From fb63af58450659746227115a81b019317748b805 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amitddng135@gmail.com>
Date: Tue, 8 Oct 2013 09:33:54 +0530
Subject: [PATCH 1/2] Bug - 5511: Check for Change in Remote IP address for
Session Security. Disable when remote ip address
changes frequently.
To Test:
1) Enable the system preference SessionRestrictionByIP
2) Change your system IP. It will not checkout your system IP or signout.
---
C4/Auth.pm | 5 +++--
.../prog/en/modules/admin/preferences/admin.pref | 7 +++++++
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/C4/Auth.pm b/C4/Auth.pm
index 156be9d..088fe27 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1009,6 +1009,7 @@ sub checkauth {
login => 1,
INPUTS => \@inputs,
casAuthentication => C4::Context->preference("casAuthentication"),
+ SessionRestrictionByIP => C4::Context->preference("SessionRestrictionByIP"),
suggestion => C4::Context->preference("suggestion"),
virtualshelves => C4::Context->preference("virtualshelves"),
LibraryName => "" . C4::Context->preference("LibraryName"),
@@ -1188,7 +1189,7 @@ sub check_api_auth {
$userid = undef;
$sessionID = undef;
return ("expired", undef, undef);
- } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+ } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) {
# IP address changed
$session->delete();
C4::Context->_unset_userenv($sessionID);
@@ -1427,7 +1428,7 @@ sub check_cookie_auth {
$userid = undef;
$sessionID = undef;
return ("expired", undef);
- } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+ } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) {
# IP address changed
$session->delete();
C4::Context->_unset_userenv($sessionID);
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
index 1215ac1..aa6be3c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
@@ -53,6 +53,13 @@ Administration:
yes: Require
no: "Don't require"
- staff to log in from a computer in the IP address range <a href="/cgi-bin/koha/admin/branches.pl">specified by their library</a> (if any).
+ -
+ - pref: SessionRestrictionByIP
+ default: 0
+ choices:
+ yes: Enable
+ no: "Disable"
+ - Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently.
# PostgreSQL is supported by CGI::Session but not by Koha.
-
- Store login session information
--
1.7.9.5