Bugzilla – Attachment 102213 Details for
Bug 24537
Add support for IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask
Bug-24537-Allow-IP-ranges-in-ILS-DIAuthorizedIPs-u.patch (text/plain), 2.78 KB, created by
Kyle M Hall (khall)
on 2020-04-01 10:29:05 UTC
(
hide
)
Description:
Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2020-04-01 10:29:05 UTC
Size:
2.78 KB
patch
obsolete
>From e3e0ab1df71129142984d3be7bbd1f7287bbc9f1 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Thu, 30 Jan 2020 14:53:09 +1100 >Subject: [PATCH] Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using > Net::Netmask > >This patch uses Net::Netmask to match IPs from ILS-DI:AuthorizedIPs >against $ENV{REMOTE_USER}. By using Net::Netmask, we can use addresses >in a variety of formats. This includes 127.0.0.1, 192.168.1.0/24, >10.0.0, and so on. > >To Test: >1. Apply the patch >2. Empty the 'ILS-DI:AuthorizedIPs' system preference >3. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' >3b. Note that the request is successful >4. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet including >your IP address (e.g. 192.168.1.0/24) >5. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' >5b. Note that the request is successful >6. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet that doesn't include >your IP address (e.g. 1.1.1) >7. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' >7b. Note that your request is refused >8. Try a variety of permutations including bad values (e.g. 192.168.1.) or multiple values >(e.g. 10.0.0.0/8,192.168.1.0/24) or multiple values including a mix of good and bad values > >Signed-off-by: David Nind <david@davidnind.com> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > opac/ilsdi.pl | 19 ++++++++++++++----- > 1 file changed, 14 insertions(+), 5 deletions(-) > >diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl >index 274808cf97..c9c01a9ce0 100755 >--- a/opac/ilsdi.pl >+++ b/opac/ilsdi.pl >@@ -27,6 +27,7 @@ use C4::Context; > use List::MoreUtils qw(any); > use XML::Simple; > use CGI qw ( -utf8 ); >+use Net::Netmask; > > =head1 DLF ILS-DI for Koha > >@@ -164,11 +165,19 @@ unless ( C4::Context->preference('ILS-DI') ) { > > # If the remote address is not allowed, redirect to 403 > my @AuthorizedIPs = split(/,/, C4::Context->preference('ILS-DI:AuthorizedIPs')); >-if ( @AuthorizedIPs # If no filter set, allow access to everybody >- and not any { $ENV{'REMOTE_ADDR'} eq $_ } @AuthorizedIPs # IP Check >- ) { >- $out->{'code'} = "NotAllowed"; >- $out->{'message'} = "Unauthorized IP address: ".$ENV{'REMOTE_ADDR'}."."; >+if ( @AuthorizedIPs ){ # If no filter set, allow access to everybody >+ my $authorized = 0; >+ foreach my $ip (@AuthorizedIPs){ >+ my $netmask = Net::Netmask->new2($ip); >+ if ( $netmask && $netmask->match($ENV{'REMOTE_ADDR'}) ){ >+ $authorized = 1; >+ last; >+ } >+ } >+ unless ($authorized){ >+ $out->{'code'} = "NotAllowed"; >+ $out->{'message'} = "Unauthorized IP address: ".$ENV{'REMOTE_ADDR'}."."; >+ } > } > > my $service = $cgi->param('service') || "ilsdi"; >-- >2.24.1 (Apple Git-126)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24537
:
98105
|
102172
| 102213 |
102214