Lines 868-976
sub checkauth {
Link Here
|
868 |
elsif ( $emailaddress) { |
868 |
elsif ( $emailaddress) { |
869 |
# the Google OpenID Connect passes an email address |
869 |
# the Google OpenID Connect passes an email address |
870 |
} |
870 |
} |
871 |
elsif ( $sessionID = $query->cookie("CGISESSID") ) |
871 |
elsif ( $sessionID = $query->cookie("CGISESSID") ) { # assignment, not comparison |
872 |
{ # assignment, not comparison |
872 |
my ( $return, $session, $more_info ) = check_cookie_auth( $sessionID, $flags, |
873 |
$session = get_session($sessionID); |
873 |
{ remote_addr => $ENV{REMOTE_ADDR} } |
874 |
C4::Context->_new_userenv($sessionID); |
874 |
); |
875 |
my ( $ip, $lasttime, $sessiontype ); |
|
|
876 |
my $s_userid = ''; |
877 |
if ($session) { |
878 |
$s_userid = $session->param('id') // ''; |
879 |
C4::Context->set_userenv( |
880 |
$session->param('number'), $s_userid, |
881 |
$session->param('cardnumber'), $session->param('firstname'), |
882 |
$session->param('surname'), $session->param('branch'), |
883 |
$session->param('branchname'), $session->param('flags'), |
884 |
$session->param('emailaddress'), $session->param('shibboleth'), |
885 |
$session->param('desk_id'), $session->param('desk_name'), |
886 |
$session->param('register_id'), $session->param('register_name') |
887 |
); |
888 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
889 |
$ip = $session->param('ip'); |
890 |
$lasttime = $session->param('lasttime'); |
891 |
$userid = $s_userid; |
892 |
$sessiontype = $session->param('sessiontype') || ''; |
893 |
} |
894 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $s_userid ) ) |
895 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
896 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
897 |
) { |
898 |
|
899 |
#if a user enters an id ne to the id in the current session, we need to log them in... |
900 |
#first we need to clear the anonymous session... |
901 |
$anon_search_history = $session->param('search_history'); |
902 |
$session->delete(); |
903 |
$session->flush; |
904 |
C4::Context->_unset_userenv($sessionID); |
905 |
$sessionID = undef; |
906 |
$userid = undef; |
907 |
} |
908 |
elsif ($logout) { |
909 |
|
875 |
|
910 |
# voluntary logout the user |
876 |
if ( $return eq 'ok' ) { |
911 |
# check wether the user was using their shibboleth session or a local one |
877 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
912 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
|
|
913 |
$session->delete(); |
914 |
$session->flush; |
915 |
C4::Context->_unset_userenv($sessionID); |
916 |
|
878 |
|
917 |
$sessionID = undef; |
879 |
my $s_userid = $session->param('id'); |
918 |
$userid = undef; |
880 |
$userid = $s_userid; |
919 |
|
881 |
|
920 |
if ($cas and $caslogout) { |
882 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $s_userid ) ) |
921 |
logout_cas($query, $type); |
883 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
922 |
} |
884 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
|
|
885 |
) { |
923 |
|
886 |
|
924 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
887 |
#if a user enters an id ne to the id in the current session, we need to log them in... |
925 |
if ( $shib and $shib_login and $shibSuccess) { |
888 |
#first we need to clear the anonymous session... |
926 |
logout_shib($query); |
889 |
$anon_search_history = $session->param('search_history'); |
|
|
890 |
$session->delete(); |
891 |
$session->flush; |
892 |
C4::Context->_unset_userenv($sessionID); |
927 |
} |
893 |
} |
928 |
} |
894 |
elsif ($logout) { |
929 |
elsif ( !$lasttime || ( $lasttime < time() - $timeout ) ) { |
|
|
930 |
|
895 |
|
931 |
# timed logout |
896 |
# voluntary logout the user |
932 |
$info{'timed_out'} = 1; |
897 |
# check wether the user was using their shibboleth session or a local one |
933 |
if ($session) { |
898 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
934 |
$session->delete(); |
899 |
$session->delete(); |
935 |
$session->flush; |
900 |
$session->flush; |
936 |
} |
901 |
C4::Context->_unset_userenv($sessionID); |
937 |
C4::Context->_unset_userenv($sessionID); |
|
|
938 |
|
902 |
|
939 |
$userid = undef; |
903 |
if ($cas and $caslogout) { |
940 |
$sessionID = undef; |
904 |
logout_cas($query, $type); |
941 |
} |
905 |
} |
942 |
elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { |
|
|
943 |
|
906 |
|
944 |
# Different ip than originally logged in from |
907 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
945 |
$info{'oldip'} = $ip; |
908 |
if ( $shib and $shib_login and $shibSuccess) { |
946 |
$info{'newip'} = $ENV{'REMOTE_ADDR'}; |
909 |
logout_shib($query); |
947 |
$info{'different_ip'} = 1; |
910 |
} |
948 |
$session->delete(); |
911 |
} else { |
949 |
$session->flush; |
|
|
950 |
C4::Context->_unset_userenv($sessionID); |
951 |
|
912 |
|
952 |
$sessionID = undef; |
913 |
$cookie = $query->cookie( |
953 |
$userid = undef; |
914 |
-name => 'CGISESSID', |
954 |
} |
915 |
-value => $session->id, |
955 |
else { |
916 |
-HttpOnly => 1, |
956 |
$cookie = $query->cookie( |
917 |
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), |
957 |
-name => 'CGISESSID', |
918 |
); |
958 |
-value => $session->id, |
919 |
|
959 |
-HttpOnly => 1, |
920 |
my $sessiontype = $session->param('sessiontype') || ''; |
960 |
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), |
921 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
961 |
); |
922 |
$flags = haspermission( $userid, $flagsrequired ); |
962 |
$session->param( 'lasttime', time() ); |
923 |
if ($flags) { |
963 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
924 |
$loggedin = 1; |
964 |
$flags = haspermission( $userid, $flagsrequired ); |
925 |
} else { |
965 |
if ($flags) { |
926 |
$info{'nopermission'} = 1; |
966 |
$loggedin = 1; |
927 |
} |
967 |
} else { |
|
|
968 |
$info{'nopermission'} = 1; |
969 |
} |
928 |
} |
970 |
} |
929 |
} |
|
|
930 |
} elsif ( !$logout ) { |
931 |
if ( $return eq 'expired' ) { |
932 |
$info{timed_out} = 1; |
933 |
} elsif ( $return eq 'restricted' ) { |
934 |
$info{oldip} = $more_info->{old_ip}; |
935 |
$info{newip} = $more_info->{new_ip}; |
936 |
$info{different_ip} = 1; |
937 |
} |
971 |
} |
938 |
} |
972 |
} |
939 |
} |
973 |
unless ( $userid || $sessionID ) { |
940 |
|
|
|
941 |
unless ( $loggedin ) { |
942 |
$sessionID = undef; |
943 |
$userid = undef; |
944 |
} |
945 |
|
946 |
unless ( $userid ) { |
974 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
947 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
975 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
948 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
976 |
|
949 |
|
Lines 985-991
sub checkauth {
Link Here
|
985 |
C4::Context->_new_userenv($sessionID); |
958 |
C4::Context->_new_userenv($sessionID); |
986 |
$cookie = $query->cookie( |
959 |
$cookie = $query->cookie( |
987 |
-name => 'CGISESSID', |
960 |
-name => 'CGISESSID', |
988 |
-value => $session->id, |
961 |
-value => $sessionID, |
989 |
-HttpOnly => 1, |
962 |
-HttpOnly => 1, |
990 |
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), |
963 |
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), |
991 |
); |
964 |
); |
Lines 1317-1324
sub checkauth {
Link Here
|
1317 |
script_name => get_script_name(), |
1290 |
script_name => get_script_name(), |
1318 |
casAuthentication => C4::Context->preference("casAuthentication"), |
1291 |
casAuthentication => C4::Context->preference("casAuthentication"), |
1319 |
shibbolethAuthentication => $shib, |
1292 |
shibbolethAuthentication => $shib, |
1320 |
SessionRestrictionByIP => C4::Context->preference("SessionRestrictionByIP"), |
|
|
1321 |
suggestion => C4::Context->preference("suggestion"), |
1293 |
suggestion => C4::Context->preference("suggestion"), |
|
|
1294 |
SessionRestrictionByIP => C4::Context->preference("SessionRestrictionByIP"), |
1322 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1295 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1323 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
1296 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
1324 |
LibraryNameTitle => "" . $LibraryNameTitle, |
1297 |
LibraryNameTitle => "" . $LibraryNameTitle, |
Lines 1486-1565
sub check_api_auth {
Link Here
|
1486 |
return ( "maintenance", undef, undef ); |
1459 |
return ( "maintenance", undef, undef ); |
1487 |
} |
1460 |
} |
1488 |
|
1461 |
|
1489 |
# FIXME -- most of what follows is a copy-and-paste |
1462 |
my ( $sessionID, $session ); |
1490 |
# of code from checkauth. There is an obvious need |
|
|
1491 |
# for refactoring to separate the various parts of |
1492 |
# the authentication code, but as of 2007-11-19 this |
1493 |
# is deferred so as to not introduce bugs into the |
1494 |
# regular authentication code for Koha 3.0. |
1495 |
|
1496 |
# see if we have a valid session cookie already |
1497 |
# however, if a userid parameter is present (i.e., from |
1498 |
# a form submission, assume that any current cookie |
1499 |
# is to be ignored |
1500 |
my $sessionID = undef; |
1501 |
unless ( $query->param('userid') ) { |
1463 |
unless ( $query->param('userid') ) { |
1502 |
$sessionID = $query->cookie("CGISESSID"); |
1464 |
$sessionID = $query->cookie("CGISESSID"); |
1503 |
} |
1465 |
} |
1504 |
if ( $sessionID && not( $cas && $query->param('PT') ) ) { |
1466 |
if ( $sessionID && not( $cas && $query->param('PT') ) ) { |
1505 |
my $session = get_session($sessionID); |
|
|
1506 |
C4::Context->_new_userenv($sessionID); |
1507 |
if ($session) { |
1508 |
C4::Context->interface($session->param('interface')); |
1509 |
C4::Context->set_userenv( |
1510 |
$session->param('number'), $session->param('id'), |
1511 |
$session->param('cardnumber'), $session->param('firstname'), |
1512 |
$session->param('surname'), $session->param('branch'), |
1513 |
$session->param('branchname'), $session->param('flags'), |
1514 |
$session->param('emailaddress'), $session->param('shibboleth'), |
1515 |
$session->param('desk_id'), $session->param('desk_name'), |
1516 |
$session->param('register_id'), $session->param('register_name') |
1517 |
); |
1518 |
|
1467 |
|
1519 |
my $ip = $session->param('ip'); |
1468 |
my $return; |
1520 |
my $lasttime = $session->param('lasttime'); |
1469 |
( $return, $session, undef ) = check_cookie_auth( |
1521 |
my $userid = $session->param('id'); |
1470 |
$sessionID, $flagsrequired, { remote_addr => $ENV{REMOTE_ADDR} } ); |
1522 |
if ( $lasttime < time() - $timeout ) { |
|
|
1523 |
|
1471 |
|
1524 |
# time out |
1472 |
return ( $return, undef, undef ) # Cookie auth failed |
1525 |
$session->delete(); |
1473 |
if $return ne "ok"; |
1526 |
$session->flush; |
1474 |
|
1527 |
C4::Context->_unset_userenv($sessionID); |
1475 |
my $cookie = $query->cookie( |
1528 |
$userid = undef; |
1476 |
-name => 'CGISESSID', |
1529 |
$sessionID = undef; |
1477 |
-value => $session->id, |
1530 |
return ( "expired", undef, undef ); |
1478 |
-HttpOnly => 1, |
1531 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { |
1479 |
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), |
|
|
1480 |
); |
1481 |
return ( $return, undef, $session ); |
1532 |
|
1482 |
|
1533 |
# IP address changed |
|
|
1534 |
$session->delete(); |
1535 |
$session->flush; |
1536 |
C4::Context->_unset_userenv($sessionID); |
1537 |
$userid = undef; |
1538 |
$sessionID = undef; |
1539 |
return ( "expired", undef, undef ); |
1540 |
} else { |
1541 |
my $cookie = $query->cookie( |
1542 |
-name => 'CGISESSID', |
1543 |
-value => $session->id, |
1544 |
-HttpOnly => 1, |
1545 |
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), |
1546 |
); |
1547 |
$session->param( 'lasttime', time() ); |
1548 |
my $flags = haspermission( $userid, $flagsrequired ); |
1549 |
if ($flags) { |
1550 |
return ( "ok", $cookie, $sessionID ); |
1551 |
} else { |
1552 |
$session->delete(); |
1553 |
$session->flush; |
1554 |
C4::Context->_unset_userenv($sessionID); |
1555 |
$userid = undef; |
1556 |
$sessionID = undef; |
1557 |
return ( "failed", undef, undef ); |
1558 |
} |
1559 |
} |
1560 |
} else { |
1561 |
return ( "expired", undef, undef ); |
1562 |
} |
1563 |
} else { |
1483 |
} else { |
1564 |
|
1484 |
|
1565 |
# new login |
1485 |
# new login |
Lines 1712-1729
Possible return values in C<$status> are:
Link Here
|
1712 |
|
1632 |
|
1713 |
=item "expired -- session cookie has expired; API user should resubmit userid and password |
1633 |
=item "expired -- session cookie has expired; API user should resubmit userid and password |
1714 |
|
1634 |
|
|
|
1635 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
1636 |
|
1715 |
=back |
1637 |
=back |
1716 |
|
1638 |
|
1717 |
=cut |
1639 |
=cut |
1718 |
|
1640 |
|
1719 |
sub check_cookie_auth { |
1641 |
sub check_cookie_auth { |
1720 |
my $cookie = shift; |
1642 |
my $sessionID = shift; |
1721 |
my $flagsrequired = shift; |
1643 |
my $flagsrequired = shift; |
1722 |
my $params = shift; |
1644 |
my $params = shift; |
1723 |
|
1645 |
|
1724 |
my $remote_addr = $params->{remote_addr} || $ENV{REMOTE_ADDR}; |
1646 |
my $remote_addr = $params->{remote_addr} || $ENV{REMOTE_ADDR}; |
1725 |
my $dbh = C4::Context->dbh; |
|
|
1726 |
my $timeout = _timeout_syspref(); |
1727 |
|
1647 |
|
1728 |
unless ( C4::Context->preference('Version') ) { |
1648 |
unless ( C4::Context->preference('Version') ) { |
1729 |
|
1649 |
|
Lines 1740-1766
sub check_cookie_auth {
Link Here
|
1740 |
return ( "maintenance", undef ); |
1660 |
return ( "maintenance", undef ); |
1741 |
} |
1661 |
} |
1742 |
|
1662 |
|
1743 |
# FIXME -- most of what follows is a copy-and-paste |
|
|
1744 |
# of code from checkauth. There is an obvious need |
1745 |
# for refactoring to separate the various parts of |
1746 |
# the authentication code, but as of 2007-11-23 this |
1747 |
# is deferred so as to not introduce bugs into the |
1748 |
# regular authentication code for Koha 3.0. |
1749 |
|
1750 |
# see if we have a valid session cookie already |
1663 |
# see if we have a valid session cookie already |
1751 |
# however, if a userid parameter is present (i.e., from |
1664 |
# however, if a userid parameter is present (i.e., from |
1752 |
# a form submission, assume that any current cookie |
1665 |
# a form submission, assume that any current cookie |
1753 |
# is to be ignored |
1666 |
# is to be ignored |
1754 |
unless ( defined $cookie and $cookie ) { |
1667 |
unless ( defined $sessionID and $sessionID ) { |
1755 |
return ( "failed", undef ); |
1668 |
return ( "failed", undef ); |
1756 |
} |
1669 |
} |
1757 |
my $sessionID = $cookie; |
|
|
1758 |
my $session = get_session($sessionID); |
1670 |
my $session = get_session($sessionID); |
1759 |
C4::Context->_new_userenv($sessionID); |
1671 |
C4::Context->_new_userenv($sessionID); |
1760 |
if ($session) { |
1672 |
if ($session) { |
1761 |
C4::Context->interface($session->param('interface')); |
1673 |
C4::Context->interface($session->param('interface')); |
1762 |
C4::Context->set_userenv( |
1674 |
C4::Context->set_userenv( |
1763 |
$session->param('number'), $session->param('id'), |
1675 |
$session->param('number'), $session->param('id') // '', |
1764 |
$session->param('cardnumber'), $session->param('firstname'), |
1676 |
$session->param('cardnumber'), $session->param('firstname'), |
1765 |
$session->param('surname'), $session->param('branch'), |
1677 |
$session->param('surname'), $session->param('branch'), |
1766 |
$session->param('branchname'), $session->param('flags'), |
1678 |
$session->param('branchname'), $session->param('flags'), |
Lines 1769-1785
sub check_cookie_auth {
Link Here
|
1769 |
$session->param('register_id'), $session->param('register_name') |
1681 |
$session->param('register_id'), $session->param('register_name') |
1770 |
); |
1682 |
); |
1771 |
|
1683 |
|
|
|
1684 |
my $userid = $session->param('id'); |
1772 |
my $ip = $session->param('ip'); |
1685 |
my $ip = $session->param('ip'); |
1773 |
my $lasttime = $session->param('lasttime'); |
1686 |
my $lasttime = $session->param('lasttime'); |
1774 |
my $userid = $session->param('id'); |
1687 |
my $timeout = _timeout_syspref(); |
1775 |
if ( $lasttime < time() - $timeout ) { |
1688 |
|
|
|
1689 |
if ( !$lasttime || ( $lasttime < time() - $timeout ) ) { |
1776 |
|
1690 |
|
1777 |
# time out |
1691 |
# time out |
1778 |
$session->delete(); |
1692 |
$session->delete(); |
1779 |
$session->flush; |
1693 |
$session->flush; |
1780 |
C4::Context->_unset_userenv($sessionID); |
1694 |
C4::Context->_unset_userenv($sessionID); |
1781 |
$userid = undef; |
|
|
1782 |
$sessionID = undef; |
1783 |
return ("expired", undef); |
1695 |
return ("expired", undef); |
1784 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { |
1696 |
} elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { |
1785 |
|
1697 |
|
Lines 1787-1806
sub check_cookie_auth {
Link Here
|
1787 |
$session->delete(); |
1699 |
$session->delete(); |
1788 |
$session->flush; |
1700 |
$session->flush; |
1789 |
C4::Context->_unset_userenv($sessionID); |
1701 |
C4::Context->_unset_userenv($sessionID); |
1790 |
$userid = undef; |
1702 |
return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr}); |
1791 |
$sessionID = undef; |
|
|
1792 |
return ( "expired", undef ); |
1793 |
} else { |
1703 |
} else { |
1794 |
$session->param( 'lasttime', time() ); |
1704 |
$session->param( 'lasttime', time() ); |
1795 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1705 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1796 |
if ($flags) { |
1706 |
if ($flags) { |
1797 |
return ( "ok", $sessionID ); |
1707 |
return ( "ok", $session ); |
1798 |
} else { |
1708 |
} else { |
1799 |
$session->delete(); |
1709 |
$session->delete(); |
1800 |
$session->flush; |
1710 |
$session->flush; |
1801 |
C4::Context->_unset_userenv($sessionID); |
1711 |
C4::Context->_unset_userenv($sessionID); |
1802 |
$userid = undef; |
|
|
1803 |
$sessionID = undef; |
1804 |
return ( "failed", undef ); |
1712 |
return ( "failed", undef ); |
1805 |
} |
1713 |
} |
1806 |
} |
1714 |
} |
1807 |
- |
|
|