Attachment 172149 Details for Bug 28657 – Bug 28657: expand branches.branchip to allow for multiple ip ranges.

[patch] Bug 28657: expand branches.branchip to allow for multiple ip ranges.

0001-Bug-28657-expand-branches.branchip-to-allow-for-mult.patch (text/plain), 7.22 KB, created by Michael Hafen on 2024-09-27 18:17:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Hafen

Created: 2024-09-27 18:17:27 UTC

Size: 7.22 KB

patch

obsolete

>From fbd6820fddfce10072a4f2de4791ea320eec3ef8 Mon Sep 17 00:00:00 2001
>From: Michael Hafen <michael.hafen@washk12.org>
>Date: Fri, 2 Jul 2021 11:03:08 -0600
>Subject: [PATCH] Bug 28657: expand branches.branchip to allow for multiple ip
> ranges.
>Content-Type: text/plain; charset="utf-8"
>
>change branches.branchip to a mediumtext, and remove '*' from existing branchip settings.
>Change C4/Auth.pm from a regexp to using in_iprange() to check client address against branchip.  (in_iprange() doesn't work with '*' in branchip.)
>Change in_iprange() to default to false (which is what the POD says it should do).  Also, have it trim '*' in case someone adds some back later.
>Change note in admin/branches.tt under branchip field to reflect changes to branchip handling.
>
>Test plan:
>
>1. Turn on StaffLoginBranchBasedOnIP system preference
>2. Change a branches branchip to multiple ip ranges seperated by a space,
>   making sure one of the ranges includes your computers address.
>3. Log out and try logging in.  The location check will fail.
>4. Apply patch.  Restart plack if necessary.
>5. Try logging in again.  The location check will succeed.
>---
> C4/Auth.pm                                    | 17 ++++++++------
> .../data/mysql/atomicupdate/bug_28657.perl    | 23 +++++++++++++++++++
> installer/data/mysql/kohastructure.sql        |  2 +-
> .../prog/en/modules/admin/branches.tt         |  4 ++--
> 4 files changed, 36 insertions(+), 10 deletions(-)
> create mode 100644 installer/data/mysql/atomicupdate/bug_28657.perl
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index d4b83bb75e..8ccd131947 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1218,9 +1218,8 @@ sub checkauth {
>                         if ( C4::Context->preference('StaffLoginRestrictLibraryByIP') ) {
>                             # we have to check they are coming from the right ip range
>                             my $domain = $branches->{$branchcode}->{'branchip'} // q{};
>-                            $domain =~ s|\.\*||g;
>-                            $domain =~ s/\s+//g;
>-                            if ( $domain && $ip !~ /^$domain/ ) {
>+                            next unless ( $domain );
>+                            if ( ! in_iprange($domain) ) {
>                                 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
>                                     -name     => 'CGISESSID',
>                                     -value    => '',
>@@ -1253,7 +1252,8 @@ sub checkauth {
> 
>                                 #     now we work with the treatment of ip
>                                 my $domain = $branches->{$br}->{'branchip'};
>-                                if ( $domain && $ip =~ /^$domain/ ) {
>+                                next unless ( $domain );
>+                                if ( in_iprange($domain) ) {
>                                     $branchcode = $branches->{$br}->{'branchcode'};
> 
>                                     # new op dev : add the branchname to the cookie
>@@ -1730,7 +1730,8 @@ sub check_api_auth {
> 
>                     #     now we work with the treatment of ip
>                     my $domain = $branches->{$br}->{'branchip'};
>-                    if ( $domain && $ip =~ /^$domain/ ) {
>+                    next unless ( $domain );
>+                    if ( in_iprange($domain) ) {
>                         $branchcode = $branches->{$br}->{'branchcode'};
> 
>                         # new op dev : add the branchname to the cookie
>@@ -2363,9 +2364,11 @@ Returns 1 if the remote address is in the provided iprange, or 0 otherwise.
> 
> sub in_iprange {
>     my ($iprange) = @_;
>-    my $result = 1;
>+    my $result = 0;
>+    # FIXME remove '*' for backwards compatibility in branchip settings
>+    $iprange =~ s|\*||g;
>     my @allowedipranges = $iprange ? split(' ', $iprange) : ();
>-    if (scalar @allowedipranges > 0) {
>+    if (@allowedipranges) {
>         my @rangelist;
>         eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@;
>         eval { $result = Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist) } || Koha::Logger->get->warn('cidrlookup failed for ' . join(' ',@rangelist) );
>diff --git a/installer/data/mysql/atomicupdate/bug_28657.perl b/installer/data/mysql/atomicupdate/bug_28657.perl
>new file mode 100644
>index 0000000000..b606956be3
>--- /dev/null
>+++ b/installer/data/mysql/atomicupdate/bug_28657.perl
>@@ -0,0 +1,23 @@
>+$DBversion = 'XXX'; # will be replaced by the RM
>+if( CheckVersion( $DBversion ) ) {
>+    $dbh->do( "ALTER TABLE `branches` MODIFY `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch'" );
>+
>+    my $sth = $dbh->prepare("
>+        SELECT branchip,branchcode
>+        FROM branches
>+        WHERE branchip like '%*%'
>+    ");
>+    $sth->execute;
>+    my $results = $sth->fetchall_arrayref({});
>+    $sth = $dbh->prepare("
>+        UPDATE branches
>+	SET branchip = ?
>+        WHERE branchcode = ?
>+    ");
>+    foreach(@$results) {
>+	$_->{branchip} =~ s|\*||g;
>+        $sth->execute($_->{branchip}, $_->{branchcode});
>+    }
>+
>+    NewVersion( $DBversion, 28657, "expand branches.branchip to allow for multiple ip ranges and remove '*'");
>+}
>diff --git a/installer/data/mysql/kohastructure.sql b/installer/data/mysql/kohastructure.sql
>index f3dd950328..0c1a2e7162 100644
>--- a/installer/data/mysql/kohastructure.sql
>+++ b/installer/data/mysql/kohastructure.sql
>@@ -1658,7 +1658,7 @@ CREATE TABLE `branches` (
>   `branchreturnpath` longtext DEFAULT NULL COMMENT 'the email to be used as Return-Path',
>   `branchurl` longtext DEFAULT NULL COMMENT 'the URL for your library or branch''s website',
>   `issuing` tinyint(4) DEFAULT NULL COMMENT 'unused in Koha',
>-  `branchip` varchar(15) DEFAULT NULL COMMENT 'the IP address for your library or branch',
>+  `branchip` mediumtext DEFAULT NULL COMMENT 'the IP address for your library or branch',
>   `branchnotes` longtext DEFAULT NULL COMMENT 'notes related to your library or branch',
>   `geolocation` varchar(255) DEFAULT NULL COMMENT 'geolocation of your library',
>   `marcorgcode` varchar(16) DEFAULT NULL COMMENT 'MARC Organization Code, see http://www.loc.gov/marc/organizations/orgshome.html, when empty defaults to syspref MARCOrgCode',
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
>index ad58c35346..fa26292b4d 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
>@@ -250,8 +250,8 @@
>                 </li>
>                 <li>
>                     <label for="branchip">IP: </label>
>-                    <input type="text" name="branchip" id="branchip"  size="15" maxlength="15" value="[% library.branchip | html %]" />
>-                    <div class="hint">Can be entered as a single IP, or a subnet such as 192.168.1.*</div>
>+                    <input type="text" name="branchip" id="branchip"  size="60" maxlength="60" value="[% library.branchip | html %]" />
>+                    <div class="hint">Can be entered as a single IP, an IP range such as 192.168.1. or 192.168.1.10-192.168.1.50 or 192.168.1.0/24, or multiple space separated IP addresses or ranges.</div>
>                 </li>
>                 <li>
>                     <label for="marcorgcode">MARC organization code</label>
>-- 
>2.43.0
>

Actions: View | Diff | Splinter Review

Attachments on bug 28657: 122572 | 134126 | 134173 | 149412 | 151484 | 151485 | 156582 | 161872 | 172149 | 172197