From fb63af58450659746227115a81b019317748b805 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amitddng135@gmail.com>
Date: Tue, 8 Oct 2013 09:33:54 +0530
Subject: [PATCH 1/2] Bug - 5511: Check for Change in Remote IP address for
 Session Security. Disable when remote ip address
 changes frequently.

To Test:
1) Enable the system preference SessionRestrictionByIP
2) Change your system IP. It will not checkout your system IP or signout.
---
 C4/Auth.pm                                         |    5 +++--
 .../prog/en/modules/admin/preferences/admin.pref   |    7 +++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 156be9d..088fe27 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1009,6 +1009,7 @@ sub checkauth {
         login                => 1,
         INPUTS               => \@inputs,
         casAuthentication    => C4::Context->preference("casAuthentication"),
+        SessionRestrictionByIP     => C4::Context->preference("SessionRestrictionByIP"),
         suggestion           => C4::Context->preference("suggestion"),
         virtualshelves       => C4::Context->preference("virtualshelves"),
         LibraryName          => "" . C4::Context->preference("LibraryName"),
@@ -1188,7 +1189,7 @@ sub check_api_auth {
                 $userid    = undef;
                 $sessionID = undef;
                 return ("expired", undef, undef);
-            } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+            } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) {
                 # IP address changed
                 $session->delete();
                 C4::Context->_unset_userenv($sessionID);
@@ -1427,7 +1428,7 @@ sub check_cookie_auth {
             $userid    = undef;
             $sessionID = undef;
             return ("expired", undef);
-        } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) {
             # IP address changed
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
index 1215ac1..aa6be3c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
@@ -53,6 +53,13 @@ Administration:
                   yes: Require
                   no: "Don't require"
             - staff to log in from a computer in the IP address range <a href="/cgi-bin/koha/admin/branches.pl">specified by their library</a> (if any).
+        -
+            - pref: SessionRestrictionByIP
+              default: 0
+              choices:
+                  yes: Enable
+                  no: "Disable"
+            - Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently.
         # PostgreSQL is supported by CGI::Session but not by Koha.
         -
             - Store login session information
-- 
1.7.9.5