Bug 21300

Summary: Restriction of ILS-DI webservice to 1st and 2d level by default
Product: Koha Reporter: abernaud <anne-claire.bernaudin>
Component: Web servicesAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description abernaud 2018-08-31 09:40:29 UTC
The Koha wiki describes a way of restricting access to ILS-DI through an Apache configuration :

https://wiki.koha-community.org/wiki/APIs_and_protocols_supported_by_Koha#ILS-DI
"ILS-DI
ILS-DI is self-documenting, so in an installation where it is enabled, you can get some information about it at the URL:
http://koha-opac.example.org/cgi-bin/koha/ilsdi.pl

Because ILS-DI gives access to all your data (items, patrons...), it should be restricted by allowing IP in the admin interface and/or by disabling services via the server.
For Apache, these rules can be added to restrict public access only to the first and second levels of ILS-DI:

<IfModule mod_rewrite.c>
   # Rewrite Rules
   RewriteEngine On
   # Restricted ILS-DI Access
   RewriteCond %{QUERY_STRING} !(^($|(\??|(.*&))service=(Describe|GetAvailability|GetRecords|GetAuthorityRecords)))
   RewriteRule ^/cgi-bin/koha/ilsdi\.pl$ - [R=403,L]
</IfModule>

Because an IP can be easily spoofed, the second way is recommanded."

This would be great to have this restriction setup by default when installing Koha, and to have the possibility to open level 3 and 4 of ILS-DI only if needed.
This would be more compliant with GDPR (see bug 18081).
Thanks
Anne-Claire