From 622537fb3354e4b7e90636478825da35bbbb5a78 Mon Sep 17 00:00:00 2001 From: Michael Hafen Date: Fri, 2 Jul 2021 11:03:08 -0600 Subject: [PATCH] Bug 28657 - expand branches.branchip to allow for multiple ip ranges. change branches.branchip to a mediumtext, and remove '*' from existing branchip settings. Change C4/Auth.pm from a regexp to using in_iprange() to check client address against branchip. (in_iprange() doesn't work with '*' in branchip.) Change in_iprange() to default to false (which is what the POD says it should do). Also, have it trim '*' in case someone adds some back later. Change note in admin/branches.tt under branchip field to reflect changes to branchip handling. --- C4/Auth.pm | 13 ++++++----- .../data/mysql/atomicupdate/bug_28657.perl | 23 +++++++++++++++++++ installer/data/mysql/kohastructure.sql | 2 +- .../prog/en/modules/admin/branches.tt | 4 ++-- 4 files changed, 33 insertions(+), 9 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_28657.perl diff --git a/C4/Auth.pm b/C4/Auth.pm index dc77f495d2..e8575e9472 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1209,8 +1209,7 @@ sub checkauth { # we have to check they are coming from the right ip range my $domain = $branches->{$branchcode}->{'branchip'}; - $domain =~ s|\.\*||g; - if ( $ip !~ /^$domain/ ) { + if ( ! in_iprange($domain) ) { $loggedin = 0; $cookie = $query->cookie( -name => 'CGISESSID', @@ -1226,7 +1225,7 @@ sub checkauth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -1682,7 +1681,7 @@ sub check_api_auth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -2249,9 +2248,11 @@ Returns 1 if the remote address is in the provided iprange, or 0 otherwise. sub in_iprange { my ($iprange) = @_; - my $result = 1; + my $result = 0; + # FIXME remove '*' for backwards compatibility in branchip settings + $iprange =~ s|\*||g; my @allowedipranges = $iprange ? split(' ', $iprange) : (); - if (scalar @allowedipranges > 0) { + if (@allowedipranges) { my @rangelist; eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@; eval { $result = Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist) } || ( $ENV{DEBUG} && warn 'cidrlookup failed for ' . join(' ',@rangelist) ); diff --git a/installer/data/mysql/atomicupdate/bug_28657.perl b/installer/data/mysql/atomicupdate/bug_28657.perl new file mode 100644 index 0000000000..b606956be3 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_28657.perl @@ -0,0 +1,23 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do( "ALTER TABLE `branches` MODIFY `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch'" ); + + my $sth = $dbh->prepare(" + SELECT branchip,branchcode + FROM branches + WHERE branchip like '%*%' + "); + $sth->execute; + my $results = $sth->fetchall_arrayref({}); + $sth = $dbh->prepare(" + UPDATE branches + SET branchip = ? + WHERE branchcode = ? + "); + foreach(@$results) { + $_->{branchip} =~ s|\*||g; + $sth->execute($_->{branchip}, $_->{branchcode}); + } + + NewVersion( $DBversion, 28657, "expand branches.branchip to allow for multiple ip ranges and remove '*'"); +} diff --git a/installer/data/mysql/kohastructure.sql b/installer/data/mysql/kohastructure.sql index 04f5bad101..f94245aff7 100644 --- a/installer/data/mysql/kohastructure.sql +++ b/installer/data/mysql/kohastructure.sql @@ -1488,7 +1488,7 @@ CREATE TABLE `branches` ( `branchreturnpath` longtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the email to be used as Return-Path', `branchurl` longtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the URL for your library or branch''s website', `issuing` tinyint(4) DEFAULT NULL COMMENT 'unused in Koha', - `branchip` varchar(15) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address for your library or branch', + `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch', `branchnotes` longtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'notes related to your library or branch', `opac_info` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'HTML that displays in OPAC', `geolocation` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'geolocation of your library', diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt index 38183a507a..17dc813ce3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt @@ -238,8 +238,8 @@ Libraries › Administration › Koha
  • - -
    Can be entered as a single IP, or a subnet such as 192.168.1.*
    + +
    Can be entered as a single IP, an IP range such as 192.168.1. or 192.168.1.10-192.168.1.50 or 192.168.1.0/24, or multiple space separated IP addresses or ranges.
  • -- 2.25.1