[Bug 41011] New: SelfCheckAllowByIPRanges doesn't work with localhost connections
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41011 Bug ID: 41011 Summary: SelfCheckAllowByIPRanges doesn't work with localhost connections Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: olli-antti.kivilahti@hypernova.fi QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org TEST PLAN: 0. Enable SCO from sysprefs 1. SelfCheckAllowByIPRanges = ::1 localhost 127.0.0.1 2. From within the Koha-server, do curl http://localhost:80/cgi-bin/koha/sco/sco-main.pl 2.a. Or set up stunnel4 for a SCO-client. 3. Observe SCO-module is not loaded, but the OPAC login screen. To fix is to add checks for C4::Auth::in_iprange to allow localhost eg. return 1 if ($ENV{'REMOTE_ADDR'} =~ /^(?:::1)|(?:localhost)|(?:127\.0\.0\.1)$/); -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41011 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lari.taskula@hypernova.fi Status|NEW |CLOSED Resolution|--- |INVALID --- Comment #1 from Lari Taskula <lari.taskula@hypernova.fi> --- Thanks for the report Olli! We eventually figured out that as per RFC3875 [1], REMOTE_ADDR only accepts IPv4 or IPv6 addresses, but not hostnames. So we don't need to expect a string "localhost" in $ENV{REMOTE_ADDR} in C4::Auth::in_iprange(). The problem can be resolved by simply removing "localhost" from the system preference SelfCheckAllowByIPRanges. Moreover SelfCheckAllowByIPRanges already documents the expected usage: "Use ranges or simple IP addresses" To fix: 0. Enable SCO from sysprefs 1. SelfCheckAllowByIPRanges = ::1 127.0.0.1 2. From within the Koha-server, do curl http://localhost:80/cgi-bin/koha/sco/sco-main.pl 3. Observe SCO-module is not loaded, but the OPAC login screen. For these reasons I am closing this Bug. [1] https://www.rfc-editor.org/rfc/rfc3875#section-4.1.8 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41011 --- Comment #2 from Lari Taskula <lari.taskula@hypernova.fi> --- (In reply to Lari Taskula from comment #1)
To fix: 0. Enable SCO from sysprefs 1. SelfCheckAllowByIPRanges = ::1 127.0.0.1 2. From within the Koha-server, do curl http://localhost:80/cgi-bin/koha/sco/sco-main.pl 3. Observe SCO-module is not loaded, but the OPAC login screen.
Correction, change
3. Observe SCO-module is not loaded, but the OPAC login screen. to
3. Observe SCO-module IS loaded, not the OPAC login screen.
-- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41011 --- Comment #3 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 188124 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188124&action=edit Bug 41011: Add test -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org