| Summary: | SelfCheckAllowByIPRanges doesn't work with localhost connections | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Olli-Antti Kivilahti <olli-antti.kivilahti> |
| Component: | Authentication | Assignee: | Bugs List <koha-bugs> |
| Status: | CLOSED INVALID | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dpavlin, lari.taskula |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: | Bug 41011: Add test | ||
|
Description
Olli-Antti Kivilahti
2025-10-14 09:54:49 UTC
Thanks for the report Olli!
We eventually figured out that as per RFC3875 [1], REMOTE_ADDR only accepts IPv4 or IPv6 addresses, but not hostnames. So we don't need to expect a string "localhost" in $ENV{REMOTE_ADDR} in C4::Auth::in_iprange().
The problem can be resolved by simply removing "localhost" from the system preference SelfCheckAllowByIPRanges.
Moreover SelfCheckAllowByIPRanges already documents the expected usage:
"Use ranges or simple IP addresses"
To fix:
0. Enable SCO from sysprefs
1. SelfCheckAllowByIPRanges = ::1 127.0.0.1
2. From within the Koha-server, do curl http://localhost:80/cgi-bin/koha/sco/sco-main.pl
3. Observe SCO-module is not loaded, but the OPAC login screen.
For these reasons I am closing this Bug.
[1] https://www.rfc-editor.org/rfc/rfc3875#section-4.1.8
(In reply to Lari Taskula from comment #1) > To fix: > 0. Enable SCO from sysprefs > 1. SelfCheckAllowByIPRanges = ::1 127.0.0.1 > 2. From within the Koha-server, do curl > http://localhost:80/cgi-bin/koha/sco/sco-main.pl > 3. Observe SCO-module is not loaded, but the OPAC login screen. Correction, change > 3. Observe SCO-module is not loaded, but the OPAC login screen. to > 3. Observe SCO-module IS loaded, not the OPAC login screen. Created attachment 188124 [details] [review] Bug 41011: Add test |