Summary: | If IndependantBranches and AutoLocation enabled, OPAC login does not redirect properly outside IP range | ||
---|---|---|---|
Product: | Koha | Reporter: | Ian Walls <koha.sekjal> |
Component: | Authentication | Assignee: | Ian Walls <koha.sekjal> |
Status: | RESOLVED DUPLICATE | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | minor | ||
Priority: | PATCH-Sent (DO NOT USE) | CC: | dpavlin, jonathan.druart, m.de.rooy, martin.renvoize, sophie.meynieux |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3068 | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Attachments: |
Proposed Patch
[SIGNED-OFF] Bug 6804: if IndependantBranches & AutoLocation, OPAC login redirect fails |
Description
Ian Walls
2011-08-29 15:32:21 UTC
Created attachment 5214 [details] [review] Proposed Patch AutoLocation should only apply to the staff client login, but when IndependantBranches was activated, it applied to the OPAC login, as well. Login was not prevented, but the patron was greeted with another login prompt, instead of the My Summary page. Very confusing. This patch adds a check for whether this is an OPAC login before executing the particular code that was causing this. To test: 1. Enable IndependantBranches & AutoLocation (be sure your branches have IP ranges configured!) 2. Select a staff account, and note the branch 3. Attempt to login to the staff client from within the IP range for the branch: this should work 4. Attempt to login to the staff client from outside the IP range: this should be blocked 5. Attempt to login to the OPAC from within the IP range: this should work 6. Attempt to login to the OPAC from outside the IP range: this should also work Created attachment 6198 [details] [review] [SIGNED-OFF] Bug 6804: if IndependantBranches & AutoLocation, OPAC login redirect fails AutoLocation should only apply to the staff client login, but when IndependantBranches was activated, it applied to the OPAC login, as well. Login was not prevented, but the patron was greeted with another login prompt, instead of the My Summary page. Very confusing. This patch adds a check for whether this is an OPAC login before executing the particular code that was causing this. To test: 1. Enable IndependantBranches & AutoLocation (be sure your branches have IP ranges configured!) 2. Select a staff account, and note the branch 3. Attempt to login to the staff client from within the IP range for the branch: this should work 4. Attempt to login to the staff client from outside the IP range: this should be blocked 5. Attempt to login to the OPAC from within the IP range: this should work 6. Attempt to login to the OPAC from outside the IP range: this should also work Signed-off-by: Sophie Meynieux <sophie.meynieux@biblibre.com> I have tested this patch as described. As my koha server is local, the IP address I have to authorize for the site was 127.0.0.1 Laurent Ducos draws our attention on the fact that this IP check can be easily bypassed by IP spoofing QA Comment: I did not test this patch, but have some comments on the code that is not directly touched by this patch but is in the direct context. I think that the check if ($ip !~ /^$domain/) does not work. If domain is a full IP address it works. But if domain is a subnet mask like 199.1.*, the check will also approve addresses like 199.11.12.13 which it should not (.* will `eat` 1.12.13). From a QA standpoint, I do not like it that the code here takes its regex here directly from the database. The point in the database column is not meant as a regex wildcard. My recommendation therefore is that this patch should also correct this regex, since it directly deals with the if-condition on top of it. Looks like this has completely fallen off the radar... do we know if it's still a bug in current master? |