View | Details | Raw Unified | Return to bug 29915
Collapse All | Expand All

(-)a/C4/Auth.pm (-31 / +35 lines)
Lines 23-28 use Carp qw( croak ); Link Here
23
23
24
use Digest::MD5 qw( md5_base64 );
24
use Digest::MD5 qw( md5_base64 );
25
use CGI::Session;
25
use CGI::Session;
26
use CGI::Session::ErrorHandler;
26
use URI;
27
use URI;
27
use URI::QueryParam;
28
use URI::QueryParam;
28
29
Lines 901-907 sub checkauth { Link Here
901
                $anon_search_history = $session->param('search_history');
902
                $anon_search_history = $session->param('search_history');
902
                $session->delete();
903
                $session->delete();
903
                $session->flush;
904
                $session->flush;
904
                C4::Context->_unset_userenv($sessionID);
905
                C4::Context::_unset_userenv($sessionID);
905
            }
906
            }
906
            elsif ($logout) {
907
            elsif ($logout) {
907
908
Lines 910-916 sub checkauth { Link Here
910
                my $shibSuccess = C4::Context->userenv->{'shibboleth'};
911
                my $shibSuccess = C4::Context->userenv->{'shibboleth'};
911
                $session->delete();
912
                $session->delete();
912
                $session->flush;
913
                $session->flush;
913
                C4::Context->_unset_userenv($sessionID);
914
                C4::Context::_unset_userenv($sessionID);
914
915
915
                if ($cas and $caslogout) {
916
                if ($cas and $caslogout) {
916
                    logout_cas($query, $type);
917
                    logout_cas($query, $type);
Lines 1103-1109 sub checkauth { Link Here
1103
                }
1104
                }
1104
                else {
1105
                else {
1105
                    $info{'nopermission'} = 1;
1106
                    $info{'nopermission'} = 1;
1106
                    C4::Context->_unset_userenv($sessionID);
1107
                    C4::Context::_unset_userenv($sessionID);
1107
                }
1108
                }
1108
                my ( $borrowernumber, $firstname, $surname, $userflags,
1109
                my ( $borrowernumber, $firstname, $surname, $userflags,
1109
                    $branchcode, $branchname, $emailaddress, $desk_id,
1110
                    $branchcode, $branchname, $emailaddress, $desk_id,
Lines 1228-1234 sub checkauth { Link Here
1228
            else {
1229
            else {
1229
                if ($userid) {
1230
                if ($userid) {
1230
                    $info{'invalid_username_or_password'} = 1;
1231
                    $info{'invalid_username_or_password'} = 1;
1231
                    C4::Context->_unset_userenv($sessionID);
1232
                    C4::Context::_unset_userenv($sessionID);
1232
                }
1233
                }
1233
                $session->param( 'lasttime', time() );
1234
                $session->param( 'lasttime', time() );
1234
                $session->param( 'ip',       $session->remote_addr() );
1235
                $session->param( 'ip',       $session->remote_addr() );
Lines 1686-1742 sub check_cookie_auth { Link Here
1686
    # however, if a userid parameter is present (i.e., from
1687
    # however, if a userid parameter is present (i.e., from
1687
    # a form submission, assume that any current cookie
1688
    # a form submission, assume that any current cookie
1688
    # is to be ignored
1689
    # is to be ignored
1689
    unless ( defined $sessionID and $sessionID ) {
1690
    unless ( $sessionID ) {
1690
        return ( "failed", undef );
1691
        return ( "failed", undef );
1691
    }
1692
    }
1693
    C4::Context::_unset_userenv($sessionID); # remove old userenv first
1692
    my $session   = get_session($sessionID);
1694
    my $session   = get_session($sessionID);
1693
    C4::Context->_new_userenv($sessionID);
1694
    if ($session) {
1695
    if ($session) {
1695
        C4::Context->interface($session->param('interface'));
1696
        C4::Context->set_userenv(
1697
            $session->param('number'),       $session->param('id') // '',
1698
            $session->param('cardnumber'),   $session->param('firstname'),
1699
            $session->param('surname'),      $session->param('branch'),
1700
            $session->param('branchname'),   $session->param('flags'),
1701
            $session->param('emailaddress'), $session->param('shibboleth'),
1702
            $session->param('desk_id'),      $session->param('desk_name'),
1703
            $session->param('register_id'),  $session->param('register_name')
1704
        );
1705
1706
        my $userid   = $session->param('id');
1696
        my $userid   = $session->param('id');
1707
        my $ip       = $session->param('ip');
1697
        my $ip       = $session->param('ip');
1708
        my $lasttime = $session->param('lasttime');
1698
        my $lasttime = $session->param('lasttime');
1709
        my $timeout = _timeout_syspref();
1699
        my $timeout = _timeout_syspref();
1710
1700
1711
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1701
        if ( !$lasttime || ( $lasttime < time() - $timeout ) ) {
1712
1713
            # time out
1702
            # time out
1714
            $session->delete();
1703
            $session->delete();
1715
            $session->flush;
1704
            $session->flush;
1716
            C4::Context->_unset_userenv($sessionID);
1717
            return ("expired", undef);
1705
            return ("expired", undef);
1718
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1719
1706
1707
        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) {
1720
            # IP address changed
1708
            # IP address changed
1721
            $session->delete();
1709
            $session->delete();
1722
            $session->flush;
1710
            $session->flush;
1723
            C4::Context->_unset_userenv($sessionID);
1724
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1711
            return ( "restricted", undef, { old_ip => $ip, new_ip => $remote_addr});
1712
1725
        } elsif ( $userid ) {
1713
        } elsif ( $userid ) {
1726
            $session->param( 'lasttime', time() );
1714
            $session->param( 'lasttime', time() );
1727
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1715
            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
1728
            if ($flags) {
1716
            if ($flags) {
1717
                C4::Context->_new_userenv($sessionID);
1718
                C4::Context->interface($session->param('interface'));
1719
                C4::Context->set_userenv(
1720
                    $session->param('number'),       $session->param('id') // '',
1721
                    $session->param('cardnumber'),   $session->param('firstname'),
1722
                    $session->param('surname'),      $session->param('branch'),
1723
                    $session->param('branchname'),   $session->param('flags'),
1724
                    $session->param('emailaddress'), $session->param('shibboleth'),
1725
                    $session->param('desk_id'),      $session->param('desk_name'),
1726
                    $session->param('register_id'),  $session->param('register_name')
1727
                );
1729
                return ( "ok", $session );
1728
                return ( "ok", $session );
1729
            } else {
1730
                $session->delete();
1731
                $session->flush;
1732
                return ( "failed", undef );
1730
            }
1733
            }
1734
1731
        } else {
1735
        } else {
1736
            C4::Context->_new_userenv($sessionID);
1737
            C4::Context->interface($session->param('interface'));
1738
            C4::Context->set_userenv( undef, q{} );
1732
            return ( "anon", $session );
1739
            return ( "anon", $session );
1733
        }
1740
        }
1734
        # If here user was logged in, but doesn't have correct permissions
1735
        # could be an 'else' at `if($flags) return "ok"` , but left here to catch any errors
1736
        $session->delete();
1737
        $session->flush;
1738
        C4::Context->_unset_userenv($sessionID);
1739
        return ( "failed", undef );
1740
    } else {
1741
    } else {
1741
        return ( "expired", undef );
1742
        return ( "expired", undef );
1742
    }
1743
    }
Lines 1782-1790 sub _get_session_params { Link Here
1782
sub get_session {
1783
sub get_session {
1783
    my $sessionID      = shift;
1784
    my $sessionID      = shift;
1784
    my $params = _get_session_params();
1785
    my $params = _get_session_params();
1785
    my $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1786
    my $session;
1786
    if ( ! $session ){
1787
    if( $sessionID ) { # find existing
1787
        die CGI::Session->errstr();
1788
        CGI::Session::ErrorHandler->set_error( q{} ); # clear error, cpan issue #111463
1789
        $session = CGI::Session->load( $params->{dsn}, $sessionID, $params->{dsn_args} );
1790
    } else {
1791
        $session = CGI::Session->new( $params->{dsn}, $sessionID, $params->{dsn_args} );
1792
        # $session->flush;
1788
    }
1793
    }
1789
    return $session;
1794
    return $session;
1790
}
1795
}
1791
- 

Return to bug 29915