View | Details | Raw Unified | Return to bug 25360
Collapse All | Expand All

(-)a/C4/Auth.pm (-8 / +8 lines)
Lines 229-235 sub get_template_and_user { Link Here
229
                -value    => '',
229
                -value    => '',
230
                -expires  => '',
230
                -expires  => '',
231
                -HttpOnly => 1,
231
                -HttpOnly => 1,
232
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
232
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
233
            );
233
            );
234
234
235
            $template->param(
235
            $template->param(
Lines 830-836 sub checkauth { Link Here
830
            -value    => '',
830
            -value    => '',
831
            -expires  => '',
831
            -expires  => '',
832
            -HttpOnly => 1,
832
            -HttpOnly => 1,
833
            -secure => ( $ENV{HTTPS} ? 1 : 0 ),
833
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
834
        );
834
        );
835
        $loggedin = 1;
835
        $loggedin = 1;
836
    }
836
    }
Lines 932-938 sub checkauth { Link Here
932
                -name     => 'CGISESSID',
932
                -name     => 'CGISESSID',
933
                -value    => $session->id,
933
                -value    => $session->id,
934
                -HttpOnly => 1,
934
                -HttpOnly => 1,
935
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
935
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
936
            );
936
            );
937
            $session->param( 'lasttime', time() );
937
            $session->param( 'lasttime', time() );
938
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
938
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
Lines 962-968 sub checkauth { Link Here
962
            -name     => 'CGISESSID',
962
            -name     => 'CGISESSID',
963
            -value    => $session->id,
963
            -value    => $session->id,
964
            -HttpOnly => 1,
964
            -HttpOnly => 1,
965
            -secure => ( $ENV{HTTPS} ? 1 : 0 ),
965
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
966
        );
966
        );
967
        my $pki_field = C4::Context->preference('AllowPKIAuth');
967
        my $pki_field = C4::Context->preference('AllowPKIAuth');
968
        if ( !defined($pki_field) ) {
968
        if ( !defined($pki_field) ) {
Lines 1129-1135 sub checkauth { Link Here
1129
                                -name     => 'CGISESSID',
1129
                                -name     => 'CGISESSID',
1130
                                -value    => '',
1130
                                -value    => '',
1131
                                -HttpOnly => 1,
1131
                                -HttpOnly => 1,
1132
                                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1132
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1133
                            );
1133
                            );
1134
                            $info{'wrongip'} = 1;
1134
                            $info{'wrongip'} = 1;
1135
                        }
1135
                        }
Lines 1208-1214 sub checkauth { Link Here
1208
                -name     => 'CGISESSID',
1208
                -name     => 'CGISESSID',
1209
                -value    => '',
1209
                -value    => '',
1210
                -HttpOnly => 1,
1210
                -HttpOnly => 1,
1211
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1211
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1212
            );
1212
            );
1213
        }
1213
        }
1214
1214
Lines 1475-1481 sub check_api_auth { Link Here
1475
                    -name     => 'CGISESSID',
1475
                    -name     => 'CGISESSID',
1476
                    -value    => $session->id,
1476
                    -value    => $session->id,
1477
                    -HttpOnly => 1,
1477
                    -HttpOnly => 1,
1478
                    -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1478
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1479
                );
1479
                );
1480
                $session->param( 'lasttime', time() );
1480
                $session->param( 'lasttime', time() );
1481
                my $flags = haspermission( $userid, $flagsrequired );
1481
                my $flags = haspermission( $userid, $flagsrequired );
Lines 1530-1536 sub check_api_auth { Link Here
1530
                -name     => 'CGISESSID',
1530
                -name     => 'CGISESSID',
1531
                -value    => $sessionID,
1531
                -value    => $sessionID,
1532
                -HttpOnly => 1,
1532
                -HttpOnly => 1,
1533
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
1533
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1534
            );
1534
            );
1535
            if ( $return == 1 ) {
1535
            if ( $return == 1 ) {
1536
                my (
1536
                my (
(-)a/C4/Context.pm (+26 lines)
Lines 1071-1076 sub set_remote_address { Link Here
1071
    }
1071
    }
1072
}
1072
}
1073
1073
1074
=head3 https_enabled
1075
1076
https_enabled should be called when checking if a HTTPS connection
1077
is used.
1078
1079
Note that this depends on a HTTPS environmental variable being defined
1080
by the web server. This function may not return the expected result,
1081
if your web server or reverse proxies are not setting the correct
1082
X-Forwarded-Proto headers and HTTPS environmental variable.
1083
1084
Note too that the HTTPS value can vary from web server to web server.
1085
We are relying on the convention of the value being "on" or "ON" here.
1086
1087
=cut
1088
1089
sub https_enabled {
1090
    my $https_enabled = 0;
1091
    my $env_https = $ENV{HTTPS};
1092
    if ($env_https){
1093
        if ($env_https =~ /^ON$/i){
1094
            $https_enabled = 1;
1095
        }
1096
    }
1097
    return $https_enabled;
1098
}
1099
1074
1;
1100
1;
1075
1101
1076
=head3 needs_install
1102
=head3 needs_install
(-)a/C4/InstallAuth.pm (-4 / +4 lines)
Lines 266-272 sub checkauth { Link Here
266
                -name     => 'CGISESSID',
266
                -name     => 'CGISESSID',
267
                -value    => $session->id,
267
                -value    => $session->id,
268
                -HttpOnly => 1,
268
                -HttpOnly => 1,
269
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
269
                -secure => ( C4::Context->https_enabled() } ? 1 : 0 ),
270
            );
270
            );
271
            $loggedin = 1;
271
            $loggedin = 1;
272
            $userid   = $session->param('cardnumber');
272
            $userid   = $session->param('cardnumber');
Lines 307-313 sub checkauth { Link Here
307
                -name     => 'CGISESSID',
307
                -name     => 'CGISESSID',
308
                -value    => $sessionID,
308
                -value    => $sessionID,
309
                -HttpOnly => 1,
309
                -HttpOnly => 1,
310
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
310
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
311
            );
311
            );
312
            if ( $return == 2 ) {
312
            if ( $return == 2 ) {
313
313
Lines 354-360 sub checkauth { Link Here
354
                -value   => '',
354
                -value   => '',
355
                -HttpOnly => 1,
355
                -HttpOnly => 1,
356
                -expires => '',
356
                -expires => '',
357
                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
357
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
358
            );
358
            );
359
        }
359
        }
360
        if ($envcookie) {
360
        if ($envcookie) {
Lines 397-403 sub checkauth { Link Here
397
        -value   => $sessionID,
397
        -value   => $sessionID,
398
        -HttpOnly => 1,
398
        -HttpOnly => 1,
399
        -expires => '',
399
        -expires => '',
400
        -secure => ( $ENV{HTTPS} ? 1 : 0 ),
400
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
401
    );
401
    );
402
    print $query->header(
402
    print $query->header(
403
        -type    => 'text/html; charset=utf-8',
403
        -type    => 'text/html; charset=utf-8',
(-)a/t/Context.t (-2 / +17 lines)
Lines 18-24 Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use DBI;
20
use DBI;
21
use Test::More tests => 29;
21
use Test::More tests => 34;
22
use Test::MockModule;
22
use Test::MockModule;
23
use Test::Warn;
23
use Test::Warn;
24
use YAML;
24
use YAML;
Lines 117-119 is(C4::Context->interface, 'opac', 'interface still opac'); Link Here
117
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
117
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
118
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
118
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
119
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
119
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
120
- 
120
121
{
122
    local %ENV = %ENV;
123
    delete $ENV{HTTPS};
124
    is( C4::Context->https_enabled, 0, "Undefined HTTPS env returns 0");
125
    $ENV{HTTPS} = '1';
126
    is( C4::Context->https_enabled, 0, "Invalid 1 HTTPS env returns 0");
127
    $ENV{HTTPS} = 'off';
128
    is( C4::Context->https_enabled, 0, "off HTTPS env returns 0");
129
    $ENV{HTTPS} = 'OFF';
130
    is( C4::Context->https_enabled, 0, "OFF HTTPS env returns 0");
131
    $ENV{HTTPS} = 'on';
132
    is( C4::Context->https_enabled, 1, "on HTTPS env returns 1");
133
    $ENV{HTTPS} = 'ON';
134
    is( C4::Context->https_enabled, 1, "ON HTTPS env returns 1");
135
}

Return to bug 25360