@@ -, +, @@
presence of tabs in files, and printslip refering to $query instead of $input
---
C4/Auth.pm | 24 +++++++++++++++++++++-
C4/Installer/PerlDependencies.pm | 5 +++++
..._14407-add_selfcheckallowbyipranges_syspref.sql | 2 ++
installer/data/mysql/sysprefs.sql | 1 +
.../en/modules/admin/preferences/circulation.pref | 4 ++++
opac/sco/help.pl | 8 +++++++-
opac/sco/printslip.pl | 7 ++++++-
opac/sco/sco-main.pl | 10 +++++++--
opac/sco/sco-patron-image.pl | 6 ++++++
9 files changed, 62 insertions(+), 5 deletions(-)
create mode 100644 installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql
--- a/C4/Auth.pm
+++ a/C4/Auth.pm
@@ -39,6 +39,7 @@ use Koha::Patrons;
use POSIX qw/strftime/;
use List::MoreUtils qw/ any /;
use Encode qw( encode is_utf8);
+use Net::CIDR;
# use utf8;
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
@@ -55,7 +56,7 @@ BEGIN {
@ISA = qw(Exporter);
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
- &get_all_subpermissions &get_user_subpermissions
+ &get_all_subpermissions &get_user_subpermissions &in_ipset
);
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
$ldap = C4::Context->config('useldapserver') || 0;
@@ -2040,6 +2041,27 @@ sub haspermission {
#FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
}
+=head2 in_ipset
+
+ $flags = ($ipset);
+
+C<$ipset> A space separated string describing an IP set. Can include single IPs or ranges
+
+Returns 1 if the remote address is in the provided ipset, or 0 otherwise.
+
+=cut
+
+sub in_ipset {
+ my ($ipset) = @_;
+ my @allowedipranges = split(' ', $ipset);
+ if (scalar @allowedipranges > 0) {
+ unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, Net::CIDR::range2cidr(@allowedipranges))) {
+ return 0;
+ }
+ }
+ return 1;
+}
+
sub getborrowernumber {
my ($userid) = @_;
my $userenv = C4::Context->userenv;
--- a/C4/Installer/PerlDependencies.pm
+++ a/C4/Installer/PerlDependencies.pm
@@ -782,6 +782,11 @@ our $PERL_DEPS = {
'required' => '0',
'min_ver' => '0.56',
},
+ 'Net::CIDR' => {
+ 'usage' => 'Core',
+ 'required' => '1',
+ 'min_ver' => '0.15',
+ },
'Net::SFTP::Foreign' => {
'usage' => 'Edifact',
'required' => '0',
--- a/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql
+++ a/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql
@@ -0,0 +1,2 @@
+INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES
+ ('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24
.)','Short');
--- a/installer/data/mysql/sysprefs.sql
+++ a/installer/data/mysql/sysprefs.sql
@@ -441,6 +441,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
('SearchEngine','Zebra','Elasticsearch|Zebra','Search Engine','Choice'),
('SearchMyLibraryFirst','0',NULL,'If ON, OPAC searches return results limited by the user\'s library by default if they are logged in','YesNo'),
('SearchWithISBNVariations','0',NULL,'If enabled, search on all variations of the ISBN','YesNo'),
+('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24
.)','Short'),
('SelfCheckHelpMessage','','70|10','Enter HTML to include under the basic Web-based Self Checkout instructions on the Help page','Textarea'),
('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'),
('SelfCheckTimeout','120','','Define the number of seconds before the Web-based Self Checkout times out a patron','Integer'),
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
@@ -751,6 +751,10 @@ Circulation:
yes: Show
no: "Don't show"
- "the print receipt popup dialog when self checkout is finished"
+ -
+ - pref: SelfCheckAllowByIPRanges
+ class: short
+ - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24
.)
Course Reserves:
-
- pref: UseCourseReserves
--- a/opac/sco/help.pl
+++ a/opac/sco/help.pl
@@ -25,10 +25,16 @@ use strict;
use warnings;
use CGI qw ( -utf8 );
-use C4::Auth qw(get_template_and_user);
+use C4::Auth qw(get_template_and_user in_ipset);
use C4::Output qw(output_html_with_http_headers);
my $query = new CGI;
+
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ print $query->redirect("/cgi-bin/koha/opac-main.pl");
+ exit;
+}
+
my ($template, $borrowernumber, $cookie) = get_template_and_user({
template_name => "sco/help.tt",
query => $query,
--- a/opac/sco/printslip.pl
+++ a/opac/sco/printslip.pl
@@ -30,12 +30,17 @@ use strict;
use warnings;
use CGI qw ( -utf8 );
use C4::Context;
-use C4::Auth qw/:DEFAULT get_session/;
+use C4::Auth qw/:DEFAULT get_session in_ipset/;
use C4::Output;
use C4::Members;
use C4::Koha;
my $input = new CGI;
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ print $input->header(status => '403 Forbidden - functionality not available from your location');
+ exit;
+}
+
my $sessionID = $input->cookie("CGISESSID");
my $session = get_session($sessionID);
--- a/opac/sco/sco-main.pl
+++ a/opac/sco/sco-main.pl
@@ -37,7 +37,7 @@ use warnings;
use CGI qw ( -utf8 );
use Digest::MD5 qw(md5_base64);
-use C4::Auth qw(get_template_and_user checkpw);
+use C4::Auth qw(get_template_and_user checkpw in_ipset);
use C4::Koha;
use C4::Circulation;
use C4::Reserves;
@@ -56,7 +56,13 @@ unless (C4::Context->preference('WebBasedSelfCheck')) {
exit;
}
-if (C4::Context->preference('AutoSelfCheckAllowed'))
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ # redirect to OPAC home if self-checkout not permitted from current IP
+ print $query->redirect("/cgi-bin/koha/opac-main.pl");
+ exit;
+}
+
+if (C4::Context->preference('AutoSelfCheckAllowed'))
{
my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID');
my $AutoSelfCheckPass = C4::Context->preference('AutoSelfCheckPass');
--- a/opac/sco/sco-patron-image.pl
+++ a/opac/sco/sco-patron-image.pl
@@ -19,6 +19,7 @@
use strict;
use warnings;
+use C4::Auth qw(in_ipset);
use C4::Service;
use C4::Members;
use Koha::Patron::Images;
@@ -34,6 +35,11 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
exit;
}
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ print $query->header(status => '403 Forbidden - functionality not available from your location');
+ exit;
+}
+
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
my $patron_image = Koha::Patron::Images->find($borrowernumber);
--