X-Git-Url: http://koha-dev.rot13.org:8081/gitweb/?a=blobdiff_plain;f=C4%2FAuth.pm;h=39eb50fe91e381cc6662b2978079dcc147579cc1;hb=bf64266e9932853e42a17f98d27417319a4ef7fe;hp=f24f9af5402dc85aea198c55d3e90a67e6037274;hpb=ca5e412c1b5ceeb6928469e6e5f33214259ea585;p=koha_gimpoz

diff --git a/C4/Auth.pm b/C4/Auth.pm
index f24f9af540..2aac67858c 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -13,36 +13,63 @@ package C4::Auth;
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 use strict;
+#use warnings; FIXME - Bug 2505
 use Digest::MD5 qw(md5_base64);
+use Storable qw(thaw freeze);
+use URI::Escape;
 use CGI::Session;
 
 require Exporter;
 use C4::Context;
-use C4::Output;    # to get the template
+use C4::Templates;    # to get the template
 use C4::Members;
 use C4::Koha;
 use C4::Branch; # GetBranches
 use C4::VirtualShelves;
+use POSIX qw/strftime/;
+use List::MoreUtils qw/ any /;
 
 # use utf8;
-use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap);
+use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $servers $memcached);
 
 BEGIN {
-    $VERSION = 3.02;        # set version for version checking
-    $debug = $ENV{DEBUG} || 0 ;
-    @ISA   = qw(Exporter);
-    @EXPORT    = qw(&checkauth &get_template_and_user);
-    @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions);
-    %EXPORT_TAGS = (EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)]);
-    $ldap = C4::Context->config('useldapserver') || 0;
+    sub psgi_env { any { /^psgi\./ } keys %ENV }
+    sub safe_exit {
+	if ( psgi_env ) { die 'psgi:exit' }
+	else { exit }
+    }
+
+    $VERSION     = 3.02;                                                                                                            # set version for version checking
+    $debug       = $ENV{DEBUG};
+    @ISA         = qw(Exporter);
+    @EXPORT      = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
+    @EXPORT_OK   = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions);
+    %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
+    $ldap        = C4::Context->config('useldapserver') || 0;
+    $cas         = C4::Context->preference('casAuthentication');
+    $caslogout   = C4::Context->preference('casLogout');
+    require C4::Auth_with_cas;             # no import
     if ($ldap) {
-        require C4::Auth_with_ldap;             # no import
-        import  C4::Auth_with_ldap qw(checkpw_ldap);
+	require C4::Auth_with_ldap;
+	import C4::Auth_with_ldap qw(checkpw_ldap);
+    }
+    if ($cas) {
+        import  C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
+    }
+    $servers = C4::Context->config('memcached_servers');
+    if ($servers) {
+	require Cache::Memcached;
+        $memcached = Cache::Memcached->new({
+					       servers => [ $servers ],
+					       debug   => 0,
+					       compress_threshold => 10_000,
+					       namespace => C4::Context->config('memcached_namespace') || 'koha',
+					   });
     }
 }
 
@@ -58,7 +85,7 @@ C4::Auth - Authenticates Koha users
 
   my $query = new CGI;
 
-  my ($template, $borrowernumber, $cookie) 
+  my ($template, $borrowernumber, $cookie)
     = get_template_and_user(
         {
             template_name   => "opac-main.tmpl",
@@ -73,54 +100,59 @@ C4::Auth - Authenticates Koha users
 
 =head1 DESCRIPTION
 
-    The main function of this module is to provide
-    authentification. However the get_template_and_user function has
-    been provided so that a users login information is passed along
-    automatically. This gets loaded into the template.
+The main function of this module is to provide
+authentification. However the get_template_and_user function has
+been provided so that a users login information is passed along
+automatically. This gets loaded into the template.
 
 =head1 FUNCTIONS
 
-=over 2
-
-=item get_template_and_user
-
-    my ($template, $borrowernumber, $cookie)
-        = get_template_and_user(
-          {
-            template_name   => "opac-main.tmpl",
-            query           => $query,
-            type            => "opac",
-            authnotrequired => 1,
-            flagsrequired   => {borrow => 1, catalogue => '*', tools => 'import_patrons' },
-          }
-        );
-
-    This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
-    to C<&checkauth> (in this module) to perform authentification.
-    See C<&checkauth> for an explanation of these parameters.
-
-    The C<template_name> is then used to find the correct template for
-    the page. The authenticated users details are loaded onto the
-    template in the HTML::Template LOOP variable C<USER_INFO>. Also the
-    C<sessionID> is passed to the template. This can be used in templates
-    if cookies are disabled. It needs to be put as and input to every
-    authenticated page.
-
-    More information on the C<gettemplate> sub can be found in the
-    Output.pm module.
+=head2 get_template_and_user
+
+ my ($template, $borrowernumber, $cookie)
+     = get_template_and_user(
+       {
+         template_name   => "opac-main.tmpl",
+         query           => $query,
+         type            => "opac",
+         authnotrequired => 1,
+         flagsrequired   => {borrow => 1, catalogue => '*', tools => 'import_patrons' },
+       }
+     );
+
+This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
+to C<&checkauth> (in this module) to perform authentification.
+See C<&checkauth> for an explanation of these parameters.
+
+The C<template_name> is then used to find the correct template for
+the page. The authenticated users details are loaded onto the
+template in the HTML::Template LOOP variable C<USER_INFO>. Also the
+C<sessionID> is passed to the template. This can be used in templates
+if cookies are disabled. It needs to be put as and input to every
+authenticated page.
+
+More information on the C<gettemplate> sub can be found in the
+Output.pm module.
 
 =cut
 
+my $SEARCH_HISTORY_INSERT_SQL =<<EOQ;
+INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, total, time            )
+VALUES                    (     ?,         ?,          ?,         ?,          ?, FROM_UNIXTIME(?))
+EOQ
 sub get_template_and_user {
     my $in       = shift;
     my $template =
-      gettemplate( $in->{'template_name'}, $in->{'type'}, $in->{'query'} );
-    my ( $user, $cookie, $sessionID, $flags ) = checkauth(
-        $in->{'query'},
-        $in->{'authnotrequired'},
-        $in->{'flagsrequired'},
-        $in->{'type'}
-    ) unless ($in->{'template_name'}=~/maintenance/);
+      C4::Templates::gettemplate( $in->{'template_name'}, $in->{'type'}, $in->{'query'} );
+    my ( $user, $cookie, $sessionID, $flags );
+    if ( $in->{'template_name'} !~m/maintenance/ ) {
+        ( $user, $cookie, $sessionID, $flags ) = checkauth(
+            $in->{'query'},
+            $in->{'authnotrequired'},
+            $in->{'flagsrequired'},
+            $in->{'type'}
+        );
+    }
 
     my $borrowernumber;
     my $insecure = C4::Context->preference('insecure');
@@ -143,28 +175,29 @@ sub get_template_and_user {
 
         my ($total, $pubshelves, $barshelves) = C4::Context->get_shelves_userenv();
         if (defined($pubshelves)) {
-            $template->param(   pubshelves      => scalar (@$pubshelves),
-                                pubshelvesloop  => $pubshelves,
-                            );
-            $template->param(   pubtotal        => $total->{'pubtotal'}, ) if ($total->{'pubtotal'} > scalar (@$pubshelves));
+            $template->param( pubshelves     => scalar @{$pubshelves},
+                              pubshelvesloop => $pubshelves,
+            );
+            $template->param( pubtotal   => $total->{'pubtotal'}, ) if ($total->{'pubtotal'} > scalar @{$pubshelves});
         }
         if (defined($barshelves)) {
-            $template->param(   barshelves      => scalar (@$barshelves),
-                                barshelvesloop  => $barshelves,
-                            );
-            $template->param(   bartotal        => $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar (@$barshelves));
+            $template->param( barshelves      => scalar @{$barshelves},
+                              barshelvesloop  => $barshelves,
+            );
+            $template->param( bartotal  => $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar @{$barshelves});
         }
 
-        $borrowernumber = getborrowernumber($user);
+        $borrowernumber = getborrowernumber($user) if defined($user);
+
         my ( $borr ) = GetMemberDetails( $borrowernumber );
         my @bordat;
         $bordat[0] = $borr;
         $template->param( "USER_INFO" => \@bordat );
-        
+
         my $all_perms = get_all_subpermissions();
 
         my @flagroots = qw(circulate catalogue parameters borrowers permissions reserveforothers borrow
-                            editcatalogue updatecharges management tools editauthorities serials reports);
+                            editcatalogue updatecharges management tools editauthorities serials reports acquisition);
         # We are going to use the $flags returned by checkauth
         # to create the template's parameters that will indicate
         # which menus the user can access.
@@ -180,7 +213,7 @@ sub get_template_and_user {
             $template->param( CAN_user_updatecharges     => 1 );
             $template->param( CAN_user_acquisition      => 1 );
             $template->param( CAN_user_management       => 1 );
-            $template->param( CAN_user_tools            => 1 ); 
+            $template->param( CAN_user_tools            => 1 );
             $template->param( CAN_user_editauthorities  => 1 );
             $template->param( CAN_user_serials          => 1 );
             $template->param( CAN_user_reports          => 1 );
@@ -192,24 +225,16 @@ sub get_template_and_user {
             }
         }
 
-        if (C4::Context->preference('GranularPermissions')) {
-            if ( $flags ) {
-                foreach my $module (keys %$all_perms) {
-                    if ( $flags->{$module} == 1) {
-                        foreach my $subperm (keys %{ $all_perms->{$module} }) {
-                            $template->param( "CAN_user_${module}_${subperm}" => 1 );
-                        }
-                    } elsif ( ref($flags->{$module}) ) {
-                        foreach my $subperm (keys %{ $flags->{$module} } ) {
-                            $template->param( "CAN_user_${module}_${subperm}" => 1 );
-                        }
-                    }
-                }
-            }
-        } else {
+        if ( $flags ) {
             foreach my $module (keys %$all_perms) {
-                foreach my $subperm (keys %{ $all_perms->{$module} }) {
-                    $template->param( "CAN_user_${module}_${subperm}" => 1 );
+                if ( $flags->{$module} == 1) {
+                    foreach my $subperm (keys %{ $all_perms->{$module} }) {
+                        $template->param( "CAN_user_${module}_${subperm}" => 1 );
+                    }
+                } elsif ( ref($flags->{$module}) ) {
+                    foreach my $subperm (keys %{ $flags->{$module} } ) {
+                        $template->param( "CAN_user_${module}_${subperm}" => 1 );
+                    }
                 }
             }
         }
@@ -224,8 +249,48 @@ sub get_template_and_user {
                 }
             }
         }
+		# Logged-in opac search history
+		# If the requested template is an opac one and opac search history is enabled
+		if ($in->{type} eq 'opac' && C4::Context->preference('EnableOpacSearchHistory')) {
+			my $dbh = C4::Context->dbh;
+			my $query = "SELECT COUNT(*) FROM search_history WHERE userid=?";
+			my $sth = $dbh->prepare($query);
+			$sth->execute($borrowernumber);
+			
+			# If at least one search has already been performed
+			if ($sth->fetchrow_array > 0) { 
+			# We show the link in opac
+			$template->param(ShowOpacRecentSearchLink => 1);
+			}
+
+			# And if there's a cookie with searches performed when the user was not logged in, 
+			# we add them to the logged-in search history
+			my $searchcookie = $in->{'query'}->cookie('KohaOpacRecentSearches');
+			if ($searchcookie){
+				$searchcookie = uri_unescape($searchcookie);
+			        my @recentSearches = @{thaw($searchcookie) || []};
+				if (@recentSearches) {
+					my $sth = $dbh->prepare($SEARCH_HISTORY_INSERT_SQL);
+					$sth->execute( $borrowernumber,
+						       $in->{'query'}->cookie("CGISESSID"),
+						       $_->{'query_desc'},
+						       $_->{'query_cgi'},
+						       $_->{'total'},
+						       $_->{'time'},
+                            ) foreach @recentSearches;
+
+					# And then, delete the cookie's content
+					my $newsearchcookie = $in->{'query'}->cookie(
+												-name => 'KohaOpacRecentSearches',
+												-value => freeze([]),
+												-expires => ''
+											 );
+					$cookie = [$cookie, $newsearchcookie];
+				}
+			}
+		}
     }
-    else {  # if this is an anonymous session, setup to display public lists...
+	else {	# if this is an anonymous session, setup to display public lists...
 
         # load the template variables for stylesheets and JavaScript
         $template->param( css_libs => $in->{'css_libs'} );
@@ -241,48 +306,66 @@ sub get_template_and_user {
         $template->param( sessionID        => $sessionID );
         
         my ($total, $pubshelves) = C4::Context->get_shelves_userenv();  # an anonymous user has no 'barshelves'...
-        if (defined(($pubshelves))) {
-            $template->param(   pubshelves      => scalar (@$pubshelves),
+        if (defined $pubshelves) {
+            $template->param(   pubshelves      => scalar @{$pubshelves},
                                 pubshelvesloop  => $pubshelves,
                             );
-            $template->param(   pubtotal        => $total->{'pubtotal'}, ) if ($total->{'pubtotal'} > scalar (@$pubshelves));
+            $template->param(   pubtotal        => $total->{'pubtotal'}, ) if ($total->{'pubtotal'} > scalar @{$pubshelves});
         }
 
     }
+ 	# Anonymous opac search history
+ 	# If opac search history is enabled and at least one search has already been performed
+ 	if (C4::Context->preference('EnableOpacSearchHistory')) {
+		my $searchcookie = $in->{'query'}->cookie('KohaOpacRecentSearches');
+		if ($searchcookie){
+			$searchcookie = uri_unescape($searchcookie);
+		        my @recentSearches = @{thaw($searchcookie) || []};
+ 	    # We show the link in opac
+			if (@recentSearches) {
+				$template->param(ShowOpacRecentSearchLink => 1);
+			}
+	    }
+ 	}
+
+    if(C4::Context->preference('dateformat')){
+        if(C4::Context->preference('dateformat') eq "metric"){
+            $template->param(dateformat_metric => 1);
+        } elsif(C4::Context->preference('dateformat') eq "us"){
+            $template->param(dateformat_us => 1);
+        } else {
+            $template->param(dateformat_iso => 1);
+        }
+    } else {
+        $template->param(dateformat_iso => 1);
+    }
 
     # these template parameters are set the same regardless of $in->{'type'}
     $template->param(
             "BiblioDefaultView".C4::Context->preference("BiblioDefaultView")         => 1,
             EnhancedMessagingPreferences => C4::Context->preference('EnhancedMessagingPreferences'),
             GoogleJackets                => C4::Context->preference("GoogleJackets"),
+	    OpenLibraryCovers            => C4::Context->preference("OpenLibraryCovers"),
             KohaAdminEmailAddress        => "" . C4::Context->preference("KohaAdminEmailAddress"),
             LoginBranchcode              => (C4::Context->userenv?C4::Context->userenv->{"branch"}:"insecure"),
             LoginFirstname               => (C4::Context->userenv?C4::Context->userenv->{"firstname"}:"Bel"),
             LoginSurname                 => C4::Context->userenv?C4::Context->userenv->{"surname"}:"Inconnu",
             TagsEnabled                  => C4::Context->preference("TagsEnabled"),
             hide_marc                    => C4::Context->preference("hide_marc"),
-            dateformat                   => C4::Context->preference("dateformat"),
-            'item-level_itypes'          => C4::Context->preference('item-level_itypes'),
+            item_level_itypes            => C4::Context->preference('item-level_itypes'),
             patronimages                 => C4::Context->preference("patronimages"),
             singleBranchMode             => C4::Context->preference("singleBranchMode"),
-            SyndeticsClientCode          => C4::Context->preference("SyndeticsClientCode"),
-            SyndeticsEnabled             => C4::Context->preference("SyndeticsEnabled"),
-            SyndeticsCoverImages         => C4::Context->preference("SyndeticsCoverImages"),
-            SyndeticsTOC                 => C4::Context->preference("SyndeticsTOC"),
-            SyndeticsSummary             => C4::Context->preference("SyndeticsSummary"),
-            SyndeticsEditions            => C4::Context->preference("SyndeticsEditions"),
-            SyndeticsExcerpt             => C4::Context->preference("SyndeticsExcerpt"),
-            SyndeticsReviews             => C4::Context->preference("SyndeticsReviews"),
-            SyndeticsAuthorNotes         => C4::Context->preference("SyndeticsAuthorNotes"),
-            SyndeticsAwards              => C4::Context->preference("SyndeticsAwards"),
-            SyndeticsSeries              => C4::Context->preference("SyndeticsSeries"),
-			SyndeticsCoverImageSize		 => C4::Context->preference("SyndeticsCoverImageSize"),
-                 );
+            XSLTDetailsDisplay           => C4::Context->preference("XSLTDetailsDisplay"),
+            XSLTResultsDisplay           => C4::Context->preference("XSLTResultsDisplay"),
+            using_https                  => $in->{'query'}->https() ? 1 : 0,
+            noItemTypeImages            => C4::Context->preference("noItemTypeImages"),
+    );
 
     if ( $in->{'type'} eq "intranet" ) {
         $template->param(
-            AmazonEnabled               => C4::Context->preference("AmazonEnabled"),
+            AmazonContent               => C4::Context->preference("AmazonContent"),
             AmazonCoverImages           => C4::Context->preference("AmazonCoverImages"),
+            AmazonEnabled               => C4::Context->preference("AmazonEnabled"),
             AmazonSimilarItems          => C4::Context->preference("AmazonSimilarItems"),
             AutoLocation                => C4::Context->preference("AutoLocation"),
             "BiblioDefaultView".C4::Context->preference("IntranetBiblioDefaultView") => 1,
@@ -293,17 +376,20 @@ sub get_template_and_user {
             IntranetmainUserblock       => C4::Context->preference("IntranetmainUserblock"),
             LibraryName                 => C4::Context->preference("LibraryName"),
             LoginBranchname             => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:"insecure"),
-            TemplateEncoding            => C4::Context->preference("TemplateEncoding"),
             advancedMARCEditor          => C4::Context->preference("advancedMARCEditor"),
             canreservefromotherbranches => C4::Context->preference('canreservefromotherbranches'),
             intranetcolorstylesheet     => C4::Context->preference("intranetcolorstylesheet"),
+            IntranetFavicon             => C4::Context->preference("IntranetFavicon"),
             intranetreadinghistory      => C4::Context->preference("intranetreadinghistory"),
             intranetstylesheet          => C4::Context->preference("intranetstylesheet"),
+            IntranetUserCSS             => C4::Context->preference("IntranetUserCSS"),
             intranetuserjs              => C4::Context->preference("intranetuserjs"),
-            noItemTypeImages            => C4::Context->preference("noItemTypeImages"),
+            intranetbookbag             => C4::Context->preference("intranetbookbag"),
             suggestion                  => C4::Context->preference("suggestion"),
             virtualshelves              => C4::Context->preference("virtualshelves"),
-			StaffSerialIssueDisplayCount => C4::Context->preference("StaffSerialIssueDisplayCount"),
+            StaffSerialIssueDisplayCount => C4::Context->preference("StaffSerialIssueDisplayCount"),
+            NoZebra                     => C4::Context->preference('NoZebra'),
+		EasyAnalyticalRecords => C4::Context->preference('EasyAnalyticalRecords'),
         );
     }
     else {
@@ -315,75 +401,110 @@ sub get_template_and_user {
         # variables passed from CGI: opac_css_override and opac_search_limits.
         my $opac_search_limit = $ENV{'OPAC_SEARCH_LIMIT'};
         my $opac_limit_override = $ENV{'OPAC_LIMIT_OVERRIDE'};
-        my $mylibraryfirst = C4::Context->preference("SearchMyLibraryFirst");
-        my $opac_name;
-        if($opac_limit_override && ($opac_search_limit =~ /branch:(\w+)/) ){
-             $opac_name = C4::Branch::GetBranchName($1)   # opac_search_limit is a branch, so we use it.
-        } elsif($mylibraryfirst){
-            $opac_name = C4::Branch::GetBranchName($mylibraryfirst);
+        my $opac_name = '';
+        if (($opac_search_limit =~ /branch:(\w+)/ && $opac_limit_override) || $in->{'query'}->param('limit') =~ /branch:(\w+)/){
+            $opac_name = $1;   # opac_search_limit is a branch, so we use it.
+        } elsif (C4::Context->preference("SearchMyLibraryFirst") && C4::Context->userenv && C4::Context->userenv->{'branch'}) {
+            $opac_name = C4::Context->userenv->{'branch'};
         }
+	my $checkstyle = C4::Context->preference("opaccolorstylesheet");
+	if ($checkstyle =~ /http/)
+	{
+            	$template->param( opacexternalsheet => $checkstyle);
+	} else
+	{
+		my $opaccolorstylesheet = C4::Context->preference("opaccolorstylesheet");  
+            $template->param( opaccolorstylesheet => $opaccolorstylesheet);
+	}
         $template->param(
+            AmazonContent             => "" . C4::Context->preference("AmazonContent"),
             AnonSuggestions           => "" . C4::Context->preference("AnonSuggestions"),
             AuthorisedValueImages     => C4::Context->preference("AuthorisedValueImages"),
+            BranchesLoop              => GetBranchesLoop($opac_name),
             LibraryName               => "" . C4::Context->preference("LibraryName"),
             LibraryNameTitle          => "" . $LibraryNameTitle,
             LoginBranchname           => C4::Context->userenv?C4::Context->userenv->{"branchname"}:"",
             OPACAmazonEnabled         => C4::Context->preference("OPACAmazonEnabled"),
+            OPACAmazonSimilarItems    => C4::Context->preference("OPACAmazonSimilarItems"),
             OPACAmazonCoverImages     => C4::Context->preference("OPACAmazonCoverImages"),
-            OPACAmazonSimilarItems    => "" . C4::Context->preference("OPACAmazonSimilarItems"),
+            OPACAmazonReviews         => C4::Context->preference("OPACAmazonReviews"),
             OPACFRBRizeEditions       => C4::Context->preference("OPACFRBRizeEditions"),
+            OpacHighlightedWords       => C4::Context->preference("OpacHighlightedWords"),
             OPACItemHolds             => C4::Context->preference("OPACItemHolds"),
             OPACShelfBrowser          => "". C4::Context->preference("OPACShelfBrowser"),
+            OpacShowRecentComments    => C4::Context->preference("OpacShowRecentComments"),
             OPACURLOpenInNewWindow    => "" . C4::Context->preference("OPACURLOpenInNewWindow"),
             OPACUserCSS               => "". C4::Context->preference("OPACUserCSS"),
             OPACViewOthersSuggestions => "" . C4::Context->preference("OPACViewOthersSuggestions"),
             OpacAuthorities           => C4::Context->preference("OpacAuthorities"),
             OPACBaseURL               => ($in->{'query'}->https() ? "https://" : "http://") . $ENV{'SERVER_NAME'} .
                    ($ENV{'SERVER_PORT'} eq ($in->{'query'}->https() ? "443" : "80") ? '' : ":$ENV{'SERVER_PORT'}"),
-            opac_name             => $opac_name,
             opac_css_override           => $ENV{'OPAC_CSS_OVERRIDE'},
             opac_search_limit         => $opac_search_limit,
             opac_limit_override       => $opac_limit_override,
             OpacBrowser               => C4::Context->preference("OpacBrowser"),
             OpacCloud                 => C4::Context->preference("OpacCloud"),
+            OpacKohaUrl               => C4::Context->preference("OpacKohaUrl"),
             OpacMainUserBlock         => "" . C4::Context->preference("OpacMainUserBlock"),
             OpacNav                   => "" . C4::Context->preference("OpacNav"),
+            OpacNavBottom             => "" . C4::Context->preference("OpacNavBottom"),
             OpacPasswordChange        => C4::Context->preference("OpacPasswordChange"),
+            OPACPatronDetails        => C4::Context->preference("OPACPatronDetails"),
+            OPACPrivacy               => C4::Context->preference("OPACPrivacy"),
+            OPACFinesTab              => C4::Context->preference("OPACFinesTab"),
             OpacTopissue              => C4::Context->preference("OpacTopissue"),
             RequestOnOpac             => C4::Context->preference("RequestOnOpac"),
-            TemplateEncoding          => "". C4::Context->preference("TemplateEncoding"),
             'Version'                 => C4::Context->preference('Version'),
-            XSLTDetailsDisplay        => C4::Context->preference("XSLTDetailsDisplay"),
-            XSLTResultsDisplay        => C4::Context->preference("XSLTResultsDisplay"),
             hidelostitems             => C4::Context->preference("hidelostitems"),
-            mylibraryfirst            => (C4::Context->preference("SearchMyLibraryFirst")) ? C4::Context->userenv->{'branch'} : '',
+            mylibraryfirst            => (C4::Context->preference("SearchMyLibraryFirst") && C4::Context->userenv) ? C4::Context->userenv->{'branch'} : '',
+            opaclayoutstylesheet      => "" . C4::Context->preference("opaclayoutstylesheet"),
+            opacstylesheet            => "" . C4::Context->preference("opacstylesheet"),
             opacbookbag               => "" . C4::Context->preference("opacbookbag"),
-            opaccolorstylesheet       => "". C4::Context->preference("opaccolorstylesheet"),
             opaccredits               => "" . C4::Context->preference("opaccredits"),
+            OpacFavicon               => C4::Context->preference("OpacFavicon"),
             opacheader                => "" . C4::Context->preference("opacheader"),
-            opaclanguagesdisplay      => "". C4::Context->preference("opaclanguagesdisplay"),
-            opaclayoutstylesheet      => "". C4::Context->preference("opaclayoutstylesheet"),
+            opaclanguagesdisplay      => "" . C4::Context->preference("opaclanguagesdisplay"),
             opacreadinghistory        => C4::Context->preference("opacreadinghistory"),
             opacsmallimage            => "" . C4::Context->preference("opacsmallimage"),
             opacuserjs                => C4::Context->preference("opacuserjs"),
             opacuserlogin             => "" . C4::Context->preference("opacuserlogin"),
             reviewson                 => C4::Context->preference("reviewson"),
+            ShowReviewer              => C4::Context->preference("ShowReviewer"),
+            ShowReviewerPhoto         => C4::Context->preference("ShowReviewerPhoto"),
             suggestion                => "" . C4::Context->preference("suggestion"),
             virtualshelves            => "" . C4::Context->preference("virtualshelves"),
-			OPACSerialIssueDisplayCount => C4::Context->preference("OPACSerialIssueDisplayCount"),
+            OPACSerialIssueDisplayCount => C4::Context->preference("OPACSerialIssueDisplayCount"),
+            OpacAddMastheadLibraryPulldown => C4::Context->preference("OpacAddMastheadLibraryPulldown"),
+            OPACXSLTDetailsDisplay           => C4::Context->preference("OPACXSLTDetailsDisplay"),
+            OPACXSLTResultsDisplay           => C4::Context->preference("OPACXSLTResultsDisplay"),
+            SyndeticsClientCode          => C4::Context->preference("SyndeticsClientCode"),
+            SyndeticsEnabled             => C4::Context->preference("SyndeticsEnabled"),
+            SyndeticsCoverImages         => C4::Context->preference("SyndeticsCoverImages"),
+            SyndeticsTOC                 => C4::Context->preference("SyndeticsTOC"),
+            SyndeticsSummary             => C4::Context->preference("SyndeticsSummary"),
+            SyndeticsEditions            => C4::Context->preference("SyndeticsEditions"),
+            SyndeticsExcerpt             => C4::Context->preference("SyndeticsExcerpt"),
+            SyndeticsReviews             => C4::Context->preference("SyndeticsReviews"),
+            SyndeticsAuthorNotes         => C4::Context->preference("SyndeticsAuthorNotes"),
+            SyndeticsAwards              => C4::Context->preference("SyndeticsAwards"),
+            SyndeticsSeries              => C4::Context->preference("SyndeticsSeries"),
+            SyndeticsCoverImageSize      => C4::Context->preference("SyndeticsCoverImageSize"),
         );
+
+        $template->param(OpacPublic => '1') if ($user || C4::Context->preference("OpacPublic"));
     }
+	$template->param(listloop=>[{shelfname=>"Freelist", shelfnumber=>110}]);
     return ( $template, $borrowernumber, $cookie, $flags);
 }
 
-=item checkauth
+=head2 checkauth
 
   ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
 
 Verifies that the user is authorized to run this script.  If
 the user is authorized, a (userid, cookie, session-id, flags)
-quadruple is returned.  If the user is not authorized due to
-insufficent privileges (see $flagsrequired below), it
+quadruple is returned.  If the user is not authorized but does
+not have the required privilege (see $flagsrequired below), it
 displays an error page and exits.  Otherwise, it displays the
 login page and exits.
 
@@ -411,21 +532,22 @@ that the user must have the "circulate" privilege in order to
 proceed. To make sure that access control is correct, the
 C<$flagsrequired> parameter must be specified correctly.
 
-If the GranularPermissions system preference is ON, the
-value of each key in the C<flagsrequired> hash takes on an additional
-meaning, e.g.,
+Koha also has a concept of sub-permissions, also known as
+granular permissions.  This makes the value of each key
+in the C<flagsrequired> hash take on an additional
+meaning, i.e.,
 
-=item 1
+ 1
 
 The user must have access to all subfunctions of the module
 specified by the hash key.
 
-=item *
+ *
 
 The user must have access to at least one subfunction of the module
 specified by the hash key.
 
-=item specific permission, e.g., 'export_catalog'
+ specific permission, e.g., 'export_catalog'
 
 The user must have access to the specific subfunction list, which
 must correspond to a row in the permissions table.
@@ -444,7 +566,7 @@ user has authenticated, C<&checkauth> restarts the original script
 
 The login page is provided using a HTML::Template, which is set in the
 systempreferences table or at the top of this file. The variable C<$type>
-selects which template to use, either the opac or the intranet 
+selects which template to use, either the opac or the intranet
 authentification template.
 
 C<&checkauth> returns a user ID, a cookie, and a session ID. The
@@ -459,21 +581,20 @@ sub _version_check ($$) {
     my $version;
     # If Version syspref is unavailable, it means Koha is beeing installed,
     # and so we must redirect to OPAC maintenance page or to the WebInstaller
-    # also, if OpacMaintenance is ON, OPAC should redirect to maintenance
-    if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') {
+	# also, if OpacMaintenance is ON, OPAC should redirect to maintenance
+	if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') {
         warn "OPAC Install required, redirecting to maintenance";
         print $query->redirect("/cgi-bin/koha/maintenance.pl");
     }
-    unless ($version = C4::Context->preference('Version')) {    # assignment, not comparison
-      if ($type ne 'opac') {
-        warn "Install required, redirecting to Installer";
-        print $query->redirect("/cgi-bin/koha/installer/install.pl");
-      } 
-      else {
-        warn "OPAC Install required, redirecting to maintenance";
-        print $query->redirect("/cgi-bin/koha/maintenance.pl");
-      }
-      exit;
+    unless ( $version = C4::Context->preference('Version') ) {    # assignment, not comparison
+        if ( $type ne 'opac' ) {
+            warn "Install required, redirecting to Installer";
+            print $query->redirect("/cgi-bin/koha/installer/install.pl");
+        } else {
+            warn "OPAC Install required, redirecting to maintenance";
+            print $query->redirect("/cgi-bin/koha/maintenance.pl");
+        }
+        safe_exit;
     }
 
     # check that database and koha version are the same
@@ -492,8 +613,8 @@ sub _version_check ($$) {
         } else {
             warn sprintf("OPAC: " . $warning, 'maintenance');
             print $query->redirect("/cgi-bin/koha/maintenance.pl");
-        }       
-        exit;
+        }
+        safe_exit;
     }
 }
 
@@ -506,7 +627,7 @@ sub _session_log {
 
 sub checkauth {
     my $query = shift;
-    $debug and warn "Checking Auth";
+	$debug and warn "Checking Auth";
     # $authnotrequired will be set for scripts which will run without authentication
     my $authnotrequired = shift;
     my $flagsrequired   = shift;
@@ -528,6 +649,10 @@ sub checkauth {
     my ( $userid, $cookie, $sessionID, $flags, $barshelves, $pubshelves );
     my $logout = $query->param('logout.x');
 
+    # This parameter is the name of the CAS server we want to authenticate against,
+    # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml
+    my $casparam = $query->param('cas');
+
     if ( $userid = $ENV{'REMOTE_USER'} ) {
         # Using Basic Authentication, no cookies required
         $cookie = $query->cookie(
@@ -537,7 +662,7 @@ sub checkauth {
         );
         $loggedin = 1;
     }
-    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison 
+    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison
         my $session = get_session($sessionID);
         C4::Context->_new_userenv($sessionID);
         my ($ip, $lasttime, $sessiontype);
@@ -556,9 +681,8 @@ sub checkauth {
             $ip       = $session->param('ip');
             $lasttime = $session->param('lasttime');
             $userid   = $session->param('id');
-            $sessiontype = $session->param('sessiontype');
+			$sessiontype = $session->param('sessiontype');
         }
-   
         if ( ($query->param('koha_login_context')) && ($query->param('userid') ne $session->param('id')) ) {
             #if a user enters an id ne to the id in the current session, we need to log them in...
             #first we need to clear the anonymous session...
@@ -566,24 +690,28 @@ sub checkauth {
             $session->flush;      
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
-            $sessionID = undef;
-            $userid = undef;
-        }
+			$sessionID = undef;
+			$userid = undef;
+		}
         elsif ($logout) {
             # voluntary logout the user
-            $session->flush;      
+            $session->flush;
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
-            _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,localtime);
+            _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime));
             $sessionID = undef;
             $userid    = undef;
+
+	    if ($cas and $caslogout) {
+		logout_cas($query);
+	    }
         }
         elsif ( $lasttime < time() - $timeout ) {
             # timed logout
             $info{'timed_out'} = 1;
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
-            _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,localtime);
+            _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime));
             $userid    = undef;
             $sessionID = undef;
         }
@@ -594,7 +722,7 @@ sub checkauth {
             $info{'different_ip'} = 1;
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
-            _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,localtime, $info{'newip'});
+            _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'});
             $sessionID = undef;
             $userid    = undef;
         }
@@ -613,170 +741,182 @@ sub checkauth {
     }
     unless ($userid || $sessionID) {
         #we initiate a session prior to checking for a username to allow for anonymous sessions...
-        my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
+		my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
         my $sessionID = $session->id;
-        C4::Context->_new_userenv($sessionID);
+       	C4::Context->_new_userenv($sessionID);
         $cookie = $query->cookie(CGISESSID => $sessionID);
-        if ( $userid    = $query->param('userid') ) {
-            my $password = $query->param('password');
-            my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password );
-            if ($return) {
-                _session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},localtime);
-                if ( $flags = haspermission($userid, $flagsrequired) ) {
-                    $loggedin = 1;
-                }
-                else {
-                    $info{'nopermission'} = 1;
-                    C4::Context->_unset_userenv($sessionID);
-                }
-
-                my ($borrowernumber, $firstname, $surname, $userflags,
-                    $branchcode, $branchname, $branchprinter, $emailaddress);
-
-                if ( $return == 1 ) {
-                    my $select = "
-                    SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, 
-                            branches.branchname    as branchname, 
-                            branches.branchprinter as branchprinter, 
-                            email 
-                    FROM borrowers 
-                    LEFT JOIN branches on borrowers.branchcode=branches.branchcode
-                    ";
-                    my $sth = $dbh->prepare("$select where userid=?");
-                    $sth->execute($userid);
-                    unless ($sth->rows) {
-                        $debug and print STDERR "AUTH_1: no rows for userid='$userid'\n";
-                        $sth = $dbh->prepare("$select where cardnumber=?");
-                        $sth->execute($cardnumber);
-                        unless ($sth->rows) {
-                            $debug and print STDERR "AUTH_2a: no rows for cardnumber='$cardnumber'\n";
-                            $sth->execute($userid);
-                            unless ($sth->rows) {
-                                $debug and print STDERR "AUTH_2b: no rows for userid='$userid' AS cardnumber\n";
-                            }
-                        }
-                    }
-                    if ($sth->rows) {
-                        ($borrowernumber, $firstname, $surname, $userflags,
-                            $branchcode, $branchname, $branchprinter, $emailaddress) = $sth->fetchrow;
-                        $debug and print STDERR "AUTH_3 results: " .
-                            "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n";
-                    } else {
-                        print STDERR "AUTH_3: no results for userid='$userid', cardnumber='$cardnumber'.\n";
-                    }
+	    $userid    = $query->param('userid');
+    	    if ($cas || $userid) {
+        	my $password = $query->param('password');
+		my ($return, $cardnumber);
+		if ($cas && $query->param('ticket')) {
+		    my $retuserid;
+		    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
+		    $userid = $retuserid;
+		    $info{'invalidCasLogin'} = 1 unless ($return);
+        	} else {
+		    my $retuserid;
+		    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
+		    $userid = $retuserid if ($retuserid ne '');
+		}
+		if ($return) {
+               _session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
+            	if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
+					$loggedin = 1;
+            	}
+           		else {
+                	$info{'nopermission'} = 1;
+                	C4::Context->_unset_userenv($sessionID);
+            	}
+
+				my ($borrowernumber, $firstname, $surname, $userflags,
+					$branchcode, $branchname, $branchprinter, $emailaddress);
+
+            	if ( $return == 1 ) {
+                	my $select = "
+                	SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, 
+                    	    branches.branchname    as branchname, 
+                        	branches.branchprinter as branchprinter, 
+                        	email 
+                	FROM borrowers 
+                	LEFT JOIN branches on borrowers.branchcode=branches.branchcode
+                	";
+                	my $sth = $dbh->prepare("$select where userid=?");
+                	$sth->execute($userid);
+			unless ($sth->rows) {
+		    	    $debug and print STDERR "AUTH_1: no rows for userid='$userid'\n";
+		    	    $sth = $dbh->prepare("$select where cardnumber=?");
+		       	    $sth->execute($cardnumber);
+
+		    	    unless ($sth->rows) {
+				$debug and print STDERR "AUTH_2a: no rows for cardnumber='$cardnumber'\n";
+				$sth->execute($userid);
+				unless ($sth->rows) {
+				    $debug and print STDERR "AUTH_2b: no rows for userid='$userid' AS cardnumber\n";
+				}
+			    }
+			}
+                	if ($sth->rows) {
+			    ($borrowernumber, $firstname, $surname, $userflags,
+                    		$branchcode, $branchname, $branchprinter, $emailaddress) = $sth->fetchrow;
+						$debug and print STDERR "AUTH_3 results: " .
+							"$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n";
+					} else {
+						print STDERR "AUTH_3: no results for userid='$userid', cardnumber='$cardnumber'.\n";
+					}
 
 # launch a sequence to check if we have a ip for the branch, i
 # if we have one we replace the branchcode of the userenv by the branch bound in the ip.
 
-                    my $ip       = $ENV{'REMOTE_ADDR'};
-                    # if they specify at login, use that
-                    if ($query->param('branch')) {
-                        $branchcode  = $query->param('branch');
-                        $branchname = GetBranchName($branchcode);
-                    }
-                    my $branches = GetBranches();
-                    if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){
-                        # we have to check they are coming from the right ip range
-                        my $domain = $branches->{$branchcode}->{'branchip'};
-                        if ($ip !~ /^$domain/){
-                            $loggedin=0;
-                            $info{'wrongip'} = 1;
-                        }
-                    }
-
-                    my @branchesloop;
-                    foreach my $br ( keys %$branches ) {
-                        #     now we work with the treatment of ip
-                        my $domain = $branches->{$br}->{'branchip'};
-                        if ( $domain && $ip =~ /^$domain/ ) {
-                            $branchcode = $branches->{$br}->{'branchcode'};
-
-                            # new op dev : add the branchprinter and branchname in the cookie
-                            $branchprinter = $branches->{$br}->{'branchprinter'};
-                            $branchname    = $branches->{$br}->{'branchname'};
-                        }
-                    }
-                    $session->param('number',$borrowernumber);
-                    $session->param('id',$userid);
-                    $session->param('cardnumber',$cardnumber);
-                    $session->param('firstname',$firstname);
-                    $session->param('surname',$surname);
-                    $session->param('branch',$branchcode);
-                    $session->param('branchname',$branchname);
-                    $session->param('flags',$userflags);
-                    $session->param('emailaddress',$emailaddress);
-                    $session->param('ip',$session->remote_addr());
-                    $session->param('lasttime',time());
-                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
-                }
-                elsif ( $return == 2 ) {
-                    #We suppose the user is the superlibrarian
-                    $borrowernumber = 0;
-                    $session->param('number',0);
-                    $session->param('id',C4::Context->config('user'));
-                    $session->param('cardnumber',C4::Context->config('user'));
-                    $session->param('firstname',C4::Context->config('user'));
-                    $session->param('surname',C4::Context->config('user'));
-                    $session->param('branch','NO_LIBRARY_SET');
-                    $session->param('branchname','NO_LIBRARY_SET');
-                    $session->param('flags',1);
-                    $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
-                    $session->param('ip',$session->remote_addr());
-                    $session->param('lasttime',time());
-                }
-                C4::Context::set_userenv(
-                    $session->param('number'),       $session->param('id'),
-                    $session->param('cardnumber'),   $session->param('firstname'),
-                    $session->param('surname'),      $session->param('branch'),
-                    $session->param('branchname'),   $session->param('flags'),
-                    $session->param('emailaddress'), $session->param('branchprinter')
-                );
-
-                # Grab borrower's shelves and public shelves and add them to the session
-                # $row_count determines how many records are returned from the db query
-                # and the number of lists to be displayed of each type in the 'Lists' button drop down
-                my $row_count = 10; # FIXME:This probably should be a syspref
-                my ($total, $totshelves, $barshelves, $pubshelves);
-                ($barshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(1, $row_count, $borrowernumber);
-                $total->{'bartotal'} = $totshelves;
-                ($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef);
-                $total->{'pubtotal'} = $totshelves;
-                $session->param('barshelves', $barshelves->[0]);
-                $session->param('pubshelves', $pubshelves->[0]);
-                $session->param('totshelves', $total);
-                
-                C4::Context::set_shelves_userenv('bar',$barshelves->[0]);
-                C4::Context::set_shelves_userenv('pub',$pubshelves->[0]);
-                C4::Context::set_shelves_userenv('tot',$total);
-            }
-            else {
-                if ($userid) {
-                    $info{'invalid_username_or_password'} = 1;
-                    C4::Context->_unset_userenv($sessionID);
-                }
-            }
-        }   # END if ( $userid    = $query->param('userid') )
-        elsif ($type eq "opac") {   
+					my $ip       = $ENV{'REMOTE_ADDR'};
+					# if they specify at login, use that
+					if ($query->param('branch')) {
+						$branchcode  = $query->param('branch');
+						$branchname = GetBranchName($branchcode);
+					}
+					my $branches = GetBranches();
+					if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){
+						# we have to check they are coming from the right ip range
+						my $domain = $branches->{$branchcode}->{'branchip'};
+						if ($ip !~ /^$domain/){
+							$loggedin=0;
+							$info{'wrongip'} = 1;
+						}
+					}
+
+					my @branchesloop;
+					foreach my $br ( keys %$branches ) {
+						#     now we work with the treatment of ip
+						my $domain = $branches->{$br}->{'branchip'};
+						if ( $domain && $ip =~ /^$domain/ ) {
+							$branchcode = $branches->{$br}->{'branchcode'};
+
+							# new op dev : add the branchprinter and branchname in the cookie
+							$branchprinter = $branches->{$br}->{'branchprinter'};
+							$branchname    = $branches->{$br}->{'branchname'};
+						}
+					}
+					$session->param('number',$borrowernumber);
+					$session->param('id',$userid);
+					$session->param('cardnumber',$cardnumber);
+					$session->param('firstname',$firstname);
+					$session->param('surname',$surname);
+					$session->param('branch',$branchcode);
+					$session->param('branchname',$branchname);
+					$session->param('flags',$userflags);
+					$session->param('emailaddress',$emailaddress);
+					$session->param('ip',$session->remote_addr());
+					$session->param('lasttime',time());
+					$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
+				}
+				elsif ( $return == 2 ) {
+					#We suppose the user is the superlibrarian
+					$borrowernumber = 0;
+					$session->param('number',0);
+					$session->param('id',C4::Context->config('user'));
+					$session->param('cardnumber',C4::Context->config('user'));
+					$session->param('firstname',C4::Context->config('user'));
+					$session->param('surname',C4::Context->config('user'));
+					$session->param('branch','NO_LIBRARY_SET');
+					$session->param('branchname','NO_LIBRARY_SET');
+					$session->param('flags',1);
+					$session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
+					$session->param('ip',$session->remote_addr());
+					$session->param('lasttime',time());
+				}
+				C4::Context::set_userenv(
+					$session->param('number'),       $session->param('id'),
+					$session->param('cardnumber'),   $session->param('firstname'),
+					$session->param('surname'),      $session->param('branch'),
+					$session->param('branchname'),   $session->param('flags'),
+					$session->param('emailaddress'), $session->param('branchprinter')
+				);
+
+				# Grab borrower's shelves and public shelves and add them to the session
+				# $row_count determines how many records are returned from the db query
+				# and the number of lists to be displayed of each type in the 'Lists' button drop down
+				my $row_count = 10; # FIXME:This probably should be a syspref
+				my ($total, $totshelves, $barshelves, $pubshelves);
+				($barshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(1, $row_count, $borrowernumber);
+				$total->{'bartotal'} = $totshelves;
+				($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef);
+				$total->{'pubtotal'} = $totshelves;
+				$session->param('barshelves', $barshelves);
+				$session->param('pubshelves', $pubshelves);
+				$session->param('totshelves', $total);
+
+				C4::Context::set_shelves_userenv('bar',$barshelves);
+				C4::Context::set_shelves_userenv('pub',$pubshelves);
+				C4::Context::set_shelves_userenv('tot',$total);
+			}
+        	else {
+            	if ($userid) {
+                	$info{'invalid_username_or_password'} = 1;
+                	C4::Context->_unset_userenv($sessionID);
+            	}
+			}
+        }	# END if ( $userid    = $query->param('userid') )
+		elsif ($type eq "opac") {
             # if we are here this is an anonymous session; add public lists to it and a few other items...
             # anonymous sessions are created only for the OPAC
-            $debug and warn "Initiating an anonymous session...";
-
-            # Grab the public shelves and add to the session...
-            my $row_count = 20; # FIXME:This probably should be a syspref
-            my ($total, $totshelves, $pubshelves);
-            ($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef);
-            $total->{'pubtotal'} = $totshelves;
-            $session->param('pubshelves', $pubshelves->[0]);
-            $session->param('totshelves', $total);
-            C4::Context::set_shelves_userenv('pub',$pubshelves->[0]);
-            C4::Context::set_shelves_userenv('tot',$total);
-            
-            # setting a couple of other session vars...
-            $session->param('ip',$session->remote_addr());
-            $session->param('lasttime',time());
-            $session->param('sessiontype','anon');
-        }
-    }   # END unless ($userid)
+			$debug and warn "Initiating an anonymous session...";
+
+			# Grab the public shelves and add to the session...
+			my $row_count = 20; # FIXME:This probably should be a syspref
+			my ($total, $totshelves, $pubshelves);
+			($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef);
+			$total->{'pubtotal'} = $totshelves;
+			$session->param('pubshelves', $pubshelves);
+			$session->param('totshelves', $total);
+			C4::Context::set_shelves_userenv('pub',$pubshelves);
+			C4::Context::set_shelves_userenv('tot',$total);
+
+			# setting a couple of other session vars...
+			$session->param('ip',$session->remote_addr());
+			$session->param('lasttime',time());
+			$session->param('sessiontype','anon');
+		}
+    }	# END unless ($userid)
     my $insecure = C4::Context->boolean_preference('insecure');
 
     # finished authentification, now respond
@@ -794,11 +934,11 @@ sub checkauth {
 # AUTH rejected, show the login/password template, after checking the DB.
 #
 #
-    
+
     # get the inputs from the incoming query
     my @inputs = ();
     foreach my $name ( param $query) {
-        (next) if ( $name eq 'userid' || $name eq 'password' );
+        (next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' );
         my $value = $query->param($name);
         push @inputs, { name => $name, value => $value };
     }
@@ -806,25 +946,36 @@ sub checkauth {
     my $branches = GetBranches();
     my @branch_loop;
     for my $branch_hash (sort keys %$branches) {
-        push @branch_loop, {branchcode => "$branch_hash", branchname => $branches->{$branch_hash}->{'branchname'}, };
+		push @branch_loop, {branchcode => "$branch_hash", branchname => $branches->{$branch_hash}->{'branchname'}, };
     }
 
     my $template_name = ( $type eq 'opac' ) ? 'opac-auth.tmpl' : 'auth.tmpl';
-    my $template = gettemplate( $template_name, $type, $query );
+    my $template = C4::Templates::gettemplate( $template_name, $type, $query );
     $template->param(branchloop => \@branch_loop,);
+    my $checkstyle = C4::Context->preference("opaccolorstylesheet");
+    if ($checkstyle =~ /\//)
+	{
+            	$template->param( opacexternalsheet => $checkstyle);
+	} else
+	{
+		my $opaccolorstylesheet = C4::Context->preference("opaccolorstylesheet");  
+            $template->param( opaccolorstylesheet => $opaccolorstylesheet);
+	}
     $template->param(
     login        => 1,
         INPUTS               => \@inputs,
+        casAuthentication    => C4::Context->preference("casAuthentication"),
         suggestion           => C4::Context->preference("suggestion"),
         virtualshelves       => C4::Context->preference("virtualshelves"),
         LibraryName          => C4::Context->preference("LibraryName"),
         opacuserlogin        => C4::Context->preference("opacuserlogin"),
         OpacNav              => C4::Context->preference("OpacNav"),
+        OpacNavBottom        => C4::Context->preference("OpacNavBottom"),
         opaccredits          => C4::Context->preference("opaccredits"),
+        OpacFavicon          => C4::Context->preference("OpacFavicon"),
         opacreadinghistory   => C4::Context->preference("opacreadinghistory"),
         opacsmallimage       => C4::Context->preference("opacsmallimage"),
         opaclayoutstylesheet => C4::Context->preference("opaclayoutstylesheet"),
-        opaccolorstylesheet  => C4::Context->preference("opaccolorstylesheet"),
         opaclanguagesdisplay => C4::Context->preference("opaclanguagesdisplay"),
         opacuserjs           => C4::Context->preference("opacuserjs"),
         opacbookbag          => "" . C4::Context->preference("opacbookbag"),
@@ -835,25 +986,51 @@ sub checkauth {
         opacheader           => C4::Context->preference("opacheader"),
         TagsEnabled                  => C4::Context->preference("TagsEnabled"),
         OPACUserCSS           => C4::Context->preference("OPACUserCSS"),
+        opacstylesheet       => C4::Context->preference("opacstylesheet"),
         intranetcolorstylesheet =>
-                                C4::Context->preference("intranetcolorstylesheet"),
+								C4::Context->preference("intranetcolorstylesheet"),
         intranetstylesheet => C4::Context->preference("intranetstylesheet"),
+        intranetbookbag    => C4::Context->preference("intranetbookbag"),
         IntranetNav        => C4::Context->preference("IntranetNav"),
         intranetuserjs     => C4::Context->preference("intranetuserjs"),
-        TemplateEncoding   => C4::Context->preference("TemplateEncoding"),
         IndependantBranches=> C4::Context->preference("IndependantBranches"),
         AutoLocation       => C4::Context->preference("AutoLocation"),
-        wrongip            => $info{'wrongip'}
+		wrongip            => $info{'wrongip'},
     );
-    
+
+    $template->param( OpacPublic => C4::Context->preference("OpacPublic"));
     $template->param( loginprompt => 1 ) unless $info{'nopermission'};
 
+    if ($cas) {
+
+	# Is authentication against multiple CAS servers enabled?
+        if (C4::Auth_with_cas::multipleAuth && !$casparam) {
+	    my $casservers = C4::Auth_with_cas::getMultipleAuth();		    
+	    my @tmplservers;
+	    foreach my $key (keys %$casservers) {
+		push @tmplservers, {name => $key, value => login_cas_url($query, $key) . "?cas=$key" };
+	    }
+	    #warn Data::Dumper::Dumper(\@tmplservers);
+	    $template->param(
+		casServersLoop => \@tmplservers
+	    );
+	} else {
+        $template->param(
+            casServerUrl    => login_cas_url($query),
+	    );
+	}
+
+	$template->param(
+            invalidCasLogin => $info{'invalidCasLogin'}
+        );
+    }
+
     my $self_url = $query->url( -absolute => 1 );
     $template->param(
         url         => $self_url,
         LibraryName => C4::Context->preference("LibraryName"),
     );
-    $template->param( \%info );
+    $template->param( %info );
 #    $cookie = $query->cookie(CGISESSID => $session->id
 #   );
     print $query->header(
@@ -862,10 +1039,10 @@ sub checkauth {
         -cookie => $cookie
       ),
       $template->output;
-    exit;
+    safe_exit;
 }
 
-=item check_api_auth
+=head2 check_api_auth
 
   ($status, $cookie, $sessionId) = check_api_auth($query, $userflags);
 
@@ -885,7 +1062,7 @@ are OK.
 
 Possible return values in C<$status> are:
 
-=over 4
+=over
 
 =item "ok" -- user authenticated; C<$cookie> and C<$sessionid> have valid values.
 
@@ -935,7 +1112,7 @@ sub check_api_auth {
     unless ($query->param('userid')) {
         $sessionID = $query->cookie("CGISESSID");
     }
-    if ($sessionID) {
+    if ($sessionID && not $cas) {
         my $session = get_session($sessionID);
         C4::Context->_new_userenv($sessionID);
         if ($session) {
@@ -983,14 +1160,27 @@ sub check_api_auth {
         }
     } else {
         # new login
-        my $userid = $query->param('userid');   
-        my $password = $query->param('password');   
-        unless ($userid and $password) {
-            # caller did something wrong, fail the authenticateion
-            return ("failed", undef, undef);
-        }
-        my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password );
-        if ($return and haspermission($userid, $flagsrequired)) {
+        my $userid = $query->param('userid');
+        my $password = $query->param('password');
+       	my ($return, $cardnumber);
+
+	# Proxy CAS auth
+	if ($cas && $query->param('PT')) {
+	    my $retuserid;
+	    $debug and print STDERR "## check_api_auth - checking CAS\n";
+	    # In case of a CAS authentication, we use the ticket instead of the password
+	    my $PT = $query->param('PT');
+	    ($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query);    # EXTERNAL AUTH
+	} else {
+	    # User / password auth
+	    unless ($userid and $password) {
+		# caller did something wrong, fail the authenticateion
+		return ("failed", undef, undef);
+	    }
+	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
+	}
+
+        if ($return and haspermission(  $userid, $flagsrequired)) {
             my $session = get_session("");
             return ("failed", undef, undef) unless $session;
 
@@ -1077,7 +1267,7 @@ sub check_api_auth {
                 $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
                 $session->param('ip',$session->remote_addr());
                 $session->param('lasttime',time());
-            } 
+            }
             C4::Context::set_userenv(
                 $session->param('number'),       $session->param('id'),
                 $session->param('cardnumber'),   $session->param('firstname'),
@@ -1089,10 +1279,10 @@ sub check_api_auth {
         } else {
             return ("failed", undef, undef);
         }
-    } 
+    }
 }
 
-=item check_cookie_auth
+=head2 check_cookie_auth
 
   ($status, $sessionId) = check_api_auth($cookie, $userflags);
 
@@ -1105,7 +1295,7 @@ have been authenticated in the usual way.
 
 Possible return values in C<$status> are:
 
-=over 4
+=over
 
 =item "ok" -- user authenticated; C<$sessionID> have valid values.
 
@@ -1201,13 +1391,13 @@ sub check_cookie_auth {
     }
 }
 
-=item get_session
+=head2 get_session
 
   use CGI::Session;
   my $session = get_session($sessionID);
 
 Given a session ID, retrieve the CGI::Session object used to store
-the session's state.  The session object can be used to store 
+the session's state.  The session object can be used to store
 data that needs to be accessed by different scripts during a
 user's session.
 
@@ -1227,6 +1417,9 @@ sub get_session {
     elsif ($storage_method eq 'Pg') {
         $session = new CGI::Session("driver:PostgreSQL;serializer:yaml;id:md5", $sessionID, {Handle=>$dbh});
     }
+    elsif ($storage_method eq 'memcached' && $servers){
+	$session = new CGI::Session("driver:memcached;serializer:yaml;id:md5", $sessionID, { Memcached => $memcached } );
+    }
     else {
         # catch all defaults to tmp should work on all systems
         $session = new CGI::Session("driver:File;serializer:yaml;id:md5", $sessionID, {Directory=>'/tmp'});
@@ -1236,11 +1429,20 @@ sub get_session {
 
 sub checkpw {
 
-    my ( $dbh, $userid, $password ) = @_;
+    my ( $dbh, $userid, $password, $query ) = @_;
     if ($ldap) {
-        $debug and print STDERR "## checkpw - checking LDAP\n";
-        my ($retval,$retcard) = checkpw_ldap(@_);    # EXTERNAL AUTH
-        ($retval) and return ($retval,$retcard);
+        $debug and print "## checkpw - checking LDAP\n";
+        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
+        ($retval) and return ($retval,$retcard,$retuserid);
+    }
+
+    if ($cas && $query && $query->param('ticket')) {
+        $debug and print STDERR "## checkpw - checking CAS\n";
+	# In case of a CAS authentication, we use the ticket instead of the password
+	my $ticket = $query->param('ticket');
+        my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query);    # EXTERNAL AUTH
+        ($retval) and return ($retval,$retcard,$retuserid);
+	return 0;
     }
 
     # INTERNAL AUTH
@@ -1253,11 +1455,11 @@ sub checkpw {
         my ( $md5password, $cardnumber, $borrowernumber, $userid, $firstname,
             $surname, $branchcode, $flags )
           = $sth->fetchrow;
-        if ( md5_base64($password) eq $md5password ) {
+        if ( md5_base64($password) eq $md5password and $md5password ne "!") {
 
             C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
                 $firstname, $surname, $branchcode, $flags );
-            return 1, $cardnumber;
+            return 1, $cardnumber, $userid;
         }
     }
     $sth =
@@ -1273,7 +1475,7 @@ sub checkpw {
 
             C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber,
                 $firstname, $surname, $branchcode, $flags );
-            return 1, $userid;
+            return 1, $cardnumber, $userid;
         }
     }
     if (   $userid && $userid eq C4::Context->config('user')
@@ -1296,7 +1498,7 @@ sub checkpw {
     return 0;
 }
 
-=item getuserflags
+=head2 getuserflags
 
     my $authflags = getuserflags($flags, $userid, [$dbh]);
 
@@ -1336,24 +1538,20 @@ sub getuserflags {
     return $userflags;
 }
 
-=item get_user_subpermissions 
+=head2 get_user_subpermissions
 
-=over 4
-
-my $user_perm_hashref = get_user_subpermissions($userid);
-
-=back
+  $user_perm_hashref = get_user_subpermissions($userid);
 
 Given the userid (note, not the borrowernumber) of a staff user,
-return a hashref of hashrefs of the specific subpermissions 
+return a hashref of hashrefs of the specific subpermissions
 accorded to the user.  An example return is
 
-{ 
+ {
     tools => {
         export_catalog => 1,
         import_patrons => 1,
     }
-}
+ }
 
 The top-level hash-key is a module or function code from
 userflags.flag, while the second-level key is a code
@@ -1384,13 +1582,9 @@ sub get_user_subpermissions {
     return $user_perms;
 }
 
-=item get_all_subpermissions
+=head2 get_all_subpermissions
 
-=over 4
-
-my $perm_hashref = get_all_subpermissions();
-
-=back
+  my $perm_hashref = get_all_subpermissions();
 
 Returns a hashref of hashrefs defining all specific
 permissions currently defined.  The return value
@@ -1414,7 +1608,7 @@ sub get_all_subpermissions {
     return $all_perms;
 }
 
-=item haspermission 
+=head2 haspermission
 
   $flags = ($userid, $flagsrequired);
 
@@ -1429,7 +1623,7 @@ sub haspermission {
     my ($userid, $flagsrequired) = @_;
     my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
     $sth->execute($userid);
-    my $flags = getuserflags( $sth->fetchrow(), $userid );
+    my $flags = getuserflags($sth->fetchrow(), $userid);
     if ( $userid eq C4::Context->config('user') ) {
         # Super User Account from /etc/koha.conf
         $flags->{'superlibrarian'} = 1;
@@ -1438,22 +1632,20 @@ sub haspermission {
         # Demo user that can do "anything" (demo=1 in /etc/koha.conf)
         $flags->{'superlibrarian'} = 1;
     }
+
     return $flags if $flags->{superlibrarian};
+
     foreach my $module ( keys %$flagsrequired ) {
-        if (C4::Context->preference('GranularPermissions')) {
-            my $subperm = $flagsrequired->{$module};
-            if ($subperm eq '*') {
-                return 0 unless ( $flags->{$module} == 1 or ref($flags->{$module}) );
-            } else {
-                return 0 unless ( $flags->{$module} == 1 or
-                                    ( ref($flags->{$module}) and 
-                                      exists $flags->{$module}->{$subperm} and 
-                                      $flags->{$module}->{$subperm} == 1 
-                                    ) 
-                                );
-            }
+        my $subperm = $flagsrequired->{$module};
+        if ($subperm eq '*') {
+            return 0 unless ( $flags->{$module} == 1 or ref($flags->{$module}) );
         } else {
-            return 0 unless ( $flags->{$module} );
+            return 0 unless ( $flags->{$module} == 1 or
+                                ( ref($flags->{$module}) and
+                                  exists $flags->{$module}->{$subperm} and
+                                  $flags->{$module}->{$subperm} == 1
+                                )
+                            );
         }
     }
     return $flags;
@@ -1463,6 +1655,10 @@ sub haspermission {
 
 sub getborrowernumber {
     my ($userid) = @_;
+    my $userenv = C4::Context->userenv;
+    if ( defined( $userenv ) && ref( $userenv ) eq 'HASH' && $userenv->{number} ) {
+        return $userenv->{number};
+    }
     my $dbh = C4::Context->dbh;
     for my $field ( 'userid', 'cardnumber' ) {
         my $sth =
@@ -1480,8 +1676,6 @@ END { }    # module clean-up code here (global destructor)
 1;
 __END__
 
-=back
-
 =head1 SEE ALSO
 
 CGI(3)