use Koha;
use Koha::Caches;
use Koha::AuthUtils qw(get_script_name hash_password);
+use Koha::DateUtils qw(dt_from_string);
+use Koha::Library::Groups;
use Koha::Libraries;
-use Koha::LibraryCategories;
use Koha::Patrons;
use POSIX qw/strftime/;
use List::MoreUtils qw/ any /;
@ISA = qw(Exporter);
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
- &get_all_subpermissions &get_user_subpermissions
+ &get_all_subpermissions &get_user_subpermissions track_login_daily
);
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
$ldap = C4::Context->config('useldapserver') || 0;
}
}
if ($cas) {
- import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
+ import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required);
}
}
C4::Context->interface( $in->{type} );
- my $safe_chars = 'a-zA-Z0-9_\-\/';
- die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+\.tt$/ig; #sanitize input
-
$in->{'authnotrequired'} ||= 0;
+
+ # the following call includes a bad template check; might croak
my $template = C4::Templates::gettemplate(
$in->{'template_name'},
$in->{'type'},
$in->{'query'},
- $in->{'is_plugin'}
);
if ( $in->{'template_name'} !~ m/maintenance/ ) {
);
}
+ if ( $in->{type} eq 'opac' && $user ) {
+ my $kick_out;
+
+ if (
+# If the user logged in is the SCO user and they try to go out of the SCO module,
+# log the user out removing the CGISESSID cookie
+ $in->{template_name} !~ m|sco/|
+ && C4::Context->preference('AutoSelfCheckID')
+ && $user eq C4::Context->preference('AutoSelfCheckID')
+ )
+ {
+ $kick_out = 1;
+ }
+ elsif (
+# If the user logged in is the SCI user and they try to go out of the SCI module,
+# kick them out unless it is SCO with a valid permission
+# or they are a superlibrarian
+ $in->{template_name} !~ m|sci/|
+ && haspermission( $user, { self_check => 'self_checkin_module' } )
+ && !(
+ $in->{template_name} =~ m|sco/| && haspermission(
+ $user, { self_check => 'self_checkout_module' }
+ )
+ )
+ && $flags && $flags->{superlibrarian} != 1
+ )
+ {
+ $kick_out = 1;
+ }
- # If the user logged in is the SCO user and they try to go out of the SCO module, log the user out removing the CGISESSID cookie
- if ( $in->{type} eq 'opac' and $in->{template_name} !~ m|sco/| ) {
- if ( $user && C4::Context->preference('AutoSelfCheckID') && $user eq C4::Context->preference('AutoSelfCheckID') ) {
- $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac', $in->{query} );
- my $cookie = $in->{query}->cookie(
+ if ($kick_out) {
+ $template = C4::Templates::gettemplate( 'opac-auth.tt', 'opac',
+ $in->{query} );
+ $cookie = $in->{query}->cookie(
-name => 'CGISESSID',
-value => '',
-expires => '',
loginprompt => 1,
script_name => get_script_name(),
);
+
print $in->{query}->header(
- { type => 'text/html',
+ {
+ type => 'text/html',
charset => 'utf-8',
cookie => $cookie,
'X-Frame-Options' => 'SAMEORIGIN'
}
),
- $template->output;
+ $template->output;
safe_exit;
}
}
# It's possible for $user to be the borrowernumber if they don't have a
# userid defined (and are logging in through some other method, such
# as SSL certs against an email address)
- my $borrower;
+ my $patron;
$borrowernumber = getborrowernumber($user) if defined($user);
if ( !defined($borrowernumber) && defined($user) ) {
- $borrower = Koha::Patrons->find( $user );
- if ($borrower) {
- $borrower = $borrower->unblessed;
+ $patron = Koha::Patrons->find( $user );
+ if ($patron) {
$borrowernumber = $user;
# A bit of a hack, but I don't know there's a nicer way
# to do it.
- $user = $borrower->{firstname} . ' ' . $borrower->{surname};
+ $user = $patron->firstname . ' ' . $patron->surname;
}
} else {
- $borrower = Koha::Patrons->find( $borrowernumber );
- $borrower->unblessed if $borrower; # FIXME Otherwise, what to do?
+ $patron = Koha::Patrons->find( $borrowernumber );
+ # FIXME What to do if $patron does not exist?
}
# user info
- $template->param( loggedinusername => $user );
- $template->param( loggedinusernumber => $borrowernumber );
+ $template->param( loggedinusername => $user ); # FIXME Should be replaced with something like patron-title.inc
+ $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
+ $template->param( logged_in_user => $patron );
$template->param( sessionID => $sessionID );
if ( $in->{'type'} eq 'opac' ) {
);
}
- $template->param( "USER_INFO" => $borrower );
+ $template->param( "USER_INFO" => $patron->unblessed ) if $borrowernumber != 0;
my $all_perms = get_all_subpermissions();
$template->param( CAN_user_plugins => 1 );
$template->param( CAN_user_coursereserves => 1 );
$template->param( CAN_user_clubs => 1 );
+ $template->param( CAN_user_ill => 1 );
foreach my $module ( keys %$all_perms ) {
foreach my $subperm ( keys %{ $all_perms->{$module} } ) {
my $https = $in->{query}->https();
my $using_https = ( defined $https and $https ne 'OFF' ) ? 1 : 0;
+ my $minPasswordLength = C4::Context->preference('minPasswordLength');
+ $minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;
$template->param(
"BiblioDefaultView" . C4::Context->preference("BiblioDefaultView") => 1,
EnhancedMessagingPreferences => C4::Context->preference('EnhancedMessagingPreferences'),
noItemTypeImages => C4::Context->preference("noItemTypeImages"),
marcflavour => C4::Context->preference("marcflavour"),
OPACBaseURL => C4::Context->preference('OPACBaseURL'),
+ minPasswordLength => $minPasswordLength,
);
if ( $in->{'type'} eq "intranet" ) {
$template->param(
EnableBorrowerFiles => C4::Context->preference('EnableBorrowerFiles'),
UseKohaPlugins => C4::Context->preference('UseKohaPlugins'),
UseCourseReserves => C4::Context->preference("UseCourseReserves"),
- useDischarge => C4::Context->preference('useDischarge'),
+ useDischarge => C4::Context->preference('useDischarge')
);
}
else {
$opac_name = C4::Context->userenv->{'branch'};
}
- my $library_categories = Koha::LibraryCategories->search({categorytype => 'searchdomain', show_in_pulldown => 1}, { order_by => ['categorytype', 'categorycode']});
+ my @search_groups = Koha::Library::Groups->get_search_groups({ interface => 'opac' });
$template->param(
OpacAdditionalStylesheet => C4::Context->preference("OpacAdditionalStylesheet"),
AnonSuggestions => "" . C4::Context->preference("AnonSuggestions"),
- BranchCategoriesLoop => $library_categories,
+ LibrarySearchGroups => \@search_groups,
opac_name => $opac_name,
LibraryName => "" . C4::Context->preference("LibraryName"),
LibraryNameTitle => "" . $LibraryNameTitle,
sub checkauth {
my $query = shift;
$debug and warn "Checking Auth";
-
# $authnotrequired will be set for scripts which will run without authentication
my $authnotrequired = shift;
my $flagsrequired = shift;
my $logout = $query->param('logout.x');
my $anon_search_history;
-
+ my $cas_ticket = '';
# This parameter is the name of the CAS server we want to authenticate against,
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml
my $casparam = $query->param('cas');
my $q_userid = $query->param('userid') // '';
+ my $session;
+
# Basic authentication is incompatible with the use of Shibboleth,
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
# and it may not be the attribute we want to use to match the koha login.
}
elsif ( $sessionID = $query->cookie("CGISESSID") )
{ # assignment, not comparison
- my $session = get_session($sessionID);
+ $session = get_session($sessionID);
C4::Context->_new_userenv($sessionID);
my ( $ip, $lasttime, $sessiontype );
my $s_userid = '';
}
}
unless ( $userid || $sessionID ) {
-
#we initiate a session prior to checking for a username to allow for anonymous sessions...
my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
{
my $password = $query->param('password');
my $shibSuccess = 0;
-
my ( $return, $cardnumber );
# If shib is enabled and we have a shib login, does the login match a valid koha user
unless ($shibSuccess) {
if ( $cas && $query->param('ticket') ) {
my $retuserid;
- ( $return, $cardnumber, $retuserid ) =
+ ( $return, $cardnumber, $retuserid, $cas_ticket ) =
checkpw( $dbh, $userid, $password, $query, $type );
$userid = $retuserid;
$info{'invalidCasLogin'} = 1 unless ($return);
}
else {
my $retuserid;
- ( $return, $cardnumber, $retuserid ) =
+ ( $return, $cardnumber, $retuserid, $cas_ticket ) =
checkpw( $dbh, $q_userid, $password, $query, $type );
$userid = $retuserid if ($retuserid);
$info{'invalid_username_or_password'} = 1 unless ($return);
}
}
- # $return: 1 = valid user, 2 = superlibrarian
+ # $return: 1 = valid user
if ($return) {
- # If DB user is logged in
- $userid ||= $q_userid if $return == 2;
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
if ( $flags = haspermission( $userid, $flagsrequired ) ) {
$session->param( 'shibboleth', $shibSuccess );
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map { $session->param($_) } qw(cardnumber firstname surname branch);
}
- elsif ( $return == 2 ) {
-
- #We suppose the user is the superlibrarian
- $borrowernumber = 0;
- $session->param( 'number', 0 );
- $session->param( 'id', C4::Context->config('user') );
- $session->param( 'cardnumber', C4::Context->config('user') );
- $session->param( 'firstname', C4::Context->config('user') );
- $session->param( 'surname', C4::Context->config('user') );
- $session->param( 'branch', 'NO_LIBRARY_SET' );
- $session->param( 'branchname', 'NO_LIBRARY_SET' );
- $session->param( 'flags', 1 );
- $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') );
- $session->param( 'ip', $session->remote_addr() );
- $session->param( 'lasttime', time() );
- }
+ $session->param('cas_ticket', $cas_ticket) if $cas_ticket;
C4::Context->set_userenv(
$session->param('number'), $session->param('id'),
$session->param('cardnumber'), $session->param('firstname'),
);
}
- if ( $userid ) {
- # track_login also depends on pref TrackLastPatronActivity
- my $patron = Koha::Patrons->find({ userid => $userid });
- $patron->track_login if $patron;
- }
+ track_login_daily( $userid );
return ( $userid, $cookie, $sessionID, $flags );
}
PatronSelfRegistration => C4::Context->preference("PatronSelfRegistration"),
PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'},
- too_many_login_attempts => ( $patron and $patron->account_locked ),
+ too_many_login_attempts => ( $patron and $patron->account_locked )
);
$template->param( SCO_login => 1 ) if ( $query->param('sco_user_login') );
+ $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
$template->param( OpacPublic => C4::Context->preference("OpacPublic") );
$template->param( loginprompt => 1 ) unless $info{'nopermission'};
=cut
sub check_api_auth {
+
my $query = shift;
my $flagsrequired = shift;
-
my $dbh = C4::Context->dbh;
my $timeout = _timeout_syspref();
# new login
my $userid = $query->param('userid');
my $password = $query->param('password');
- my ( $return, $cardnumber );
+ my ( $return, $cardnumber, $cas_ticket );
# Proxy CAS auth
if ( $cas && $query->param('PT') ) {
# In case of a CAS authentication, we use the ticket instead of the password
my $PT = $query->param('PT');
- ( $return, $cardnumber, $userid ) = check_api_auth_cas( $dbh, $PT, $query ); # EXTERNAL AUTH
+ ( $return, $cardnumber, $userid, $cas_ticket ) = check_api_auth_cas( $dbh, $PT, $query ); # EXTERNAL AUTH
} else {
# User / password auth
# caller did something wrong, fail the authenticateion
return ( "failed", undef, undef );
}
- ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
+ my $newuserid;
+ ( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $dbh, $userid, $password, $query );
}
if ( $return and haspermission( $userid, $flagsrequired ) ) {
$session->param( 'emailaddress', $emailaddress );
$session->param( 'ip', $session->remote_addr() );
$session->param( 'lasttime', time() );
- } elsif ( $return == 2 ) {
-
- #We suppose the user is the superlibrarian
- $session->param( 'number', 0 );
- $session->param( 'id', C4::Context->config('user') );
- $session->param( 'cardnumber', C4::Context->config('user') );
- $session->param( 'firstname', C4::Context->config('user') );
- $session->param( 'surname', C4::Context->config('user') );
- $session->param( 'branch', 'NO_LIBRARY_SET' );
- $session->param( 'branchname', 'NO_LIBRARY_SET' );
- $session->param( 'flags', 1 );
- $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') );
- $session->param( 'ip', $session->remote_addr() );
- $session->param( 'lasttime', time() );
}
+ $session->param( 'cas_ticket', $cas_ticket);
C4::Context->set_userenv(
$session->param('number'), $session->param('id'),
$session->param('cardnumber'), $session->param('firstname'),
=cut
-sub get_session {
- my $sessionID = shift;
+sub _get_session_params {
my $storage_method = C4::Context->preference('SessionStorage');
- my $dbh = C4::Context->dbh;
- my $session;
if ( $storage_method eq 'mysql' ) {
- $session = new CGI::Session( "driver:MySQL;serializer:yaml;id:md5", $sessionID, { Handle => $dbh } );
+ my $dbh = C4::Context->dbh;
+ return { dsn => "driver:MySQL;serializer:yaml;id:md5", dsn_args => { Handle => $dbh } };
}
elsif ( $storage_method eq 'Pg' ) {
- $session = new CGI::Session( "driver:PostgreSQL;serializer:yaml;id:md5", $sessionID, { Handle => $dbh } );
+ my $dbh = C4::Context->dbh;
+ return { dsn => "driver:PostgreSQL;serializer:yaml;id:md5", dsn_args => { Handle => $dbh } };
}
elsif ( $storage_method eq 'memcached' && Koha::Caches->get_instance->memcached_cache ) {
my $memcached = Koha::Caches->get_instance()->memcached_cache;
- $session = new CGI::Session( "driver:memcached;serializer:yaml;id:md5", $sessionID, { Memcached => $memcached } );
+ return { dsn => "driver:memcached;serializer:yaml;id:md5", dsn_args => { Memcached => $memcached } };
}
else {
# catch all defaults to tmp should work on all systems
my $dir = File::Spec->tmpdir;
my $instance = C4::Context->config( 'database' ); #actually for packages not exactly the instance name, but generally safer to leave it as it is
- $session = new CGI::Session( "driver:File;serializer:yaml;id:md5", $sessionID, { Directory => "$dir/cgisess_$instance" } );
+ return { dsn => "driver:File;serializer:yaml;id:md5", dsn_args => { Directory => "$dir/cgisess_$instance" } };
}
- return $session;
+}
+
+sub get_session {
+ my $sessionID = shift;
+ my $params = _get_session_params();
+ return new CGI::Session( $params->{dsn}, $sessionID, $params->{dsn_args} );
}
# 1 if auth is ok
# 0 if auth is nok
# -1 if user bind failed (LDAP only)
- # 2 if DB user is used (internal only)
if ( $patron and $patron->account_locked ) {
# Nothing to check, account is locked
# In case of a CAS authentication, we use the ticket instead of the password
my $ticket = $query->param('ticket');
$query->delete('ticket'); # remove ticket to come back to original URL
- my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type ); # EXTERNAL AUTH
+ my ( $retval, $retcard, $retuserid, $cas_ticket ) = checkpw_cas( $dbh, $ticket, $query, $type ); # EXTERNAL AUTH
if ( $retval ) {
- @return = ( $retval, $retcard, $retuserid );
+ @return = ( $retval, $retcard, $retuserid, $cas_ticket );
+ } else {
+ @return = (0);
}
$passwd_ok = $retval;
}
$password = Encode::encode( 'UTF-8', $password )
if Encode::is_utf8($password);
- if ( $userid && $userid eq C4::Context->config('user') ) {
- if ( $password && $password eq C4::Context->config('pass') ) {
-
- # Koha superuser account
- # C4::Context->set_userenv(0,0,C4::Context->config('user'),C4::Context->config('user'),C4::Context->config('user'),"",1);
- return 2;
- }
- else {
- return 0;
- }
- }
-
my $sth =
$dbh->prepare(
"select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where userid=?"
return 1, $cardnumber, $userid;
}
}
- if ( $userid && $userid eq 'demo'
- && "$password" eq 'demo'
- && C4::Context->config('demo') )
- {
-
- # DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
- # some features won't be effective : modify systempref, modify MARC structure,
- return 2;
- }
return 0;
}
$sth->execute($userid);
my $row = $sth->fetchrow();
my $flags = getuserflags( $row, $userid );
- if ( $userid eq C4::Context->config('user') ) {
-
- # Super User Account from /etc/koha.conf
- $flags->{'superlibrarian'} = 1;
- }
- elsif ( $userid eq 'demo' && C4::Context->config('demo') ) {
-
- # Demo user that can do "anything" (demo=1 in /etc/koha.conf)
- $flags->{'superlibrarian'} = 1;
- }
return $flags if $flags->{superlibrarian};
return 0;
}
+=head2 track_login_daily
+
+ track_login_daily( $userid );
+
+Wraps the call to $patron->track_login, the method used to update borrowers.lastseen. We only call track_login once a day.
+
+=cut
+
+sub track_login_daily {
+ my $userid = shift;
+ return if !$userid || !C4::Context->preference('TrackLastPatronActivity');
+
+ my $cache = Koha::Caches->get_instance();
+ my $cache_key = "track_login_" . $userid;
+ my $cached = $cache->get_from_cache($cache_key);
+ my $today = dt_from_string()->ymd;
+ return if $cached && $cached eq $today;
+
+ my $patron = Koha::Patrons->find({ userid => $userid });
+ return unless $patron;
+ $patron->track_login;
+ $cache->set_in_cache( $cache_key, $today );
+}
+
END { } # module clean-up code here (global destructor)
1;
__END__
projects / koha.git / blobdiff