From 4ad40081b0a3f0c7bd4bda859308599a75626707 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Fri, 19 Aug 2016 14:59:04 -0300 Subject: [PATCH] Bug 17050: (QA followup) Use Mojo::Transaction to get the remote address While the original patch fixes the issue, reading at Mojolicious source code, revealed that Mojo::Transaction already has proper processing for detecting the remote address: sub remote_address { my $self = shift; return $self->original_remote_address(@_) if @_; return $self->original_remote_address unless $self->req->reverse_proxy; # Reverse proxy return ($self->req->headers->header('X-Forwarded-For') // '') =~ /([^,\s]+)$/ ? $1 : $self->original_remote_address; } Without this patch, if there's a request without HTTP_X_FORWARDED_FOR, then the remote address would be empty. Such would be the case of a dev/standard setup without Plack. This patch makes Koha::REST::V1::startup use tx->remote_address instead of dealing with the headers on its own. Signed-off-by: Tomas Cohen Arazi Signed-off-by: Benjamin Rokseth Signed-off-by: Jonathan Druart Signed-off-by: Kyle M Hall https://bugs.koha-community.org/show_bug.cgi?id=17084 --- Koha/REST/V1.pm | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm index b16e1e3..84161c3 100644 --- a/Koha/REST/V1.pm +++ b/Koha/REST/V1.pm @@ -28,10 +28,13 @@ sub startup { my $route = $self->routes->under->to( cb => sub { my $c = shift; + # Mojo doesn't use %ENV the way CGI apps do + # Manually pass the remote_address to check_auth_cookie + my $remote_addr = $c->tx->remote_address; + my ($status, $sessionID) = check_cookie_auth( + $c->cookie('CGISESSID'), undef, + { remote_addr => $remote_addr }); - # ENV{REMOTE_ADDR} is not set here, we need to read the headers - my $remote_addr = $c->req->headers->header('x-forwarded-for'); - my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'), undef, { remote_addr => $remote_addr }); if ($status eq "ok") { my $session = get_session($sessionID); my $user = Koha::Patrons->find($session->param('number')); -- 2.1.4