Bugzilla – Attachment 170526 Details for
Bug 36867
ILS-DI AuthorizedIPs should deny explicitly except those listed
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs
Bug-36867-Do-not-allow-access-to-ILS-DI-for-IPs-no.patch (text/plain), 1.97 KB, created by
Martin Renvoize (ashimema)
on 2024-08-21 07:39:20 UTC
(
hide
)
Description:
Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2024-08-21 07:39:20 UTC
Size:
1.97 KB
patch
obsolete
>From 53de116cce999dc05376815f5a5557f6e1e91f7b Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Wed, 15 May 2024 16:10:05 +0000 >Subject: [PATCH] Bug 36867: Do not allow access to ILS-DI for IPs not > explicitly listed in ILS-DI:AuthorizedIPs > >This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed > >To test: > 1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank > 2 - In another window: > http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item > 3 - You get a response > 4 - Apply patch and restart all > 5 - Reload ilsdi page, 'Not authorized' > 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs > 7 - Reload the page, you get a response again > 8 - Change ILS-DI:AuthorizedIPs to: > 0:0:0:0/0 > 9 - You still have access >10 - Paste your specific IP again, and add a second made up IP (comma separated) >11 - Reload and confirm you still have access > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > opac/ilsdi.pl | 15 ++++++++++++++- > 1 file changed, 14 insertions(+), 1 deletion(-) > >diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl >index 4cf4818aa40..221225a2efa 100755 >--- a/opac/ilsdi.pl >+++ b/opac/ilsdi.pl >@@ -172,9 +172,22 @@ if (@AuthorizedIPs) { # If no filter set, allow access to everybody > } > } > unless ($authorized) { >- $out->{'code'} = "NotAllowed"; >+ $out->{'code'} = "NotAllowed"; > $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; > } >+} else { >+ $out->{'code'} = "NotAllowed"; >+ $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; >+ >+ print XMLout( >+ $out, >+ noattr => 1, >+ nosort => 1, >+ xmldecl => '<?xml version="1.0" encoding="UTF-8" ?>', >+ RootName => "ilsdi", >+ SuppressEmpty => 1 >+ ); >+ exit 0; > } > > my $service = $cgi->param('service') || "ilsdi"; >-- >2.46.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36867
:
166786
|
166787
|
166818
|
166819
|
170526
|
170527
|
179905
|
179908
|
179909
|
181678