From 9778758215775399c2e8c7a88efa2fe79fb7d200 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amitddng135@gmail.com>
Date: Tue, 8 Oct 2013 09:33:54 +0530
Subject: [PATCH] [PASSED QA] Bug - 5511: Check for Change in Remote IP address
 for Session Security. Disable when remote ip address changes frequently.

To Test:
1) Enable the system preference SessionRestrictionByIP
2) Change your system IP. It will not checkout your system IP or signout.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
 C4/Auth.pm                                                         | 5 +++--
 .../intranet-tmpl/prog/en/modules/admin/preferences/admin.pref     | 7 +++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index b808c66..6255b34 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1115,6 +1115,7 @@ sub checkauth {
         INPUTS               => \@inputs,
         casAuthentication    => C4::Context->preference("casAuthentication"),
         shibbolethAuthentication => $shib,
+        SessionRestrictionByIP     => C4::Context->preference("SessionRestrictionByIP"),
         suggestion           => C4::Context->preference("suggestion"),
         virtualshelves       => C4::Context->preference("virtualshelves"),
         LibraryName          => "" . C4::Context->preference("LibraryName"),
@@ -1301,7 +1302,7 @@ sub check_api_auth {
                 $userid    = undef;
                 $sessionID = undef;
                 return ("expired", undef, undef);
-            } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+            } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) {
                 # IP address changed
                 $session->delete();
                 $session->flush;
@@ -1543,7 +1544,7 @@ sub check_cookie_auth {
             $userid    = undef;
             $sessionID = undef;
             return ("expired", undef);
-        } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+        } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) {
             # IP address changed
             $session->delete();
             $session->flush;
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
index f796361..e2ea915 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
@@ -63,6 +63,13 @@ Administration:
                   yes: Require
                   no: "Don't require"
             - staff to log in from a computer in the IP address range <a href="/cgi-bin/koha/admin/branches.pl">specified by their library</a> (if any).
+        -
+            - pref: SessionRestrictionByIP
+              default: 0
+              choices:
+                  yes: Enable
+                  no: "Disable"
+            - Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently.
         # PostgreSQL is supported by CGI::Session but not by Koha.
         -
             - Store login session information
-- 
1.9.1