From b53b8a67f7bf5d5b152691bd8161bec7617ee731 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 9 Jul 2015 09:59:20 +0800 Subject: [PATCH] Allow web-based self-checkout to be limited to only certain IPs or IP ranges. New patch that uses Net::CIDR, which should be available in debian. --- .../bug_14407-add_selfcheckallowbyipranges_syspref.sql | 2 ++ installer/data/mysql/sysprefs.sql | 1 + .../prog/en/modules/admin/preferences/circulation.pref | 4 ++++ opac/sco/help.pl | 11 +++++++++++ opac/sco/printslip.pl | 10 ++++++++++ opac/sco/sco-main.pl | 9 +++++++++ opac/sco/sco-patron-image.pl | 9 +++++++++ 7 files changed, 46 insertions(+) create mode 100644 installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql diff --git a/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql b/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql new file mode 100644 index 0000000..4041a58 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql @@ -0,0 +1,2 @@ +INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES + ('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.)','Short'); diff --git a/installer/data/mysql/sysprefs.sql b/installer/data/mysql/sysprefs.sql index a343571..14a315d 100644 --- a/installer/data/mysql/sysprefs.sql +++ b/installer/data/mysql/sysprefs.sql @@ -374,6 +374,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('SCOUserJS','',NULL,'Define custom javascript for inclusion in the SCO module','free'), ('SearchMyLibraryFirst','0',NULL,'If ON, OPAC searches return results limited by the user\'s library by default if they are logged in','YesNo'), ('SearchWithISBNVariations','0',NULL,'If enabled, search on all variations of the ISBN','YesNo'), +('SelfCheckAllowByIPRanges','',NULL,('Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.)','Short'), ('SelfCheckHelpMessage','','70|10','Enter HTML to include under the basic Web-based Self Checkout instructions on the Help page','Textarea'), ('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'), ('SelfCheckTimeout','120','','Define the number of seconds before the Web-based Self Checkout times out a patron','Integer'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref index f9cd822..d08acba 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref @@ -681,6 +681,10 @@ Circulation: yes: Show no: "Don't show" - "the print receipt popup dialog when self checkout is finished" + - + - pref: SelfCheckAllowByIPRanges + class: short + - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.) Course Reserves: - diff --git a/opac/sco/help.pl b/opac/sco/help.pl index c41d737..1f755f5 100755 --- a/opac/sco/help.pl +++ b/opac/sco/help.pl @@ -24,11 +24,22 @@ use strict; use warnings; use CGI qw ( -utf8 ); +use Net::CIDR; use C4::Auth qw(get_template_and_user); use C4::Output qw(output_html_with_http_headers); my $query = new CGI; + + +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, Net::CIDR::range2cidr(@allowedipranges))) { + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; + } +} + my ($template, $borrowernumber, $cookie) = get_template_and_user({ template_name => "sco/help.tt", query => $query, diff --git a/opac/sco/printslip.pl b/opac/sco/printslip.pl index b85b8f5..eaf557d 100755 --- a/opac/sco/printslip.pl +++ b/opac/sco/printslip.pl @@ -29,12 +29,22 @@ It is called from sco-main.pl use strict; use warnings; use CGI qw ( -utf8 ); +use Net::CIDR; + use C4::Context; use C4::Auth qw/:DEFAULT get_session/; use C4::Output; use C4::Members; use C4::Koha; +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, Net::CIDR::range2cidr(@allowedipranges))) { + print $query->header(status => '403 Forbidden - functionality not available from your location'); + exit; + } +} + my $input = new CGI; my $sessionID = $input->cookie("CGISESSID"); my $session = get_session($sessionID); diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index b214f54..3741447 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -36,6 +36,7 @@ use warnings; use CGI qw ( -utf8 ); use Digest::MD5 qw(md5_base64); +use Net::CIDR; use C4::Auth qw(get_template_and_user checkpw); use C4::Koha; @@ -54,6 +55,14 @@ unless (C4::Context->preference('WebBasedSelfCheck')) { exit; } +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, Net::CIDR::range2cidr(@allowedipranges))) { + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; + } +} + if (C4::Context->preference('AutoSelfCheckAllowed')) { my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID'); diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl index c6c0a19..c83b7c3 100755 --- a/opac/sco/sco-patron-image.pl +++ b/opac/sco/sco-patron-image.pl @@ -19,6 +19,8 @@ use strict; use warnings; +use Net::IP::Match::XS; + use C4::Service; use C4::Members; @@ -32,6 +34,13 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { print $query->header(status => '403 Forbidden - displaying patron images in self-check not enabled'); exit; } +my @allowedipranges = split(' ', C4::Context->preference('SelfCheckAllowByIPRanges')); +if (scalar @allowedipranges > 0) { + unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, Net::CIDR::range2cidr(@allowedipranges))) { + print $query->header(status => '403 Forbidden - functionality not available from your location'); + exit; + } +} my ($borrowernumber) = C4::Service->require_params('borrowernumber'); -- 2.1.0