Attachment 91173 Details for Bug 23068 – Bug 23068: Add ability for Koha to handle X-Forwarded-For headers so REMOTE_ADDR features work behind a proxy

[patch] Bug 23068: Add ability for Koha to handle X-Forwarded-For headers so REMOTE_ADDR features work behind a proxy

Bug-23068-Add-ability-for-Koha-to-handle-X-Forward.patch (text/plain), 2.24 KB, created by Martin Renvoize (ashimema) on 2019-07-02 06:16:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2019-07-02 06:16:12 UTC

Size: 2.24 KB

patch

obsolete

>From 50cf6cfa8f83775a0b65e5efe2f3287d9cbd8262 Mon Sep 17 00:00:00 2001
>From: Kyle M Hall <kyle@bywatersolutions.com>
>Date: Thu, 6 Jun 2019 15:35:10 -0400
>Subject: [PATCH] Bug 23068: Add ability for Koha to handle X-Forwarded-For
> headers so REMOTE_ADDR features work behind a proxy
>
>Koha has a number of features that rely on knowing the IP address of the connecting client. If that server is behind a proxy these features do not work. We can use Plack::Middleware::RealIP to automatically convert the X-Forwarded-For header into the REMOTE_ADDR environment variable so no Koha code need be modified.
>
>We can take advantage of the module's trusted_proxy setting to allow Koha to use these feature even after going through *multiple* proxies.
>
>TEST PLAN:
>1) Apply this patch set
>2) Install Plack::Middleware::RealIP via cpanm or your favorite utility
>3) Update your plack.psgi with the changes you find in this patch set ( this process differs based on your testing environment )
>4) Restart plack
>5) Tail the plack error log for your instance
>6) Use curl to access the OPAC, adding an X-Forwarded-For header: curl --header "X-Forwarded-For: 32.32.32.32" http://127.0.0.1:8080
>7) Note the logs output this address if you are unproxied
>8) If you are proxied, restart plack using a command like below, where the ip you see in the logs is what you put in the environment variable:
>    KOHA_TRUSTED_PROXIES="172.22.0.1 1.1.1.1" koha-plack --restart kohadev
>9) Repeat step 6
>7) You should now see 32.32.32.32 as the remote address in your logs!
>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>---
> debian/templates/plack.psgi | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/debian/templates/plack.psgi b/debian/templates/plack.psgi
>index 3538b9a5a1..b80a556e45 100644
>--- a/debian/templates/plack.psgi
>+++ b/debian/templates/plack.psgi
>@@ -68,6 +68,12 @@ my $apiv1  = builder {
> builder {
>     enable "ReverseProxy";
>     enable "Plack::Middleware::Static";
>+
>+    my @proxies = split( / /, $ENV{KOHA_TRUSTED_PROXIES} );
>+    enable 'Plack::Middleware::RealIP',
>+      header        => 'X-Forwarded-For',
>+      trusted_proxy => [@proxies];
>+
>     # + is required so Plack doesn't try to prefix Plack::Middleware::
>     enable "+Koha::Middleware::SetEnv";
> 
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 23068: 90395 | 90396 | 90582 | 91173 | 91174 | 91447 | 92461 | 92462 | 92463 | 92464 | 94807 | 94808 | 94838 | 94839 | 94919