Bugzilla – Attachment 40612 Details for
Bug 14407
Limit web-based self-checkout to specific IP addresses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Allow web-based self-checkout to be limited to only certain IPs or IP ranges
Bug-14407-Allow-web-based-self-checkout-to-be-limite.patch (text/plain), 7.16 KB, created by
Nicholas van Oudtshoorn
on 2015-06-25 04:49:13 UTC
(
hide
)
Description:
Allow web-based self-checkout to be limited to only certain IPs or IP ranges
Filename:
MIME Type:
Creator:
Nicholas van Oudtshoorn
Created:
2015-06-25 04:49:13 UTC
Size:
7.16 KB
patch
obsolete
>From adb624d49599df3e00a7747396c2d11590be7099 Mon Sep 17 00:00:00 2001 >From: root <root@beta.pbcstudents.pbc.wa.edu.au> >Date: Thu, 25 Jun 2015 12:48:05 +0800 >Subject: [PATCH] Bug 14407 - Allow web-based self-checkout to be limited to > only certain IPs or IP ranges > >Test plan: >0) Back up your databse >1) Apply this patch >2) In your mysql client use your Koha database and execute: > > DELETE FROM systempreferences; > > SOURCE ~/kohaclone/installer/data/mysql/sysprefs.sql; > -- Should be no errors. > > SELECT * FROM systempreferences WHERE variable='SelfCheckAllowByIPRanges'; > -- Should see 1 entry > > QUIT; >3) Restore your database >4) Run installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql >5) In your mysql client, using your Koha database, execute: > > SELECT * FROM systempreferences WHERE variable='SelfCheckAllowByIPRanges'; > -- should see the same entry as above >6) Try access the Self-checkout, self-checkout help, and self-checkout patron images. It should work. >7) Log into the staff client >8) Home -> Koha administration -> Global system preferences >9) -> CIRCULATION > Make sure that SelfCheckAllowByIPRanges is set to a computer you can test on >10) Try access the Self-checkout, self-checkout help, and self-checkout patron images from a computer with an IP in the range above. It should work. >11) Try access the Self-checkout, self-checkout help, and self-checkout patron images from a computer with an IP outside of the range above. It should *not* work. >--- > installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql | 2 ++ > installer/data/mysql/sysprefs.sql | 1 + > .../prog/en/modules/admin/preferences/circulation.pref | 4 ++++ > opac/sco/help.pl | 10 ++++++++++ > opac/sco/sco-main.pl | 9 +++++++++ > opac/sco/sco-patron-image.pl | 11 +++++++++++ > 6 files changed, 37 insertions(+) > create mode 100644 installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql > >diff --git a/installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql b/installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql >new file mode 100644 >index 0000000..7548d78 >--- /dev/null >+++ b/installer/data/mysql/atomicupdate/selfcheckallowbyiprange.sql >@@ -0,0 +1,2 @@ >+INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES >+ ('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like <code>192.168.1.1 192.168.0.0/24</code>.)','Short'); >diff --git a/installer/data/mysql/sysprefs.sql b/installer/data/mysql/sysprefs.sql >index 84ba363..abfdee6 100644 >--- a/installer/data/mysql/sysprefs.sql >+++ b/installer/data/mysql/sysprefs.sql >@@ -55,6 +55,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` > ('AutoSelfCheckAllowed','0','','For corporate and special libraries which want web-based self-check available from any PC without the need for a manual staff login. Most libraries will want to leave this turned off. If on, requires self-check ID and password to be entered in AutoSelfCheckID and AutoSelfCheckPass sysprefs.','YesNo'), > ('AutoSelfCheckID','','','Staff ID with circulation rights to be used for automatic web-based self-check. Only applies if AutoSelfCheckAllowed syspref is turned on.','free'), > ('AutoSelfCheckPass','','','Password to be used for automatic web-based self-check. Only applies if AutoSelfCheckAllowed syspref is turned on.','free'), >+('SelfCheckAllowByIPRanges','',NULL,('Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like <code>192.168.1.1 192.168.0.0/24</code>.)','Short'), > ('Babeltheque','0','','Turn ON Babeltheque content - See babeltheque.com to subscribe to this service','YesNo'), > ('Babeltheque_url_js','','','Url for Babeltheque javascript (e.g. http://www.babeltheque.com/bw_XX.js)','Free'), > ('Babeltheque_url_update','','','Url for Babeltheque update (E.G. http://www.babeltheque.com/.../file.csv.bz2)','Free'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref >index f9cd822..d08acba 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref >@@ -681,6 +681,10 @@ Circulation: > yes: Show > no: "Don't show" > - "the print receipt popup dialog when self checkout is finished" >+ - >+ - pref: SelfCheckAllowByIPRanges >+ class: short >+ - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like <code>192.168.1.1 192.168.0.0/24</code>.) > > Course Reserves: > - >diff --git a/opac/sco/help.pl b/opac/sco/help.pl >index c41d737..d1b6121 100755 >--- a/opac/sco/help.pl >+++ b/opac/sco/help.pl >@@ -24,11 +24,21 @@ > use strict; > use warnings; > use CGI qw ( -utf8 ); >+use Net::IP::Match::XS; > > use C4::Auth qw(get_template_and_user); > use C4::Output qw(output_html_with_http_headers); > > my $query = new CGI; >+ >+my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); >+if (scalar @allowedipranges > 0) { >+ unless (match_ip($ENV{'REMOTE_ADDR'}, @allowedipranges)) { >+ print $query->redirect("/cgi-bin/koha/opac-main.pl"); >+ exit; >+ } >+} >+ > my ($template, $borrowernumber, $cookie) = get_template_and_user({ > template_name => "sco/help.tt", > query => $query, >diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl >index b214f54..5758bbf 100755 >--- a/opac/sco/sco-main.pl >+++ b/opac/sco/sco-main.pl >@@ -36,6 +36,7 @@ use warnings; > > use CGI qw ( -utf8 ); > use Digest::MD5 qw(md5_base64); >+use Net::IP::Match::XS; > > use C4::Auth qw(get_template_and_user checkpw); > use C4::Koha; >@@ -54,6 +55,14 @@ unless (C4::Context->preference('WebBasedSelfCheck')) { > exit; > } > >+my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); >+if (scalar @allowedipranges > 0) { >+ unless (match_ip($ENV{'REMOTE_ADDR'}, @allowedipranges)) { >+ print $query->redirect("/cgi-bin/koha/opac-main.pl"); >+ exit; >+ } >+} >+ > if (C4::Context->preference('AutoSelfCheckAllowed')) > { > my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID'); >diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl >index c6c0a19..fa1c4df 100755 >--- a/opac/sco/sco-patron-image.pl >+++ b/opac/sco/sco-patron-image.pl >@@ -19,6 +19,8 @@ > > use strict; > use warnings; >+use Net::IP::Match::XS; >+ > use C4::Service; > use C4::Members; > >@@ -33,6 +35,15 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { > exit; > } > >+my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); >+if (scalar @allowedipranges > 0) { >+ unless (match_ip($ENV{'REMOTE_ADDR'}, @allowedipranges)) { >+ print $query->header(status => '403 Forbidden - functionality not available from your location'); >+ exit; >+ } >+} >+ >+ > my ($borrowernumber) = C4::Service->require_params('borrowernumber'); > > my ($imagedata, $dberror) = GetPatronImage($borrowernumber); >-- >2.1.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14407
:
40612
|
40613
|
40852
|
40854
|
45894
|
45898
|
45899
|
51812
|
51813
|
53760
|
54560
|
55746
|
56064
|
56065
|
56066
|
68834
|
68835
|
68836
|
70475
|
70476
|
73316
|
73318
|
73339
|
73340
|
73341
|
73342
|
80735
|
80736
|
80737
|
80738
|
86123
|
88863
|
88864
|
88865
|
88866
|
89114