From cf0a07b07272cd1fb1297c3841a5ff1786f2405c Mon Sep 17 00:00:00 2001 From: Michael Hafen Date: Fri, 2 Jul 2021 11:03:08 -0600 Subject: [PATCH] Bug 28657: expand branches.branchip to allow for multiple ip ranges. Content-Type: text/plain; charset="utf-8" change branches.branchip to a mediumtext, and remove '*' from existing branchip settings. Change C4/Auth.pm from a regexp to using in_iprange() to check client address against branchip. (in_iprange() doesn't work with '*' in branchip.) Change in_iprange() to default to false (which is what the POD says it should do). Also, have it trim '*' in case someone adds some back later. Change note in admin/branches.tt under branchip field to reflect changes to branchip handling. Test plan: 1. Turn on AutoLocation system preference 2. Change a branches branchip to multiple ip ranges seperated by a space, making sure one of the ranges includes your computers address. 3. Log out and try logging in. The location check will fail. 4. Apply patch. Restart plack if necessary. 5. Try logging in again. The location check will succeed. --- C4/Auth.pm | 16 ++++++++----- .../data/mysql/atomicupdate/bug_28657.perl | 23 +++++++++++++++++++ installer/data/mysql/kohastructure.sql | 2 +- .../prog/en/modules/admin/branches.tt | 4 ++-- 4 files changed, 36 insertions(+), 9 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_28657.perl diff --git a/C4/Auth.pm b/C4/Auth.pm index d7151485a2..677d125318 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1180,8 +1180,8 @@ sub checkauth { # we have to check they are coming from the right ip range my $domain = $branches->{$branchcode}->{'branchip'}; - $domain =~ s|\.\*||g; - if ( $ip !~ /^$domain/ ) { + next unless ( $domain ); + if ( ! in_iprange($domain) ) { $loggedin = 0; $cookie = $query->cookie( -name => 'CGISESSID', @@ -1197,7 +1197,8 @@ sub checkauth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + next unless ( $domain ); + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -1603,7 +1604,8 @@ sub check_api_auth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + next unless ( $domain ); + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -2167,9 +2169,11 @@ Returns 1 if the remote address is in the provided iprange, or 0 otherwise. sub in_iprange { my ($iprange) = @_; - my $result = 1; + my $result = 0; + # FIXME remove '*' for backwards compatibility in branchip settings + $iprange =~ s|\*||g; my @allowedipranges = $iprange ? split(' ', $iprange) : (); - if (scalar @allowedipranges > 0) { + if (@allowedipranges) { my @rangelist; eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@; eval { $result = Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist) } || Koha::Logger->get->warn('cidrlookup failed for ' . join(' ',@rangelist) ); diff --git a/installer/data/mysql/atomicupdate/bug_28657.perl b/installer/data/mysql/atomicupdate/bug_28657.perl new file mode 100644 index 0000000000..b606956be3 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_28657.perl @@ -0,0 +1,23 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do( "ALTER TABLE `branches` MODIFY `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch'" ); + + my $sth = $dbh->prepare(" + SELECT branchip,branchcode + FROM branches + WHERE branchip like '%*%' + "); + $sth->execute; + my $results = $sth->fetchall_arrayref({}); + $sth = $dbh->prepare(" + UPDATE branches + SET branchip = ? + WHERE branchcode = ? + "); + foreach(@$results) { + $_->{branchip} =~ s|\*||g; + $sth->execute($_->{branchip}, $_->{branchcode}); + } + + NewVersion( $DBversion, 28657, "expand branches.branchip to allow for multiple ip ranges and remove '*'"); +} diff --git a/installer/data/mysql/kohastructure.sql b/installer/data/mysql/kohastructure.sql index e8325e18ab..0595c1b571 100644 --- a/installer/data/mysql/kohastructure.sql +++ b/installer/data/mysql/kohastructure.sql @@ -1511,7 +1511,7 @@ CREATE TABLE `branches` ( `branchreturnpath` longtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the email to be used as Return-Path', `branchurl` longtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the URL for your library or branch''s website', `issuing` tinyint(4) DEFAULT NULL COMMENT 'unused in Koha', - `branchip` varchar(15) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address for your library or branch', + `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch', `branchnotes` longtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'notes related to your library or branch', `opac_info` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'HTML that displays in OPAC', `geolocation` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'geolocation of your library', diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt index 7f5db486e4..1b2aec24b2 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt @@ -238,8 +238,8 @@ Libraries › Administration › Koha
  • - -
    Can be entered as a single IP, or a subnet such as 192.168.1.*
    + +
    Can be entered as a single IP, an IP range such as 192.168.1. or 192.168.1.10-192.168.1.50 or 192.168.1.0/24, or multiple space separated IP addresses or ranges.
  • -- 2.25.1