@@ -, +, @@
---
C4/Auth.pm | 26 +++++++++++++++++++++-
C4/Installer/PerlDependencies.pm | 5 +++++
installer/data/mysql/sysprefs.sql | 1 +
.../en/modules/admin/preferences/circulation.pref | 4 ++++
opac/sco/help.pl | 8 ++++++-
opac/sco/printslip.pl | 7 +++++-
opac/sco/sco-main.pl | 10 +++++++--
opac/sco/sco-patron-image.pl | 6 +++++
8 files changed, 62 insertions(+), 5 deletions(-)
--- a/C4/Auth.pm
+++ a/C4/Auth.pm
@@ -39,6 +39,7 @@ use Koha::Patrons;
use POSIX qw/strftime/;
use List::MoreUtils qw/ any /;
use Encode qw( encode is_utf8);
+use Net::CIDR;
# use utf8;
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
@@ -55,7 +56,7 @@ BEGIN {
@ISA = qw(Exporter);
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
- &get_all_subpermissions &get_user_subpermissions
+ &get_all_subpermissions &get_user_subpermissions &in_ipset
);
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
$ldap = C4::Context->config('useldapserver') || 0;
@@ -2066,6 +2067,29 @@ sub haspermission {
#FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
}
+=head2 in_ipset
+
+ $flags = ($ipset);
+
+C<$ipset> A space separated string describing an IP set. Can include single IPs or ranges
+
+Returns 1 if the remote address is in the provided ipset, or 0 otherwise.
+
+=cut
+
+sub in_ipset {
+ my ($ipset) = @_;
+ my @allowedipranges = split(' ', $ipset);
+ if (scalar @allowedipranges > 0) {
+ my @rangelist;
+ eval { @rangelist = Net::CIDR::range2cidr(@allowedipranges); }; return 0 if $@;
+ unless (Net::CIDR::cidrlookup($ENV{'REMOTE_ADDR'}, @rangelist)) {
+ return 0;
+ }
+ }
+ return 1;
+}
+
sub getborrowernumber {
my ($userid) = @_;
my $userenv = C4::Context->userenv;
--- a/C4/Installer/PerlDependencies.pm
+++ a/C4/Installer/PerlDependencies.pm
@@ -802,6 +802,11 @@ our $PERL_DEPS = {
'required' => '0',
'min_ver' => '0.56',
},
+ 'Net::CIDR' => {
+ 'usage' => 'Core',
+ 'required' => '1',
+ 'min_ver' => '0.15',
+ },
'Net::SFTP::Foreign' => {
'usage' => 'Edifact',
'required' => '0',
--- a/installer/data/mysql/sysprefs.sql
+++ a/installer/data/mysql/sysprefs.sql
@@ -479,6 +479,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
('SearchEngine','Zebra','Elasticsearch|Zebra','Search Engine','Choice'),
('SearchMyLibraryFirst','0',NULL,'If ON, OPAC searches return results limited by the user\'s library by default if they are logged in','YesNo'),
('SearchWithISBNVariations','0',NULL,'If enabled, search on all variations of the ISBN','YesNo'),
+('SelfCheckAllowByIPRanges','',NULL,'(Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24
.)','Short'),
('SelfCheckHelpMessage','','70|10','Enter HTML to include under the basic Web-based Self Checkout instructions on the Help page','Textarea'),
('SelfCheckoutByLogin','1',NULL,'Have patrons login into the web-based self checkout system with their username/password or their cardnumber','YesNo'),
('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'),
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
@@ -843,6 +843,10 @@ Circulation:
yes: Show
no: "Don't show"
- "the print receipt popup dialog when self checkout is finished"
+ -
+ - pref: SelfCheckAllowByIPRanges
+ class: short
+ - (Leave blank if not used. Use ranges or simple ip addresses separated by spaces, like 192.168.1.1 192.168.0.0/24
.)
Course Reserves:
-
- pref: UseCourseReserves
--- a/opac/sco/help.pl
+++ a/opac/sco/help.pl
@@ -25,10 +25,16 @@ use strict;
use warnings;
use CGI qw ( -utf8 );
-use C4::Auth qw(get_template_and_user);
+use C4::Auth qw(get_template_and_user in_ipset);
use C4::Output qw(output_html_with_http_headers);
my $query = new CGI;
+
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ print $query->redirect("/cgi-bin/koha/opac-main.pl");
+ exit;
+}
+
my ($template, $borrowernumber, $cookie) = get_template_and_user({
template_name => "sco/help.tt",
query => $query,
--- a/opac/sco/printslip.pl
+++ a/opac/sco/printslip.pl
@@ -30,12 +30,17 @@ use strict;
use warnings;
use CGI qw ( -utf8 );
use C4::Context;
-use C4::Auth qw/:DEFAULT get_session/;
+use C4::Auth qw/:DEFAULT get_session in_ipset/;
use C4::Output;
use C4::Members;
use C4::Koha;
my $input = new CGI;
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ print $input->header(status => '403 Forbidden - functionality not available from your location');
+ exit;
+}
+
my $sessionID = $input->cookie("CGISESSID");
my $session = get_session($sessionID);
--- a/opac/sco/sco-main.pl
+++ a/opac/sco/sco-main.pl
@@ -35,7 +35,7 @@ use Modern::Perl;
use CGI qw ( -utf8 );
-use C4::Auth qw(get_template_and_user checkpw);
+use C4::Auth qw(get_template_and_user checkpw in_ipset);
use C4::Koha;
use C4::Circulation;
use C4::Reserves;
@@ -58,7 +58,13 @@ unless (C4::Context->preference('WebBasedSelfCheck')) {
exit;
}
-if (C4::Context->preference('AutoSelfCheckAllowed'))
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ # redirect to OPAC home if self-checkout not permitted from current IP
+ print $query->redirect("/cgi-bin/koha/opac-main.pl");
+ exit;
+}
+
+if (C4::Context->preference('AutoSelfCheckAllowed'))
{
my $AutoSelfCheckID = C4::Context->preference('AutoSelfCheckID');
my $AutoSelfCheckPass = C4::Context->preference('AutoSelfCheckPass');
--- a/opac/sco/sco-patron-image.pl
+++ a/opac/sco/sco-patron-image.pl
@@ -19,6 +19,7 @@
use strict;
use warnings;
+use C4::Auth qw(in_ipset);
use C4::Service;
use C4::Members;
use Koha::Patron::Images;
@@ -36,6 +37,11 @@ unless (C4::Context->preference('ShowPatronImageInWebBasedSelfCheck')) {
exit;
}
+unless ( in_ipset(C4::Context->preference('SelfCheckAllowByIPRanges')) ) {
+ print $query->header(status => '403 Forbidden - functionality not available from your location');
+ exit;
+}
+
my ($borrowernumber) = C4::Service->require_params('borrowernumber');
my ($csrf_token) = C4::Service->require_params('csrf_token');
--