gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs 

This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed

To test:
 1 - Enable ILS-DI, leave  ILS-DI:AuthorizedIPs blank
 2 - In another window:
    http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item
 3 - You get a response
 4 - Apply patch and restart all
 5 - Reload ilsdi page, 'Not authorized'
 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs
 7 - Reload the page, you get a response again
 8 - Change ILS-DI:AuthorizedIPs to:
    0:0:0:0/0
 9 - You still have access
10 - Paste your specific IP again, and add a second made up IP (comma separated)
11 - Reload and confirm you still have access

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Nick Clemens 2024-05-15 16:10:05 +00:00 committed by Wainui Witika-Park
parent 6e267dc90f
commit 5fcc519aa3
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
opac/ilsdi.pl
View File

@ -176,6 +176,19 @@ if (@AuthorizedIPs) { # If no filter set, allow access to everybody
$out->{'code'} = "NotAllowed";
$out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}.";
}
} else {
$out->{'code'} = "NotAllowed";
$out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}.";
print XMLout(
$out,
noattr => 1,
nosort => 1,
xmldecl => '<?xml version="1.0" encoding="UTF-8" ?>',
RootName => "ilsdi",
SuppressEmpty => 1
);
exit 0;
}
my $service = $cgi->param('service') || "ilsdi";