From 7d84edc77ba68ea1ceb356109ab13d00a2ae5441 Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Wed, 15 May 2024 16:10:05 +0000 Subject: [PATCH] Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed To test: 1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank 2 - In another window: http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item 3 - You get a response 4 - Apply patch and restart all 5 - Reload ilsdi page, 'Not authorized' 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs 7 - Reload the page, you get a response again 8 - Change ILS-DI:AuthorizedIPs to: 0:0:0:0/0 9 - You still have access 10 - Paste your specific IP again, and add a second made up IP (comma separated) 11 - Reload and confirm you still have access Signed-off-by: Martin Renvoize --- opac/ilsdi.pl | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl index 280b7ab83ca..f22764ccc74 100755 --- a/opac/ilsdi.pl +++ b/opac/ilsdi.pl @@ -178,6 +178,19 @@ if (@AuthorizedIPs) { # If no filter set, allow access to everybody $out->{'code'} = "NotAllowed"; $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; } +} else { + $out->{'code'} = "NotAllowed"; + $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; + + print XMLout( + $out, + noattr => 1, + nosort => 1, + xmldecl => '', + RootName => "ilsdi", + SuppressEmpty => 1 + ); + exit 0; } my $service = $cgi->param('service') || "ilsdi"; -- 2.49.0