Summary: | Add support for IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Web services | Assignee: | David Cook <dcook> |
Status: | CLOSED FIXED | QA Contact: | Kyle M Hall (khall) <kyle> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | 1joynelson, bc, black23, kyle, martin.renvoize |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23068 | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: |
It's now possible to not only allow a single IP, but multiple IPs, IP ranges and subnets access to the ILS-DI API.
|
Version(s) released in: |
20.05.00
|
Circulation function: | |||
Attachments: |
Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask
Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask Bug 24537: Tidy code |
Description
David Cook
2020-01-30 03:40:24 UTC
Created attachment 98105 [details] [review] Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask This patch uses Net::Netmask to match IPs from ILS-DI:AuthorizedIPs against $ENV{REMOTE_USER}. By using Net::Netmask, we can use addresses in a variety of formats. This includes 127.0.0.1, 192.168.1.0/24, 10.0.0, and so on. To Test: 1. Apply the patch 2. Empty the 'ILS-DI:AuthorizedIPs' system preference 3. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 3b. Note that the request is successful 4. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet including your IP address (e.g. 192.168.1.0/24) 5. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 5b. Note that the request is successful 6. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet that doesn't include your IP address (e.g. 1.1.1) 7. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 7b. Note that your request is refused 8. Try a variety of permutations including bad values (e.g. 192.168.1.) or multiple values (e.g. 10.0.0.0/8,192.168.1.0/24) or multiple values including a mix of good and bad values Note that this really shines when you're running Koha behind a reverse proxy and you use koha_trusted_proxies to set your REMOTE_USER to the IP address that contacted your reverse proxy (or the last one in a trust chain). (Note also that there are other places in Koha that could benefit from this. Like OpacSuppressionByIPRange, RestrictedPageLocalIPs, etc.) *** Bug 20243 has been marked as a duplicate of this bug. *** Created attachment 102172 [details] [review] Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask This patch uses Net::Netmask to match IPs from ILS-DI:AuthorizedIPs against $ENV{REMOTE_USER}. By using Net::Netmask, we can use addresses in a variety of formats. This includes 127.0.0.1, 192.168.1.0/24, 10.0.0, and so on. To Test: 1. Apply the patch 2. Empty the 'ILS-DI:AuthorizedIPs' system preference 3. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 3b. Note that the request is successful 4. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet including your IP address (e.g. 192.168.1.0/24) 5. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 5b. Note that the request is successful 6. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet that doesn't include your IP address (e.g. 1.1.1) 7. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 7b. Note that your request is refused 8. Try a variety of permutations including bad values (e.g. 192.168.1.) or multiple values (e.g. 10.0.0.0/8,192.168.1.0/24) or multiple values including a mix of good and bad values Signed-off-by: David Nind <david@davidnind.com> Thanks, David! You're a legend :). Created attachment 102213 [details] [review] Bug 24537: Allow IP ranges in ILS-DI:AuthorizedIPs using Net::Netmask This patch uses Net::Netmask to match IPs from ILS-DI:AuthorizedIPs against $ENV{REMOTE_USER}. By using Net::Netmask, we can use addresses in a variety of formats. This includes 127.0.0.1, 192.168.1.0/24, 10.0.0, and so on. To Test: 1. Apply the patch 2. Empty the 'ILS-DI:AuthorizedIPs' system preference 3. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 3b. Note that the request is successful 4. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet including your IP address (e.g. 192.168.1.0/24) 5. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 5b. Note that the request is successful 6. Set the 'ILS-DI:AuthorizedIPs' system preference to a subnet that doesn't include your IP address (e.g. 1.1.1) 7. Send a request to '/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=1&id_type=cardnumber' 7b. Note that your request is refused 8. Try a variety of permutations including bad values (e.g. 192.168.1.) or multiple values (e.g. 10.0.0.0/8,192.168.1.0/24) or multiple values including a mix of good and bad values Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 102214 [details] [review] Bug 24537: Tidy code Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Nice work everyone! Pushed to master for 20.05 enhancement not backported to 19.11.x |