View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/C4/Auth.pm (-31 / +35 lines)
Lines 23-28 use Carp qw( croak ); Link Here
23
23
24
use Digest::MD5 qw( md5_base64 );
24
use Digest::MD5 qw( md5_base64 );
25
use CGI::Session;
25
use CGI::Session;
26
use CGI::Session::ErrorHandler;
26
use URI;
27
use URI;
27
use URI::QueryParam;
28
use URI::QueryParam;
28
29
Lines 885-891 sub checkauth { Link Here
885
                $anon_search_history = $session->param('search_history');
886
                $anon_search_history = $session->param('search_history');
886
                $session->delete();
887
                $session->delete();
887
                $session->flush;
888
                $session->flush;
888
                C4::Context->_unset_userenv($sessionID);
889
                C4::Context::_unset_userenv($sessionID);
889
            }
890
            }
890
            elsif ($logout) {
891
            elsif ($logout) {
891
892
Lines 894-900 sub checkauth { Link Here
894
                my $shibSuccess = C4::Context->userenv->{'shibboleth'};
895
                my $shibSuccess = C4::Context->userenv->{'shibboleth'};
895
                $session->delete();
896
                $session->delete();
896
                $session->flush;
897
                $session->flush;
897
                C4::Context->_unset_userenv($sessionID);
898
                C4::Context::_unset_userenv($sessionID);
898
899
899
                if ($cas and $caslogout) {
900
                if ($cas and $caslogout) {
900
                    logout_cas($query, $type);
901
                    logout_cas($query, $type);
Lines 1087-1093 sub checkauth { Link Here
1087
                }
1088
                }
1088
                else {
1089
                else {
1089
                    $info{'nopermission'} = 1;
1090
                    $info{'nopermission'} = 1;
1090
                    C4::Context->_unset_userenv($sessionID);
1091
                    C4::Context::_unset_userenv($sessionID);
1091
                }
1092
                }
1092
                my ( $borrowernumber, $firstname, $surname, $userflags,
1093
                my ( $borrowernumber, $firstname, $surname, $userflags,
1093
                    $branchcode, $branchname, $emailaddress, $desk_id,
1094
                    $branchcode, $branchname, $emailaddress, $desk_id,
Lines 1205-1211 sub checkauth { Link Here
1205
            else {
1206
            else {
1206
                if ($userid) {
1207
                if ($userid) {
1207
                    $info{'invalid_username_or_password'} = 1;
1208
                    $info{'invalid_username_or_password'} = 1;
1208
                    C4::Context->_unset_userenv($sessionID);
1209
                    C4::Context::_unset_userenv($sessionID);
1209
                }
1210
                }
1210
                $session->param( 'lasttime', time() );
1211
                $session->param( 'lasttime', time() );
1211
                $session->param( 'ip',       $session->remote_addr() );
1212
                $session->param( 'ip',       $session->remote_addr() );
Lines 1663-1719 sub check_cookie_auth { Link Here
1663
    # however, if a userid parameter is present (i.e., from
1664
    # however, if a userid parameter is present (i.e., from
1664
    # a form submission, assume that any current cookie
1665
    # a form submission, assume that any current cookie
1665
    # is to be ignored
1666
    # is to be ignored
1666
    unless ( defined $sessionID and $sessionID ) {
1667
    unless ( $sessionID ) {
1667
        return ( "failed", undef );
1668
        return ( "failed", undef );
1668
    }
1669
    }
1670
    C4::Context::_unset_userenv($sessionID); # remove old userenv first
1669
    my $session   = get_session($sessionID);
1671
    my $session   = get_session($sessionID);
1670
    C4::Context->_new_userenv($sessionID);
1671
    if ($session) {
1672
    if ($session) {
1672
        C4::Context->interface($session->param('interface'));
1673
        C4::Context->set_userenv(
1674
            $session->param('number'),       $session->param('id') // '',
1675
            $session->param('cardnumber'),   $session->param('firstname'),
1676
            $session->param('surname'),      $session->param('branch'),
1677
            $session->param('branchname'),   $session->param('flags'),
1678
            $session->param('emailaddress'), $session->param('shibboleth'),
1679
            $session->param('desk_id'),      $session->param('desk_name'),
1680
            $session->param('register_id'),  $session->param('register_name')
1681
        );
1682
1683
        my $userid   = $session->param('id');
1673
        my $userid   = $session->param('id');
1684
        my $ip       = $session->param('ip');
1674
        my $ip       = $session->param('ip');
1685
        my $lasttime = $session->param('lasttime');
1675
        my $lasttime = $session->param('lasttime');
1686
        my $timeout = _timeout_syspref();
1676
        my $timeout = _timeout_syspref();
1687
1677
1688
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1678
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1689
1690
            # time out
1679
            # time out
1691
            $session->delete();
1680
            $session->delete();
1692
            $session->flush;
1681
            $session->flush;
1693
            C4::Context->_unset_userenv($sessionID);
1694
            return ("expired", undef);
1682
            return ("expired", undef);
1695
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1696
1683
1684
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1697
            # IP address changed
1685
            # IP address changed
1698
            $session->delete();
1686
            $session->delete();
1699
            $session->flush;
1687
            $session->flush;
1700
            C4::Context->_unset_userenv($sessionID);
1701
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1688
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1689
1702
        } elsif ( $userid ) {
1690
        } elsif ( $userid ) {
1703
            $session->param( 'lasttime', time() );
1691
            $session->param( 'lasttime', time() );
1704
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1692
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1705
            if ($flags) {
1693
            if ($flags) {
1694
                C4::Context->_new_userenv($sessionID);
1695
                C4::Context->interface($session->param('interface'));
1696
                C4::Context->set_userenv(
1697
                    $session->param('number'),       $session->param('id') // '',
1698
                    $session->param('cardnumber'),   $session->param('firstname'),
1699
                    $session->param('surname'),      $session->param('branch'),
1700
                    $session->param('branchname'),   $session->param('flags'),
1701
                    $session->param('emailaddress'), $session->param('shibboleth'),
1702
                    $session->param('desk_id'),      $session->param('desk_name'),
1703
                    $session->param('register_id'),  $session->param('register_name')
1704
                );
1706
                return ( "ok", $session );
1705
                return ( "ok", $session );
1706
            } else {
1707
                $session->delete();
1708
                $session->flush;
1709
                return ( "failed", undef );
1707
            }
1710
            }
1711
1708
        } else {
1712
        } else {
1713
            C4::Context->_new_userenv($sessionID);
1714
            C4::Context->interface($session->param('interface'));
1715
            C4::Context->set_userenv( undef, q{} );
1709
            return ( "anon", $session );
1716
            return ( "anon", $session );
1710
        }
1717
        }
1711
        # If here user was logged in, but doesn't have correct permissions
1712
        # could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors
1713
        $session->delete();
1714
        $session->flush;
1715
        C4::Context->_unset_userenv($sessionID);
1716
        return ( "failed", undef );
1717
    } else {
1718
    } else {
1718
        return ( "expired", undef );
1719
        return ( "expired", undef );
1719
    }
1720
    }
Lines 1759-1767 sub _get_session_params { Link Here
1759
sub get_session {
1760
sub get_session {
1760
    my $sessionID      = shift;
1761
    my $sessionID      = shift;
1761
    my $params = _get_session_params();
1762
    my $params = _get_session_params();
1762
    my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1763
    my $session;
1763
    if ( ! $session ){
1764
    if( $sessionID ) { # find existing
1764
        die CGI::Session->errstr();
1765
        CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463
1766
        $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} );
1767
    } else {
1768
        $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1769
        # $session->flush;
1765
    }
1770
    }
1766
    return $session;
1771
    return $session;
1767
}
1772
}
1768
- 

Return to bug 29915