From 9d1d15c6b7532c781bd9a387828b4877d60e318e Mon Sep 17 00:00:00 2001 From: Michael Hafen Date: Fri, 2 Jul 2021 11:03:08 -0600 Subject: [PATCH] Bug 28657: expand branches.branchip to allow for multiple ip ranges. Content-Type: text/plain; charset="utf-8" change branches.branchip to a mediumtext, and remove '*' from existing branchip settings. Change C4/Auth.pm from a regexp to using in_iprange() to check client address against branchip. (in_iprange() doesn't work with '*' in branchip.) Change in_iprange() to default to false (which is what the POD says it should do). Also, have it trim '*' in case someone adds some back later. Change note in admin/branches.tt under branchip field to reflect changes to branchip handling. Test plan: 1. Turn on AutoLocation system preference 2. Change a branches branchip to multiple ip ranges seperated by a space, making sure one of the ranges includes your computers address. 3. Log out and try logging in. The location check will fail. 4. Apply patch. Restart plack if necessary. 5. Try logging in again. The location check will succeed. --- C4/Auth.pm | 16 ++++++++----- .../data/mysql/atomicupdate/bug_28657.perl | 23 +++++++++++++++++++ installer/data/mysql/kohastructure.sql | 2 +- .../prog/en/modules/admin/branches.tt | 4 ++-- 4 files changed, 36 insertions(+), 9 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_28657.perl diff --git a/C4/Auth.pm b/C4/Auth.pm index adc1b5dd0d..e2af3dd1ff 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1186,8 +1186,8 @@ sub checkauth { # we have to check they are coming from the right ip range my $domain = $branches->{$branchcode}->{'branchip'}; - $domain =~ s|\.\*||g; - if ( $ip !~ /^$domain/ ) { + next unless ( $domain ); + if ( ! in_iprange($domain) ) { $loggedin = 0; $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', @@ -1204,7 +1204,8 @@ sub checkauth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + next unless ( $domain ); + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -1647,7 +1648,8 @@ sub check_api_auth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + next unless ( $domain ); + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -2260,9 +2262,11 @@ Returns 1 if the remote address is in the provided iprange, or 0 otherwise. sub in_iprange { my ($iprange) = @_; - my $result = 1; + my $result = 0; + # FIXME remove '*' for backwards compatibility in branchip settings + $iprange =~ s|\*||g; my @allowedipranges = $iprange ? split(' ', $iprange) : (); - if (scalar @allowedipranges > 0) { + if (@allowedipranges) { my @rangelist; eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@; eval { $result = Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist) } || Koha::Logger->get->warn('cidrlookup failed for ' . join(' ',@rangelist) ); diff --git a/installer/data/mysql/atomicupdate/bug_28657.perl b/installer/data/mysql/atomicupdate/bug_28657.perl new file mode 100644 index 0000000000..b606956be3 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_28657.perl @@ -0,0 +1,23 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do( "ALTER TABLE `branches` MODIFY `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch'" ); + + my $sth = $dbh->prepare(" + SELECT branchip,branchcode + FROM branches + WHERE branchip like '%*%' + "); + $sth->execute; + my $results = $sth->fetchall_arrayref({}); + $sth = $dbh->prepare(" + UPDATE branches + SET branchip = ? + WHERE branchcode = ? + "); + foreach(@$results) { + $_->{branchip} =~ s|\*||g; + $sth->execute($_->{branchip}, $_->{branchcode}); + } + + NewVersion( $DBversion, 28657, "expand branches.branchip to allow for multiple ip ranges and remove '*'"); +} diff --git a/installer/data/mysql/kohastructure.sql b/installer/data/mysql/kohastructure.sql index cba889d5e0..0cc5aacd83 100644 --- a/installer/data/mysql/kohastructure.sql +++ b/installer/data/mysql/kohastructure.sql @@ -1536,7 +1536,7 @@ CREATE TABLE `branches` ( `branchreturnpath` longtext DEFAULT NULL COMMENT 'the email to be used as Return-Path', `branchurl` longtext DEFAULT NULL COMMENT 'the URL for your library or branch''s website', `issuing` tinyint(4) DEFAULT NULL COMMENT 'unused in Koha', - `branchip` varchar(15) DEFAULT NULL COMMENT 'the IP address for your library or branch', + `branchip` mediumtext DEFAULT NULL COMMENT 'the IP address for your library or branch', `branchnotes` longtext DEFAULT NULL COMMENT 'notes related to your library or branch', `geolocation` varchar(255) DEFAULT NULL COMMENT 'geolocation of your library', `marcorgcode` varchar(16) DEFAULT NULL COMMENT 'MARC Organization Code, see http://www.loc.gov/marc/organizations/orgshome.html, when empty defaults to syspref MARCOrgCode', diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt index 218730f325..cdd1422f9e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt @@ -253,8 +253,8 @@ Libraries › Administration › Koha
  • - -
    Can be entered as a single IP, or a subnet such as 192.168.1.*
    + +
    Can be entered as a single IP, an IP range such as 192.168.1. or 192.168.1.10-192.168.1.50 or 192.168.1.0/24, or multiple space separated IP addresses or ranges.
  • -- 2.34.1