Found when testing StaffLoginRestrictBranchByIP: * Turn on StaffLoginRestrictBranchByIP * Set CPL's IP to 1.2.3.4 * Go to the staff login screen and try to connect to CPL => Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK) * Pick another library => 403 (KO)
I think I see the issue - we aren't getting a sessionID after the failure: 1224 if ( $ip !~ /^$domain/ ) { 1225 $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( 1226 -name => 'CGISESSID', 1227 -value => '', 1228 -HttpOnly => 1, 1229 -secure => ( C4::Context->https_enabled() ? 1 : 0 ), 1230 -sameSite => 'Lax', 1231 )); 1232 $info{'wrongip'} = 1; 1233 $auth_state = "failed"; 1234 } This correctly clears (without it I can log in to any branch on subsequent try) but does not create a new session ID, not sure how to fix this one
Might be fixed if we store the session's id in userenv (see bug 37041).