From 44c2634d39bd3fc4faab4be33e9b28c3cc40bc9e Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 8 Oct 2013 09:33:54 +0530 Subject: [PATCH] [SIGNED OFF] Bug - 5511: Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently. To Test: 1) Enable the system preference SessionRestrictionByIP 2) Change your system IP. It will not checkout your system IP or signout. Signed-off-by: Martin Renvoize --- C4/Auth.pm | 5 +++-- .../intranet-tmpl/prog/en/modules/admin/preferences/admin.pref | 7 +++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index b808c66..6255b34 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1115,6 +1115,7 @@ sub checkauth { INPUTS => \@inputs, casAuthentication => C4::Context->preference("casAuthentication"), shibbolethAuthentication => $shib, + SessionRestrictionByIP => C4::Context->preference("SessionRestrictionByIP"), suggestion => C4::Context->preference("suggestion"), virtualshelves => C4::Context->preference("virtualshelves"), LibraryName => "" . C4::Context->preference("LibraryName"), @@ -1301,7 +1302,7 @@ sub check_api_auth { $userid = undef; $sessionID = undef; return ("expired", undef, undef); - } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { # IP address changed $session->delete(); $session->flush; @@ -1543,7 +1544,7 @@ sub check_cookie_auth { $userid = undef; $sessionID = undef; return ("expired", undef); - } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { # IP address changed $session->delete(); $session->flush; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index e7d12fb..af58870 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -63,6 +63,13 @@ Administration: yes: Require no: "Don't require" - staff to log in from a computer in the IP address range specified by their library (if any). + - + - pref: SessionRestrictionByIP + default: 0 + choices: + yes: Enable + no: "Disable" + - Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently. # PostgreSQL is supported by CGI::Session but not by Koha. - - Store login session information -- 1.7.10.4