From 01b4a76d32cb5a31a09509f9eb6664e47bfe844a Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Wed, 15 May 2024 16:10:05 +0000 Subject: [PATCH] Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed To test: 1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank 2 - In another window: http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item 3 - You get a response 4 - Apply patch and restart all 5 - Reload ilsdi page, 'Not authorized' 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs 7 - Reload the page, you get a response again 8 - Change ILS-DI:AuthorizedIPs to: 0:0:0:0/0 9 - You still have access 10 - Paste your specific IP again, and add a second made up IP (comma separated) 11 - Reload and confirm you still have access --- opac/ilsdi.pl | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl index 5b105246fa4..b6b91b6ae1a 100755 --- a/opac/ilsdi.pl +++ b/opac/ilsdi.pl @@ -173,9 +173,22 @@ if (@AuthorizedIPs) { # If no filter set, allow access to everybody } } unless ($authorized) { - $out->{'code'} = "NotAllowed"; + $out->{'code'} = "NotAllowed"; $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; } +} else { + $out->{'code'} = "NotAllowed"; + $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; + + print XMLout( + $out, + noattr => 1, + nosort => 1, + xmldecl => '', + RootName => "ilsdi", + SuppressEmpty => 1 + ); + exit 0; } my $service = $cgi->param('service') || "ilsdi"; -- 2.39.2