3 # Copyright 2000-2002 Katipo Communications
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it under the
8 # terms of the GNU General Public License as published by the Free Software
9 # Foundation; either version 2 of the License, or (at your option) any later
12 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14 # A PARTICULAR PURPOSE. See the GNU General Public License for more details.
16 # You should have received a copy of the GNU General Public License along
17 # with Koha; if not, write to the Free Software Foundation, Inc.,
18 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22 use Digest::MD5 qw(md5_base64);
23 use JSON qw/encode_json decode_json/;
29 use C4::Templates; # to get the template
30 use C4::Branch; # GetBranches
31 use C4::VirtualShelves;
32 use Koha::AuthUtils qw(hash_password);
33 use POSIX qw/strftime/;
34 use List::MoreUtils qw/ any /;
37 use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);
40 sub psgi_env { any { /^psgi\./ } keys %ENV }
42 if ( psgi_env ) { die 'psgi:exit' }
45 $VERSION = 3.07.00.049; # set version for version checking
49 @EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
50 @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
51 &get_all_subpermissions &get_user_subpermissions
52 ParseSearchHistorySession SetSearchHistorySession
54 %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
55 $ldap = C4::Context->config('useldapserver') || 0;
56 $cas = C4::Context->preference('casAuthentication');
57 $caslogout = C4::Context->preference('casLogout');
58 require C4::Auth_with_cas; # no import
60 require C4::Auth_with_ldap;
61 import C4::Auth_with_ldap qw(checkpw_ldap);
64 import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
71 C4::Auth - Authenticates Koha users
81 my ($template, $borrowernumber, $cookie)
82 = get_template_and_user(
84 template_name => "opac-main.tmpl",
88 flagsrequired => {borrow => 1, catalogue => '*', tools => 'import_patrons' },
92 output_html_with_http_headers $query, $cookie, $template->output;
96 The main function of this module is to provide
97 authentification. However the get_template_and_user function has
98 been provided so that a users login information is passed along
99 automatically. This gets loaded into the template.
103 =head2 get_template_and_user
105 my ($template, $borrowernumber, $cookie)
106 = get_template_and_user(
108 template_name => "opac-main.tmpl",
111 authnotrequired => 1,
112 flagsrequired => {borrow => 1, catalogue => '*', tools => 'import_patrons' },
116 This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
117 to C<&checkauth> (in this module) to perform authentification.
118 See C<&checkauth> for an explanation of these parameters.
120 The C<template_name> is then used to find the correct template for
121 the page. The authenticated users details are loaded onto the
122 template in the HTML::Template LOOP variable C<USER_INFO>. Also the
123 C<sessionID> is passed to the template. This can be used in templates
124 if cookies are disabled. It needs to be put as and input to every
127 More information on the C<gettemplate> sub can be found in the
132 my $SEARCH_HISTORY_INSERT_SQL =<<EOQ;
133 INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, total, time )
134 VALUES ( ?, ?, ?, ?, ?, FROM_UNIXTIME(?))
137 sub get_template_and_user {
140 my ( $user, $cookie, $sessionID, $flags );
142 my $template = C4::Templates::gettemplate(
143 $in->{'template_name'},
149 if ( $in->{'template_name'} !~m/maintenance/ ) {
150 ( $user, $cookie, $sessionID, $flags ) = checkauth(
152 $in->{'authnotrequired'},
153 $in->{'flagsrequired'},
161 # It's possible for $user to be the borrowernumber if they don't have a
162 # userid defined (and are logging in through some other method, such
163 # as SSL certs against an email address)
164 $borrowernumber = getborrowernumber($user) if defined($user);
165 if (!defined($borrowernumber) && defined($user)) {
166 my $borrower = C4::Members::GetMember(borrowernumber => $user);
168 $borrowernumber = $user;
169 # A bit of a hack, but I don't know there's a nicer way
171 $user = $borrower->{firstname} . ' ' . $borrower->{surname};
176 $template->param( loggedinusername => $user );
177 $template->param( sessionID => $sessionID );
179 my ($total, $pubshelves, $barshelves) = C4::VirtualShelves::GetSomeShelfNames($borrowernumber, 'MASTHEAD');
181 pubshelves => $total->{pubtotal},
182 pubshelvesloop => $pubshelves,
183 barshelves => $total->{bartotal},
184 barshelvesloop => $barshelves,
187 my ( $borr ) = C4::Members::GetMemberDetails( $borrowernumber );
190 $template->param( "USER_INFO" => \@bordat );
192 my $all_perms = get_all_subpermissions();
194 my @flagroots = qw(circulate catalogue parameters borrowers permissions reserveforothers borrow
195 editcatalogue updatecharges management tools editauthorities serials reports acquisition);
196 # We are going to use the $flags returned by checkauth
197 # to create the template's parameters that will indicate
198 # which menus the user can access.
199 if ( $flags && $flags->{superlibrarian}==1 ) {
200 $template->param( CAN_user_circulate => 1 );
201 $template->param( CAN_user_catalogue => 1 );
202 $template->param( CAN_user_parameters => 1 );
203 $template->param( CAN_user_borrowers => 1 );
204 $template->param( CAN_user_permissions => 1 );
205 $template->param( CAN_user_reserveforothers => 1 );
206 $template->param( CAN_user_borrow => 1 );
207 $template->param( CAN_user_editcatalogue => 1 );
208 $template->param( CAN_user_updatecharges => 1 );
209 $template->param( CAN_user_acquisition => 1 );
210 $template->param( CAN_user_management => 1 );
211 $template->param( CAN_user_tools => 1 );
212 $template->param( CAN_user_editauthorities => 1 );
213 $template->param( CAN_user_serials => 1 );
214 $template->param( CAN_user_reports => 1 );
215 $template->param( CAN_user_staffaccess => 1 );
216 $template->param( CAN_user_plugins => 1 );
217 $template->param( CAN_user_coursereserves => 1 );
218 foreach my $module (keys %$all_perms) {
219 foreach my $subperm (keys %{ $all_perms->{$module} }) {
220 $template->param( "CAN_user_${module}_${subperm}" => 1 );
226 foreach my $module (keys %$all_perms) {
227 if ( $flags->{$module} == 1) {
228 foreach my $subperm (keys %{ $all_perms->{$module} }) {
229 $template->param( "CAN_user_${module}_${subperm}" => 1 );
231 } elsif ( ref($flags->{$module}) ) {
232 foreach my $subperm (keys %{ $flags->{$module} } ) {
233 $template->param( "CAN_user_${module}_${subperm}" => 1 );
240 foreach my $module (keys %$flags) {
241 if ( $flags->{$module} == 1 or ref($flags->{$module}) ) {
242 $template->param( "CAN_user_$module" => 1 );
243 if ($module eq "parameters") {
244 $template->param( CAN_user_management => 1 );
249 # Logged-in opac search history
250 # If the requested template is an opac one and opac search history is enabled
251 if ($in->{type} eq 'opac' && C4::Context->preference('EnableOpacSearchHistory')) {
252 my $dbh = C4::Context->dbh;
253 my $query = "SELECT COUNT(*) FROM search_history WHERE userid=?";
254 my $sth = $dbh->prepare($query);
255 $sth->execute($borrowernumber);
257 # If at least one search has already been performed
258 if ($sth->fetchrow_array > 0) {
259 # We show the link in opac
260 $template->param(ShowOpacRecentSearchLink => 1);
263 # And if there's a cookie with searches performed when the user was not logged in,
264 # we add them to the logged-in search history
265 my @recentSearches = ParseSearchHistorySession($in->{'query'});
266 if (@recentSearches) {
267 my $sth = $dbh->prepare($SEARCH_HISTORY_INSERT_SQL);
268 $sth->execute( $borrowernumber,
269 $in->{'query'}->cookie("CGISESSID"),
274 ) foreach @recentSearches;
279 else { # if this is an anonymous session, setup to display public lists...
281 $template->param( sessionID => $sessionID );
283 my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
285 pubshelves => $total->{pubtotal},
286 pubshelvesloop => $pubshelves,
289 # Anonymous opac search history
290 # If opac search history is enabled and at least one search has already been performed
291 if (C4::Context->preference('EnableOpacSearchHistory')) {
292 my @recentSearches = ParseSearchHistorySession($in->{'query'});
293 if (@recentSearches) {
294 $template->param(ShowOpacRecentSearchLink => 1);
298 if(C4::Context->preference('dateformat')){
299 $template->param(dateformat => C4::Context->preference('dateformat'))
302 # these template parameters are set the same regardless of $in->{'type'}
304 "BiblioDefaultView".C4::Context->preference("BiblioDefaultView") => 1,
305 EnhancedMessagingPreferences => C4::Context->preference('EnhancedMessagingPreferences'),
306 GoogleJackets => C4::Context->preference("GoogleJackets"),
307 OpenLibraryCovers => C4::Context->preference("OpenLibraryCovers"),
308 KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"),
309 LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{"branch"}:undef),
310 LoginFirstname => (C4::Context->userenv?C4::Context->userenv->{"firstname"}:"Bel"),
311 LoginSurname => C4::Context->userenv?C4::Context->userenv->{"surname"}:"Inconnu",
312 emailaddress => C4::Context->userenv?C4::Context->userenv->{"emailaddress"}:undef,
313 loggedinpersona => C4::Context->userenv?C4::Context->userenv->{"persona"}:undef,
314 TagsEnabled => C4::Context->preference("TagsEnabled"),
315 hide_marc => C4::Context->preference("hide_marc"),
316 item_level_itypes => C4::Context->preference('item-level_itypes'),
317 patronimages => C4::Context->preference("patronimages"),
318 singleBranchMode => C4::Context->preference("singleBranchMode"),
319 XSLTDetailsDisplay => C4::Context->preference("XSLTDetailsDisplay"),
320 XSLTResultsDisplay => C4::Context->preference("XSLTResultsDisplay"),
321 using_https => $in->{'query'}->https() ? 1 : 0,
322 noItemTypeImages => C4::Context->preference("noItemTypeImages"),
323 marcflavour => C4::Context->preference("marcflavour"),
324 persona => C4::Context->preference("persona"),
326 if ( $in->{'type'} eq "intranet" ) {
328 AmazonCoverImages => C4::Context->preference("AmazonCoverImages"),
329 AutoLocation => C4::Context->preference("AutoLocation"),
330 "BiblioDefaultView".C4::Context->preference("IntranetBiblioDefaultView") => 1,
331 CalendarFirstDayOfWeek => (C4::Context->preference("CalendarFirstDayOfWeek") eq "Sunday")?0:1,
332 CircAutocompl => C4::Context->preference("CircAutocompl"),
333 FRBRizeEditions => C4::Context->preference("FRBRizeEditions"),
334 IndependentBranches => C4::Context->preference("IndependentBranches"),
335 IntranetNav => C4::Context->preference("IntranetNav"),
336 IntranetmainUserblock => C4::Context->preference("IntranetmainUserblock"),
337 LibraryName => C4::Context->preference("LibraryName"),
338 LoginBranchname => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:undef),
339 advancedMARCEditor => C4::Context->preference("advancedMARCEditor"),
340 canreservefromotherbranches => C4::Context->preference('canreservefromotherbranches'),
341 intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"),
342 IntranetFavicon => C4::Context->preference("IntranetFavicon"),
343 intranetreadinghistory => C4::Context->preference("intranetreadinghistory"),
344 intranetstylesheet => C4::Context->preference("intranetstylesheet"),
345 IntranetUserCSS => C4::Context->preference("IntranetUserCSS"),
346 intranetuserjs => C4::Context->preference("intranetuserjs"),
347 intranetbookbag => C4::Context->preference("intranetbookbag"),
348 suggestion => C4::Context->preference("suggestion"),
349 virtualshelves => C4::Context->preference("virtualshelves"),
350 StaffSerialIssueDisplayCount => C4::Context->preference("StaffSerialIssueDisplayCount"),
351 EasyAnalyticalRecords => C4::Context->preference('EasyAnalyticalRecords'),
352 LocalCoverImages => C4::Context->preference('LocalCoverImages'),
353 OPACLocalCoverImages => C4::Context->preference('OPACLocalCoverImages'),
354 AllowMultipleCovers => C4::Context->preference('AllowMultipleCovers'),
355 EnableBorrowerFiles => C4::Context->preference('EnableBorrowerFiles'),
356 UseKohaPlugins => C4::Context->preference('UseKohaPlugins'),
357 UseCourseReserves => C4::Context->preference("UseCourseReserves"),
361 warn "template type should be OPAC, here it is=[" . $in->{'type'} . "]" unless ( $in->{'type'} eq 'opac' );
362 #TODO : replace LibraryName syspref with 'system name', and remove this html processing
363 my $LibraryNameTitle = C4::Context->preference("LibraryName");
364 $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
365 $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
366 # clean up the busc param in the session if the page is not opac-detail and not the "add to list" page
367 if ( C4::Context->preference("OpacBrowseResults")
368 && $in->{'template_name'} =~ /opac-(.+)\.(?:tt|tmpl)$/ ) {
370 unless ( $pagename =~ /^(?:MARC|ISBD)?detail$/
371 or $pagename =~ /^addbybiblionumber$/ ) {
372 my $sessionSearch = get_session($sessionID || $in->{'query'}->cookie("CGISESSID"));
373 $sessionSearch->clear(["busc"]) if ($sessionSearch->param("busc"));
376 # variables passed from CGI: opac_css_override and opac_search_limits.
377 my $opac_search_limit = $ENV{'OPAC_SEARCH_LIMIT'};
378 my $opac_limit_override = $ENV{'OPAC_LIMIT_OVERRIDE'};
380 if (($opac_search_limit && $opac_search_limit =~ /branch:(\w+)/ && $opac_limit_override) || ($in->{'query'}->param('limit') && $in->{'query'}->param('limit') =~ /branch:(\w+)/)){
381 $opac_name = $1; # opac_search_limit is a branch, so we use it.
382 } elsif ( $in->{'query'}->param('multibranchlimit') ) {
383 $opac_name = $in->{'query'}->param('multibranchlimit');
384 } elsif (C4::Context->preference("SearchMyLibraryFirst") && C4::Context->userenv && C4::Context->userenv->{'branch'}) {
385 $opac_name = C4::Context->userenv->{'branch'};
388 opaccolorstylesheet => C4::Context->preference("opaccolorstylesheet"),
389 AnonSuggestions => "" . C4::Context->preference("AnonSuggestions"),
390 AuthorisedValueImages => C4::Context->preference("AuthorisedValueImages"),
391 BranchesLoop => GetBranchesLoop($opac_name),
392 BranchCategoriesLoop => GetBranchCategories( 'searchdomain', 1, $opac_name ),
393 CalendarFirstDayOfWeek => (C4::Context->preference("CalendarFirstDayOfWeek") eq "Sunday")?0:1,
394 LibraryName => "" . C4::Context->preference("LibraryName"),
395 LibraryNameTitle => "" . $LibraryNameTitle,
396 LoginBranchname => C4::Context->userenv?C4::Context->userenv->{"branchname"}:"",
397 OPACAmazonCoverImages => C4::Context->preference("OPACAmazonCoverImages"),
398 OPACFRBRizeEditions => C4::Context->preference("OPACFRBRizeEditions"),
399 OpacHighlightedWords => C4::Context->preference("OpacHighlightedWords"),
400 OPACItemHolds => C4::Context->preference("OPACItemHolds"),
401 OPACShelfBrowser => "". C4::Context->preference("OPACShelfBrowser"),
402 OPACURLOpenInNewWindow => "" . C4::Context->preference("OPACURLOpenInNewWindow"),
403 OPACUserCSS => "". C4::Context->preference("OPACUserCSS"),
404 OPACMobileUserCSS => "". C4::Context->preference("OPACMobileUserCSS"),
405 OPACViewOthersSuggestions => "" . C4::Context->preference("OPACViewOthersSuggestions"),
406 OpacAuthorities => C4::Context->preference("OpacAuthorities"),
407 OPACBaseURL => ($in->{'query'}->https() ? "https://" : "http://") . $ENV{'SERVER_NAME'} .
408 ($ENV{'SERVER_PORT'} eq ($in->{'query'}->https() ? "443" : "80") ? '' : ":$ENV{'SERVER_PORT'}"),
409 opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'},
410 opac_search_limit => $opac_search_limit,
411 opac_limit_override => $opac_limit_override,
412 OpacBrowser => C4::Context->preference("OpacBrowser"),
413 OpacCloud => C4::Context->preference("OpacCloud"),
414 OpacKohaUrl => C4::Context->preference("OpacKohaUrl"),
415 OpacMainUserBlock => "" . C4::Context->preference("OpacMainUserBlock"),
416 OpacMainUserBlockMobile => "" . C4::Context->preference("OpacMainUserBlockMobile"),
417 OpacShowFiltersPulldownMobile => C4::Context->preference("OpacShowFiltersPulldownMobile"),
418 OpacShowLibrariesPulldownMobile => C4::Context->preference("OpacShowLibrariesPulldownMobile"),
419 OpacNav => "" . C4::Context->preference("OpacNav"),
420 OpacNavRight => "" . C4::Context->preference("OpacNavRight"),
421 OpacNavBottom => "" . C4::Context->preference("OpacNavBottom"),
422 OpacPasswordChange => C4::Context->preference("OpacPasswordChange"),
423 OPACPatronDetails => C4::Context->preference("OPACPatronDetails"),
424 OPACPrivacy => C4::Context->preference("OPACPrivacy"),
425 OPACFinesTab => C4::Context->preference("OPACFinesTab"),
426 OpacTopissue => C4::Context->preference("OpacTopissue"),
427 RequestOnOpac => C4::Context->preference("RequestOnOpac"),
428 'Version' => C4::Context->preference('Version'),
429 hidelostitems => C4::Context->preference("hidelostitems"),
430 mylibraryfirst => (C4::Context->preference("SearchMyLibraryFirst") && C4::Context->userenv) ? C4::Context->userenv->{'branch'} : '',
431 opaclayoutstylesheet => "" . C4::Context->preference("opaclayoutstylesheet"),
432 opacbookbag => "" . C4::Context->preference("opacbookbag"),
433 opaccredits => "" . C4::Context->preference("opaccredits"),
434 OpacFavicon => C4::Context->preference("OpacFavicon"),
435 opacheader => "" . C4::Context->preference("opacheader"),
436 opaclanguagesdisplay => "" . C4::Context->preference("opaclanguagesdisplay"),
437 opacreadinghistory => C4::Context->preference("opacreadinghistory"),
438 opacsmallimage => "" . C4::Context->preference("opacsmallimage"),
439 opacuserjs => C4::Context->preference("opacuserjs"),
440 opacuserlogin => "" . C4::Context->preference("opacuserlogin"),
441 ShowReviewer => C4::Context->preference("ShowReviewer"),
442 ShowReviewerPhoto => C4::Context->preference("ShowReviewerPhoto"),
443 suggestion => "" . C4::Context->preference("suggestion"),
444 virtualshelves => "" . C4::Context->preference("virtualshelves"),
445 OPACSerialIssueDisplayCount => C4::Context->preference("OPACSerialIssueDisplayCount"),
446 OPACXSLTDetailsDisplay => C4::Context->preference("OPACXSLTDetailsDisplay"),
447 OPACXSLTResultsDisplay => C4::Context->preference("OPACXSLTResultsDisplay"),
448 SyndeticsClientCode => C4::Context->preference("SyndeticsClientCode"),
449 SyndeticsEnabled => C4::Context->preference("SyndeticsEnabled"),
450 SyndeticsCoverImages => C4::Context->preference("SyndeticsCoverImages"),
451 SyndeticsTOC => C4::Context->preference("SyndeticsTOC"),
452 SyndeticsSummary => C4::Context->preference("SyndeticsSummary"),
453 SyndeticsEditions => C4::Context->preference("SyndeticsEditions"),
454 SyndeticsExcerpt => C4::Context->preference("SyndeticsExcerpt"),
455 SyndeticsReviews => C4::Context->preference("SyndeticsReviews"),
456 SyndeticsAuthorNotes => C4::Context->preference("SyndeticsAuthorNotes"),
457 SyndeticsAwards => C4::Context->preference("SyndeticsAwards"),
458 SyndeticsSeries => C4::Context->preference("SyndeticsSeries"),
459 SyndeticsCoverImageSize => C4::Context->preference("SyndeticsCoverImageSize"),
460 OPACLocalCoverImages => C4::Context->preference("OPACLocalCoverImages"),
461 PatronSelfRegistration => C4::Context->preference("PatronSelfRegistration"),
462 PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
465 $template->param(OpacPublic => '1') if ($user || C4::Context->preference("OpacPublic"));
468 # Check if we were asked using parameters to force a specific language
469 if ( defined $in->{'query'}->param('language') ) {
470 # Extract the language, let C4::Templates::getlanguage choose
472 my $language = C4::Templates::getlanguage($in->{'query'},$in->{'type'});
473 my $languagecookie = C4::Templates::getlanguagecookie($in->{'query'},$language);
474 if ( ref $cookie eq 'ARRAY' ) {
475 push @{ $cookie }, $languagecookie;
477 $cookie = [$cookie, $languagecookie];
481 return ( $template, $borrowernumber, $cookie, $flags);
486 ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
488 Verifies that the user is authorized to run this script. If
489 the user is authorized, a (userid, cookie, session-id, flags)
490 quadruple is returned. If the user is not authorized but does
491 not have the required privilege (see $flagsrequired below), it
492 displays an error page and exits. Otherwise, it displays the
493 login page and exits.
495 Note that C<&checkauth> will return if and only if the user
496 is authorized, so it should be called early on, before any
497 unfinished operations (e.g., if you've opened a file, then
498 C<&checkauth> won't close it for you).
500 C<$query> is the CGI object for the script calling C<&checkauth>.
502 The C<$noauth> argument is optional. If it is set, then no
503 authorization is required for the script.
505 C<&checkauth> fetches user and session information from C<$query> and
506 ensures that the user is authorized to run scripts that require
509 The C<$flagsrequired> argument specifies the required privileges
510 the user must have if the username and password are correct.
511 It should be specified as a reference-to-hash; keys in the hash
512 should be the "flags" for the user, as specified in the Members
513 intranet module. Any key specified must correspond to a "flag"
514 in the userflags table. E.g., { circulate => 1 } would specify
515 that the user must have the "circulate" privilege in order to
516 proceed. To make sure that access control is correct, the
517 C<$flagsrequired> parameter must be specified correctly.
519 Koha also has a concept of sub-permissions, also known as
520 granular permissions. This makes the value of each key
521 in the C<flagsrequired> hash take on an additional
526 The user must have access to all subfunctions of the module
527 specified by the hash key.
531 The user must have access to at least one subfunction of the module
532 specified by the hash key.
534 specific permission, e.g., 'export_catalog'
536 The user must have access to the specific subfunction list, which
537 must correspond to a row in the permissions table.
539 The C<$type> argument specifies whether the template should be
540 retrieved from the opac or intranet directory tree. "opac" is
541 assumed if it is not specified; however, if C<$type> is specified,
542 "intranet" is assumed if it is not "opac".
544 If C<$query> does not have a valid session ID associated with it
545 (i.e., the user has not logged in) or if the session has expired,
546 C<&checkauth> presents the user with a login page (from the point of
547 view of the original script, C<&checkauth> does not return). Once the
548 user has authenticated, C<&checkauth> restarts the original script
549 (this time, C<&checkauth> returns).
551 The login page is provided using a HTML::Template, which is set in the
552 systempreferences table or at the top of this file. The variable C<$type>
553 selects which template to use, either the opac or the intranet
554 authentification template.
556 C<&checkauth> returns a user ID, a cookie, and a session ID. The
557 cookie should be sent back to the browser; it verifies that the user
566 # If Version syspref is unavailable, it means Koha is beeing installed,
567 # and so we must redirect to OPAC maintenance page or to the WebInstaller
568 # also, if OpacMaintenance is ON, OPAC should redirect to maintenance
569 if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') {
570 warn "OPAC Install required, redirecting to maintenance";
571 print $query->redirect("/cgi-bin/koha/maintenance.pl");
574 unless ( $version = C4::Context->preference('Version') ) { # assignment, not comparison
575 if ( $type ne 'opac' ) {
576 warn "Install required, redirecting to Installer";
577 print $query->redirect("/cgi-bin/koha/installer/install.pl");
579 warn "OPAC Install required, redirecting to maintenance";
580 print $query->redirect("/cgi-bin/koha/maintenance.pl");
585 # check that database and koha version are the same
586 # there is no DB version, it's a fresh install,
587 # go to web installer
588 # there is a DB version, compare it to the code version
589 my $kohaversion=C4::Context::KOHAVERSION;
590 # remove the 3 last . to have a Perl number
591 $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/;
592 $debug and print STDERR "kohaversion : $kohaversion\n";
593 if ($version < $kohaversion){
594 my $warning = "Database update needed, redirecting to %s. Database is $version and Koha is $kohaversion";
595 if ($type ne 'opac'){
596 warn sprintf($warning, 'Installer');
597 print $query->redirect("/cgi-bin/koha/installer/install.pl?step=3");
599 warn sprintf("OPAC: " . $warning, 'maintenance');
600 print $query->redirect("/cgi-bin/koha/maintenance.pl");
608 open my $fh, '>>', "/tmp/sessionlog" or warn "ERROR: Cannot append to /tmp/sessionlog";
609 printf $fh join("\n",@_);
613 sub _timeout_syspref {
614 my $timeout = C4::Context->preference('timeout') || 600;
615 # value in days, convert in seconds
616 if ($timeout =~ /(\d+)[dD]/) {
617 $timeout = $1 * 86400;
624 $debug and warn "Checking Auth";
625 # $authnotrequired will be set for scripts which will run without authentication
626 my $authnotrequired = shift;
627 my $flagsrequired = shift;
630 $type = 'opac' unless $type;
632 my $dbh = C4::Context->dbh;
633 my $timeout = _timeout_syspref();
635 _version_check($type,$query);
639 my ( $userid, $cookie, $sessionID, $flags, $barshelves, $pubshelves );
640 my $logout = $query->param('logout.x');
642 my $anon_search_history;
644 # This parameter is the name of the CAS server we want to authenticate against,
645 # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml
646 my $casparam = $query->param('cas');
647 my $q_userid = $query->param('userid') // '';
649 if ( $userid = $ENV{'REMOTE_USER'} ) {
650 # Using Basic Authentication, no cookies required
651 $cookie = $query->cookie(
652 -name => 'CGISESSID',
660 # we dont want to set a session because we are being called by a persona callback
662 elsif ( $sessionID = $query->cookie("CGISESSID") )
663 { # assignment, not comparison
664 my $session = get_session($sessionID);
665 C4::Context->_new_userenv($sessionID);
666 my ($ip, $lasttime, $sessiontype);
669 $s_userid = $session->param('id') // '';
670 C4::Context::set_userenv(
671 $session->param('number'), $s_userid,
672 $session->param('cardnumber'), $session->param('firstname'),
673 $session->param('surname'), $session->param('branch'),
674 $session->param('branchname'), $session->param('flags'),
675 $session->param('emailaddress'), $session->param('branchprinter'),
676 $session->param('persona')
678 C4::Context::set_shelves_userenv('bar',$session->param('barshelves'));
679 C4::Context::set_shelves_userenv('pub',$session->param('pubshelves'));
680 C4::Context::set_shelves_userenv('tot',$session->param('totshelves'));
681 $debug and printf STDERR "AUTH_SESSION: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
682 $ip = $session->param('ip');
683 $lasttime = $session->param('lasttime');
685 $sessiontype = $session->param('sessiontype') || '';
687 if ( ( $query->param('koha_login_context') && ($q_userid ne $s_userid) )
688 || ( $cas && $query->param('ticket') ) ) {
689 #if a user enters an id ne to the id in the current session, we need to log them in...
690 #first we need to clear the anonymous session...
691 $debug and warn "query id = $q_userid but session id = $s_userid";
692 $anon_search_history = $session->param('search_history');
695 C4::Context->_unset_userenv($sessionID);
700 # voluntary logout the user
703 C4::Context->_unset_userenv($sessionID);
704 #_session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime));
708 if ($cas and $caslogout) {
712 elsif ( !$lasttime || ($lasttime < time() - $timeout) ) {
714 $info{'timed_out'} = 1;
715 $session->delete() if $session;
716 C4::Context->_unset_userenv($sessionID);
717 #_session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime));
721 elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
722 # Different ip than originally logged in from
723 $info{'oldip'} = $ip;
724 $info{'newip'} = $ENV{'REMOTE_ADDR'};
725 $info{'different_ip'} = 1;
727 C4::Context->_unset_userenv($sessionID);
728 #_session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'});
733 $cookie = $query->cookie(
734 -name => 'CGISESSID',
735 -value => $session->id,
738 $session->param( 'lasttime', time() );
739 unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
740 $flags = haspermission($userid, $flagsrequired);
744 $info{'nopermission'} = 1;
749 unless ($userid || $sessionID) {
751 #we initiate a session prior to checking for a username to allow for anonymous sessions...
752 my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
754 # Save anonymous search history in new session so it can be retrieved
755 # by get_template_and_user to store it in user's search history after
756 # a successful login.
757 if ($anon_search_history) {
758 $session->param('search_history', $anon_search_history);
761 my $sessionID = $session->id;
762 C4::Context->_new_userenv($sessionID);
763 $cookie = $query->cookie(
764 -name => 'CGISESSID',
765 -value => $session->id,
769 my $pki_field = C4::Context->preference('AllowPKIAuth');
770 if (! defined($pki_field) ) {
771 print STDERR "ERROR: Missing system preference AllowPKIAuth.\n";
774 if ( ( $cas && $query->param('ticket') )
776 || $pki_field ne 'None'
779 my $password = $query->param('password');
781 my ( $return, $cardnumber );
782 if ( $cas && $query->param('ticket') ) {
784 ( $return, $cardnumber, $retuserid ) =
785 checkpw( $dbh, $userid, $password, $query );
786 $userid = $retuserid;
787 $info{'invalidCasLogin'} = 1 unless ($return);
791 my $value = $persona;
793 # If we're looking up the email, there's a chance that the person
794 # doesn't have a userid. So if there is none, we pass along the
795 # borrower number, and the bits of code that need to know the user
796 # ID will have to be smart enough to handle that.
798 my @users_info = C4::Members::GetBorrowersWithEmail($value);
801 # First the userid, then the borrowernum
802 $value = $users_info[0][1] || $users_info[0][0];
807 $return = $value ? 1 : 0;
812 ( $pki_field eq 'Common Name' && $ENV{'SSL_CLIENT_S_DN_CN'} )
813 || ( $pki_field eq 'emailAddress'
814 && $ENV{'SSL_CLIENT_S_DN_Email'} )
818 if ( $pki_field eq 'Common Name' ) {
819 $value = $ENV{'SSL_CLIENT_S_DN_CN'};
821 elsif ( $pki_field eq 'emailAddress' ) {
822 $value = $ENV{'SSL_CLIENT_S_DN_Email'};
824 # If we're looking up the email, there's a chance that the person
825 # doesn't have a userid. So if there is none, we pass along the
826 # borrower number, and the bits of code that need to know the user
827 # ID will have to be smart enough to handle that.
829 my @users_info = C4::Members::GetBorrowersWithEmail($value);
832 # First the userid, then the borrowernum
833 $value = $users_info[0][1] || $users_info[0][0];
840 $return = $value ? 1 : 0;
846 ( $return, $cardnumber, $retuserid ) =
847 checkpw( $dbh, $userid, $password, $query );
848 $userid = $retuserid if ( $retuserid );
851 #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
852 if ( $flags = haspermission( $userid, $flagsrequired ) ) {
856 $info{'nopermission'} = 1;
857 C4::Context->_unset_userenv($sessionID);
859 my ($borrowernumber, $firstname, $surname, $userflags,
860 $branchcode, $branchname, $branchprinter, $emailaddress);
862 if ( $return == 1 ) {
864 SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode,
865 branches.branchname as branchname,
866 branches.branchprinter as branchprinter,
869 LEFT JOIN branches on borrowers.branchcode=branches.branchcode
871 my $sth = $dbh->prepare("$select where userid=?");
872 $sth->execute($userid);
873 unless ($sth->rows) {
874 $debug and print STDERR "AUTH_1: no rows for userid='$userid'\n";
875 $sth = $dbh->prepare("$select where cardnumber=?");
876 $sth->execute($cardnumber);
878 unless ($sth->rows) {
879 $debug and print STDERR "AUTH_2a: no rows for cardnumber='$cardnumber'\n";
880 $sth->execute($userid);
881 unless ($sth->rows) {
882 $debug and print STDERR "AUTH_2b: no rows for userid='$userid' AS cardnumber\n";
887 ($borrowernumber, $firstname, $surname, $userflags,
888 $branchcode, $branchname, $branchprinter, $emailaddress) = $sth->fetchrow;
889 $debug and print STDERR "AUTH_3 results: " .
890 "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n";
892 print STDERR "AUTH_3: no results for userid='$userid', cardnumber='$cardnumber'.\n";
895 # launch a sequence to check if we have a ip for the branch, i
896 # if we have one we replace the branchcode of the userenv by the branch bound in the ip.
898 my $ip = $ENV{'REMOTE_ADDR'};
899 # if they specify at login, use that
900 if ($query->param('branch')) {
901 $branchcode = $query->param('branch');
902 $branchname = GetBranchName($branchcode);
904 my $branches = GetBranches();
905 if (C4::Context->boolean_preference('IndependentBranches') && C4::Context->boolean_preference('Autolocation')){
906 # we have to check they are coming from the right ip range
907 my $domain = $branches->{$branchcode}->{'branchip'};
908 if ($ip !~ /^$domain/){
910 $info{'wrongip'} = 1;
915 foreach my $br ( keys %$branches ) {
916 # now we work with the treatment of ip
917 my $domain = $branches->{$br}->{'branchip'};
918 if ( $domain && $ip =~ /^$domain/ ) {
919 $branchcode = $branches->{$br}->{'branchcode'};
921 # new op dev : add the branchprinter and branchname in the cookie
922 $branchprinter = $branches->{$br}->{'branchprinter'};
923 $branchname = $branches->{$br}->{'branchname'};
926 $session->param('number',$borrowernumber);
927 $session->param('id',$userid);
928 $session->param('cardnumber',$cardnumber);
929 $session->param('firstname',$firstname);
930 $session->param('surname',$surname);
931 $session->param('branch',$branchcode);
932 $session->param('branchname',$branchname);
933 $session->param('flags',$userflags);
934 $session->param('emailaddress',$emailaddress);
935 $session->param('ip',$session->remote_addr());
936 $session->param('lasttime',time());
937 $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
939 elsif ( $return == 2 ) {
940 #We suppose the user is the superlibrarian
942 $session->param('number',0);
943 $session->param('id',C4::Context->config('user'));
944 $session->param('cardnumber',C4::Context->config('user'));
945 $session->param('firstname',C4::Context->config('user'));
946 $session->param('surname',C4::Context->config('user'));
947 $session->param('branch','NO_LIBRARY_SET');
948 $session->param('branchname','NO_LIBRARY_SET');
949 $session->param('flags',1);
950 $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
951 $session->param('ip',$session->remote_addr());
952 $session->param('lasttime',time());
955 $session->param('persona',1);
957 C4::Context::set_userenv(
958 $session->param('number'), $session->param('id'),
959 $session->param('cardnumber'), $session->param('firstname'),
960 $session->param('surname'), $session->param('branch'),
961 $session->param('branchname'), $session->param('flags'),
962 $session->param('emailaddress'), $session->param('branchprinter'),
963 $session->param('persona')
969 $info{'invalid_username_or_password'} = 1;
970 C4::Context->_unset_userenv($sessionID);
972 $session->param('lasttime',time());
973 $session->param('ip',$session->remote_addr());
975 } # END if ( $userid = $query->param('userid') )
976 elsif ($type eq "opac") {
977 # if we are here this is an anonymous session; add public lists to it and a few other items...
978 # anonymous sessions are created only for the OPAC
979 $debug and warn "Initiating an anonymous session...";
981 # setting a couple of other session vars...
982 $session->param('ip',$session->remote_addr());
983 $session->param('lasttime',time());
984 $session->param('sessiontype','anon');
986 } # END unless ($userid)
988 # finished authentification, now respond
989 if ( $loggedin || $authnotrequired )
993 $cookie = $query->cookie(
994 -name => 'CGISESSID',
999 return ( $userid, $cookie, $sessionID, $flags );
1004 # AUTH rejected, show the login/password template, after checking the DB.
1008 # get the inputs from the incoming query
1010 foreach my $name ( param $query) {
1011 (next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' );
1012 my $value = $query->param($name);
1013 push @inputs, { name => $name, value => $value };
1016 my $LibraryNameTitle = C4::Context->preference("LibraryName");
1017 $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
1018 $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
1020 my $template_name = ( $type eq 'opac' ) ? 'opac-auth.tmpl' : 'auth.tmpl';
1021 my $template = C4::Templates::gettemplate($template_name, $type, $query );
1023 branchloop => GetBranchesLoop(),
1024 opaccolorstylesheet => C4::Context->preference("opaccolorstylesheet"),
1025 opaclayoutstylesheet => C4::Context->preference("opaclayoutstylesheet"),
1028 casAuthentication => C4::Context->preference("casAuthentication"),
1029 suggestion => C4::Context->preference("suggestion"),
1030 virtualshelves => C4::Context->preference("virtualshelves"),
1031 LibraryName => "" . C4::Context->preference("LibraryName"),
1032 LibraryNameTitle => "" . $LibraryNameTitle,
1033 opacuserlogin => C4::Context->preference("opacuserlogin"),
1034 OpacNav => C4::Context->preference("OpacNav"),
1035 OpacNavRight => C4::Context->preference("OpacNavRight"),
1036 OpacNavBottom => C4::Context->preference("OpacNavBottom"),
1037 opaccredits => C4::Context->preference("opaccredits"),
1038 OpacFavicon => C4::Context->preference("OpacFavicon"),
1039 opacreadinghistory => C4::Context->preference("opacreadinghistory"),
1040 opacsmallimage => C4::Context->preference("opacsmallimage"),
1041 opaclanguagesdisplay => C4::Context->preference("opaclanguagesdisplay"),
1042 opacuserjs => C4::Context->preference("opacuserjs"),
1043 opacbookbag => "" . C4::Context->preference("opacbookbag"),
1044 OpacCloud => C4::Context->preference("OpacCloud"),
1045 OpacTopissue => C4::Context->preference("OpacTopissue"),
1046 OpacAuthorities => C4::Context->preference("OpacAuthorities"),
1047 OpacBrowser => C4::Context->preference("OpacBrowser"),
1048 opacheader => C4::Context->preference("opacheader"),
1049 TagsEnabled => C4::Context->preference("TagsEnabled"),
1050 OPACUserCSS => C4::Context->preference("OPACUserCSS"),
1051 intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"),
1052 intranetstylesheet => C4::Context->preference("intranetstylesheet"),
1053 intranetbookbag => C4::Context->preference("intranetbookbag"),
1054 IntranetNav => C4::Context->preference("IntranetNav"),
1055 IntranetFavicon => C4::Context->preference("IntranetFavicon"),
1056 intranetuserjs => C4::Context->preference("intranetuserjs"),
1057 IndependentBranches=> C4::Context->preference("IndependentBranches"),
1058 AutoLocation => C4::Context->preference("AutoLocation"),
1059 wrongip => $info{'wrongip'},
1060 PatronSelfRegistration => C4::Context->preference("PatronSelfRegistration"),
1061 PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"),
1062 persona => C4::Context->preference("Persona"),
1063 opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'},
1066 $template->param( OpacPublic => C4::Context->preference("OpacPublic"));
1067 $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1069 if($type eq 'opac'){
1070 my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
1072 pubshelves => $total->{pubtotal},
1073 pubshelvesloop => $pubshelves,
1079 # Is authentication against multiple CAS servers enabled?
1080 if (C4::Auth_with_cas::multipleAuth && !$casparam) {
1081 my $casservers = C4::Auth_with_cas::getMultipleAuth();
1083 foreach my $key (keys %$casservers) {
1084 push @tmplservers, {name => $key, value => login_cas_url($query, $key) . "?cas=$key" };
1087 casServersLoop => \@tmplservers
1091 casServerUrl => login_cas_url($query),
1096 invalidCasLogin => $info{'invalidCasLogin'}
1100 my $self_url = $query->url( -absolute => 1 );
1103 LibraryName => C4::Context->preference("LibraryName"),
1105 $template->param( %info );
1106 # $cookie = $query->cookie(CGISESSID => $session->id
1108 print $query->header(
1109 -type => 'text/html',
1110 -charset => 'utf-8',
1117 =head2 check_api_auth
1119 ($status, $cookie, $sessionId) = check_api_auth($query, $userflags);
1121 Given a CGI query containing the parameters 'userid' and 'password' and/or a session
1122 cookie, determine if the user has the privileges specified by C<$userflags>.
1124 C<check_api_auth> is is meant for authenticating users of web services, and
1125 consequently will always return and will not attempt to redirect the user
1128 If a valid session cookie is already present, check_api_auth will return a status
1129 of "ok", the cookie, and the Koha session ID.
1131 If no session cookie is present, check_api_auth will check the 'userid' and 'password
1132 parameters and create a session cookie and Koha session if the supplied credentials
1135 Possible return values in C<$status> are:
1139 =item "ok" -- user authenticated; C<$cookie> and C<$sessionid> have valid values.
1141 =item "failed" -- credentials are not correct; C<$cookie> and C<$sessionid> are undef
1143 =item "maintenance" -- DB is in maintenance mode; no login possible at the moment
1145 =item "expired -- session cookie has expired; API user should resubmit userid and password
1151 sub check_api_auth {
1153 my $flagsrequired = shift;
1155 my $dbh = C4::Context->dbh;
1156 my $timeout = _timeout_syspref();
1158 unless (C4::Context->preference('Version')) {
1159 # database has not been installed yet
1160 return ("maintenance", undef, undef);
1162 my $kohaversion=C4::Context::KOHAVERSION;
1163 $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/;
1164 if (C4::Context->preference('Version') < $kohaversion) {
1165 # database in need of version update; assume that
1166 # no API should be called while databsae is in
1168 return ("maintenance", undef, undef);
1171 # FIXME -- most of what follows is a copy-and-paste
1172 # of code from checkauth. There is an obvious need
1173 # for refactoring to separate the various parts of
1174 # the authentication code, but as of 2007-11-19 this
1175 # is deferred so as to not introduce bugs into the
1176 # regular authentication code for Koha 3.0.
1178 # see if we have a valid session cookie already
1179 # however, if a userid parameter is present (i.e., from
1180 # a form submission, assume that any current cookie
1182 my $sessionID = undef;
1183 unless ($query->param('userid')) {
1184 $sessionID = $query->cookie("CGISESSID");
1186 if ($sessionID && not ($cas && $query->param('PT')) ) {
1187 my $session = get_session($sessionID);
1188 C4::Context->_new_userenv($sessionID);
1190 C4::Context::set_userenv(
1191 $session->param('number'), $session->param('id'),
1192 $session->param('cardnumber'), $session->param('firstname'),
1193 $session->param('surname'), $session->param('branch'),
1194 $session->param('branchname'), $session->param('flags'),
1195 $session->param('emailaddress'), $session->param('branchprinter')
1198 my $ip = $session->param('ip');
1199 my $lasttime = $session->param('lasttime');
1200 my $userid = $session->param('id');
1201 if ( $lasttime < time() - $timeout ) {
1204 C4::Context->_unset_userenv($sessionID);
1207 return ("expired", undef, undef);
1208 } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
1209 # IP address changed
1211 C4::Context->_unset_userenv($sessionID);
1214 return ("expired", undef, undef);
1216 my $cookie = $query->cookie(
1217 -name => 'CGISESSID',
1218 -value => $session->id,
1221 $session->param('lasttime',time());
1222 my $flags = haspermission($userid, $flagsrequired);
1224 return ("ok", $cookie, $sessionID);
1227 C4::Context->_unset_userenv($sessionID);
1230 return ("failed", undef, undef);
1234 return ("expired", undef, undef);
1238 my $userid = $query->param('userid');
1239 my $password = $query->param('password');
1240 my ($return, $cardnumber);
1243 if ($cas && $query->param('PT')) {
1245 $debug and print STDERR "## check_api_auth - checking CAS\n";
1246 # In case of a CAS authentication, we use the ticket instead of the password
1247 my $PT = $query->param('PT');
1248 ($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query); # EXTERNAL AUTH
1250 # User / password auth
1251 unless ($userid and $password) {
1252 # caller did something wrong, fail the authenticateion
1253 return ("failed", undef, undef);
1255 ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
1258 if ($return and haspermission( $userid, $flagsrequired)) {
1259 my $session = get_session("");
1260 return ("failed", undef, undef) unless $session;
1262 my $sessionID = $session->id;
1263 C4::Context->_new_userenv($sessionID);
1264 my $cookie = $query->cookie(
1265 -name => 'CGISESSID',
1266 -value => $sessionID,
1269 if ( $return == 1 ) {
1271 $borrowernumber, $firstname, $surname,
1272 $userflags, $branchcode, $branchname,
1273 $branchprinter, $emailaddress
1277 "select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname,branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where userid=?"
1279 $sth->execute($userid);
1281 $borrowernumber, $firstname, $surname,
1282 $userflags, $branchcode, $branchname,
1283 $branchprinter, $emailaddress
1284 ) = $sth->fetchrow if ( $sth->rows );
1286 unless ($sth->rows ) {
1287 my $sth = $dbh->prepare(
1288 "select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname, branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where cardnumber=?"
1290 $sth->execute($cardnumber);
1292 $borrowernumber, $firstname, $surname,
1293 $userflags, $branchcode, $branchname,
1294 $branchprinter, $emailaddress
1295 ) = $sth->fetchrow if ( $sth->rows );
1297 unless ( $sth->rows ) {
1298 $sth->execute($userid);
1300 $borrowernumber, $firstname, $surname, $userflags,
1301 $branchcode, $branchname, $branchprinter, $emailaddress
1302 ) = $sth->fetchrow if ( $sth->rows );
1306 my $ip = $ENV{'REMOTE_ADDR'};
1307 # if they specify at login, use that
1308 if ($query->param('branch')) {
1309 $branchcode = $query->param('branch');
1310 $branchname = GetBranchName($branchcode);
1312 my $branches = GetBranches();
1314 foreach my $br ( keys %$branches ) {
1315 # now we work with the treatment of ip
1316 my $domain = $branches->{$br}->{'branchip'};
1317 if ( $domain && $ip =~ /^$domain/ ) {
1318 $branchcode = $branches->{$br}->{'branchcode'};
1320 # new op dev : add the branchprinter and branchname in the cookie
1321 $branchprinter = $branches->{$br}->{'branchprinter'};
1322 $branchname = $branches->{$br}->{'branchname'};
1325 $session->param('number',$borrowernumber);
1326 $session->param('id',$userid);
1327 $session->param('cardnumber',$cardnumber);
1328 $session->param('firstname',$firstname);
1329 $session->param('surname',$surname);
1330 $session->param('branch',$branchcode);
1331 $session->param('branchname',$branchname);
1332 $session->param('flags',$userflags);
1333 $session->param('emailaddress',$emailaddress);
1334 $session->param('ip',$session->remote_addr());
1335 $session->param('lasttime',time());
1336 } elsif ( $return == 2 ) {
1337 #We suppose the user is the superlibrarian
1338 $session->param('number',0);
1339 $session->param('id',C4::Context->config('user'));
1340 $session->param('cardnumber',C4::Context->config('user'));
1341 $session->param('firstname',C4::Context->config('user'));
1342 $session->param('surname',C4::Context->config('user'));
1343 $session->param('branch','NO_LIBRARY_SET');
1344 $session->param('branchname','NO_LIBRARY_SET');
1345 $session->param('flags',1);
1346 $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
1347 $session->param('ip',$session->remote_addr());
1348 $session->param('lasttime',time());
1350 C4::Context::set_userenv(
1351 $session->param('number'), $session->param('id'),
1352 $session->param('cardnumber'), $session->param('firstname'),
1353 $session->param('surname'), $session->param('branch'),
1354 $session->param('branchname'), $session->param('flags'),
1355 $session->param('emailaddress'), $session->param('branchprinter')
1357 return ("ok", $cookie, $sessionID);
1359 return ("failed", undef, undef);
1364 =head2 check_cookie_auth
1366 ($status, $sessionId) = check_api_auth($cookie, $userflags);
1368 Given a CGISESSID cookie set during a previous login to Koha, determine
1369 if the user has the privileges specified by C<$userflags>.
1371 C<check_cookie_auth> is meant for authenticating special services
1372 such as tools/upload-file.pl that are invoked by other pages that
1373 have been authenticated in the usual way.
1375 Possible return values in C<$status> are:
1379 =item "ok" -- user authenticated; C<$sessionID> have valid values.
1381 =item "failed" -- credentials are not correct; C<$sessionid> are undef
1383 =item "maintenance" -- DB is in maintenance mode; no login possible at the moment
1385 =item "expired -- session cookie has expired; API user should resubmit userid and password
1391 sub check_cookie_auth {
1393 my $flagsrequired = shift;
1395 my $dbh = C4::Context->dbh;
1396 my $timeout = _timeout_syspref();
1398 unless (C4::Context->preference('Version')) {
1399 # database has not been installed yet
1400 return ("maintenance", undef);
1402 my $kohaversion=C4::Context::KOHAVERSION;
1403 $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/;
1404 if (C4::Context->preference('Version') < $kohaversion) {
1405 # database in need of version update; assume that
1406 # no API should be called while databsae is in
1408 return ("maintenance", undef);
1411 # FIXME -- most of what follows is a copy-and-paste
1412 # of code from checkauth. There is an obvious need
1413 # for refactoring to separate the various parts of
1414 # the authentication code, but as of 2007-11-23 this
1415 # is deferred so as to not introduce bugs into the
1416 # regular authentication code for Koha 3.0.
1418 # see if we have a valid session cookie already
1419 # however, if a userid parameter is present (i.e., from
1420 # a form submission, assume that any current cookie
1422 unless (defined $cookie and $cookie) {
1423 return ("failed", undef);
1425 my $sessionID = $cookie;
1426 my $session = get_session($sessionID);
1427 C4::Context->_new_userenv($sessionID);
1429 C4::Context::set_userenv(
1430 $session->param('number'), $session->param('id'),
1431 $session->param('cardnumber'), $session->param('firstname'),
1432 $session->param('surname'), $session->param('branch'),
1433 $session->param('branchname'), $session->param('flags'),
1434 $session->param('emailaddress'), $session->param('branchprinter')
1437 my $ip = $session->param('ip');
1438 my $lasttime = $session->param('lasttime');
1439 my $userid = $session->param('id');
1440 if ( $lasttime < time() - $timeout ) {
1443 C4::Context->_unset_userenv($sessionID);
1446 return ("expired", undef);
1447 } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
1448 # IP address changed
1450 C4::Context->_unset_userenv($sessionID);
1453 return ("expired", undef);
1455 $session->param('lasttime',time());
1456 my $flags = haspermission($userid, $flagsrequired);
1458 return ("ok", $sessionID);
1461 C4::Context->_unset_userenv($sessionID);
1464 return ("failed", undef);
1468 return ("expired", undef);
1475 my $session = get_session($sessionID);
1477 Given a session ID, retrieve the CGI::Session object used to store
1478 the session's state. The session object can be used to store
1479 data that needs to be accessed by different scripts during a
1482 If the C<$sessionID> parameter is an empty string, a new session
1488 my $sessionID = shift;
1489 my $storage_method = C4::Context->preference('SessionStorage');
1490 my $dbh = C4::Context->dbh;
1492 if ($storage_method eq 'mysql'){
1493 $session = new CGI::Session("driver:MySQL;serializer:yaml;id:md5", $sessionID, {Handle=>$dbh});
1495 elsif ($storage_method eq 'Pg') {
1496 $session = new CGI::Session("driver:PostgreSQL;serializer:yaml;id:md5", $sessionID, {Handle=>$dbh});
1498 elsif ($storage_method eq 'memcached' && C4::Context->ismemcached){
1499 $session = new CGI::Session("driver:memcached;serializer:yaml;id:md5", $sessionID, { Memcached => C4::Context->memcached } );
1502 # catch all defaults to tmp should work on all systems
1503 $session = new CGI::Session("driver:File;serializer:yaml;id:md5", $sessionID, {Directory=>'/tmp'});
1509 my ( $dbh, $userid, $password, $query ) = @_;
1512 $debug and print STDERR "## checkpw - checking LDAP\n";
1513 my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH
1514 ($retval) and return ($retval,$retcard,$retuserid);
1517 if ($cas && $query && $query->param('ticket')) {
1518 $debug and print STDERR "## checkpw - checking CAS\n";
1519 # In case of a CAS authentication, we use the ticket instead of the password
1520 my $ticket = $query->param('ticket');
1521 my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH
1522 ($retval) and return ($retval,$retcard,$retuserid);
1526 return checkpw_internal(@_)
1529 sub checkpw_internal {
1530 my ( $dbh, $userid, $password ) = @_;
1534 "select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?"
1536 $sth->execute($userid);
1538 my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname,
1539 $surname, $branchcode, $flags )
1542 if ( checkpw_hash($password, $stored_hash) ) {
1544 C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
1545 $firstname, $surname, $branchcode, $flags );
1546 return 1, $cardnumber, $userid;
1551 "select password,cardnumber,borrowernumber,userid, firstname,surname,branchcode,flags from borrowers where cardnumber=?"
1553 $sth->execute($userid);
1555 my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname,
1556 $surname, $branchcode, $flags )
1559 if ( checkpw_hash($password, $stored_hash) ) {
1561 C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber,
1562 $firstname, $surname, $branchcode, $flags );
1563 return 1, $cardnumber, $userid;
1566 if ( $userid && $userid eq C4::Context->config('user')
1567 && "$password" eq C4::Context->config('pass') )
1570 # Koha superuser account
1571 # C4::Context->set_userenv(0,0,C4::Context->config('user'),C4::Context->config('user'),C4::Context->config('user'),"",1);
1574 if ( $userid && $userid eq 'demo'
1575 && "$password" eq 'demo'
1576 && C4::Context->config('demo') )
1579 # DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
1580 # some features won't be effective : modify systempref, modify MARC structure,
1587 my ( $password, $stored_hash ) = @_;
1589 return if $stored_hash eq '!';
1591 # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5
1593 if ( substr($stored_hash,0,2) eq '$2') {
1594 $hash = hash_password($password, $stored_hash);
1596 $hash = md5_base64($password);
1598 return $hash eq $stored_hash;
1603 my $authflags = getuserflags($flags, $userid, [$dbh]);
1605 Translates integer flags into permissions strings hash.
1607 C<$flags> is the integer userflags value ( borrowers.userflags )
1608 C<$userid> is the members.userid, used for building subpermissions
1609 C<$authflags> is a hashref of permissions
1616 my $dbh = @_ ? shift : C4::Context->dbh;
1619 # I don't want to do this, but if someone logs in as the database
1620 # user, it would be preferable not to spam them to death with
1621 # numeric warnings. So, we make $flags numeric.
1622 no warnings 'numeric';
1625 my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags");
1628 while ( my ( $bit, $flag, $defaulton ) = $sth->fetchrow ) {
1629 if ( ( $flags & ( 2**$bit ) ) || $defaulton ) {
1630 $userflags->{$flag} = 1;
1633 $userflags->{$flag} = 0;
1636 # get subpermissions and merge with top-level permissions
1637 my $user_subperms = get_user_subpermissions($userid);
1638 foreach my $module (keys %$user_subperms) {
1639 next if $userflags->{$module} == 1; # user already has permission for everything in this module
1640 $userflags->{$module} = $user_subperms->{$module};
1646 =head2 get_user_subpermissions
1648 $user_perm_hashref = get_user_subpermissions($userid);
1650 Given the userid (note, not the borrowernumber) of a staff user,
1651 return a hashref of hashrefs of the specific subpermissions
1652 accorded to the user. An example return is
1656 export_catalog => 1,
1657 import_patrons => 1,
1661 The top-level hash-key is a module or function code from
1662 userflags.flag, while the second-level key is a code
1665 The results of this function do not give a complete picture
1666 of the functions that a staff user can access; it is also
1667 necessary to check borrowers.flags.
1671 sub get_user_subpermissions {
1674 my $dbh = C4::Context->dbh;
1675 my $sth = $dbh->prepare("SELECT flag, user_permissions.code
1676 FROM user_permissions
1677 JOIN permissions USING (module_bit, code)
1678 JOIN userflags ON (module_bit = bit)
1679 JOIN borrowers USING (borrowernumber)
1681 $sth->execute($userid);
1683 my $user_perms = {};
1684 while (my $perm = $sth->fetchrow_hashref) {
1685 $user_perms->{$perm->{'flag'}}->{$perm->{'code'}} = 1;
1690 =head2 get_all_subpermissions
1692 my $perm_hashref = get_all_subpermissions();
1694 Returns a hashref of hashrefs defining all specific
1695 permissions currently defined. The return value
1696 has the same structure as that of C<get_user_subpermissions>,
1697 except that the innermost hash value is the description
1698 of the subpermission.
1702 sub get_all_subpermissions {
1703 my $dbh = C4::Context->dbh;
1704 my $sth = $dbh->prepare("SELECT flag, code, description
1706 JOIN userflags ON (module_bit = bit)");
1710 while (my $perm = $sth->fetchrow_hashref) {
1711 $all_perms->{$perm->{'flag'}}->{$perm->{'code'}} = $perm->{'description'};
1716 =head2 haspermission
1718 $flags = ($userid, $flagsrequired);
1720 C<$userid> the userid of the member
1721 C<$flags> is a hashref of required flags like C<$borrower-<{authflags}>
1723 Returns member's flags or 0 if a permission is not met.
1728 my ($userid, $flagsrequired) = @_;
1729 my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
1730 $sth->execute($userid);
1731 my $row = $sth->fetchrow();
1732 my $flags = getuserflags($row, $userid);
1733 if ( $userid eq C4::Context->config('user') ) {
1734 # Super User Account from /etc/koha.conf
1735 $flags->{'superlibrarian'} = 1;
1737 elsif ( $userid eq 'demo' && C4::Context->config('demo') ) {
1738 # Demo user that can do "anything" (demo=1 in /etc/koha.conf)
1739 $flags->{'superlibrarian'} = 1;
1742 return $flags if $flags->{superlibrarian};
1744 foreach my $module ( keys %$flagsrequired ) {
1745 my $subperm = $flagsrequired->{$module};
1746 if ($subperm eq '*') {
1747 return 0 unless ( $flags->{$module} == 1 or ref($flags->{$module}) );
1749 return 0 unless ( $flags->{$module} == 1 or
1750 ( ref($flags->{$module}) and
1751 exists $flags->{$module}->{$subperm} and
1752 $flags->{$module}->{$subperm} == 1
1758 #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
1762 sub getborrowernumber {
1764 my $userenv = C4::Context->userenv;
1765 if ( defined( $userenv ) && ref( $userenv ) eq 'HASH' && $userenv->{number} ) {
1766 return $userenv->{number};
1768 my $dbh = C4::Context->dbh;
1769 for my $field ( 'userid', 'cardnumber' ) {
1771 $dbh->prepare("select borrowernumber from borrowers where $field=?");
1772 $sth->execute($userid);
1774 my ($bnumber) = $sth->fetchrow;
1781 sub ParseSearchHistorySession {
1783 my $sessionID = $cgi->cookie('CGISESSID');
1784 return () unless $sessionID;
1785 my $session = get_session($sessionID);
1786 return () unless $session and $session->param('search_history');
1787 my $obj = eval { decode_json(uri_unescape($session->param('search_history'))) };
1788 return () unless defined $obj;
1789 return () unless ref $obj eq 'ARRAY';
1793 sub SetSearchHistorySession {
1794 my ($cgi, $search_history) = @_;
1795 my $sessionID = $cgi->cookie('CGISESSID');
1796 return () unless $sessionID;
1797 my $session = get_session($sessionID);
1798 return () unless $session;
1799 $session->param('search_history', uri_escape(encode_json($search_history)));
1802 END { } # module clean-up code here (global destructor)
1812 Crypt::Eksblowfish::Bcrypt(3)