion($DBversion);
		4447	}
		4448
4442		4449
4443	=head1 FUNCTIONS	4450	=head1 FUNCTIONS
4444		4451

Lines 71-76 Administration: Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref (+8 lines)
71	tmp: as temporary files.	71	tmp: as temporary files.
72	memcached: in a memcached server.	72	memcached: in a memcached server.
73	-	73	-
		74	- pref: HandleXForwardedFor
		75	default: ignore
		76	choices:
		77	ignore: Always use the address of the machine connecting to Koha
		78	routable: Use the first routable address or address of the last hop before the proxy
		79	first: Always use the address of the machine with the web browser
		80	- as the client IP for authenticated sessions.
		81	-
74	- pref: IndependantBranches	82	- pref: IndependantBranches
75	default: 0	83	default: 0
76	choices:	84	choices:

Line 0 Link Here

(-)a/t/Auth.t (-1 / +17 lines)
0	-	1	#!/usr/bin/perl
		2	#
		3	# This Koha test module is a stub!
		4	# Add more tests here!!!
		5
		6	use strict;
		7	use warnings;
		8
		9	use Test::More tests => 5;
		10
		11	BEGIN {
		12	use_ok('C4::Auth');
		13	ok(C4::Auth::get_clientip('192.168.101.2', '192.168.101.3, 192.168.101.4', 'ignore') eq '192.168.101.2', 'get_clientip: Ignore proxies for client IP');
		14	ok(C4::Auth::get_clientip('192.168.101.2', '192.168.101.3, 192.168.101.4', 'first') eq '192.168.101.3', 'get_clientip: Always use most remote client IP');
		15	ok(C4::Auth::get_clientip('192.168.101.2', '127.0.0.1, 192.168.102.3, 10.0.0.1, 53.42.191.136', 'routable') eq '53.42.191.136', 'get_clientip: Find routable client IP w/reverse proxy');
		16	ok(C4::Auth::get_clientip('192.168.101.2', '127.0.0.1, 192.168.102.3, 10.0.0.1', 'routable') eq '10.0.0.1', 'get_clientip: Handle no-routable IPs w/reverse proxy');
		17	}

Return to bug 6800

Lines 633-638 sub checkauth { Link Here

(-)a/C4/Auth.pm (-15 / +70 lines)
633	$timeout = $1 * 86400;	633	$timeout = $1 * 86400;
634	};	634	};
635	$timeout = 600 unless $timeout;	635	$timeout = 600 unless $timeout;
		636	my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor'));
636		637
637	_version_check($type,$query);	638	_version_check($type,$query);
638	# state variables	639	# state variables
Lines 707-716 sub checkauth { Link Here
707	$userid = undef;	708	$userid = undef;
708	$sessionID = undef;	709	$sessionID = undef;
709	}	710	}
710	elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {	711	elsif ($ip ne $clientip) {
711	# Different ip than originally logged in from	712	# Different ip than originally logged in from
712	$info{'oldip'} = $ip;	713	$info{'oldip'} = $ip;
713	$info{'newip'} = $ENV{'REMOTE_ADDR'};	714	$info{'newip'} = $clientip;
714	$info{'different_ip'} = 1;	715	$info{'different_ip'} = 1;
715	$session->delete();	716	$session->delete();
716	C4::Context->_unset_userenv($sessionID);	717	C4::Context->_unset_userenv($sessionID);
Lines 752-758 sub checkauth { Link Here
752	$userid = $retuserid if ($retuserid ne '');	753	$userid = $retuserid if ($retuserid ne '');
753	}	754	}
754	if ($return) {	755	if ($return) {
755	_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));	756	_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$clientip,(strftime '%c', localtime));
756	if ( $flags = haspermission( $userid, $flagsrequired ) ) {	757	if ( $flags = haspermission( $userid, $flagsrequired ) ) {
757	$loggedin = 1;	758	$loggedin = 1;
758	}	759	}
Lines 800-806 sub checkauth { Link Here
800	# launch a sequence to check if we have a ip for the branch, i	801	# launch a sequence to check if we have a ip for the branch, i
801	# if we have one we replace the branchcode of the userenv by the branch bound in the ip.	802	# if we have one we replace the branchcode of the userenv by the branch bound in the ip.
802		803
803	my $ip = $ENV{'REMOTE_ADDR'};
804	# if they specify at login, use that	804	# if they specify at login, use that
805	if ($query->param('branch')) {	805	if ($query->param('branch')) {
806	$branchcode = $query->param('branch');	806	$branchcode = $query->param('branch');
Lines 810-816 sub checkauth { Link Here
810	if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){	810	if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){
811	# we have to check they are coming from the right ip range	811	# we have to check they are coming from the right ip range
812	my $domain = $branches->{$branchcode}->{'branchip'};	812	my $domain = $branches->{$branchcode}->{'branchip'};
813	if ($ip !~ /^$domain/){	813	if ($clientip !~ /^$domain/){
814	$loggedin=0;	814	$loggedin=0;
815	$info{'wrongip'} = 1;	815	$info{'wrongip'} = 1;
816	}	816	}
Lines 820-826 sub checkauth { Link Here
820	foreach my $br ( keys %$branches ) {	820	foreach my $br ( keys %$branches ) {
821	# now we work with the treatment of ip	821	# now we work with the treatment of ip
822	my $domain = $branches->{$br}->{'branchip'};	822	my $domain = $branches->{$br}->{'branchip'};
823	if ( $domain && $ip =~ /^$domain/ ) {	823	if ( $domain && $clientip =~ /^$domain/ ) {
824	$branchcode = $branches->{$br}->{'branchcode'};	824	$branchcode = $branches->{$br}->{'branchcode'};
825		825
826	# new op dev : add the branchprinter and branchname in the cookie	826	# new op dev : add the branchprinter and branchname in the cookie
Lines 837-843 sub checkauth { Link Here
837	$session->param('branchname',$branchname);	837	$session->param('branchname',$branchname);
838	$session->param('flags',$userflags);	838	$session->param('flags',$userflags);
839	$session->param('emailaddress',$emailaddress);	839	$session->param('emailaddress',$emailaddress);
840	$session->param('ip',$session->remote_addr());	840	$session->param('ip',$clientip);
841	$session->param('lasttime',time());	841	$session->param('lasttime',time());
842	$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;	842	$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
843	}	843	}
Lines 853-859 sub checkauth { Link Here
853	$session->param('branchname','NO_LIBRARY_SET');	853	$session->param('branchname','NO_LIBRARY_SET');
854	$session->param('flags',1);	854	$session->param('flags',1);
855	$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));	855	$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
856	$session->param('ip',$session->remote_addr());	856	$session->param('ip',$clientip);
857	$session->param('lasttime',time());	857	$session->param('lasttime',time());
858	}	858	}
859	C4::Context::set_userenv(	859	C4::Context::set_userenv(
Lines 904-910 sub checkauth { Link Here
904	C4::Context::set_shelves_userenv('tot',$total);	904	C4::Context::set_shelves_userenv('tot',$total);
905		905
906	# setting a couple of other session vars...	906	# setting a couple of other session vars...
907	$session->param('ip',$session->remote_addr());	907	$session->param('ip',$clientip);
908	$session->param('lasttime',time());	908	$session->param('lasttime',time());
909	$session->param('sessiontype','anon');	909	$session->param('sessiontype','anon');
910	}	910	}
Lines 1074-1079 sub check_api_auth { Link Here
1074	my $dbh = C4::Context->dbh;	1074	my $dbh = C4::Context->dbh;
1075	my $timeout = C4::Context->preference('timeout');	1075	my $timeout = C4::Context->preference('timeout');
1076	$timeout = 600 unless $timeout;	1076	$timeout = 600 unless $timeout;
		1077	my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor'));
1077		1078
1078	unless (C4::Context->preference('Version')) {	1079	unless (C4::Context->preference('Version')) {
1079	# database has not been installed yet	1080	# database has not been installed yet
Lines 1125-1131 sub check_api_auth { Link Here
1125	$userid = undef;	1126	$userid = undef;
1126	$sessionID = undef;	1127	$sessionID = undef;
1127	return ("expired", undef, undef);	1128	return ("expired", undef, undef);
1128	} elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {	1129	} elsif ( $ip ne $clientip ) {
1129	# IP address changed	1130	# IP address changed
1130	$session->delete();	1131	$session->delete();
1131	C4::Context->_unset_userenv($sessionID);	1132	C4::Context->_unset_userenv($sessionID);
Lines 1215-1221 sub check_api_auth { Link Here
1215	}	1216	}
1216	}	1217	}
1217		1218
1218	my $ip = $ENV{'REMOTE_ADDR'};
1219	# if they specify at login, use that	1219	# if they specify at login, use that
1220	if ($query->param('branch')) {	1220	if ($query->param('branch')) {
1221	$branchcode = $query->param('branch');	1221	$branchcode = $query->param('branch');
Lines 1226-1232 sub check_api_auth { Link Here
1226	foreach my $br ( keys %$branches ) {	1226	foreach my $br ( keys %$branches ) {
1227	# now we work with the treatment of ip	1227	# now we work with the treatment of ip
1228	my $domain = $branches->{$br}->{'branchip'};	1228	my $domain = $branches->{$br}->{'branchip'};
1229	if ( $domain && $ip =~ /^$domain/ ) {	1229	if ( $domain && $clientip =~ /^$domain/ ) {
1230	$branchcode = $branches->{$br}->{'branchcode'};	1230	$branchcode = $branches->{$br}->{'branchcode'};
1231		1231
1232	# new op dev : add the branchprinter and branchname in the cookie	1232	# new op dev : add the branchprinter and branchname in the cookie
Lines 1243-1249 sub check_api_auth { Link Here
1243	$session->param('branchname',$branchname);	1243	$session->param('branchname',$branchname);
1244	$session->param('flags',$userflags);	1244	$session->param('flags',$userflags);
1245	$session->param('emailaddress',$emailaddress);	1245	$session->param('emailaddress',$emailaddress);
1246	$session->param('ip',$session->remote_addr());	1246	$session->param('ip',$clientip);
1247	$session->param('lasttime',time());	1247	$session->param('lasttime',time());
1248	} elsif ( $return == 2 ) {	1248	} elsif ( $return == 2 ) {
1249	#We suppose the user is the superlibrarian	1249	#We suppose the user is the superlibrarian
Lines 1256-1262 sub check_api_auth { Link Here
1256	$session->param('branchname','NO_LIBRARY_SET');	1256	$session->param('branchname','NO_LIBRARY_SET');
1257	$session->param('flags',1);	1257	$session->param('flags',1);
1258	$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));	1258	$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
1259	$session->param('ip',$session->remote_addr());	1259	$session->param('ip',$clientip);
1260	$session->param('lasttime',time());	1260	$session->param('lasttime',time());
1261	}	1261	}
1262	C4::Context::set_userenv(	1262	C4::Context::set_userenv(
Lines 1307-1312 sub check_cookie_auth { Link Here
1307	my $dbh = C4::Context->dbh;	1307	my $dbh = C4::Context->dbh;
1308	my $timeout = C4::Context->preference('timeout');	1308	my $timeout = C4::Context->preference('timeout');
1309	$timeout = 600 unless $timeout;	1309	$timeout = 600 unless $timeout;
		1310	my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor'));
1310		1311
1311	unless (C4::Context->preference('Version')) {	1312	unless (C4::Context->preference('Version')) {
1312	# database has not been installed yet	1313	# database has not been installed yet
Lines 1357-1363 sub check_cookie_auth { Link Here
1357	$userid = undef;	1358	$userid = undef;
1358	$sessionID = undef;	1359	$sessionID = undef;
1359	return ("expired", undef);	1360	return ("expired", undef);
1360	} elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {	1361	} elsif ( $ip ne $clientip ) {
1361	# IP address changed	1362	# IP address changed
1362	$session->delete();	1363	$session->delete();
1363	C4::Context->_unset_userenv($sessionID);	1364	C4::Context->_unset_userenv($sessionID);
Lines 1382-1387 sub check_cookie_auth { Link Here
1382	}	1383	}
1383	}	1384	}
1384		1385
		1386	=head2 get_clientip
		1387
		1388	my $clientip = get_clientip($remote_addr, $forwarded_for, $require_routable);
		1389
		1390	Parses the remote IP address (passed to the function in $remote_addr), the
		1391	X-Forwarded-For header (passed to the function in $forwarded_for), and retrieves
		1392	the IP address of the client, returning a string representation of the IP
		1393	address. If $require_routable is set to "first", this function will always
		1394	return the most-distant IP address. If $require_routable is set to "routable",
		1395	this function will choose the first routable IP address in the list of relays,
		1396	or the address immediately before the closest proxy. If $require_routable is set
		1397	to "ignore", this function will always return the most recent hop (i.e. the
		1398	remote address). "Ignore" is the default.
		1399
		1400	=cut
		1401
		1402	sub get_clientip {
		1403	my $remote_addr = shift;
		1404	my $forwarded_for = shift;
		1405	my $require_routable = shift;
		1406	my $clientip;
		1407
		1408	$require_routable \|\|= 'ignore';
		1409
		1410	if ($require_routable eq 'ignore' \|\| !length $forwarded_for) {
		1411	$clientip = $remote_addr;
		1412	} else {
		1413	my @ips = split(', ', $forwarded_for);
		1414	$ips[$#ips + 1] = $remote_addr;
		1415	if ($require_routable eq 'first') {
		1416	$clientip = $ips[0];
		1417	} else { # $require_routable eq 'routable'
		1418	foreach (@ips) {
		1419	if ( $_ !~ /^(192\.\|10\.\|127\.\|0\.\|169\.254\.\|2([345][0-9\|2[4-9])\.\|172\.(1[6-9]\|2[0-9]\|3[0-1])\.)/) {
		1420	$clientip = $_;
		1421	last;
		1422	# We've found the client if the IP is not in any of:
		1423	# * 192.0.0.0/8
		1424	# * 10.0.0.0/8
		1425	# * 127.0.0.0/8
		1426	# * 169.254.0.0/16
		1427	# * 224.0.0.0/4 or 240.0.0.0/4
		1428	# * 172.16.0.0/12
		1429	}
		1430	}
		1431	if (!length $clientip) {
		1432	$clientip = $ips[$#ips - 1];
		1433	}
		1434	}
		1435	}
		1436
		1437	return $clientip;
		1438	}
		1439
1385	=head2 get_session	1440	=head2 get_session
1386		1441
1387	use CGI::Session;	1442	use CGI::Session;