From 5160d9a81cbfa18b7c13107be3da7785fd635517 Mon Sep 17 00:00:00 2001 From: Michael Hafen Date: Fri, 2 Jul 2021 11:03:08 -0600 Subject: [PATCH] Bug 28657: expand branches.branchip to allow for multiple ip ranges. Content-Type: text/plain; charset="utf-8" . Change branches.branchip to a mediumtext, and remove '*' from existing branchip settings. . Change C4/Auth.pm and Koha/Template/Plugin/Branches.pm from a regexp to using in_iprange() to check client address against branchip. (in_iprange() doesn't work with '*' in branchip.) . Change in_iprange() to default to false (which is what the POD says it should do). Also, have it trim '*' in case someone adds some back later. . Change note in admin/branches.tt under branchip field to reflect changes to branchip handling. Test plan: 1. Turn on StaffLoginRestrictLibraryByIp or StaffLoginBranchBasedOnIP system preference 2. Change a libraries branchip to multiple ip ranges seperated by a space, making sure one of the ranges includes your computers address. 3. Log out and try logging in. The library won't appear in the select list. The location check will fail. 4. Apply patch and database update in patch. Restart plack if necessary. 5. Try logging in again. The library will appear in the select list and the location check will succeed. --- C4/Auth.pm | 17 ++++++++------ Koha/Template/Plugin/Branches.pm | 6 ++--- .../data/mysql/atomicupdate/bug_28657.perl | 23 +++++++++++++++++++ installer/data/mysql/kohastructure.sql | 2 +- .../prog/en/modules/admin/branches.tt | 4 ++-- 5 files changed, 38 insertions(+), 14 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_28657.perl diff --git a/C4/Auth.pm b/C4/Auth.pm index d4b83bb75e..8ccd131947 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1218,9 +1218,8 @@ sub checkauth { if ( C4::Context->preference('StaffLoginRestrictLibraryByIP') ) { # we have to check they are coming from the right ip range my $domain = $branches->{$branchcode}->{'branchip'} // q{}; - $domain =~ s|\.\*||g; - $domain =~ s/\s+//g; - if ( $domain && $ip !~ /^$domain/ ) { + next unless ( $domain ); + if ( ! in_iprange($domain) ) { $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( -name => 'CGISESSID', -value => '', @@ -1253,7 +1252,8 @@ sub checkauth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + next unless ( $domain ); + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -1730,7 +1730,8 @@ sub check_api_auth { # now we work with the treatment of ip my $domain = $branches->{$br}->{'branchip'}; - if ( $domain && $ip =~ /^$domain/ ) { + next unless ( $domain ); + if ( in_iprange($domain) ) { $branchcode = $branches->{$br}->{'branchcode'}; # new op dev : add the branchname to the cookie @@ -2363,9 +2364,11 @@ Returns 1 if the remote address is in the provided iprange, or 0 otherwise. sub in_iprange { my ($iprange) = @_; - my $result = 1; + my $result = 0; + # FIXME remove '*' for backwards compatibility in branchip settings + $iprange =~ s|\*||g; my @allowedipranges = $iprange ? split(' ', $iprange) : (); - if (scalar @allowedipranges > 0) { + if (@allowedipranges) { my @rangelist; eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@; eval { $result = Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist) } || Koha::Logger->get->warn('cidrlookup failed for ' . join(' ',@rangelist) ); diff --git a/Koha/Template/Plugin/Branches.pm b/Koha/Template/Plugin/Branches.pm index 72870b8b69..56f224d4cc 100644 --- a/Koha/Template/Plugin/Branches.pm +++ b/Koha/Template/Plugin/Branches.pm @@ -25,6 +25,7 @@ use base qw( Template::Plugin ); use C4::Koha; use C4::Context; +use C4::Auth qw(in_iprange); use Koha::Cache::Memory::Lite; use Koha::Libraries; @@ -91,13 +92,10 @@ sub all { : Koha::Libraries->search_filtered( $search_params, { order_by => ['branchname'] } )->unblessed; if ($ip_limit) { - my $ip = $ENV{'REMOTE_ADDR'}; my @ip_libraries = (); for my $l (@$libraries) { my $domain = $l->{branchip} // ''; - $domain =~ s|\.\*||g; - $domain =~ s/\s+//g; - unless ( $domain && $ip !~ /^$domain/ ) { + unless ( $domain && ! in_iprange($domain) ) { push @ip_libraries, $l; } } diff --git a/installer/data/mysql/atomicupdate/bug_28657.perl b/installer/data/mysql/atomicupdate/bug_28657.perl new file mode 100644 index 0000000000..b606956be3 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_28657.perl @@ -0,0 +1,23 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do( "ALTER TABLE `branches` MODIFY `branchip` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'the IP address(s) for your library or branch'" ); + + my $sth = $dbh->prepare(" + SELECT branchip,branchcode + FROM branches + WHERE branchip like '%*%' + "); + $sth->execute; + my $results = $sth->fetchall_arrayref({}); + $sth = $dbh->prepare(" + UPDATE branches + SET branchip = ? + WHERE branchcode = ? + "); + foreach(@$results) { + $_->{branchip} =~ s|\*||g; + $sth->execute($_->{branchip}, $_->{branchcode}); + } + + NewVersion( $DBversion, 28657, "expand branches.branchip to allow for multiple ip ranges and remove '*'"); +} diff --git a/installer/data/mysql/kohastructure.sql b/installer/data/mysql/kohastructure.sql index f3dd950328..0c1a2e7162 100644 --- a/installer/data/mysql/kohastructure.sql +++ b/installer/data/mysql/kohastructure.sql @@ -1658,7 +1658,7 @@ CREATE TABLE `branches` ( `branchreturnpath` longtext DEFAULT NULL COMMENT 'the email to be used as Return-Path', `branchurl` longtext DEFAULT NULL COMMENT 'the URL for your library or branch''s website', `issuing` tinyint(4) DEFAULT NULL COMMENT 'unused in Koha', - `branchip` varchar(15) DEFAULT NULL COMMENT 'the IP address for your library or branch', + `branchip` mediumtext DEFAULT NULL COMMENT 'the IP address for your library or branch', `branchnotes` longtext DEFAULT NULL COMMENT 'notes related to your library or branch', `geolocation` varchar(255) DEFAULT NULL COMMENT 'geolocation of your library', `marcorgcode` varchar(16) DEFAULT NULL COMMENT 'MARC Organization Code, see http://www.loc.gov/marc/organizations/orgshome.html, when empty defaults to syspref MARCOrgCode', diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt index ad58c35346..fa26292b4d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt @@ -250,8 +250,8 @@
  • - -
    Can be entered as a single IP, or a subnet such as 192.168.1.*
    + +
    Can be entered as a single IP, an IP range such as 192.168.1. or 192.168.1.10-192.168.1.50 or 192.168.1.0/24, or multiple space separated IP addresses or ranges.
  • -- 2.43.0