X-Git-Url: http://koha-dev.rot13.org:8081/gitweb/?a=blobdiff_plain;f=C4%2FAuth.pm;h=e156474ba874b79ce61917c5235357deb97b6091;hb=ff4d456072fecb4045928015d57c1594b911ef96;hp=74106c33c3f93dd11d5d4c51044bde30877bdc08;hpb=c80b328aaeec50a765c6a127e422ac41ceca629a;p=koha_gimpoz

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 74106c33c3..e156474ba8 100755
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1,7 +1,3 @@
-
-# -*- tab-width: 8 -*-
-# NOTE: This file uses 8-character tabs; do not change the tab size!
-
 package C4::Auth;
 
 # Copyright 2000-2002 Katipo Communications
@@ -23,6 +19,8 @@ package C4::Auth;
 
 use strict;
 use Digest::MD5 qw(md5_base64);
+use Storable qw(thaw freeze);
+use URI::Escape;
 use CGI::Session;
 
 require Exporter;
@@ -31,23 +29,31 @@ use C4::Output;    # to get the template
 use C4::Members;
 use C4::Koha;
 use C4::Branch; # GetBranches
-use C4::VirtualShelves 3.02 qw(GetShelvesSummary);
+use C4::VirtualShelves;
+use POSIX qw/strftime/;
 
 # use utf8;
-use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap);
+use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);
 
 BEGIN {
     $VERSION = 3.02;        # set version for version checking
-    $debug = $ENV{DEBUG} || 0 ;
+    $debug = $ENV{DEBUG};
     @ISA   = qw(Exporter);
-    @EXPORT    = qw(&checkauth &get_template_and_user);
+    @EXPORT    = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
     @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions);
     %EXPORT_TAGS = (EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)]);
     $ldap = C4::Context->config('useldapserver') || 0;
+    $cas = C4::Context->preference('casAuthentication');
+    $caslogout = C4::Context->preference('casLogout');
     if ($ldap) {
         require C4::Auth_with_ldap;             # no import
         import  C4::Auth_with_ldap qw(checkpw_ldap);
     }
+    if ($cas) {
+        require C4::Auth_with_cas;             # no import
+        import  C4::Auth_with_cas qw(checkpw_cas login_cas logout_cas login_cas_url);
+    }
+
 }
 
 =head1 NAME
@@ -62,7 +68,7 @@ C4::Auth - Authenticates Koha users
 
   my $query = new CGI;
 
-  my ($template, $borrowernumber, $cookie) 
+  my ($template, $borrowernumber, $cookie)
     = get_template_and_user(
         {
             template_name   => "opac-main.tmpl",
@@ -145,26 +151,31 @@ sub get_template_and_user {
         $template->param( loggedinusername => $user );
         $template->param( sessionID        => $sessionID );
 
-		my ($pubshelves, $barshelves) = C4::Context->get_shelves_userenv();
+		my ($total, $pubshelves, $barshelves) = C4::Context->get_shelves_userenv();
 		if (defined($pubshelves)) {
-        	$template->param( pubshelves     => scalar (@$pubshelves));
-        	$template->param( pubshelvesloop => $pubshelves);
+        	$template->param( 	pubshelves     	=> scalar (@$pubshelves),
+        						pubshelvesloop 	=> $pubshelves,
+							);
+			$template->param(	pubtotal		=> $total->{'pubtotal'}, ) if ($total->{'pubtotal'} > scalar (@$pubshelves));
 		}
 		if (defined($barshelves)) {
-        	$template->param( barshelves     => scalar (@$barshelves));
-        	$template->param( barshelvesloop => $barshelves);
+        	$template->param(	barshelves     	=> scalar (@$barshelves),
+        						barshelvesloop 	=> $barshelves,
+							);
+			$template->param(	bartotal		=> $total->{'bartotal'}, ) if ($total->{'bartotal'} > scalar (@$barshelves));
 		}
 
-        $borrowernumber = getborrowernumber($user);
+        $borrowernumber = getborrowernumber($user) if defined($user);
+
         my ( $borr ) = GetMemberDetails( $borrowernumber );
         my @bordat;
         $bordat[0] = $borr;
         $template->param( "USER_INFO" => \@bordat );
-        
+
         my $all_perms = get_all_subpermissions();
 
         my @flagroots = qw(circulate catalogue parameters borrowers permissions reserveforothers borrow
-                            editcatalogue updatecharges management tools editauthorities serials reports);
+                            editcatalogue updatecharges management tools editauthorities serials reports acquisition);
         # We are going to use the $flags returned by checkauth
         # to create the template's parameters that will indicate
         # which menus the user can access.
@@ -180,7 +191,7 @@ sub get_template_and_user {
             $template->param( CAN_user_updatecharges     => 1 );
             $template->param( CAN_user_acquisition      => 1 );
             $template->param( CAN_user_management       => 1 );
-            $template->param( CAN_user_tools            => 1 ); 
+            $template->param( CAN_user_tools            => 1 );
             $template->param( CAN_user_editauthorities  => 1 );
             $template->param( CAN_user_serials          => 1 );
             $template->param( CAN_user_reports          => 1 );
@@ -224,6 +235,58 @@ sub get_template_and_user {
                 }
             }
         }
+		# Logged-in opac search history
+		# If the requested template is an opac one and opac search history is enabled
+		if ($in->{'type'} == "opac" && C4::Context->preference('EnableOpacSearchHistory')) {
+			my $dbh = C4::Context->dbh;
+			my $query = "SELECT COUNT(*) FROM search_history WHERE userid=?";
+			my $sth = $dbh->prepare($query);
+			$sth->execute($borrowernumber);
+			
+			# If at least one search has already been performed
+			if ($sth->fetchrow_array > 0) { 
+			# We show the link in opac
+			$template->param(ShowOpacRecentSearchLink => 1);
+			}
+
+			# And if there's a cookie with searches performed when the user was not logged in, 
+			# we add them to the logged-in search history
+			my @recentSearches;
+			my $searchcookie = $in->{'query'}->cookie('KohaOpacRecentSearches');
+			if ($searchcookie){
+				$searchcookie = uri_unescape($searchcookie);
+				if (thaw($searchcookie)) {
+					@recentSearches = @{thaw($searchcookie)};
+				}
+
+				if (@recentSearches > 0) {
+					my $query = "INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, total, time) VALUES";
+					my $icount = 1;
+					foreach my $asearch (@recentSearches) {
+						$query .= "(";
+						$query .= $borrowernumber . ", ";
+						$query .= '"' . $in->{'query'}->cookie("CGISESSID") . "\", ";
+						$query .= '"' . $asearch->{'query_desc'} . "\", ";
+						$query .= '"' . $asearch->{'query_cgi'} . "\", ";
+						$query .=       $asearch->{'total'} . ", ";
+						$query .= 'FROM_UNIXTIME(' . $asearch->{'time'} . "))";
+						if ($icount < @recentSearches) { $query .= ", ";}
+						$icount++;
+					}
+
+					my $sth = $dbh->prepare($query);
+					$sth->execute;
+
+					# And then, delete the cookie's content
+					my $newsearchcookie = $in->{'query'}->cookie(
+												-name => 'KohaOpacRecentSearches',
+												-value => freeze([]),
+												-expires => ''
+											 );
+					$cookie = [$cookie, $newsearchcookie];
+				}
+			}
+		}
     }
 	else {	# if this is an anonymous session, setup to display public lists...
 
@@ -239,14 +302,39 @@ sub get_template_and_user {
         $template->param( js_widgets => $in->{'js_widgets'} );
 
         $template->param( sessionID        => $sessionID );
-		
-		my ($pubshelves) = C4::Context->get_shelves_userenv();	# an anonymous user has no 'barshelves'...
-		if (defined(($pubshelves))) {
-        	$template->param( pubshelves     => scalar (@$pubshelves));
-        	$template->param( pubshelvesloop => $pubshelves);
-		}
+        
+        my ($total, $pubshelves) = C4::Context->get_shelves_userenv();  # an anonymous user has no 'barshelves'...
+        if (defined(($pubshelves))) {
+            $template->param(   pubshelves      => scalar (@$pubshelves),
+                                pubshelvesloop  => $pubshelves,
+                            );
+            $template->param(   pubtotal        => $total->{'pubtotal'}, ) if ($total->{'pubtotal'} > scalar (@$pubshelves));
+        }
 
-	}
+    }
+ 	# Anonymous opac search history
+ 	# If opac search history is enabled and at least one search has already been performed
+ 	if (C4::Context->preference('EnableOpacSearchHistory') && $in->{'query'}->cookie('KohaOpacRecentSearches')) {
+ 	    # We show the link in opac
+ 	    if (thaw(uri_unescape($in->{'query'}->cookie('KohaOpacRecentSearches')))) {
+			my @recentSearches = @{thaw(uri_unescape($in->{'query'}->cookie('KohaOpacRecentSearches')))};
+			if (@recentSearches > 0) {
+				$template->param(ShowOpacRecentSearchLink => 1);
+			}
+	    }
+ 	}
+
+    if(C4::Context->preference('dateformat')){
+        if(C4::Context->preference('dateformat') eq "metric"){
+            $template->param(dateformat_metric => 1);
+        } elsif(C4::Context->preference('dateformat') eq "us"){
+            $template->param(dateformat_us => 1);
+        } else {
+            $template->param(dateformat_iso => 1);
+        }
+    } else {
+        $template->param(dateformat_iso => 1);
+    }
 
     # these template parameters are set the same regardless of $in->{'type'}
     $template->param(
@@ -262,7 +350,10 @@ sub get_template_and_user {
             'item-level_itypes'          => C4::Context->preference('item-level_itypes'),
             patronimages                 => C4::Context->preference("patronimages"),
             singleBranchMode             => C4::Context->preference("singleBranchMode"),
-                 );
+            OPACXSLTDetailsDisplay       => C4::Context->preference("XSLTDetailsDisplay"),
+            OPACXSLTResultsDisplay       => C4::Context->preference("XSLTResultsDisplay"),
+            BranchesLoop                 => GetBranchesLoop(),
+    );
 
     if ( $in->{'type'} eq "intranet" ) {
         $template->param(
@@ -284,16 +375,30 @@ sub get_template_and_user {
             intranetreadinghistory      => C4::Context->preference("intranetreadinghistory"),
             intranetstylesheet          => C4::Context->preference("intranetstylesheet"),
             intranetuserjs              => C4::Context->preference("intranetuserjs"),
+            intranetbookbag             => C4::Context->preference("intranetbookbag"),
             noItemTypeImages            => C4::Context->preference("noItemTypeImages"),
             suggestion                  => C4::Context->preference("suggestion"),
             virtualshelves              => C4::Context->preference("virtualshelves"),
+            StaffSerialIssueDisplayCount => C4::Context->preference("StaffSerialIssueDisplayCount"),
+            NoZebra                     => C4::Context->preference('NoZebra'),
         );
     }
     else {
         warn "template type should be OPAC, here it is=[" . $in->{'type'} . "]" unless ( $in->{'type'} eq 'opac' );
+        #TODO : replace LibraryName syspref with 'system name', and remove this html processing
         my $LibraryNameTitle = C4::Context->preference("LibraryName");
         $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi;
         $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg;
+        # variables passed from CGI: opac_css_override and opac_search_limits.
+        my $opac_search_limit = $ENV{'OPAC_SEARCH_LIMIT'};
+        my $opac_limit_override = $ENV{'OPAC_LIMIT_OVERRIDE'};
+        my $mylibraryfirst = C4::Context->preference("SearchMyLibraryFirst");
+        my $opac_name;
+        if($opac_limit_override && ($opac_search_limit =~ /branch:(\w+)/) ){
+             $opac_name = C4::Branch::GetBranchName($1)   # opac_search_limit is a branch, so we use it.
+        } elsif($mylibraryfirst){
+            $opac_name = C4::Branch::GetBranchName($mylibraryfirst);
+        }
         $template->param(
             AmazonContent             => "" . C4::Context->preference("AmazonContent"),
             AnonSuggestions           => "" . C4::Context->preference("AnonSuggestions"),
@@ -301,36 +406,44 @@ sub get_template_and_user {
             LibraryName               => "" . C4::Context->preference("LibraryName"),
             LibraryNameTitle          => "" . $LibraryNameTitle,
             LoginBranchname           => C4::Context->userenv?C4::Context->userenv->{"branchname"}:"",
-            OPACAmazonSimilarItems    => "" . C4::Context->preference("OPACAmazonSimilarItems"),
+            OPACAmazonEnabled         => C4::Context->preference("OPACAmazonEnabled"),
+            OPACAmazonSimilarItems    => C4::Context->preference("OPACAmazonSimilarItems"),
+            OPACAmazonCoverImages     => C4::Context->preference("OPACAmazonCoverImages"),
+            OPACAmazonReviews         => C4::Context->preference("OPACAmazonReviews"),
             OPACFRBRizeEditions       => C4::Context->preference("OPACFRBRizeEditions"),
+            OpacHighlightedWords       => C4::Context->preference("OpacHighlightedWords"),
             OPACItemHolds             => C4::Context->preference("OPACItemHolds"),
             OPACShelfBrowser          => "". C4::Context->preference("OPACShelfBrowser"),
             OPACURLOpenInNewWindow    => "" . C4::Context->preference("OPACURLOpenInNewWindow"),
             OPACUserCSS               => "". C4::Context->preference("OPACUserCSS"),
             OPACViewOthersSuggestions => "" . C4::Context->preference("OPACViewOthersSuggestions"),
             OpacAuthorities           => C4::Context->preference("OpacAuthorities"),
-            OPACBaseURL               => ($in->{'query'}->https() ? "https://" : "http://") .
-                   $ENV{'SERVER_NAME'} .
+            OPACBaseURL               => ($in->{'query'}->https() ? "https://" : "http://") . $ENV{'SERVER_NAME'} .
                    ($ENV{'SERVER_PORT'} eq ($in->{'query'}->https() ? "443" : "80") ? '' : ":$ENV{'SERVER_PORT'}"),
+            opac_name             => $opac_name,
+            opac_css_override           => $ENV{'OPAC_CSS_OVERRIDE'},
+            opac_search_limit         => $opac_search_limit,
+            opac_limit_override       => $opac_limit_override,
             OpacBrowser               => C4::Context->preference("OpacBrowser"),
             OpacCloud                 => C4::Context->preference("OpacCloud"),
             OpacMainUserBlock         => "" . C4::Context->preference("OpacMainUserBlock"),
             OpacNav                   => "" . C4::Context->preference("OpacNav"),
             OpacPasswordChange        => C4::Context->preference("OpacPasswordChange"),
+            OPACPatronDetails        => C4::Context->preference("OPACPatronDetails"),
+            OPACFinesTab              => C4::Context->preference("OPACFinesTab"),
             OpacTopissue              => C4::Context->preference("OpacTopissue"),
             RequestOnOpac             => C4::Context->preference("RequestOnOpac"),
             TemplateEncoding          => "". C4::Context->preference("TemplateEncoding"),
             'Version'                 => C4::Context->preference('Version'),
-            XSLTDetailsDisplay        => C4::Context->preference("XSLTDetailsDisplay"),
-            XSLTResultsDisplay        => C4::Context->preference("XSLTResultsDisplay"),
             hidelostitems             => C4::Context->preference("hidelostitems"),
-            mylibraryfirst            => C4::Context->preference("SearchMyLibraryFirst"),
+            mylibraryfirst            => (C4::Context->preference("SearchMyLibraryFirst") && C4::Context->userenv) ? C4::Context->userenv->{'branch'} : '',
+            opaclayoutstylesheet      => "" . C4::Context->preference("opaclayoutstylesheet"),
+            opaccolorstylesheet       => "" . C4::Context->preference("opaccolorstylesheet"),
+            opacstylesheet            => "" . C4::Context->preference("opacstylesheet"),
             opacbookbag               => "" . C4::Context->preference("opacbookbag"),
-            opaccolorstylesheet       => "". C4::Context->preference("opaccolorstylesheet"),
             opaccredits               => "" . C4::Context->preference("opaccredits"),
             opacheader                => "" . C4::Context->preference("opacheader"),
-            opaclanguagesdisplay      => "". C4::Context->preference("opaclanguagesdisplay"),
-            opaclayoutstylesheet      => "". C4::Context->preference("opaclayoutstylesheet"),
+            opaclanguagesdisplay      => "" . C4::Context->preference("opaclanguagesdisplay"),
             opacreadinghistory        => C4::Context->preference("opacreadinghistory"),
             opacsmallimage            => "" . C4::Context->preference("opacsmallimage"),
             opacuserjs                => C4::Context->preference("opacuserjs"),
@@ -338,6 +451,8 @@ sub get_template_and_user {
             reviewson                 => C4::Context->preference("reviewson"),
             suggestion                => "" . C4::Context->preference("suggestion"),
             virtualshelves            => "" . C4::Context->preference("virtualshelves"),
+            OPACSerialIssueDisplayCount => C4::Context->preference("OPACSerialIssueDisplayCount"),
+            OpacAddMastheadLibraryPulldown => C4::Context->preference("OpacAddMastheadLibraryPulldown"),
         );
     }
 	$template->param(listloop=>[{shelfname=>"Freelist", shelfnumber=>110}]);
@@ -412,7 +527,7 @@ user has authenticated, C<&checkauth> restarts the original script
 
 The login page is provided using a HTML::Template, which is set in the
 systempreferences table or at the top of this file. The variable C<$type>
-selects which template to use, either the opac or the intranet 
+selects which template to use, either the opac or the intranet
 authentification template.
 
 C<&checkauth> returns a user ID, a cookie, and a session ID. The
@@ -427,12 +542,16 @@ sub _version_check ($$) {
     my $version;
     # If Version syspref is unavailable, it means Koha is beeing installed,
     # and so we must redirect to OPAC maintenance page or to the WebInstaller
-    #warn "about to check version";
+	# also, if OpacMaintenance is ON, OPAC should redirect to maintenance
+	if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') {
+		warn "OPAC Install required, redirecting to maintenance";
+		print $query->redirect("/cgi-bin/koha/maintenance.pl");
+	}
     unless ($version = C4::Context->preference('Version')) {    # assignment, not comparison
       if ($type ne 'opac') {
         warn "Install required, redirecting to Installer";
         print $query->redirect("/cgi-bin/koha/installer/install.pl");
-      } 
+      }
       else {
         warn "OPAC Install required, redirecting to maintenance";
         print $query->redirect("/cgi-bin/koha/maintenance.pl");
@@ -456,7 +575,7 @@ sub _version_check ($$) {
         } else {
             warn sprintf("OPAC: " . $warning, 'maintenance');
             print $query->redirect("/cgi-bin/koha/maintenance.pl");
-        }       
+        }
         exit;
     }
 }
@@ -501,7 +620,7 @@ sub checkauth {
         );
         $loggedin = 1;
     }
-    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison 
+    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison
         my $session = get_session($sessionID);
         C4::Context->_new_userenv($sessionID);
         my ($ip, $lasttime, $sessiontype);
@@ -515,17 +634,17 @@ sub checkauth {
             );
             C4::Context::set_shelves_userenv('bar',$session->param('barshelves'));
             C4::Context::set_shelves_userenv('pub',$session->param('pubshelves'));
+            C4::Context::set_shelves_userenv('tot',$session->param('totshelves'));
             $debug and printf STDERR "AUTH_SESSION: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
             $ip       = $session->param('ip');
             $lasttime = $session->param('lasttime');
             $userid   = $session->param('id');
 			$sessiontype = $session->param('sessiontype');
         }
-   
-   		if ( ($query->param('koha_login_context')) && ($query->param('userid') ne $session->param('id')) ) {
-			#if a user enters an id ne to the id in the current session, we need to log them in...
-			#first we need to clear the anonymous session...
-			$debug and warn "query id = " . $query->param('userid') . " but session id = " . $session->param('id');
+        if ( ($query->param('koha_login_context')) && ($query->param('userid') ne $session->param('id')) ) {
+            #if a user enters an id ne to the id in the current session, we need to log them in...
+            #first we need to clear the anonymous session...
+            $debug and warn "query id = " . $query->param('userid') . " but session id = " . $session->param('id');
             $session->flush;      
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
@@ -534,45 +653,49 @@ sub checkauth {
 		}
         elsif ($logout) {
             # voluntary logout the user
-            $session->flush;      
+            $session->flush;
             $session->delete();
             C4::Context->_unset_userenv($sessionID);
-            _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,localtime);
+            _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime));
             $sessionID = undef;
             $userid    = undef;
+
+	    if ($cas and $caslogout) {
+		logout_cas($query);
+	    }
+        }
+        elsif ( $lasttime < time() - $timeout ) {
+            # timed logout
+            $info{'timed_out'} = 1;
+            $session->delete();
+            C4::Context->_unset_userenv($sessionID);
+            _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime));
+            $userid    = undef;
+            $sessionID = undef;
+        }
+        elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
+            # Different ip than originally logged in from
+            $info{'oldip'}        = $ip;
+            $info{'newip'}        = $ENV{'REMOTE_ADDR'};
+            $info{'different_ip'} = 1;
+            $session->delete();
+            C4::Context->_unset_userenv($sessionID);
+            _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'});
+            $sessionID = undef;
+            $userid    = undef;
+        }
+        else {
+            $cookie = $query->cookie( CGISESSID => $session->id );
+            $session->param('lasttime',time());
+            unless ( $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
+                $flags = haspermission($userid, $flagsrequired);
+                if ($flags) {
+                    $loggedin = 1;
+                } else {
+                    $info{'nopermission'} = 1;
+                }
+            }
         }
-		elsif ( $lasttime < time() - $timeout ) {
-			# timed logout
-			$info{'timed_out'} = 1;
-			$session->delete();
-			C4::Context->_unset_userenv($sessionID);
-			_session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,localtime);
-			$userid    = undef;
-			$sessionID = undef;
-		}
-		elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) {
-			# Different ip than originally logged in from
-			$info{'oldip'}        = $ip;
-			$info{'newip'}        = $ENV{'REMOTE_ADDR'};
-			$info{'different_ip'} = 1;
-			$session->delete();
-			C4::Context->_unset_userenv($sessionID);
-			_session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,localtime, $info{'newip'});
-			$sessionID = undef;
-			$userid    = undef;
-		}
-		else {
-			$cookie = $query->cookie( CGISESSID => $session->id );
-			$session->param('lasttime',time());
-			unless ( $sessiontype eq 'anon' ) {	#if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
-				$flags = haspermission( $dbh, $userid, $flagsrequired );
-				if ($flags) {
-					$loggedin = 1;
-				} else {
-					$info{'nopermission'} = 1;
-				}
-			}
-		}
     }
     unless ($userid || $sessionID) {
         #we initiate a session prior to checking for a username to allow for anonymous sessions...
@@ -580,12 +703,21 @@ sub checkauth {
         my $sessionID = $session->id;
        	C4::Context->_new_userenv($sessionID);
         $cookie = $query->cookie(CGISESSID => $sessionID);
-		if ( $userid    = $query->param('userid') ) {
+	    $userid    = $query->param('userid');
+    	    if ($cas || $userid) {
         	my $password = $query->param('password');
-        	my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password );
-        	if ($return) {
+		my ($return, $cardnumber);
+		if ($cas && $query->param('ticket')) {
+		    my $retuserid;
+		    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
+		    $userid = $retuserid;
+		    $info{'invalidCasLogin'} = 1 unless ($return);
+        	} else {
+		    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
+		}
+		if ($return) {
             	_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},localtime);
-            	if ( $flags = haspermission( $dbh, $userid, $flagsrequired ) ) {
+            	if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
 					$loggedin = 1;
             	}
            		else {
@@ -695,15 +827,22 @@ sub checkauth {
 					$session->param('emailaddress'), $session->param('branchprinter')
 				);
 
-				# Grab borrower's shelves and add to the session...
-				$barshelves = GetShelvesSummary($borrowernumber,2,10);
-				$session->param('barshelves', $barshelves);
-				C4::Context::set_shelves_userenv('bar',$barshelves);
-
-				# Grab the public shelves and add to the session...
-				$pubshelves = GetShelvesSummary(0,2,10);
-				$session->param('pubshelves', $pubshelves);
-				C4::Context::set_shelves_userenv('pub',$pubshelves);
+				# Grab borrower's shelves and public shelves and add them to the session
+				# $row_count determines how many records are returned from the db query
+				# and the number of lists to be displayed of each type in the 'Lists' button drop down
+				my $row_count = 10; # FIXME:This probably should be a syspref
+				my ($total, $totshelves, $barshelves, $pubshelves);
+				($barshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(1, $row_count, $borrowernumber);
+				$total->{'bartotal'} = $totshelves;
+				($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef);
+				$total->{'pubtotal'} = $totshelves;
+				$session->param('barshelves', $barshelves->[0]);
+				$session->param('pubshelves', $pubshelves->[0]);
+				$session->param('totshelves', $total);
+
+				C4::Context::set_shelves_userenv('bar',$barshelves->[0]);
+				C4::Context::set_shelves_userenv('pub',$pubshelves->[0]);
+				C4::Context::set_shelves_userenv('tot',$total);
 			}
         	else {
             	if ($userid) {
@@ -712,16 +851,21 @@ sub checkauth {
             	}
 			}
         }	# END if ( $userid    = $query->param('userid') )
-		elsif ($type eq "opac") {	
+		elsif ($type eq "opac") {
             # if we are here this is an anonymous session; add public lists to it and a few other items...
             # anonymous sessions are created only for the OPAC
 			$debug and warn "Initiating an anonymous session...";
 
 			# Grab the public shelves and add to the session...
-			$pubshelves = GetShelvesSummary(0,2,10);
-			$session->param('pubshelves', $pubshelves);
-			C4::Context::set_shelves_userenv('pub',$pubshelves);
-			
+			my $row_count = 20; # FIXME:This probably should be a syspref
+			my ($total, $totshelves, $pubshelves);
+			($pubshelves, $totshelves) = C4::VirtualShelves::GetRecentShelves(2, $row_count, undef);
+			$total->{'pubtotal'} = $totshelves;
+			$session->param('pubshelves', $pubshelves->[0]);
+			$session->param('totshelves', $total);
+			C4::Context::set_shelves_userenv('pub',$pubshelves->[0]);
+			C4::Context::set_shelves_userenv('tot',$total);
+
 			# setting a couple of other session vars...
 			$session->param('ip',$session->remote_addr());
 			$session->param('lasttime',time());
@@ -745,11 +889,11 @@ sub checkauth {
 # AUTH rejected, show the login/password template, after checking the DB.
 #
 #
-    
+
     # get the inputs from the incoming query
     my @inputs = ();
     foreach my $name ( param $query) {
-        (next) if ( $name eq 'userid' || $name eq 'password' );
+        (next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' );
         my $value = $query->param($name);
         push @inputs, { name => $name, value => $value };
     }
@@ -766,6 +910,7 @@ sub checkauth {
     $template->param(
     login        => 1,
         INPUTS               => \@inputs,
+        casAuthentication    => C4::Context->preference("casAuthentication"),
         suggestion           => C4::Context->preference("suggestion"),
         virtualshelves       => C4::Context->preference("virtualshelves"),
         LibraryName          => C4::Context->preference("LibraryName"),
@@ -784,10 +929,12 @@ sub checkauth {
         OpacAuthorities      => C4::Context->preference("OpacAuthorities"),
         OpacBrowser          => C4::Context->preference("OpacBrowser"),
         opacheader           => C4::Context->preference("opacheader"),
+        TagsEnabled                  => C4::Context->preference("TagsEnabled"),
         OPACUserCSS           => C4::Context->preference("OPACUserCSS"),
         intranetcolorstylesheet =>
 								C4::Context->preference("intranetcolorstylesheet"),
         intranetstylesheet => C4::Context->preference("intranetstylesheet"),
+        intranetbookbag    => C4::Context->preference("intranetbookbag"),
         IntranetNav        => C4::Context->preference("IntranetNav"),
         intranetuserjs     => C4::Context->preference("intranetuserjs"),
         TemplateEncoding   => C4::Context->preference("TemplateEncoding"),
@@ -795,9 +942,15 @@ sub checkauth {
         AutoLocation       => C4::Context->preference("AutoLocation"),
 		wrongip            => $info{'wrongip'}
     );
-    
     $template->param( loginprompt => 1 ) unless $info{'nopermission'};
 
+    if ($cas) { 
+	$template->param(
+	    casServerUrl    => login_cas_url(),
+	    invalidCasLogin => $info{'invalidCasLogin'}
+	);
+    }
+
     my $self_url = $query->url( -absolute => 1 );
     $template->param(
         url         => $self_url,
@@ -917,7 +1070,7 @@ sub check_api_auth {
             } else {
                 my $cookie = $query->cookie( CGISESSID => $session->id );
                 $session->param('lasttime',time());
-                my $flags = haspermission( $dbh, $userid, $flagsrequired );
+                my $flags = haspermission($userid, $flagsrequired);
                 if ($flags) {
                     return ("ok", $cookie, $sessionID);
                 } else {
@@ -933,14 +1086,21 @@ sub check_api_auth {
         }
     } else {
         # new login
-        my $userid = $query->param('userid');   
-        my $password = $query->param('password');   
+        my $userid = $query->param('userid');
+        my $password = $query->param('password');
         unless ($userid and $password) {
             # caller did something wrong, fail the authenticateion
             return ("failed", undef, undef);
         }
-        my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password );
-        if ($return and haspermission( $dbh, $userid, $flagsrequired)) {
+	my ($return, $cardnumber);
+	if ($cas && $query->param('ticket')) {
+	    my $retuserid;
+	    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
+	    $userid = $retuserid;
+	} else {
+	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
+	}
+        if ($return and haspermission(  $userid, $flagsrequired)) {
             my $session = get_session("");
             return ("failed", undef, undef) unless $session;
 
@@ -1027,7 +1187,7 @@ sub check_api_auth {
                 $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress'));
                 $session->param('ip',$session->remote_addr());
                 $session->param('lasttime',time());
-            } 
+            }
             C4::Context::set_userenv(
                 $session->param('number'),       $session->param('id'),
                 $session->param('cardnumber'),   $session->param('firstname'),
@@ -1039,7 +1199,7 @@ sub check_api_auth {
         } else {
             return ("failed", undef, undef);
         }
-    } 
+    }
 }
 
 =item check_cookie_auth
@@ -1135,7 +1295,7 @@ sub check_cookie_auth {
             return ("expired", undef);
         } else {
             $session->param('lasttime',time());
-            my $flags = haspermission( $dbh, $userid, $flagsrequired );
+            my $flags = haspermission($userid, $flagsrequired);
             if ($flags) {
                 return ("ok", $sessionID);
             } else {
@@ -1157,7 +1317,7 @@ sub check_cookie_auth {
   my $session = get_session($sessionID);
 
 Given a session ID, retrieve the CGI::Session object used to store
-the session's state.  The session object can be used to store 
+the session's state.  The session object can be used to store
 data that needs to be accessed by different scripts during a
 user's session.
 
@@ -1186,13 +1346,22 @@ sub get_session {
 
 sub checkpw {
 
-    my ( $dbh, $userid, $password ) = @_;
+    my ( $dbh, $userid, $password, $query ) = @_;
     if ($ldap) {
         $debug and print "## checkpw - checking LDAP\n";
         my ($retval,$retcard) = checkpw_ldap(@_);    # EXTERNAL AUTH
         ($retval) and return ($retval,$retcard);
     }
 
+    if ($cas && $query->param('ticket')) {
+        $debug and print STDERR "## checkpw - checking CAS\n";
+	# In case of a CAS authentication, we use the ticket instead of the password
+	my $ticket = $query->param('ticket');
+        my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query);    # EXTERNAL AUTH
+        ($retval) and return ($retval,$retcard,$retuserid);
+	return 0;
+    }
+
     # INTERNAL AUTH
     my $sth =
       $dbh->prepare(
@@ -1203,7 +1372,7 @@ sub checkpw {
         my ( $md5password, $cardnumber, $borrowernumber, $userid, $firstname,
             $surname, $branchcode, $flags )
           = $sth->fetchrow;
-        if ( md5_base64($password) eq $md5password ) {
+        if ( md5_base64($password) eq $md5password and $md5password ne "!") {
 
             C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
                 $firstname, $surname, $branchcode, $flags );
@@ -1248,10 +1417,12 @@ sub checkpw {
 
 =item getuserflags
 
- $authflags = getuserflags($flags,$dbh);
+    my $authflags = getuserflags($flags, $userid, [$dbh]);
+
 Translates integer flags into permissions strings hash.
 
 C<$flags> is the integer userflags value ( borrowers.userflags )
+C<$userid> is the members.userid, used for building subpermissions
 C<$authflags> is a hashref of permissions
 
 =cut
@@ -1259,7 +1430,7 @@ C<$authflags> is a hashref of permissions
 sub getuserflags {
     my $flags   = shift;
     my $userid  = shift;
-    my $dbh     = shift;
+    my $dbh     = @_ ? shift : C4::Context->dbh;
     my $userflags;
     $flags = 0 unless $flags;
     my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags");
@@ -1284,7 +1455,7 @@ sub getuserflags {
     return $userflags;
 }
 
-=item get_user_subpermissions 
+=item get_user_subpermissions
 
 =over 4
 
@@ -1293,10 +1464,10 @@ my $user_perm_hashref = get_user_subpermissions($userid);
 =back
 
 Given the userid (note, not the borrowernumber) of a staff user,
-return a hashref of hashrefs of the specific subpermissions 
+return a hashref of hashrefs of the specific subpermissions
 accorded to the user.  An example return is
 
-{ 
+{
     tools => {
         export_catalog => 1,
         import_patrons => 1,
@@ -1317,7 +1488,7 @@ sub get_user_subpermissions {
     my $userid = shift;
 
     my $dbh = C4::Context->dbh;
-    my $sth = $dbh->prepare("SELECT flag, code
+    my $sth = $dbh->prepare("SELECT flag, user_permissions.code
                              FROM user_permissions
                              JOIN permissions USING (module_bit, code)
                              JOIN userflags ON (module_bit = bit)
@@ -1362,11 +1533,11 @@ sub get_all_subpermissions {
     return $all_perms;
 }
 
-=item haspermission 
+=item haspermission
 
-  $flags = ($dbh,$member,$flagsrequired);
+  $flags = ($userid, $flagsrequired);
 
-C<$member> may be either userid or overloaded with $borrower hashref from GetMemberDetails.
+C<$userid> the userid of the member
 C<$flags> is a hashref of required flags like C<$borrower-&lt;{authflags}> 
 
 Returns member's flags or 0 if a permission is not met.
@@ -1374,22 +1545,15 @@ Returns member's flags or 0 if a permission is not met.
 =cut
 
 sub haspermission {
-    my ( $dbh, $userid, $flagsrequired ) = @_;
-    my ($flags,$intflags);
-    $dbh=C4::Context->dbh unless($dbh);
-    if(ref($userid)) {
-        $intflags = $userid->{'flags'};  
-    } else {
-        my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
-        $sth->execute($userid);
-        my ($intflags) = $sth->fetchrow;
-        $flags = getuserflags( $intflags, $userid, $dbh );
-    }
+    my ($userid, $flagsrequired) = @_;
+    my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
+    $sth->execute($userid);
+    my $flags = getuserflags( $sth->fetchrow(), $userid );
     if ( $userid eq C4::Context->config('user') ) {
         # Super User Account from /etc/koha.conf
         $flags->{'superlibrarian'} = 1;
     }
-    if ( $userid eq 'demo' && C4::Context->config('demo') ) {
+    elsif ( $userid eq 'demo' && C4::Context->config('demo') ) {
         # Demo user that can do "anything" (demo=1 in /etc/koha.conf)
         $flags->{'superlibrarian'} = 1;
     }
@@ -1401,10 +1565,10 @@ sub haspermission {
                 return 0 unless ( $flags->{$module} == 1 or ref($flags->{$module}) );
             } else {
                 return 0 unless ( $flags->{$module} == 1 or
-                                    ( ref($flags->{$module}) and 
-                                      exists $flags->{$module}->{$subperm} and 
-                                      $flags->{$module}->{$subperm} == 1 
-                                    ) 
+                                    ( ref($flags->{$module}) and
+                                      exists $flags->{$module}->{$subperm} and
+                                      $flags->{$module}->{$subperm} == 1
+                                    )
                                 );
             }
         } else {
@@ -1418,6 +1582,10 @@ sub haspermission {
 
 sub getborrowernumber {
     my ($userid) = @_;
+    my $userenv = C4::Context->userenv;
+    if ( defined( $userenv ) && ref( $userenv ) eq 'HASH' && $userenv->{number} ) {
+        return $userenv->{number};
+    }
     my $dbh = C4::Context->dbh;
     for my $field ( 'userid', 'cardnumber' ) {
         my $sth =