View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/C4/Auth.pm (-31 / +35 lines)
Lines 23-28 use Carp qw( croak ); Link Here
23
23
24
use Digest::MD5 qw( md5_base64 );
24
use Digest::MD5 qw( md5_base64 );
25
use CGI::Session;
25
use CGI::Session;
26
use CGI::Session::ErrorHandler;
26
use URI;
27
use URI;
27
use URI::QueryParam;
28
use URI::QueryParam;
28
29
Lines 902-908 sub checkauth { Link Here
902
                $anon_search_history = $session->param('search_history');
903
                $anon_search_history = $session->param('search_history');
903
                $session->delete();
904
                $session->delete();
904
                $session->flush;
905
                $session->flush;
905
                C4::Context->_unset_userenv($sessionID);
906
                C4::Context::_unset_userenv($sessionID);
906
            }
907
            }
907
            elsif ($logout) {
908
            elsif ($logout) {
908
909
Lines 912-918 sub checkauth { Link Here
912
                $session->delete();
913
                $session->delete();
913
                $session->flush;
914
                $session->flush;
914
                $cookies = clear_all_cookies($query);
915
                $cookies = clear_all_cookies($query);
915
                C4::Context->_unset_userenv($sessionID);
916
                C4::Context::_unset_userenv($sessionID);
916
917
917
                if ($cas and $caslogout) {
918
                if ($cas and $caslogout) {
918
                    logout_cas($query, $type);
919
                    logout_cas($query, $type);
Lines 1105-1111 sub checkauth { Link Here
1105
                }
1106
                }
1106
                else {
1107
                else {
1107
                    $info{'nopermission'} = 1;
1108
                    $info{'nopermission'} = 1;
1108
                    C4::Context->_unset_userenv($sessionID);
1109
                    C4::Context::_unset_userenv($sessionID);
1109
                }
1110
                }
1110
                my ( $borrowernumber, $firstname, $surname, $userflags,
1111
                my ( $borrowernumber, $firstname, $surname, $userflags,
1111
                    $branchcode, $branchname, $emailaddress, $desk_id,
1112
                    $branchcode, $branchname, $emailaddress, $desk_id,
Lines 1230-1236 sub checkauth { Link Here
1230
            else {
1231
            else {
1231
                if ($userid) {
1232
                if ($userid) {
1232
                    $info{'invalid_username_or_password'} = 1;
1233
                    $info{'invalid_username_or_password'} = 1;
1233
                    C4::Context->_unset_userenv($sessionID);
1234
                    C4::Context::_unset_userenv($sessionID);
1234
                }
1235
                }
1235
                $session->param( 'lasttime', time() );
1236
                $session->param( 'lasttime', time() );
1236
                $session->param( 'ip',       $session->remote_addr() );
1237
                $session->param( 'ip',       $session->remote_addr() );
Lines 1688-1744 sub check_cookie_auth { Link Here
1688
    # however, if a userid parameter is present (i.e., from
1689
    # however, if a userid parameter is present (i.e., from
1689
    # a form submission, assume that any current cookie
1690
    # a form submission, assume that any current cookie
1690
    # is to be ignored
1691
    # is to be ignored
1691
    unless ( defined $sessionID and $sessionID ) {
1692
    unless ( $sessionID ) {
1692
        return ( "failed", undef );
1693
        return ( "failed", undef );
1693
    }
1694
    }
1695
    C4::Context::_unset_userenv($sessionID); # remove old userenv first
1694
    my $session   = get_session($sessionID);
1696
    my $session   = get_session($sessionID);
1695
    C4::Context->_new_userenv($sessionID);
1696
    if ($session) {
1697
    if ($session) {
1697
        C4::Context->interface($session->param('interface'));
1698
        C4::Context->set_userenv(
1699
            $session->param('number'),       $session->param('id') // '',
1700
            $session->param('cardnumber'),   $session->param('firstname'),
1701
            $session->param('surname'),      $session->param('branch'),
1702
            $session->param('branchname'),   $session->param('flags'),
1703
            $session->param('emailaddress'), $session->param('shibboleth'),
1704
            $session->param('desk_id'),      $session->param('desk_name'),
1705
            $session->param('register_id'),  $session->param('register_name')
1706
        );
1707
1708
        my $userid   = $session->param('id');
1698
        my $userid   = $session->param('id');
1709
        my $ip       = $session->param('ip');
1699
        my $ip       = $session->param('ip');
1710
        my $lasttime = $session->param('lasttime');
1700
        my $lasttime = $session->param('lasttime');
1711
        my $timeout = _timeout_syspref();
1701
        my $timeout = _timeout_syspref();
1712
1702
1713
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1703
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1714
1715
            # time out
1704
            # time out
1716
            $session->delete();
1705
            $session->delete();
1717
            $session->flush;
1706
            $session->flush;
1718
            C4::Context->_unset_userenv($sessionID);
1719
            return ("expired", undef);
1707
            return ("expired", undef);
1720
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1721
1708
1709
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1722
            # IP address changed
1710
            # IP address changed
1723
            $session->delete();
1711
            $session->delete();
1724
            $session->flush;
1712
            $session->flush;
1725
            C4::Context->_unset_userenv($sessionID);
1726
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1713
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1714
1727
        } elsif ( $userid ) {
1715
        } elsif ( $userid ) {
1728
            $session->param( 'lasttime', time() );
1716
            $session->param( 'lasttime', time() );
1729
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1717
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1730
            if ($flags) {
1718
            if ($flags) {
1719
                C4::Context->_new_userenv($sessionID);
1720
                C4::Context->interface($session->param('interface'));
1721
                C4::Context->set_userenv(
1722
                    $session->param('number'),       $session->param('id') // '',
1723
                    $session->param('cardnumber'),   $session->param('firstname'),
1724
                    $session->param('surname'),      $session->param('branch'),
1725
                    $session->param('branchname'),   $session->param('flags'),
1726
                    $session->param('emailaddress'), $session->param('shibboleth'),
1727
                    $session->param('desk_id'),      $session->param('desk_name'),
1728
                    $session->param('register_id'),  $session->param('register_name')
1729
                );
1731
                return ( "ok", $session );
1730
                return ( "ok", $session );
1731
            } else {
1732
                $session->delete();
1733
                $session->flush;
1734
                return ( "failed", undef );
1732
            }
1735
            }
1736
1733
        } else {
1737
        } else {
1738
            C4::Context->_new_userenv($sessionID);
1739
            C4::Context->interface($session->param('interface'));
1740
            C4::Context->set_userenv( undef, q{} );
1734
            return ( "anon", $session );
1741
            return ( "anon", $session );
1735
        }
1742
        }
1736
        # If here user was logged in, but doesn't have correct permissions
1737
        # could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors
1738
        $session->delete();
1739
        $session->flush;
1740
        C4::Context->_unset_userenv($sessionID);
1741
        return ( "failed", undef );
1742
    } else {
1743
    } else {
1743
        return ( "expired", undef );
1744
        return ( "expired", undef );
1744
    }
1745
    }
Lines 1784-1792 sub _get_session_params { Link Here
1784
sub get_session {
1785
sub get_session {
1785
    my $sessionID      = shift;
1786
    my $sessionID      = shift;
1786
    my $params = _get_session_params();
1787
    my $params = _get_session_params();
1787
    my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1788
    my $session;
1788
    if ( ! $session ){
1789
    if( $sessionID ) { # find existing
1789
        die CGI::Session->errstr();
1790
        CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463
1791
        $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} );
1792
    } else {
1793
        $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1794
        # $session->flush;
1790
    }
1795
    }
1791
    return $session;
1796
    return $session;
1792
}
1797
}
1793
- 

Return to bug 29915