From 83fe1e4b5bdc43ded15afe90f26035621606abbe Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Wed, 15 May 2024 16:10:05 +0000 Subject: [PATCH] Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed To test: 1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank 2 - In another window: http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item 3 - You get a response 4 - Apply patch and restart all 5 - Reload ilsdi page, 'Not authorized' 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs 7 - Reload the page, you get a response again 8 - Change ILS-DI:AuthorizedIPs to: 0:0:0:0/0 9 - You still have access 10 - Paste your specific IP again, and add a second made up IP (comma separated) 11 - Reload and confirm you still have access Signed-off-by: Martin Renvoize Signed-off-by: wainuiwitikapark (cherry picked from commit 5fcc519aa351ceafb0fb6a15547eab33c6bb7b07) Signed-off-by: Fridolin Somers --- opac/ilsdi.pl | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/opac/ilsdi.pl b/opac/ilsdi.pl index 5b105246fa..422df4ccc7 100755 --- a/opac/ilsdi.pl +++ b/opac/ilsdi.pl @@ -176,6 +176,19 @@ if (@AuthorizedIPs) { # If no filter set, allow access to everybody $out->{'code'} = "NotAllowed"; $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; } +} else { + $out->{'code'} = "NotAllowed"; + $out->{'message'} = "Unauthorized IP address: $ENV{REMOTE_ADDR}."; + + print XMLout( + $out, + noattr => 1, + nosort => 1, + xmldecl => '', + RootName => "ilsdi", + SuppressEmpty => 1 + ); + exit 0; } my $service = $cgi->param('service') || "ilsdi";