@@ -, +, @@ REST API --- C4/Auth.pm | 7 ++++++- Koha/REST/V1.pm | 4 +++- 2 files changed, 9 insertions(+), 2 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -814,6 +814,7 @@ sub checkauth { C4::Context::set_shelves_userenv( 'tot', $session->param('totshelves') ); $debug and printf STDERR "AUTH_SESSION: (%s)\t%s %s - %s\n", map { $session->param($_) } qw(cardnumber firstname surname branch); $ip = $session->param('ip'); + $lasttime = $session->param('lasttime'); $userid = $s_userid; $sessiontype = $session->param('sessiontype') || ''; @@ -1614,7 +1615,9 @@ Possible return values in C<$status> are: sub check_cookie_auth { my $cookie = shift; my $flagsrequired = shift; + my $params = shift; + my $remote_addr = $params->{remote_addr} || $ENV{REMOTE_ADDR}; my $dbh = C4::Context->dbh; my $timeout = _timeout_syspref(); @@ -1650,6 +1653,7 @@ sub check_cookie_auth { my $sessionID = $cookie; my $session = get_session($sessionID); C4::Context->_new_userenv($sessionID); + if ($session) { C4::Context->set_userenv( $session->param('number'), $session->param('id'), @@ -1660,6 +1664,7 @@ sub check_cookie_auth { ); my $ip = $session->param('ip'); + my $lasttime = $session->param('lasttime'); my $userid = $session->param('id'); if ( $lasttime < time() - $timeout ) { @@ -1671,7 +1676,7 @@ sub check_cookie_auth { $userid = undef; $sessionID = undef; return ("expired", undef); - } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $ENV{'REMOTE_ADDR'} ) { + } elsif ( C4::Context->preference('SessionRestrictionByIP') && $ip ne $remote_addr ) { # IP address changed $session->delete(); --- a/Koha/REST/V1.pm +++ a/Koha/REST/V1.pm @@ -29,7 +29,9 @@ sub startup { cb => sub { my $c = shift; - my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID')); + # ENV{REMOTE_ADDR} is not set here, we need to read the headers + my $remote_addr = $c->req->headers->header('x-forwarded-for'); + my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'), undef, { remote_addr => $remote_addr }); if ($status eq "ok") { my $session = get_session($sessionID); my $user = Koha::Patrons->find($session->param('number')); --