View | Details | Raw Unified | Return to bug 14407
Collapse All | Expand All

(-)a/C4/Auth.pm (-1 / +25 lines)
Lines 39-44 use Koha::Patrons; Link Here
39
use POSIX qw/strftime/;
39
use POSIX qw/strftime/;
40
use List::MoreUtils qw/ any /;
40
use List::MoreUtils qw/ any /;
41
use Encode qw( encode is_utf8);
41
use Encode qw( encode is_utf8);
42
use Net::CIDR;
42
43
43
# use utf8;
44
# use utf8;
44
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
45
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
Lines 55-61 BEGIN { Link Here
55
    @ISA       = qw(Exporter);
56
    @ISA       = qw(Exporter);
56
    @EXPORT    = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
57
    @EXPORT    = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
57
    @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
58
    @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
58
      &get_all_subpermissions &get_user_subpermissions
59
      &get_all_subpermissions &get_user_subpermissions &in_ipset
59
    );
60
    );
60
    %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
61
    %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
61
    $ldap      = C4::Context->config('useldapserver') || 0;
62
    $ldap      = C4::Context->config('useldapserver') || 0;
Lines 2082-2087 sub haspermission { Link Here
2082
    #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
2083
    #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
2083
}
2084
}
2084
2085
2086
=head2 in_ipset
2087
2088
  $flags = ($ipset);
2089
2090
C<$ipset> A space separated string describing an IP set. Can include single IPs or ranges
2091
2092
Returns 1 if the remote address is in the provided ipset, or 0 otherwise.
2093
2094
=cut
2095
2096
sub in_ipset {
2097
 my ($ipset) = @_;
2098
 my @allowedipranges = split(' ', $ipset);
2099
 if (scalar @allowedipranges > 0) {
2100
    my @rangelist;
2101
    eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@;
2102
    unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist)) {
2103
      return 0;
2104
    }
2105
 }
2106
 return 1;
2107
}
2108
2085
sub getborrowernumber {
2109
sub getborrowernumber {
2086
    my ($userid) = @_;
2110
    my ($userid) = @_;
2087
    my $userenv = C4::Context->userenv;
2111
    my $userenv = C4::Context->userenv;
(-)a/C4/Installer/PerlDependencies.pm (+5 lines)
Lines 802-807 our $PERL_DEPS = { Link Here
802
        'required' => '0',
802
        'required' => '0',
803
        'min_ver'  => '0.56',
803
        'min_ver'  => '0.56',
804
    },
804
    },
805
    'Net::CIDR'    => {
806
        'usage'    => 'Core',
807
        'required' => '1',
808
        'min_ver'  => '0.15',
809
    },
805
    'Net::SFTP::Foreign' => {
810
    'Net::SFTP::Foreign' => {
806
        'usage'    => 'Edifact',
811
        'usage'    => 'Edifact',
807
        'required' => '0',
812
        'required' => '0',
(-)a/installer/data/mysql/atomicupdate/bug_14407-add_selfcheckallowbyipranges_syspref.sql (+2 lines)
Line 0 Link Here
1
INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES
2
	('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like <code>192.168.1.1 192.168.0.0/24</code>.)','Short');
(-)a/installer/data/mysql/sysprefs.sql (+1 lines)
Lines 475-480 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here
475
('SearchEngine','Zebra','Elasticsearch|Zebra','Search Engine','Choice'),
475
('SearchEngine','Zebra','Elasticsearch|Zebra','Search Engine','Choice'),
476
('SearchMyLibraryFirst','0',NULL,'If ON, OPAC searches return results limited by the user\'s library by default if they are logged in','YesNo'),
476
('SearchMyLibraryFirst','0',NULL,'If ON, OPAC searches return results limited by the user\'s library by default if they are logged in','YesNo'),
477
('SearchWithISBNVariations','0',NULL,'If enabled, search on all variations of the ISBN','YesNo'),
477
('SearchWithISBNVariations','0',NULL,'If enabled, search on all variations of the ISBN','YesNo'),
478
('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like <code>192.168.1.1 192.168.0.0/24</code>.)','Short'),
478
('SelfCheckHelpMessage','','70|10','Enter HTML to include under the basic Web-based Self Checkout instructions on the Help page','Textarea'),
479
('SelfCheckHelpMessage','','70|10','Enter HTML to include under the basic Web-based Self Checkout instructions on the Help page','Textarea'),
479
('SelfCheckoutByLogin','1',NULL,'Have patrons login into the web-based self checkout system with their username/password or their cardnumber','YesNo'),
480
('SelfCheckoutByLogin','1',NULL,'Have patrons login into the web-based self checkout system with their username/password or their cardnumber','YesNo'),
480
('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'),
481
('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref (+4 lines)
Lines 824-829 Circulation: Link Here
824
                  yes: Show
824
                  yes: Show
825
                  no: "Don't show"
825
                  no: "Don't show"
826
            - "the print receipt popup dialog when self checkout is finished"
826
            - "the print receipt popup dialog when self checkout is finished"
827
        -
828
            - pref: SelfCheckAllowByIPRanges
829
              class: short
830
            - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like <code>192.168.1.1 192.168.0.0/24</code>.)
827
    Course Reserves:
831
    Course Reserves:
828
        -
832
        -
829
            - pref: UseCourseReserves
833
            - pref: UseCourseReserves
(-)a/opac/sco/help.pl (-1 / +7 lines)
Lines 25-34 use strict; Link Here
25
use warnings;
25
use warnings;
26
use CGI qw ( -utf8 );
26
use CGI qw ( -utf8 );
27
27
28
use C4::Auth   qw(get_template_and_user);
28
use C4::Auth   qw(get_template_and_user in_ipset);
29
use C4::Output qw(output_html_with_http_headers);
29
use C4::Output qw(output_html_with_http_headers);
30
30
31
my $query = new CGI;
31
my $query = new CGI;
32
33
unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
34
    print $query->redirect("/cgi-bin/koha/opac-main.pl");
35
    exit;
36
}
37
32
my ($template, $borrowernumber, $cookie) = get_template_and_user({
38
my ($template, $borrowernumber, $cookie) = get_template_and_user({
33
    template_name => "sco/help.tt",
39
    template_name => "sco/help.tt",
34
    query => $query,
40
    query => $query,
(-)a/opac/sco/printslip.pl (-1 / +6 lines)
Lines 30-41 use strict; Link Here
30
use warnings;
30
use warnings;
31
use CGI qw ( -utf8 );
31
use CGI qw ( -utf8 );
32
use C4::Context;
32
use C4::Context;
33
use C4::Auth qw/:DEFAULT get_session/;
33
use C4::Auth qw/:DEFAULT get_session in_ipset/;
34
use C4::Output;
34
use C4::Output;
35
use C4::Members;
35
use C4::Members;
36
use C4::Koha;
36
use C4::Koha;
37
37
38
my $input = new CGI;
38
my $input = new CGI;
39
unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
40
    print $input->header(status => '403 Forbidden - functionality not available from your location');
41
    exit;
42
}
43
39
my $sessionID = $input->cookie("CGISESSID");
44
my $sessionID = $input->cookie("CGISESSID");
40
my $session = get_session($sessionID);
45
my $session = get_session($sessionID);
41
46
(-)a/opac/sco/sco-main.pl (-2 / +8 lines)
Lines 35-41 use Modern::Perl; Link Here
35
35
36
use CGI qw ( -utf8 );
36
use CGI qw ( -utf8 );
37
37
38
use C4::Auth qw(get_template_and_user checkpw);
38
use C4::Auth qw(get_template_and_user checkpw in_ipset);
39
use C4::Koha;
39
use C4::Koha;
40
use C4::Circulation;
40
use C4::Circulation;
41
use C4::Reserves;
41
use C4::Reserves;
Lines 58-64 unless (C4::Context->preference('WebBasedSelfCheck')) { Link Here
58
    exit;
58
    exit;
59
}
59
}
60
60
61
if (C4::Context->preference('AutoSelfCheckAllowed')) 
61
unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
62
    # redirect to OPAC home if self-checkout not permitted from current IP
63
    print $query->redirect("/cgi-bin/koha/opac-main.pl");
64
    exit;
65
}
66
67
if (C4::Context->preference('AutoSelfCheckAllowed'))
62
{
68
{
63
    my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID');
69
    my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID');
64
    my $AutoSelfCheckPass = C4::Context->preference('AutoSelfCheckPass');
70
    my $AutoSelfCheckPass = C4::Context->preference('AutoSelfCheckPass');
(-)a/opac/sco/sco-patron-image.pl (+6 lines)
Lines 19-24 Link Here
19
19
20
use strict;
20
use strict;
21
use warnings;
21
use warnings;
22
use C4::Auth qw(in_ipset);
22
use C4::Service;
23
use C4::Service;
23
use C4::Members;
24
use C4::Members;
24
use Koha::Patron::Images;
25
use Koha::Patron::Images;
Lines 36-41 unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) { Link Here
36
    exit;
37
    exit;
37
}
38
}
38
39
40
unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
41
    print $query->header(status => '403 Forbidden - functionality not available from your location');
42
    exit;
43
}
44
39
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
45
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
40
my ($csrf_token) = C4::Service->require_params('csrf_token');
46
my ($csrf_token) = C4::Service->require_params('csrf_token');
41
47
(-)a/t/Auth.t (-1 / +37 lines)
Line 0 Link Here
0
- 
1
# This file is part of Koha.
2
#
3
# Copyright (C) 2013 Equinox Software, Inc.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
use Test::More tests => 10;
20
21
use C4::Auth qw / in_ipset /;
22
use warnings;
23
24
$ENV{REMOTE_ADDR} = '192.168.1.30';
25
my $ipset1 = "192.168.1.30";
26
27
ok(in_ipset("192.168.1.30"), 'simple single ip matching remote ip');
28
ok(!in_ipset("192.168.1.31"), 'simple single ip not match remote ip');
29
ok(in_ipset("192.168.1.1/24"), 'simple ip range/24 with remote ip in it');
30
ok(!in_ipset("192.168.2.1/24"), 'simple ip range/24 with remote ip not in it');
31
ok(in_ipset("192.168.2.1/16"), 'simple ip range/16 with remote ip in it');
32
ok(!in_ipset("192.168.1.10-30"), 'invalidly represented IP range with remote ip in it');
33
ok(in_ipset("192.168.1.10-192.168.1.30"), 'validly represented ip range with remote ip in it');
34
ok(in_ipset("127.0.0.1 192.168.1.30 192.168.2.10-192.168.2.25"), 'multiple ips and ranges, including the remote ip');
35
ok(!in_ipset("127.0.0.1 8.8.8.8 192.168.2.1/24 192.168.3.1/24 192.168.1.1-192.168.1.29"), "multiple ip and ip ranges, with the remote ip in none of them");
36
ok(in_ipset(""), "blank list given, no preference set - implies everything goes through.");
37

Return to bug 14407