Lines 646-651
sub checkauth {
Link Here
|
646 |
$timeout = $1 * 86400; |
646 |
$timeout = $1 * 86400; |
647 |
}; |
647 |
}; |
648 |
$timeout = 600 unless $timeout; |
648 |
$timeout = 600 unless $timeout; |
|
|
649 |
my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor')); |
649 |
|
650 |
|
650 |
_version_check($type,$query); |
651 |
_version_check($type,$query); |
651 |
# state variables |
652 |
# state variables |
Lines 720-729
sub checkauth {
Link Here
|
720 |
$userid = undef; |
721 |
$userid = undef; |
721 |
$sessionID = undef; |
722 |
$sessionID = undef; |
722 |
} |
723 |
} |
723 |
elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { |
724 |
elsif ($ip ne $clientip) { |
724 |
# Different ip than originally logged in from |
725 |
# Different ip than originally logged in from |
725 |
$info{'oldip'} = $ip; |
726 |
$info{'oldip'} = $ip; |
726 |
$info{'newip'} = $ENV{'REMOTE_ADDR'}; |
727 |
$info{'newip'} = $clientip; |
727 |
$info{'different_ip'} = 1; |
728 |
$info{'different_ip'} = 1; |
728 |
$session->delete(); |
729 |
$session->delete(); |
729 |
C4::Context->_unset_userenv($sessionID); |
730 |
C4::Context->_unset_userenv($sessionID); |
Lines 765-771
sub checkauth {
Link Here
|
765 |
$userid = $retuserid if ($retuserid ne ''); |
766 |
$userid = $retuserid if ($retuserid ne ''); |
766 |
} |
767 |
} |
767 |
if ($return) { |
768 |
if ($return) { |
768 |
_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
769 |
_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$clientip,(strftime '%c', localtime)); |
769 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
770 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
770 |
$loggedin = 1; |
771 |
$loggedin = 1; |
771 |
} |
772 |
} |
Lines 813-819
sub checkauth {
Link Here
|
813 |
# launch a sequence to check if we have a ip for the branch, i |
814 |
# launch a sequence to check if we have a ip for the branch, i |
814 |
# if we have one we replace the branchcode of the userenv by the branch bound in the ip. |
815 |
# if we have one we replace the branchcode of the userenv by the branch bound in the ip. |
815 |
|
816 |
|
816 |
my $ip = $ENV{'REMOTE_ADDR'}; |
|
|
817 |
# if they specify at login, use that |
817 |
# if they specify at login, use that |
818 |
if ($query->param('branch')) { |
818 |
if ($query->param('branch')) { |
819 |
$branchcode = $query->param('branch'); |
819 |
$branchcode = $query->param('branch'); |
Lines 823-829
sub checkauth {
Link Here
|
823 |
if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ |
823 |
if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ |
824 |
# we have to check they are coming from the right ip range |
824 |
# we have to check they are coming from the right ip range |
825 |
my $domain = $branches->{$branchcode}->{'branchip'}; |
825 |
my $domain = $branches->{$branchcode}->{'branchip'}; |
826 |
if ($ip !~ /^$domain/){ |
826 |
if ($clientip !~ /^$domain/){ |
827 |
$loggedin=0; |
827 |
$loggedin=0; |
828 |
$info{'wrongip'} = 1; |
828 |
$info{'wrongip'} = 1; |
829 |
} |
829 |
} |
Lines 833-839
sub checkauth {
Link Here
|
833 |
foreach my $br ( keys %$branches ) { |
833 |
foreach my $br ( keys %$branches ) { |
834 |
# now we work with the treatment of ip |
834 |
# now we work with the treatment of ip |
835 |
my $domain = $branches->{$br}->{'branchip'}; |
835 |
my $domain = $branches->{$br}->{'branchip'}; |
836 |
if ( $domain && $ip =~ /^$domain/ ) { |
836 |
if ( $domain && $clientip =~ /^$domain/ ) { |
837 |
$branchcode = $branches->{$br}->{'branchcode'}; |
837 |
$branchcode = $branches->{$br}->{'branchcode'}; |
838 |
|
838 |
|
839 |
# new op dev : add the branchprinter and branchname in the cookie |
839 |
# new op dev : add the branchprinter and branchname in the cookie |
Lines 850-856
sub checkauth {
Link Here
|
850 |
$session->param('branchname',$branchname); |
850 |
$session->param('branchname',$branchname); |
851 |
$session->param('flags',$userflags); |
851 |
$session->param('flags',$userflags); |
852 |
$session->param('emailaddress',$emailaddress); |
852 |
$session->param('emailaddress',$emailaddress); |
853 |
$session->param('ip',$session->remote_addr()); |
853 |
$session->param('ip',$clientip); |
854 |
$session->param('lasttime',time()); |
854 |
$session->param('lasttime',time()); |
855 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
855 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
856 |
} |
856 |
} |
Lines 866-872
sub checkauth {
Link Here
|
866 |
$session->param('branchname','NO_LIBRARY_SET'); |
866 |
$session->param('branchname','NO_LIBRARY_SET'); |
867 |
$session->param('flags',1); |
867 |
$session->param('flags',1); |
868 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
868 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
869 |
$session->param('ip',$session->remote_addr()); |
869 |
$session->param('ip',$clientip); |
870 |
$session->param('lasttime',time()); |
870 |
$session->param('lasttime',time()); |
871 |
} |
871 |
} |
872 |
C4::Context::set_userenv( |
872 |
C4::Context::set_userenv( |
Lines 917-923
sub checkauth {
Link Here
|
917 |
C4::Context::set_shelves_userenv('tot',$total); |
917 |
C4::Context::set_shelves_userenv('tot',$total); |
918 |
|
918 |
|
919 |
# setting a couple of other session vars... |
919 |
# setting a couple of other session vars... |
920 |
$session->param('ip',$session->remote_addr()); |
920 |
$session->param('ip',$clientip); |
921 |
$session->param('lasttime',time()); |
921 |
$session->param('lasttime',time()); |
922 |
$session->param('sessiontype','anon'); |
922 |
$session->param('sessiontype','anon'); |
923 |
} |
923 |
} |
Lines 1088-1093
sub check_api_auth {
Link Here
|
1088 |
my $dbh = C4::Context->dbh; |
1088 |
my $dbh = C4::Context->dbh; |
1089 |
my $timeout = C4::Context->preference('timeout'); |
1089 |
my $timeout = C4::Context->preference('timeout'); |
1090 |
$timeout = 600 unless $timeout; |
1090 |
$timeout = 600 unless $timeout; |
|
|
1091 |
my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor')); |
1091 |
|
1092 |
|
1092 |
unless (C4::Context->preference('Version')) { |
1093 |
unless (C4::Context->preference('Version')) { |
1093 |
# database has not been installed yet |
1094 |
# database has not been installed yet |
Lines 1139-1145
sub check_api_auth {
Link Here
|
1139 |
$userid = undef; |
1140 |
$userid = undef; |
1140 |
$sessionID = undef; |
1141 |
$sessionID = undef; |
1141 |
return ("expired", undef, undef); |
1142 |
return ("expired", undef, undef); |
1142 |
} elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { |
1143 |
} elsif ( $ip ne $clientip ) { |
1143 |
# IP address changed |
1144 |
# IP address changed |
1144 |
$session->delete(); |
1145 |
$session->delete(); |
1145 |
C4::Context->_unset_userenv($sessionID); |
1146 |
C4::Context->_unset_userenv($sessionID); |
Lines 1229-1235
sub check_api_auth {
Link Here
|
1229 |
} |
1230 |
} |
1230 |
} |
1231 |
} |
1231 |
|
1232 |
|
1232 |
my $ip = $ENV{'REMOTE_ADDR'}; |
|
|
1233 |
# if they specify at login, use that |
1233 |
# if they specify at login, use that |
1234 |
if ($query->param('branch')) { |
1234 |
if ($query->param('branch')) { |
1235 |
$branchcode = $query->param('branch'); |
1235 |
$branchcode = $query->param('branch'); |
Lines 1240-1246
sub check_api_auth {
Link Here
|
1240 |
foreach my $br ( keys %$branches ) { |
1240 |
foreach my $br ( keys %$branches ) { |
1241 |
# now we work with the treatment of ip |
1241 |
# now we work with the treatment of ip |
1242 |
my $domain = $branches->{$br}->{'branchip'}; |
1242 |
my $domain = $branches->{$br}->{'branchip'}; |
1243 |
if ( $domain && $ip =~ /^$domain/ ) { |
1243 |
if ( $domain && $clientip =~ /^$domain/ ) { |
1244 |
$branchcode = $branches->{$br}->{'branchcode'}; |
1244 |
$branchcode = $branches->{$br}->{'branchcode'}; |
1245 |
|
1245 |
|
1246 |
# new op dev : add the branchprinter and branchname in the cookie |
1246 |
# new op dev : add the branchprinter and branchname in the cookie |
Lines 1257-1263
sub check_api_auth {
Link Here
|
1257 |
$session->param('branchname',$branchname); |
1257 |
$session->param('branchname',$branchname); |
1258 |
$session->param('flags',$userflags); |
1258 |
$session->param('flags',$userflags); |
1259 |
$session->param('emailaddress',$emailaddress); |
1259 |
$session->param('emailaddress',$emailaddress); |
1260 |
$session->param('ip',$session->remote_addr()); |
1260 |
$session->param('ip',$clientip); |
1261 |
$session->param('lasttime',time()); |
1261 |
$session->param('lasttime',time()); |
1262 |
} elsif ( $return == 2 ) { |
1262 |
} elsif ( $return == 2 ) { |
1263 |
#We suppose the user is the superlibrarian |
1263 |
#We suppose the user is the superlibrarian |
Lines 1270-1276
sub check_api_auth {
Link Here
|
1270 |
$session->param('branchname','NO_LIBRARY_SET'); |
1270 |
$session->param('branchname','NO_LIBRARY_SET'); |
1271 |
$session->param('flags',1); |
1271 |
$session->param('flags',1); |
1272 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
1272 |
$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); |
1273 |
$session->param('ip',$session->remote_addr()); |
1273 |
$session->param('ip',$clientip); |
1274 |
$session->param('lasttime',time()); |
1274 |
$session->param('lasttime',time()); |
1275 |
} |
1275 |
} |
1276 |
C4::Context::set_userenv( |
1276 |
C4::Context::set_userenv( |
Lines 1321-1326
sub check_cookie_auth {
Link Here
|
1321 |
my $dbh = C4::Context->dbh; |
1321 |
my $dbh = C4::Context->dbh; |
1322 |
my $timeout = C4::Context->preference('timeout'); |
1322 |
my $timeout = C4::Context->preference('timeout'); |
1323 |
$timeout = 600 unless $timeout; |
1323 |
$timeout = 600 unless $timeout; |
|
|
1324 |
my $clientip = get_clientip($ENV{'REMOTE_ADDR'}, $ENV{'HTTP_X_FORWARDED_FOR'}, C4::Context->preference('HandleXForwardedFor')); |
1324 |
|
1325 |
|
1325 |
unless (C4::Context->preference('Version')) { |
1326 |
unless (C4::Context->preference('Version')) { |
1326 |
# database has not been installed yet |
1327 |
# database has not been installed yet |
Lines 1371-1377
sub check_cookie_auth {
Link Here
|
1371 |
$userid = undef; |
1372 |
$userid = undef; |
1372 |
$sessionID = undef; |
1373 |
$sessionID = undef; |
1373 |
return ("expired", undef); |
1374 |
return ("expired", undef); |
1374 |
} elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { |
1375 |
} elsif ( $ip ne $clientip ) { |
1375 |
# IP address changed |
1376 |
# IP address changed |
1376 |
$session->delete(); |
1377 |
$session->delete(); |
1377 |
C4::Context->_unset_userenv($sessionID); |
1378 |
C4::Context->_unset_userenv($sessionID); |
Lines 1396-1401
sub check_cookie_auth {
Link Here
|
1396 |
} |
1397 |
} |
1397 |
} |
1398 |
} |
1398 |
|
1399 |
|
|
|
1400 |
=head2 get_clientip |
1401 |
|
1402 |
my $clientip = get_clientip($remote_addr, $forwarded_for, $require_routable); |
1403 |
|
1404 |
Parses the remote IP address (passed to the function in $remote_addr), the |
1405 |
X-Forwarded-For header (passed to the function in $forwarded_for), and retrieves |
1406 |
the IP address of the client, returning a string representation of the IP |
1407 |
address. If $require_routable is set to "first", this function will always |
1408 |
return the most-distant IP address. If $require_routable is set to "routable", |
1409 |
this function will choose the first routable IP address in the list of relays, |
1410 |
or the address immediately before the closest proxy. If $require_routable is set |
1411 |
to "ignore", this function will always return the most recent hop (i.e. the |
1412 |
remote address). "Ignore" is the default. |
1413 |
|
1414 |
=cut |
1415 |
|
1416 |
sub get_clientip { |
1417 |
my $remote_addr = shift; |
1418 |
my $forwarded_for = shift; |
1419 |
my $require_routable = shift; |
1420 |
my $clientip; |
1421 |
|
1422 |
$require_routable ||= 'ignore'; |
1423 |
|
1424 |
if ($require_routable eq 'ignore' || !length $forwarded_for) { |
1425 |
$clientip = $remote_addr; |
1426 |
} else { |
1427 |
my @ips = split(', ', $forwarded_for); |
1428 |
$ips[$#ips + 1] = $remote_addr; |
1429 |
if ($require_routable eq 'first') { |
1430 |
$clientip = $ips[0]; |
1431 |
} else { # $require_routable eq 'routable' |
1432 |
foreach (@ips) { |
1433 |
if ( $_ !~ /^(192\.|10\.|127\.|0\.|169\.254\.|2([345][0-9|2[4-9])\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/) { |
1434 |
$clientip = $_; |
1435 |
last; |
1436 |
# We've found the client if the IP is not in any of: |
1437 |
# * 192.0.0.0/8 |
1438 |
# * 10.0.0.0/8 |
1439 |
# * 127.0.0.0/8 |
1440 |
# * 169.254.0.0/16 |
1441 |
# * 224.0.0.0/4 or 240.0.0.0/4 |
1442 |
# * 172.16.0.0/12 |
1443 |
} |
1444 |
} |
1445 |
if (!length $clientip) { |
1446 |
$clientip = $ips[$#ips - 1]; |
1447 |
} |
1448 |
} |
1449 |
} |
1450 |
|
1451 |
return $clientip; |
1452 |
} |
1453 |
|
1399 |
=head2 get_session |
1454 |
=head2 get_session |
1400 |
|
1455 |
|
1401 |
use CGI::Session; |
1456 |
use CGI::Session; |