Download the PHP package internetrix/silverstripe-controller-ip-restriction without Composer
On this page you can find all versions of the php package internetrix/silverstripe-controller-ip-restriction. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download internetrix/silverstripe-controller-ip-restriction
More information about internetrix/silverstripe-controller-ip-restriction
Files in internetrix/silverstripe-controller-ip-restriction
Package silverstripe-controller-ip-restriction
Short Description Restrict SilverStripe controllers to specific IP address
License BSD-3-Clause
Informations about the package silverstripe-controller-ip-restriction
Introduction
This module allows SilverStripe developers to restrict access to arbitrary-defined controllers, according to a User's IP address. Requests to specific Controllers will be denied if a user's IP does not match the provided list of allowed IP addresses.
Allowed IP addresses can be set via an environment variable or via the SiteConfig. Common use cases of the module includes:
- Restricting access to the CMS admin section
- Restricting access to the dev/tasks admin.
Requirements
- SilverStripe CMS ^4
Installation & Configuration
-
Install the module via composer:
- Set the following variables for
Internetrix\CMSAdminIPRestriction\AllowedIPMiddlewarein config:- enabled: Set this to true to enable this module's AllowedIPMiddleware
- restricted_controllers: A list of controllers you want to be restricted by IP addresses
In the following example, we are restricting access to the CMS admin as well as the /dev controller.
- Define which IP addresses are allowed in
.envfile, using aSS_ADMIN_ALLOWED_IPSvariable. For multiple IP addresses, use a comma-limited list.
- Additional allowed IP addresses can also be set by a CMS admin via the CMS SiteConfig, under the
Allowed IPstab. Simply create a new record with an exact IP address and label it with the corresponding physical location (used for audit purposes)
Bypass IP restriction
- If a certain user is an Admin, they can bypass the IP restriction check if the
CanBypassIPRestrictiondatabase field is set to true. This can be set when editing the member in the CMS and is only applied if the User remains a CMS Administrator.
Important: Due to race conditions, this features requires a user to be first logged-in so that theCanBypassIPRestrictionvalue for the user can be checked. If the CMS admin or another Controller is restricted, a user must first log-in to SilverStripe via a non-restricted page (i.e A Only Logged-in Users Can View Page) before the IP Bypass will be applied.
Troubleshooting
- If no IP address is specified in
.envor via theSiteConfig, the restricted controllers will be inaccessible.
Todo
- Currently, IP matching is based on exact matching IP address. Range, wildcard and CIDR is currently not supported and will included in the future. Pull requests welcome!