| Lines 146-151
          sub get_template_and_user {
      
      
        Link Here | 
        
          | 146 |     my $borrowernumber; | 146 |     my $borrowernumber; | 
        
          | 147 |     my $insecure = C4::Context->preference('insecure'); | 147 |     my $insecure = C4::Context->preference('insecure'); | 
        
          | 148 |     if ($user or $insecure) { | 148 |     if ($user or $insecure) { | 
            
              |  |  | 149 |         # It's possible for $user to be the borrowernumber if they don't have a | 
            
              | 150 |         # userid defined (and are logging in through some other method, such | 
            
              | 151 |         # as SSL certs against an email address) | 
            
              | 152 |         $borrowernumber = getborrowernumber($user) if defined($user); | 
            
              | 153 |         if (!defined($borrowernumber) && defined($user)) { | 
            
              | 154 | 		my $borrower = GetMember(borrowernumber => $user); | 
            
              | 155 | 		if ($borrower) { | 
            
              | 156 | 		$borrowernumber = $user; | 
            
              | 157 |                 # A bit of a hack, but I don't know there's a nicer way | 
            
              | 158 |                 # to do it. | 
            
              | 159 |                 $user = $borrower->{firstname} . ' ' . $borrower->{surname}; | 
            
              | 160 |             } | 
            
              | 161 |         } | 
        
          | 149 |  | 162 |  | 
        
          | 150 |         # user info | 163 |         # user info | 
        
          | 151 |         $template->param( loggedinusername => $user ); | 164 |         $template->param( loggedinusername => $user ); | 
  
    | Lines 165-171
          sub get_template_and_user {
      
      
        Link Here | 
        
          | 165 |             $template->param( bartotal  => $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar @{$barshelves}); | 178 |             $template->param( bartotal  => $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar @{$barshelves}); | 
        
          | 166 |         } | 179 |         } | 
        
          | 167 |  | 180 |  | 
            
              | 168 |         $borrowernumber = getborrowernumber($user) if defined($user); |  |  | 
        
          | 169 |         require C4::Members; | 181 |         require C4::Members; | 
        
          | 170 |         my ( $borr ) = C4::Members::GetMemberDetails( $borrowernumber ); | 182 |         my ( $borr ) = C4::Members::GetMemberDetails( $borrowernumber ); | 
        
          | 171 |         my @bordat; | 183 |         my @bordat; | 
  
    | Lines 719-742
          sub checkauth {
      
      
        Link Here | 
        
          | 719 |     } | 731 |     } | 
        
          | 720 |     unless ($userid || $sessionID) { | 732 |     unless ($userid || $sessionID) { | 
        
          | 721 |         #we initiate a session prior to checking for a username to allow for anonymous sessions... | 733 |         #we initiate a session prior to checking for a username to allow for anonymous sessions... | 
          
            
              | 722 | 		my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; | 734 |         my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; | 
        
          | 723 |         my $sessionID = $session->id; | 735 |         my $sessionID = $session->id; | 
          
            
              | 724 |        	C4::Context->_new_userenv($sessionID); | 736 |         C4::Context->_new_userenv($sessionID); | 
            
              | 725 |         $cookie = $query->cookie(CGISESSID => $sessionID); | 737 |         $cookie = $query->cookie( CGISESSID => $sessionID ); | 
            
              | 726 | 	    $userid    = $query->param('userid'); | 738 |         $userid = $query->param('userid'); | 
            
              | 727 |             if (($cas && $query->param('ticket')) || $userid) { | 739 |         if (   ( $cas && $query->param('ticket') ) | 
            
              | 728 |         	my $password = $query->param('password'); | 740 |             || $userid | 
            
              | 729 | 		my ($return, $cardnumber); | 741 |             || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne | 
            
              | 730 | 		if ($cas && $query->param('ticket')) { | 742 |             'None' ) | 
            
              | 731 | 		    my $retuserid; | 743 |         { | 
            
              | 732 | 		    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); | 744 |             my $password = $query->param('password'); | 
            
              | 733 | 		    $userid = $retuserid; | 745 |             my ( $return, $cardnumber ); | 
            
              | 734 | 		    $info{'invalidCasLogin'} = 1 unless ($return); | 746 |             if ( $cas && $query->param('ticket') ) { | 
            
              | 735 |         	} else { | 747 |                 my $retuserid; | 
            
              | 736 | 		    my $retuserid; | 748 |                 ( $return, $cardnumber, $retuserid ) = | 
            
              | 737 | 		    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); | 749 |                   checkpw( $dbh, $userid, $password, $query ); | 
            
              | 738 | 		    $userid = $retuserid if ($retuserid ne ''); | 750 |                 $userid = $retuserid; | 
            
              | 739 | 		} | 751 |                 $info{'invalidCasLogin'} = 1 unless ($return); | 
            
              |  |  | 752 |             } | 
            
              | 753 |             elsif ( | 
            
              | 754 |                 ( $pki_field eq 'Common Name' && $ENV{'SSL_CLIENT_S_DN_CN'} ) | 
            
              | 755 |                 || (   $pki_field eq 'emailAddress' | 
            
              | 756 |                     && $ENV{'SSL_CLIENT_S_DN_Email'} ) | 
            
              | 757 |               ) | 
            
              | 758 |             { | 
            
              | 759 |                 my $value; | 
            
              | 760 |                 if ( $pki_field eq 'Common Name' ) { | 
            
              | 761 |                     $value = $ENV{'SSL_CLIENT_S_DN_CN'}; | 
            
              | 762 |                 } | 
            
              | 763 |                 elsif ( $pki_field eq 'emailAddress' ) { | 
            
              | 764 |                     $value = $ENV{'SSL_CLIENT_S_DN_Email'}; | 
            
              | 765 |  | 
            
              | 766 |               # If we're looking up the email, there's a chance that the person | 
            
              | 767 |               # doesn't have a userid. So if there is none, we pass along the | 
            
              | 768 |               # borrower number, and the bits of code that need to know the user | 
            
              | 769 |               # ID will have to be smart enough to handle that. | 
            
              | 770 |                     require C4::Members; | 
            
              | 771 |                     my @users_info = C4::Members::GetBorrowersWithEmail($value); | 
            
              | 772 |                     if (@users_info) { | 
            
              | 773 |  | 
            
              | 774 |                         # First the userid, then the borrowernum | 
            
              | 775 |                         $value = $users_info[0][1] || $users_info[0][0]; | 
            
              | 776 |                     } else { | 
            
              | 777 |                         undef $value; | 
            
              | 778 |                     } | 
            
              | 779 |                 } | 
            
              | 780 |  | 
            
              | 781 |                 # 0 for no user, 1 for normal, 2 for demo user. | 
            
              | 782 |                 $return = $value ? 1 : 0; | 
            
              | 783 |                 $userid = $value; | 
            
              | 784 |             } | 
            
              | 785 |             else { | 
            
              | 786 |                 my $retuserid; | 
            
              | 787 |                 ( $return, $cardnumber, $retuserid ) = | 
            
              | 788 |                   checkpw( $dbh, $userid, $password, $query ); | 
            
              | 789 |                 $userid = $retuserid if ( $retuserid ne '' ); | 
            
              | 790 |             } | 
        
          | 740 | 		if ($return) { | 791 | 		if ($return) { | 
        
          | 741 |                #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); | 792 |                #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); | 
        
          | 742 |             	if ( $flags = haspermission(  $userid, $flagsrequired ) ) { | 793 |             	if ( $flags = haspermission(  $userid, $flagsrequired ) ) { | 
  
    | Lines 746-872
          sub checkauth {
      
      
        Link Here | 
        
          | 746 |                 	$info{'nopermission'} = 1; | 797 |                 	$info{'nopermission'} = 1; | 
        
          | 747 |                 	C4::Context->_unset_userenv($sessionID); | 798 |                 	C4::Context->_unset_userenv($sessionID); | 
        
          | 748 |             	} | 799 |             	} | 
          
            
              | 749 |  | 800 |                 my ($borrowernumber, $firstname, $surname, $userflags, | 
            
              | 750 | 				my ($borrowernumber, $firstname, $surname, $userflags, | 801 |                     $branchcode, $branchname, $branchprinter, $emailaddress); | 
            
              | 751 | 					$branchcode, $branchname, $branchprinter, $emailaddress); | 802 |  | 
            
              | 752 |  | 803 |                 if ( $return == 1 ) { | 
            
              | 753 |             	if ( $return == 1 ) { | 804 |                     my $select = " | 
            
              | 754 |                 	my $select = " | 805 |                     SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, | 
            
              | 755 |                 	SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode,  | 806 |                     branches.branchname    as branchname, | 
            
              | 756 |                     	    branches.branchname    as branchname,  | 807 |                     branches.branchprinter as branchprinter, | 
            
              | 757 |                         	branches.branchprinter as branchprinter,  | 808 |                     email | 
            
              | 758 |                         	email  | 809 |                     FROM borrowers | 
            
              | 759 |                 	FROM borrowers  | 810 |                     LEFT JOIN branches on borrowers.branchcode=branches.branchcode | 
            
              | 760 |                 	LEFT JOIN branches on borrowers.branchcode=branches.branchcode | 811 |                     "; | 
            
              | 761 |                 	"; | 812 |                     my $sth = $dbh->prepare("$select where userid=?"); | 
            
              | 762 |                 	my $sth = $dbh->prepare("$select where userid=?"); | 813 |                     $sth->execute($userid); | 
            
              | 763 |                 	$sth->execute($userid); | 814 |                     unless ($sth->rows) { | 
            
              | 764 | 			unless ($sth->rows) { | 815 |                         $debug and print STDERR "AUTH_1: no rows for userid='$userid'\n"; | 
            
              | 765 | 		    	    $debug and print STDERR "AUTH_1: no rows for userid='$userid'\n"; | 816 |                         $sth = $dbh->prepare("$select where cardnumber=?"); | 
            
              | 766 | 		    	    $sth = $dbh->prepare("$select where cardnumber=?"); | 817 |                         $sth->execute($cardnumber); | 
            
              | 767 | 		       	    $sth->execute($cardnumber); | 818 |  | 
            
              | 768 |  | 819 |                         unless ($sth->rows) { | 
            
              | 769 | 		    	    unless ($sth->rows) { | 820 |                             $debug and print STDERR "AUTH_2a: no rows for cardnumber='$cardnumber'\n"; | 
            
              | 770 | 				$debug and print STDERR "AUTH_2a: no rows for cardnumber='$cardnumber'\n"; | 821 |                             $sth->execute($userid); | 
            
              | 771 | 				$sth->execute($userid); | 822 |                             unless ($sth->rows) { | 
            
              | 772 | 				unless ($sth->rows) { | 823 |                                 $debug and print STDERR "AUTH_2b: no rows for userid='$userid' AS cardnumber\n"; | 
            
              | 773 | 				    $debug and print STDERR "AUTH_2b: no rows for userid='$userid' AS cardnumber\n"; | 824 |                             } | 
            
              | 774 | 				} | 825 |                         } | 
            
              | 775 | 			    } | 826 |                     } | 
            
              | 776 | 			} | 827 |                     if ($sth->rows) { | 
            
              | 777 |                 	if ($sth->rows) { | 828 |                         ($borrowernumber, $firstname, $surname, $userflags, | 
            
              | 778 | 			    ($borrowernumber, $firstname, $surname, $userflags, | 829 |                             $branchcode, $branchname, $branchprinter, $emailaddress) = $sth->fetchrow; | 
            
              | 779 |                     		$branchcode, $branchname, $branchprinter, $emailaddress) = $sth->fetchrow; | 830 |                         $debug and print STDERR "AUTH_3 results: " . | 
            
              | 780 | 						$debug and print STDERR "AUTH_3 results: " . | 831 |                         "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n"; | 
            
              | 781 | 							"$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n"; | 832 |                     } else { | 
            
              | 782 | 					} else { | 833 |                         print STDERR "AUTH_3: no results for userid='$userid', cardnumber='$cardnumber'.\n"; | 
            
              | 783 | 						print STDERR "AUTH_3: no results for userid='$userid', cardnumber='$cardnumber'.\n"; | 834 |                     } | 
            
              | 784 | 					} |  |  | 
        
          | 785 |  | 835 |  | 
        
          | 786 | # launch a sequence to check if we have a ip for the branch, i | 836 | # launch a sequence to check if we have a ip for the branch, i | 
        
          | 787 | # if we have one we replace the branchcode of the userenv by the branch bound in the ip. | 837 | # if we have one we replace the branchcode of the userenv by the branch bound in the ip. | 
        
          | 788 |  | 838 |  | 
          
            
              | 789 | 					my $ip       = $ENV{'REMOTE_ADDR'}; | 839 |                     my $ip       = $ENV{'REMOTE_ADDR'}; | 
            
              | 790 | 					# if they specify at login, use that | 840 |                     # if they specify at login, use that | 
            
              | 791 | 					if ($query->param('branch')) { | 841 |                     if ($query->param('branch')) { | 
            
              | 792 | 						$branchcode  = $query->param('branch'); | 842 |                         $branchcode  = $query->param('branch'); | 
            
              | 793 | 						$branchname = GetBranchName($branchcode); | 843 |                         $branchname = GetBranchName($branchcode); | 
            
              | 794 | 					} | 844 |                     } | 
            
              | 795 | 					my $branches = GetBranches(); | 845 |                     my $branches = GetBranches(); | 
            
              | 796 | 					if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ | 846 |                     if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ | 
            
              | 797 | 						# we have to check they are coming from the right ip range | 847 |                         # we have to check they are coming from the right ip range | 
            
              | 798 | 						my $domain = $branches->{$branchcode}->{'branchip'}; | 848 |                         my $domain = $branches->{$branchcode}->{'branchip'}; | 
            
              | 799 | 						if ($ip !~ /^$domain/){ | 849 |                         if ($ip !~ /^$domain/){ | 
            
              | 800 | 							$loggedin=0; | 850 |                             $loggedin=0; | 
            
              | 801 | 							$info{'wrongip'} = 1; | 851 |                             $info{'wrongip'} = 1; | 
            
              | 802 | 						} | 852 |                         } | 
            
              | 803 | 					} | 853 |                     } | 
            
              | 804 |  | 854 |  | 
            
              | 805 | 					my @branchesloop; | 855 |                     my @branchesloop; | 
            
              | 806 | 					foreach my $br ( keys %$branches ) { | 856 |                     foreach my $br ( keys %$branches ) { | 
            
              | 807 | 						#     now we work with the treatment of ip | 857 |                         #     now we work with the treatment of ip | 
            
              | 808 | 						my $domain = $branches->{$br}->{'branchip'}; | 858 |                         my $domain = $branches->{$br}->{'branchip'}; | 
            
              | 809 | 						if ( $domain && $ip =~ /^$domain/ ) { | 859 |                         if ( $domain && $ip =~ /^$domain/ ) { | 
            
              | 810 | 							$branchcode = $branches->{$br}->{'branchcode'}; | 860 |                             $branchcode = $branches->{$br}->{'branchcode'}; | 
            
              | 811 |  | 861 |  | 
            
              | 812 | 							# new op dev : add the branchprinter and branchname in the cookie | 862 |                             # new op dev : add the branchprinter and branchname in the cookie | 
            
              | 813 | 							$branchprinter = $branches->{$br}->{'branchprinter'}; | 863 |                             $branchprinter = $branches->{$br}->{'branchprinter'}; | 
            
              | 814 | 							$branchname    = $branches->{$br}->{'branchname'}; | 864 |                             $branchname    = $branches->{$br}->{'branchname'}; | 
            
              | 815 | 						} | 865 |                         } | 
            
              | 816 | 					} | 866 |                     } | 
            
              | 817 | 					$session->param('number',$borrowernumber); | 867 |                     $session->param('number',$borrowernumber); | 
            
              | 818 | 					$session->param('id',$userid); | 868 |                     $session->param('id',$userid); | 
            
              | 819 | 					$session->param('cardnumber',$cardnumber); | 869 |                     $session->param('cardnumber',$cardnumber); | 
            
              | 820 | 					$session->param('firstname',$firstname); | 870 |                     $session->param('firstname',$firstname); | 
            
              | 821 | 					$session->param('surname',$surname); | 871 |                     $session->param('surname',$surname); | 
            
              | 822 | 					$session->param('branch',$branchcode); | 872 |                     $session->param('branch',$branchcode); | 
            
              | 823 | 					$session->param('branchname',$branchname); | 873 |                     $session->param('branchname',$branchname); | 
            
              | 824 | 					$session->param('flags',$userflags); | 874 |                     $session->param('flags',$userflags); | 
            
              | 825 | 					$session->param('emailaddress',$emailaddress); | 875 |                     $session->param('emailaddress',$emailaddress); | 
            
              | 826 | 					$session->param('ip',$session->remote_addr()); | 876 |                     $session->param('ip',$session->remote_addr()); | 
            
              | 827 | 					$session->param('lasttime',time()); | 877 |                     $session->param('lasttime',time()); | 
            
              | 828 | 					$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; | 878 |                     $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; | 
            
              | 829 | 				} | 879 |                 } | 
            
              | 830 | 				elsif ( $return == 2 ) { | 880 |                 elsif ( $return == 2 ) { | 
            
              | 831 | 					#We suppose the user is the superlibrarian | 881 |                     #We suppose the user is the superlibrarian | 
            
              | 832 | 					$borrowernumber = 0; | 882 |                     $borrowernumber = 0; | 
            
              | 833 | 					$session->param('number',0); | 883 |                     $session->param('number',0); | 
            
              | 834 | 					$session->param('id',C4::Context->config('user')); | 884 |                     $session->param('id',C4::Context->config('user')); | 
            
              | 835 | 					$session->param('cardnumber',C4::Context->config('user')); | 885 |                     $session->param('cardnumber',C4::Context->config('user')); | 
            
              | 836 | 					$session->param('firstname',C4::Context->config('user')); | 886 |                     $session->param('firstname',C4::Context->config('user')); | 
            
              | 837 | 					$session->param('surname',C4::Context->config('user')); | 887 |                     $session->param('surname',C4::Context->config('user')); | 
            
              | 838 | 					$session->param('branch','NO_LIBRARY_SET'); | 888 |                     $session->param('branch','NO_LIBRARY_SET'); | 
            
              | 839 | 					$session->param('branchname','NO_LIBRARY_SET'); | 889 |                     $session->param('branchname','NO_LIBRARY_SET'); | 
            
              | 840 | 					$session->param('flags',1); | 890 |                     $session->param('flags',1); | 
            
              | 841 | 					$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); | 891 |                     $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); | 
            
              | 842 | 					$session->param('ip',$session->remote_addr()); | 892 |                     $session->param('ip',$session->remote_addr()); | 
            
              | 843 | 					$session->param('lasttime',time()); | 893 |                     $session->param('lasttime',time()); | 
            
              | 844 | 				} | 894 |                 } | 
            
              | 845 | 				C4::Context::set_userenv( | 895 |                 C4::Context::set_userenv( | 
            
              | 846 | 					$session->param('number'),       $session->param('id'), | 896 |                     $session->param('number'),       $session->param('id'), | 
            
              | 847 | 					$session->param('cardnumber'),   $session->param('firstname'), | 897 |                     $session->param('cardnumber'),   $session->param('firstname'), | 
            
              | 848 | 					$session->param('surname'),      $session->param('branch'), | 898 |                     $session->param('surname'),      $session->param('branch'), | 
            
              | 849 | 					$session->param('branchname'),   $session->param('flags'), | 899 |                     $session->param('branchname'),   $session->param('flags'), | 
            
              | 850 | 					$session->param('emailaddress'), $session->param('branchprinter') | 900 |                     $session->param('emailaddress'), $session->param('branchprinter') | 
            
              | 851 | 				); | 901 |                 ); | 
            
              | 852 |  | 902 |  | 
            
              | 853 | 				# Grab borrower's shelves and public shelves and add them to the session | 903 |                 # Grab borrower's shelves and public shelves and add them to the session | 
            
              | 854 | 				# $row_count determines how many records are returned from the db query | 904 |                 # $row_count determines how many records are returned from the db query | 
            
              | 855 | 				# and the number of lists to be displayed of each type in the 'Lists' button drop down | 905 |                 # and the number of lists to be displayed of each type in the 'Lists' button drop down | 
            
              | 856 | 				my $row_count = 10; # FIXME:This probably should be a syspref | 906 |                 my $row_count = 10; # FIXME:This probably should be a syspref | 
            
              | 857 | 				my ($total, $totshelves, $barshelves, $pubshelves); | 907 |                 my ($total, $totshelves, $barshelves, $pubshelves); | 
            
              | 858 | 				($barshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(1, $row_count, $borrowernumber); | 908 |                 ($barshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(1, $row_count, $borrowernumber); | 
            
              | 859 | 				$total->{'bartotal'} = $totshelves; | 909 |                 $total->{'bartotal'} = $totshelves; | 
            
              | 860 | 				($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef); | 910 |                 ($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef); | 
            
              | 861 | 				$total->{'pubtotal'} = $totshelves; | 911 |                 $total->{'pubtotal'} = $totshelves; | 
            
              | 862 | 				$session->param('barshelves', $barshelves); | 912 |                 $session->param('barshelves', $barshelves); | 
            
              | 863 | 				$session->param('pubshelves', $pubshelves); | 913 |                 $session->param('pubshelves', $pubshelves); | 
            
              | 864 | 				$session->param('totshelves', $total); | 914 |                 $session->param('totshelves', $total); | 
            
              | 865 |  | 915 |  | 
            
              | 866 | 				C4::Context::set_shelves_userenv('bar',$barshelves); | 916 |                 C4::Context::set_shelves_userenv('bar',$barshelves); | 
            
              | 867 | 				C4::Context::set_shelves_userenv('pub',$pubshelves); | 917 |                 C4::Context::set_shelves_userenv('pub',$pubshelves); | 
            
              | 868 | 				C4::Context::set_shelves_userenv('tot',$total); | 918 |                 C4::Context::set_shelves_userenv('tot',$total); | 
            
              | 869 | 			} | 919 |             } | 
        
          | 870 |         	else { | 920 |         	else { | 
        
          | 871 |             	if ($userid) { | 921 |             	if ($userid) { | 
        
          | 872 |                 	$info{'invalid_username_or_password'} = 1; | 922 |                 	$info{'invalid_username_or_password'} = 1; |