Bug 3068

Summary: Auth.pm: IP address matching overly generous
Product: Koha Reporter: Ian Walls <koha.sekjal>
Component: Architecture, internals, and plumbingAssignee: Ian Walls <koha.sekjal>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: minor    
Priority: P5 - low CC: mirko
Version: 3.4   
Hardware: PC   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Chris Cormack 2010-05-21 01:06:01 UTC


---- Reported by ian.walls@bywatersolutions.com 2009-03-27 21:55:08 ----

On lines 655 and 665 of Auth.pm, in the subroutine checkauth(), the regular expression that attempts to match the remote address with the branchip does not behave as expected.  Since the user input is used directly in a regular expression, without escaping the '.'s and translating the '*'s, unintended IPs can slip in.  

Example:

Branch IP Range:  192.168.1.*
Should only match with IPs that have the same first 3 octets, however the following regex actually matches all these IP ranges:
191.168.1.*
191.168.10-19.*
191.168.100-199.*

Problem could be solved by escaping '.' and replacing '*' with '.*' in the $domain variable.

The documentation to also be updated to reflect this as a feature, rather than a bug.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC  ---

This bug was previously known as _bug_ 3068 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3068

Unknown operating system Linux - Debian. Setting to default OS "All".
Actual time not defined. Setting to 0.0

Comment 1 Ian Walls 2010-12-11 21:24:32 UTC
Problem persists... assigning to myself to fix at last.
Comment 2 Mirko Tietgen 2013-01-15 13:34:54 UTC
If I am not mistaken
- this bug refers to what is nowadays line 700f of Auth.pm
- said regular expression is not part of the code anymore

I am marking this as resolved-fixed but would appreciate if someone (maybe Ian) could verify what I wrote.