https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Analysis of IP-based restriction patterns in Koha: Current state - three different matching strategies coexist: 1. C4::Auth::in_iprange (used by SelfCheckAllowByIPRanges) - Proper CIDR matching via Net::CIDR - Reads REMOTE_ADDR internally - Space-separated ranges - Already exported, used by opac/sco/*.pl 2. Regex prefix match (used by OpacSuppressionByIPRange, RestrictedPageLocalIPs) - Simple: $ip =~ /^$range/ - Not CIDR-aware, dot matches any char - Repeated inline in opac-search.pl, opac-shelves.pl, C4::Output, opac-restrictedpage.pl 3. Net::Netmask (used by ILS-DI AuthorizedIPs) - $netmask->match($ENV{REMOTE_ADDR}) - Only in opac/ilsdi.pl Places where IP restriction logic exists: - opac/sco/sco-main.pl (SelfCheckAllowByIPRanges via in_iprange) - opac/sco/help.pl (same) - opac/sco/printslip.pl (same) - opac/sco/sco-patron-image.pl (same) - opac/opac-search.pl (OpacSuppressionByIPRange, regex prefix) - opac/opac-shelves.pl (OpacSuppressionByIPRange, regex prefix, x2) - C4/Output.pm redirect_if_opac_suppressed (OpacSuppressionByIPRange, regex prefix) - opac/opac-restrictedpage.pl (RestrictedPageLocalIPs, regex prefix) - opac/ilsdi.pl (ILS-DI:AuthorizedIPs, Net::Netmask) - C4/Auth.pm session IP validation (direct comparison) - Koha/Template/Plugin/Branches.pm (REMOTE_ADDR for branch detection) Open questions for design: - Should this live in Koha::Policy::Access::IPRange (following the Policy pattern for resolving configuration into a decision)? - Or is it a lower-level utility (just 'does this IP match this range') that Policy classes and controllers both consume? - Should we unify on CIDR (Net::CIDR, which in_iprange already uses) and deprecate the regex prefix approach? - The regex approach is simpler for users to configure ('172.18.' vs '172.18.0.0/16') - do we keep both syntaxes? - in_iprange currently lives in C4::Auth which is not the right home for a general utility Note: in_iprange already does what we need. The main work is: 1. Relocate it (Koha::Network::Utils? Koha::IP? Koha::Policy::IPAccess?) 2. Decide if the regex prefix syntax should be supported alongside CIDR 3. Replace the inline regex checks with the centralized helper 4. Ensure test coverage for edge cases (undef REMOTE_ADDR, empty range, IPv6) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.