---- Reported by firstname.lastname@example.org 2009-03-27 21:55:08 ----
On lines 655 and 665 of Auth.pm, in the subroutine checkauth(), the regular expression that attempts to match the remote address with the branchip does not behave as expected. Since the user input is used directly in a regular expression, without escaping the '.'s and translating the '*'s, unintended IPs can slip in.
Branch IP Range: 192.168.1.*
Should only match with IPs that have the same first 3 octets, however the following regex actually matches all these IP ranges:
Problem could be solved by escaping '.' and replacing '*' with '.*' in the $domain variable.
The documentation to also be updated to reflect this as a feature, rather than a bug.
--- Bug imported by email@example.com 2010-05-21 01:06 UTC ---
This bug was previously known as _bug_ 3068 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3068
Unknown operating system Linux - Debian. Setting to default OS "All".
Actual time not defined. Setting to 0.0
Problem persists... assigning to myself to fix at last.
If I am not mistaken
- this bug refers to what is nowadays line 700f of Auth.pm
- said regular expression is not part of the code anymore
I am marking this as resolved-fixed but would appreciate if someone (maybe Ian) could verify what I wrote.