Bugzilla – Attachment 166786 Details for
Bug 36867
ILS-DI AuthorizedIPs should deny explicitly except those listed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs
Bug-36867-Do-not-allow-access-to-ILS-DI-for-IPs-no.patch (text/plain), 1.90 KB, created by
Nick Clemens (kidclamp)
on 2024-05-15 16:32:19 UTC
(
hide
)
Description:
Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2024-05-15 16:32:19 UTC
Size:
1.90 KB
patch
obsolete
>From bdd8a60a084c38baac2eef7816f02a42aef1b807 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Wed, 15 May 2024 16:10:05 +0000 >Subject: [PATCH] Bug 36867: Do not allow access to ILS-DI for IPs not > explicitly listed in ILS-DI:AuthorizedIPs > >This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed > >To test: > 1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank > 2 - In another window: > http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item > 3 - You get a response > 4 - Apply patch and restart all > 5 - Reload ilsdi page, 'Not authorized' > 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs > 7 - Reload the page, you get a response again > 8 - Change ILS-DI:AuthorizedIPs to: > 0:0:0:0/0 > 9 - You still have access >10 - Paste your specific IP again, and add a second made up IP (comma separated) >11 - Reload and confirm you still have access >--- > opac/ilsdi.pl | 15 ++++++++++++++- > 1 file changed, 14 insertions(+), 1 deletion(-) > >diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl >index 5b105246fa4..b6b91b6ae1a 100755 >--- a/opac/ilsdi.pl >+++ b/opac/ilsdi.pl >@@ -173,9 +173,22 @@ if (@AuthorizedIPs) { # If no filter set, allow access to everybody > } > } > unless ($authorized) { >- $out->{'code'} = "NotAllowed"; >+ $out->{'code'} = "NotAllowed"; > $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; > } >+} else { >+ $out->{'code'} = "NotAllowed"; >+ $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; >+ >+ print XMLout( >+ $out, >+ noattr => 1, >+ nosort => 1, >+ xmldecl => '<?xml version="1.0" encoding="UTF-8" ?>', >+ RootName => "ilsdi", >+ SuppressEmpty => 1 >+ ); >+ exit 0; > } > > my $service = $cgi->param('service') || "ilsdi"; >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36867
:
166786
|
166787
|
166818
|
166819
|
170526
|
170527
|
179905
|
179908
|
179909
|
181678