From f99a5f89166570ff877cd2331948f75eb2f855b0 Mon Sep 17 00:00:00 2001 From: Benjamin Rokseth Date: Fri, 26 Aug 2016 10:19:36 +0000 Subject: [PATCH] Bug 16694 - Limit SIP2 auth by patron attribute The main use case of this bug is to use patron attributes to grant special privileges, e.g. to open a door to an unmanned library. This patch adds an extra check against patron attributes if login account in SIPconfig.xml has a key validate_patron_attribute set to some patron attribute. If a patron information request is sent (63), and patron has proper rights in the given attribute: (a value of 1/true or some authorised value mapping to 1) The user will be allowed access (in SIP: charge and/or renewal ok). Otherwise denied. Please note that this is specific to the SIP login account, so self checkout machines can be handled differently than e.g. a door card terminal. To test: 0) you need to debug using telnet or the koha provided sip_client 1) add validate_patron_attribute="testattribute" to some login account in SIPconfig.xml 2) add a patron attribute "testattribute" 3) edit some patron and set "testattribute" to "1" 4) do a sip login with the given login account from SIPconfig.xml 5) do a patron information request (63) on the patron 6) observe that no charge or renewal denied is given in the response (64 ) 7) try all or any of the following: - set patron attribute to anything but "1" - delete the patron attribute - map the patron attribute to an authorized list, e.g. (YES_NO) and set it to a value that doesn't map to "1", e.g. "No". 8) do a patron information request (63) again 9) observe that charge and renewal is now denied in the SIP response (64YY) 10) thank yourself if noone else does and grab a coffee --- C4/SIP/Sip/MsgType.pm | 11 +++++++++++ etc/SIPconfig.xml | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/C4/SIP/Sip/MsgType.pm b/C4/SIP/Sip/MsgType.pm index 4e406e2..274645f 100644 --- a/C4/SIP/Sip/MsgType.pm +++ b/C4/SIP/Sip/MsgType.pm @@ -940,6 +940,17 @@ sub handle_patron_info { $resp = (PATRON_INFO_RESP); if ($patron) { + # Bug 16694 - Limit SIP2 auth by patron attribute + # If login account has validate_patron_attribute set, it will check if patron has this attribute set + # If set, anything but 1 (True) will result in charge and renewal privileges denied + if ($server->{account}->{validate_patron_attribute}) { + my $attr = C4::Members::Attributes::GetBorrowerAttributeValue($patron->{borrowernumber}, $server->{account}->{validate_patron_attribute}); + if (!$attr || $attr != "1") { + $patron->{charge_ok} = "0"; + $patron->{renew_ok} = "0"; + } + } + $resp .= patron_status_string($patron); $resp .= ( defined($lang) and length($lang) == 3 ) ? $lang : $patron->language; $resp .= timestamp(); diff --git a/etc/SIPconfig.xml b/etc/SIPconfig.xml index c61a6c7..1d9f6f0 100644 --- a/etc/SIPconfig.xml +++ b/etc/SIPconfig.xml @@ -51,7 +51,8 @@ + av_field_template="[% accountline.description %] [% accountline.amountoutstanding | format('%.2f') %]" + validate_patron_attribute="sc-door-access" > -- 2.1.4