@@ -, +, @@ for Session Security. Disable when remote ip address changes frequently. --- C4/Auth.pm | 5 +++-- .../intranet-tmpl/prog/en/modules/admin/preferences/admin.pref | 7 +++++++ 2 files changed, 10 insertions(+), 2 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -1115,6 +1115,7 @@ sub checkauth { INPUTS => \@inputs, casAuthentication => C4::Context->preference("casAuthentication"), shibbolethAuthentication => $shib, + SessionRestrictionByIP => C4::Context->preference("SessionRestrictionByIP"), suggestion => C4::Context->preference("suggestion"), virtualshelves => C4::Context->preference("virtualshelves"), LibraryName => "" . C4::Context->preference("LibraryName"), @@ -1301,7 +1302,7 @@ sub check_api_auth { $userid = undef; $sessionID = undef; return ("expired", undef, undef); - } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { # IP address changed $session->delete(); $session->flush; @@ -1543,7 +1544,7 @@ sub check_cookie_auth { $userid = undef; $sessionID = undef; return ("expired", undef); - } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { # IP address changed $session->delete(); $session->flush; --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -63,6 +63,13 @@ Administration: yes: Require no: "Don't require" - staff to log in from a computer in the IP address range specified by their library (if any). + - + - pref: SessionRestrictionByIP + default: 0 + choices: + yes: Enable + no: "Disable" + - Check for Change in Remote IP address for Session Security. Disable when remote ip address changes frequently. # PostgreSQL is supported by CGI::Session but not by Koha. - - Store login session information --