From c75f5b6d6cb16850838d5db1bd849cf7702e4378 Mon Sep 17 00:00:00 2001 From: Nicholas van Oudtshoorn Date: Tue, 22 Dec 2015 13:13:21 +0800 Subject: [PATCH] Minor adjustment to the previous patch, removing a no-longer-needed "use" --- C4/Auth.pm | 24 +++++++++++++++++++++- C4/Installer/PerlDependencies.pm | 5 +++++ ..._14407-add_selfcheckallowbyipranges_syspref.sql | 2 ++ installer/data/mysql/sysprefs.sql | 1 + .../en/modules/admin/preferences/circulation.pref | 4 ++++ opac/sco/help.pl | 8 +++++++- opac/sco/printslip.pl | 8 +++++++- opac/sco/sco-main.pl | 7 ++++++- opac/sco/sco-patron-image.pl | 6 ++++++ 9 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql diff --git a/C4/Auth.pm b/C4/Auth.pm index 8512fd9..9f683f9 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -35,6 +35,7 @@ use Koha::AuthUtils qw(hash_password); use POSIX qw/strftime/; use List::MoreUtils qw/ any /; use Encode qw( encode is_utf8); +use Net::CIDR; # use utf8; use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login); @@ -52,7 +53,7 @@ BEGIN { @ISA = qw(Exporter); @EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash - &get_all_subpermissions &get_user_subpermissions + &get_all_subpermissions &get_user_subpermissions &in_ipset ); %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); $ldap = C4::Context->config('useldapserver') || 0; @@ -2021,6 +2022,27 @@ sub getborrowernumber { return 0; } +=head2 in_ipset + + $flags = ($ipset); + +C<$ipset> A space separated string describing an IP set. Can include single IPs or ranges + +Returns 1 if the remote address is in the provided ipset, or 0 otherwise. + +=cut + +sub in_ipset { + my ($ipset) = @_; + my @allowedipranges = split(' ', $ipset); + if (scalar @allowedipranges > 0) { + unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, Net::CIDR::range2cidr(@allowedipranges))) { + return 0; + } + } + return 1; +} + END { } # module clean-up code here (global destructor) 1; __END__ diff --git a/C4/Installer/PerlDependencies.pm b/C4/Installer/PerlDependencies.pm index c1d03c7..847752e 100644 --- a/C4/Installer/PerlDependencies.pm +++ b/C4/Installer/PerlDependencies.pm @@ -782,6 +782,11 @@ our $PERL_DEPS = { 'required' => '1', 'min_ver' => '1.10', }, + 'Net::CIDR' => { + 'usage' => 'Core', + 'required' => '1', + 'min_ver' => '0.15', + }, }; 1; diff --git a/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql b/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql new file mode 100644 index 0000000..4041a58 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql @@ -0,0 +1,2 @@ +INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES + ('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.)','Short'); diff --git a/installer/data/mysql/sysprefs.sql b/installer/data/mysql/sysprefs.sql index 484b3cd..1ecd26f 100644 --- a/installer/data/mysql/sysprefs.sql +++ b/installer/data/mysql/sysprefs.sql @@ -393,6 +393,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('SCOUserJS','',NULL,'Define custom javascript for inclusion in the SCO module','free'), ('SearchMyLibraryFirst','0',NULL,'If ON, OPAC searches return results limited by the user\'s library by default if they are logged in','YesNo'), ('SearchWithISBNVariations','0',NULL,'If enabled, search on all variations of the ISBN','YesNo'), +('SelfCheckAllowByIPRanges','',NULL,('Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.)','Short'), ('SelfCheckHelpMessage','','70|10','Enter HTML to include under the basic Web-based Self Checkout instructions on the Help page','Textarea'), ('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'), ('SelfCheckTimeout','120','','Define the number of seconds before the Web-based Self Checkout times out a patron','Integer'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref index 6a0954d..39fc7b8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref @@ -698,6 +698,10 @@ Circulation: yes: Show no: "Don't show" - "the print receipt popup dialog when self checkout is finished" + - + - pref: SelfCheckAllowByIPRanges + class: short + - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24.) Course Reserves: - - pref: UseCourseReserves diff --git a/opac/sco/help.pl b/opac/sco/help.pl index 412dc40..74ab566 100755 --- a/opac/sco/help.pl +++ b/opac/sco/help.pl @@ -25,10 +25,16 @@ use strict; use warnings; use CGI qw ( -utf8 ); -use C4::Auth qw(get_template_and_user); +use C4::Auth qw(get_template_and_user in_ipset); use C4::Output qw(output_html_with_http_headers); my $query = new CGI; + +unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) { + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; +} + my ($template, $borrowernumber, $cookie) = get_template_and_user({ template_name => "sco/help.tt", query => $query, diff --git a/opac/sco/printslip.pl b/opac/sco/printslip.pl index b85b8f5..6d65686 100755 --- a/opac/sco/printslip.pl +++ b/opac/sco/printslip.pl @@ -29,12 +29,18 @@ It is called from sco-main.pl use strict; use warnings; use CGI qw ( -utf8 ); + use C4::Context; -use C4::Auth qw/:DEFAULT get_session/; +use C4::Auth qw/:DEFAULT get_session in_ipset/; use C4::Output; use C4::Members; use C4::Koha; +unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) { + print $query->header(status => '403 Forbidden - functionality not available from your location'); + exit; +} + my $input = new CGI; my $sessionID = $input->cookie("CGISESSID"); my $session = get_session($sessionID); diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index eff549d..a839d26 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -37,7 +37,7 @@ use warnings; use CGI qw ( -utf8 ); use Digest::MD5 qw(md5_base64); -use C4::Auth qw(get_template_and_user checkpw); +use C4::Auth qw(get_template_and_user checkpw in_ipset); use C4::Koha; use C4::Circulation; use C4::Reserves; @@ -53,6 +53,11 @@ unless (C4::Context->preference('WebBasedSelfCheck')) { print $query->redirect("/cgi-bin/koha/opac-main.pl"); exit; } +unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) { + # redirect to OPAC home if self-checkout not permitted from current IP + print $query->redirect("/cgi-bin/koha/opac-main.pl"); + exit; +} if (C4::Context->preference('AutoSelfCheckAllowed')) { diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl index 9ace639..feeee18 100755 --- a/opac/sco/sco-patron-image.pl +++ b/opac/sco/sco-patron-image.pl @@ -19,6 +19,8 @@ use strict; use warnings; + +use C4::Auth qw(in_ipset); use C4::Service; use C4::Members; @@ -32,6 +34,10 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { print $query->header(status => '403 Forbidden - displaying patron images in self-check not enabled'); exit; } +unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) { + print $query->header(status => '403 Forbidden - functionality not available from your location'); + exit; +} my ($borrowernumber) = C4::Service->require_params('borrowernumber'); -- 2.4.3