Bug 41310

Summary: Add remote_ip (REMOTE_ADDR) to action_logs table to improve security auditing
Product: Koha Reporter: Saiful Amin <saiful>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Saiful Amin 2025-11-26 06:26:05 UTC
Context:
Currently, the action_logs table records what happened, when it happened, and who performed the action. However, it does not record the network context (source IP) of the request.

The Problem:
For security auditing, it is necessary to trace an action back to a specific IP address. This is critical when:
1. A staff account is compromised (distinguishing the attacker from the real user).
2. Multiple concurrent sessions exist for the same user (e.g., logged in at the desk and on a mobile device).

The Session data:
The sessions table in Koha is temporary, which may even be stored cache or filesystem. If we store the session_id in action_logs, we can only link it to an IP address while the session is still active. Once the session is cleared, we will lose the IP address history.

Proposed Solution:
We should capture the REMOTE_ADDR at the time the action occurs and store it directly into a new column in the action_logs table. This ensures the audit trail remains complete permanently, regardless of the session status.