View | Details | Raw Unified | Return to bug 25360
Collapse All | Expand All

(-)a/C4/Auth.pm (-4 / +12 lines)
Lines 229-234 sub get_template_and_user { Link Here
229
                -value    => '',
229
                -value    => '',
230
                -expires  => '',
230
                -expires  => '',
231
                -HttpOnly => 1,
231
                -HttpOnly => 1,
232
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
232
            );
233
            );
233
234
234
            $template->param(
235
            $template->param(
Lines 825-830 sub checkauth { Link Here
825
            -value    => '',
826
            -value    => '',
826
            -expires  => '',
827
            -expires  => '',
827
            -HttpOnly => 1,
828
            -HttpOnly => 1,
829
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
828
        );
830
        );
829
        $loggedin = 1;
831
        $loggedin = 1;
830
    }
832
    }
Lines 925-931 sub checkauth { Link Here
925
            $cookie = $query->cookie(
927
            $cookie = $query->cookie(
926
                -name     => 'CGISESSID',
928
                -name     => 'CGISESSID',
927
                -value    => $session->id,
929
                -value    => $session->id,
928
                -HttpOnly => 1
930
                -HttpOnly => 1,
931
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
929
            );
932
            );
930
            $session->param( 'lasttime', time() );
933
            $session->param( 'lasttime', time() );
931
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
934
            unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
Lines 954-960 sub checkauth { Link Here
954
        $cookie = $query->cookie(
957
        $cookie = $query->cookie(
955
            -name     => 'CGISESSID',
958
            -name     => 'CGISESSID',
956
            -value    => $session->id,
959
            -value    => $session->id,
957
            -HttpOnly => 1
960
            -HttpOnly => 1,
961
            -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
958
        );
962
        );
959
        my $pki_field = C4::Context->preference('AllowPKIAuth');
963
        my $pki_field = C4::Context->preference('AllowPKIAuth');
960
        if ( !defined($pki_field) ) {
964
        if ( !defined($pki_field) ) {
Lines 1120-1126 sub checkauth { Link Here
1120
                            $cookie = $query->cookie(
1124
                            $cookie = $query->cookie(
1121
                                -name     => 'CGISESSID',
1125
                                -name     => 'CGISESSID',
1122
                                -value    => '',
1126
                                -value    => '',
1123
                                -HttpOnly => 1
1127
                                -HttpOnly => 1,
1128
                                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1124
                            );
1129
                            );
1125
                            $info{'wrongip'} = 1;
1130
                            $info{'wrongip'} = 1;
1126
                        }
1131
                        }
Lines 1198-1204 sub checkauth { Link Here
1198
            $cookie = $query->cookie(
1203
            $cookie = $query->cookie(
1199
                -name     => 'CGISESSID',
1204
                -name     => 'CGISESSID',
1200
                -value    => '',
1205
                -value    => '',
1201
                -HttpOnly => 1
1206
                -HttpOnly => 1,
1207
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1202
            );
1208
            );
1203
        }
1209
        }
1204
1210
Lines 1464-1469 sub check_api_auth { Link Here
1464
                    -name     => 'CGISESSID',
1470
                    -name     => 'CGISESSID',
1465
                    -value    => $session->id,
1471
                    -value    => $session->id,
1466
                    -HttpOnly => 1,
1472
                    -HttpOnly => 1,
1473
                    -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1467
                );
1474
                );
1468
                $session->param( 'lasttime', time() );
1475
                $session->param( 'lasttime', time() );
1469
                my $flags = haspermission( $userid, $flagsrequired );
1476
                my $flags = haspermission( $userid, $flagsrequired );
Lines 1518-1523 sub check_api_auth { Link Here
1518
                -name     => 'CGISESSID',
1525
                -name     => 'CGISESSID',
1519
                -value    => $sessionID,
1526
                -value    => $sessionID,
1520
                -HttpOnly => 1,
1527
                -HttpOnly => 1,
1528
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
1521
            );
1529
            );
1522
            if ( $return == 1 ) {
1530
            if ( $return == 1 ) {
1523
                my (
1531
                my (
(-)a/C4/Context.pm (+26 lines)
Lines 1069-1074 sub set_remote_address { Link Here
1069
    }
1069
    }
1070
}
1070
}
1071
1071
1072
=head3 https_enabled
1073
1074
https_enabled should be called when checking if a HTTPS connection
1075
is used.
1076
1077
Note that this depends on a HTTPS environmental variable being defined
1078
by the web server. This function may not return the expected result,
1079
if your web server or reverse proxies are not setting the correct
1080
X-Forwarded-Proto headers and HTTPS environmental variable.
1081
1082
Note too that the HTTPS value can vary from web server to web server.
1083
We are relying on the convention of the value being "on" or "ON" here.
1084
1085
=cut
1086
1087
sub https_enabled {
1088
    my $https_enabled = 0;
1089
    my $env_https = $ENV{HTTPS};
1090
    if ($env_https){
1091
        if ($env_https =~ /^ON$/i){
1092
            $https_enabled = 1;
1093
        }
1094
    }
1095
    return $https_enabled;
1096
}
1097
1072
1;
1098
1;
1073
1099
1074
=head3 needs_install
1100
=head3 needs_install
(-)a/C4/InstallAuth.pm (-2 / +6 lines)
Lines 261-266 sub checkauth { Link Here
261
                -name     => 'CGISESSID',
261
                -name     => 'CGISESSID',
262
                -value    => $session->id,
262
                -value    => $session->id,
263
                -HttpOnly => 1,
263
                -HttpOnly => 1,
264
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
264
            );
265
            );
265
            $loggedin = 1;
266
            $loggedin = 1;
266
            $userid   = $session->param('cardnumber');
267
            $userid   = $session->param('cardnumber');
Lines 300-305 sub checkauth { Link Here
300
                -name     => 'CGISESSID',
301
                -name     => 'CGISESSID',
301
                -value    => $sessionID,
302
                -value    => $sessionID,
302
                -HttpOnly => 1,
303
                -HttpOnly => 1,
304
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
303
            );
305
            );
304
            if ( $return == 2 ) {
306
            if ( $return == 2 ) {
305
307
Lines 345-351 sub checkauth { Link Here
345
                -name    => 'CGISESSID',
347
                -name    => 'CGISESSID',
346
                -value   => '',
348
                -value   => '',
347
                -HttpOnly => 1,
349
                -HttpOnly => 1,
348
                -expires => ''
350
                -expires => '',
351
                -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
349
            );
352
            );
350
        }
353
        }
351
        if ($envcookie) {
354
        if ($envcookie) {
Lines 387-393 sub checkauth { Link Here
387
        -name    => 'CGISESSID',
390
        -name    => 'CGISESSID',
388
        -value   => $sessionID,
391
        -value   => $sessionID,
389
        -HttpOnly => 1,
392
        -HttpOnly => 1,
390
        -expires => ''
393
        -expires => '',
394
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
391
    );
395
    );
392
    print $query->header(
396
    print $query->header(
393
        -type    => 'text/html; charset=utf-8',
397
        -type    => 'text/html; charset=utf-8',
(-)a/t/Context.t (-2 / +17 lines)
Lines 18-24 Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use DBI;
20
use DBI;
21
use Test::More tests => 29;
21
use Test::More tests => 35;
22
use Test::MockModule;
22
use Test::MockModule;
23
use Test::Warn;
23
use Test::Warn;
24
use YAML;
24
use YAML;
Lines 117-119 is(C4::Context->interface, 'opac', 'interface still opac'); Link Here
117
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
117
is( C4::Context->interface( 'SiP' ), 'sip', 'interface SiP' );
118
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
118
is( C4::Context->interface( 'COMMANDLINE' ), 'commandline', 'interface commandline uc' );
119
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
119
is( C4::Context->interface( 'CRON' ), 'cron', 'interface cron uc' );
120
- 
120
121
{
122
    local %ENV = %ENV;
123
    delete $ENV{HTTPS};
124
    is( C4::Context->https_enabled, 0, "Undefined HTTPS env returns 0");
125
    $ENV{HTTPS} = '1';
126
    is( C4::Context->https_enabled, 0, "Invalid 1 HTTPS env returns 0");
127
    $ENV{HTTPS} = 'off';
128
    is( C4::Context->https_enabled, 0, "off HTTPS env returns 0");
129
    $ENV{HTTPS} = 'OFF';
130
    is( C4::Context->https_enabled, 0, "OFF HTTPS env returns 0");
131
    $ENV{HTTPS} = 'on';
132
    is( C4::Context->https_enabled, 1, "on HTTPS env returns 1");
133
    $ENV{HTTPS} = 'ON';
134
    is( C4::Context->https_enabled, 1, "ON HTTPS env returns 1");
135
}

Return to bug 25360