Bug 41011

Summary: SelfCheckAllowByIPRanges doesn't work with localhost connections
Product: Koha Reporter: Olli-Antti Kivilahti <olli-antti.kivilahti>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: CLOSED INVALID QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dpavlin, lari.taskula
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 41011: Add test

Description Olli-Antti Kivilahti 2025-10-14 09:54:49 UTC
TEST PLAN:
0. Enable SCO from sysprefs
1. SelfCheckAllowByIPRanges = ::1 localhost 127.0.0.1
2. From within the Koha-server, do curl http://localhost:80/cgi-bin/koha/sco/sco-main.pl
2.a. Or set up stunnel4 for a SCO-client.
3. Observe SCO-module is not loaded, but the OPAC login screen.

To fix is to add checks for C4::Auth::in_iprange to allow localhost

eg.

return 1 if ($ENV{'REMOTE_ADDR'} =~ /^(?:::1)|(?:localhost)|(?:127\.0\.0\.1)$/);
Comment 1 Lari Taskula 2025-10-19 07:29:34 UTC
Thanks for the report Olli!

We eventually figured out that as per RFC3875 [1], REMOTE_ADDR only accepts IPv4 or IPv6 addresses, but not hostnames. So we don't need to expect a string "localhost" in $ENV{REMOTE_ADDR} in C4::Auth::in_iprange().

The problem can be resolved by simply removing "localhost" from the system preference SelfCheckAllowByIPRanges.

Moreover SelfCheckAllowByIPRanges already documents the expected usage:
"Use ranges or simple IP addresses"

To fix:
0. Enable SCO from sysprefs
1. SelfCheckAllowByIPRanges = ::1 127.0.0.1
2. From within the Koha-server, do curl http://localhost:80/cgi-bin/koha/sco/sco-main.pl
3. Observe SCO-module is not loaded, but the OPAC login screen.

For these reasons I am closing this Bug.

[1] https://www.rfc-editor.org/rfc/rfc3875#section-4.1.8
Comment 2 Lari Taskula 2025-10-19 08:02:55 UTC
(In reply to Lari Taskula from comment #1)
> To fix:
> 0. Enable SCO from sysprefs
> 1. SelfCheckAllowByIPRanges = ::1 127.0.0.1
> 2. From within the Koha-server, do curl
> http://localhost:80/cgi-bin/koha/sco/sco-main.pl
> 3. Observe SCO-module is not loaded, but the OPAC login screen.

Correction, change

> 3. Observe SCO-module is not loaded, but the OPAC login screen.
to

> 3. Observe SCO-module IS loaded, not the OPAC login screen.
Comment 3 Lari Taskula 2025-10-19 08:09:03 UTC
Created attachment 188124 [details] [review]
Bug 41011: Add test