Bug 41310 - Add remote_ip (REMOTE_ADDR) to action_logs table to improve security auditing
Summary: Add remote_ip (REMOTE_ADDR) to action_logs table to improve security auditing
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-11-26 06:26 UTC by Saiful Amin
Modified: 2025-11-26 06:26 UTC (History)
0 users

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Saiful Amin 2025-11-26 06:26:05 UTC
Context:
Currently, the action_logs table records what happened, when it happened, and who performed the action. However, it does not record the network context (source IP) of the request.

The Problem:
For security auditing, it is necessary to trace an action back to a specific IP address. This is critical when:
1. A staff account is compromised (distinguishing the attacker from the real user).
2. Multiple concurrent sessions exist for the same user (e.g., logged in at the desk and on a mobile device).

The Session data:
The sessions table in Koha is temporary, which may even be stored cache or filesystem. If we store the session_id in action_logs, we can only link it to an IP address while the session is still active. Once the session is cleared, we will lose the IP address history.

Proposed Solution:
We should capture the REMOTE_ADDR at the time the action occurs and store it directly into a new column in the action_logs table. This ensures the audit trail remains complete permanently, regardless of the session status.