Bug 3068 - Auth.pm: IP address matching overly generous
Summary: Auth.pm: IP address matching overly generous
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: 3.4
Hardware: PC All
: P5 - low minor (vote)
Assignee: Ian Walls
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-27 09:55 UTC by Ian Walls
Modified: 2013-12-05 20:04 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:06:01 UTC


---- Reported by ian.walls@bywatersolutions.com 2009-03-27 21:55:08 ----

On lines 655 and 665 of Auth.pm, in the subroutine checkauth(), the regular expression that attempts to match the remote address with the branchip does not behave as expected.  Since the user input is used directly in a regular expression, without escaping the '.'s and translating the '*'s, unintended IPs can slip in.  

Example:

Branch IP Range:  192.168.1.*
Should only match with IPs that have the same first 3 octets, however the following regex actually matches all these IP ranges:
191.168.1.*
191.168.10-19.*
191.168.100-199.*

Problem could be solved by escaping '.' and replacing '*' with '.*' in the $domain variable.

The documentation to also be updated to reflect this as a feature, rather than a bug.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC  ---

This bug was previously known as _bug_ 3068 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3068

Unknown operating system Linux - Debian. Setting to default OS "All".
Actual time not defined. Setting to 0.0

Comment 1 Ian Walls 2010-12-11 21:24:32 UTC
Problem persists... assigning to myself to fix at last.
Comment 2 Mirko Tietgen 2013-01-15 13:34:54 UTC
If I am not mistaken
- this bug refers to what is nowadays line 700f of Auth.pm
- said regular expression is not part of the code anymore

I am marking this as resolved-fixed but would appreciate if someone (maybe Ian) could verify what I wrote.