2 /***************************************************************************
3 * Copyright (C) 2003-2009 Polytechnique.org *
4 * http://opensource.polytechnique.org/ *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
22 class XorgSession
extends PlSession
24 const INVALID_USER
= -2;
26 const COOKIE_SUCCESS
= 0;
27 const INVALID_COOKIE
= 1;
29 public function __construct()
31 parent
::__construct();
34 public function startAvailableAuth()
37 switch ($this->tryCookie()) {
38 case self
::COOKIE_SUCCESS
:
39 if (!$this->start(AUTH_COOKIE
)) {
44 case self
::INVALID_USER
:
45 case self
::INVALID_COOKIE
:
49 if ((check_ip('dangerous') && S
::has('uid')) ||
check_account()) {
50 S
::logger()->log("view_page", $_SERVER['REQUEST_URI']);
55 /** Check the cookie and set the associated user_id in the auth_by_cookie session variable.
57 private function tryCookie()
59 S
::kill('auth_by_cookie');
60 if (Cookie
::v('access') == '' ||
!Cookie
::has('uid')) {
61 return self
::NO_COOKIE
;
64 $res = XDB
::query('SELECT uid, password
66 WHERE uid = {?} AND state = \'active\'',
68 if ($res->numRows() != 0) {
69 list($uid, $password) = $res->fetchOneRow();
70 if (sha1($password) == Cookie
::v('access')) {
71 S
::set('auth_by_cookie', $uid);
72 return self
::COOKIE_SUCCESS
;
74 return self
::INVALID_COOKIE
;
77 return self
::INVALID_USER
;
80 private function checkPassword($uname, $login, $response, $login_type)
82 $res = XDB
::query('SELECT a.uid, a.password
84 INNER JOIN aliases AS l ON (l.id = a.uid AND l.type != \'homonyme\')
85 WHERE l.' . $login_type . ' = {?} AND a.state = \'active\'',
87 if (list($uid, $password) = $res->fetchOneRow()) {
88 $expected_response = sha1("$uname:$password:" . S
::v('challenge'));
89 /* XXX: Deprecates len(password) > 10 conversion */
90 if ($response != $expected_response) {
92 Platal
::page()->trigError('Mot de passe ou nom d\'utilisateur invalide');
94 Platal
::page()->trigError('Mot de passe invalide');
96 S
::logger($uid)->log('auth_fail', 'bad password');
101 Platal
::page()->trigError('Mot de passe ou nom d\'utilisateur invalide');
108 protected function doAuth($level)
112 /* Cookie authentication
114 if ($level == AUTH_COOKIE
&& !S
::has('auth_by_cookie')) {
117 if ($level == AUTH_COOKIE
&& S
::has('auth_by_cookie')) {
119 S
::set('auth', AUTH_COOKIE
);
121 return User
::getSilentWithUID(S
::i('auth_by_cookie'));
125 /* We want to do auth... we must have infos from a form.
127 if (!Post
::has('username') ||
!Post
::has('response') ||
!S
::has('challenge')) {
131 /** We come from an authentication form.
134 $login = $uname = S
::suid('uid');
137 $uname = Env
::v('username');
138 if (Env
::v('domain') == "alias") {
139 $res = XDB
::query('SELECT redirect
141 INNER JOIN virtual_redirect USING(vid)
142 WHERE alias LIKE {?}',
143 $uname . '@' . $globals->mail
->alias_dom
);
144 $redirect = $res->fetchOneCell();
146 $login = substr($redirect, 0, strpos($redirect, '@'));
156 $uid = $this->checkPassword($uname, $login, Post
::v('response'), (!$redirect && is_numeric($uname)) ?
'id' : 'alias');
157 if (!is_null($uid) && S
::suid()) {
158 if (S
::suid('uid') == $uid) {
164 if (!is_null($uid)) {
165 S
::set('auth', AUTH_MDP
);
167 if (Post
::has('domain')) {
168 if (($domain = Post
::v('domain', 'login')) == 'alias') {
169 Cookie
::set('domain', 'alias', 300);
171 Cookie
::kill('domain');
175 S
::kill('challenge');
176 S
::logger($uid)->log('auth_ok');
178 return User
::getSilentWithUID($uid);
181 protected function startSessionAs($user, $level)
183 $session_user = S
::v('user');
184 if ((!is_null($session_user) && $session_user->id() != $user->id())
185 ||
(S
::has('uid') && S
::i('uid') != $user->id())) {
187 } else if (S
::has('uid')) {
190 if ($level == AUTH_SUID
) {
191 S
::set('auth', AUTH_MDP
);
194 // Retrieves main user properties.
195 /** TODO: Move needed informations to account tables */
196 /** TODO: Currently suppressed data are matricule, promo */
197 /** TODO: Use the User object to fetch all this */
198 $res = XDB
::query("SELECT a.uid, a.hruid, a.display_name, a.full_name,
199 a.sex = 'female' AS femme, a.email_format,
200 a.token, FIND_IN_SET('watch', a.flags) AS watch_account,
201 UNIX_TIMESTAMP(fp.last_seen) AS banana_last, UNIX_TIMESTAMP(w.last) AS watch_last,
202 a.last_version, g.g_account_name IS NOT NULL AS googleapps,
203 UNIX_TIMESTAMP(s.start) AS lastlogin, s.host,
206 INNER JOIN account_types AS at ON(a.type = at.type)
207 INNER JOIN watch AS w ON(w.uid = a.uid)
208 LEFT JOIN forum_profiles AS fp ON(fp.uid = a.uid)
209 LEFT JOIN gapps_accounts AS g ON(a.uid = g.l_userid AND g.g_status = 'active')
210 LEFT JOIN logger.last_sessions AS ls ON (ls.uid = a.uid)
211 LEFT JOIN logger.sessions AS s ON(s.id = ls.id)
212 WHERE a.uid = {?} AND a.state = 'active'", $user->id());
213 if ($res->numRows() != 1) {
217 $sess = $res->fetchOneAssoc();
218 $perms = $sess['perms'];
219 unset($sess['perms']);
221 // Loads the data into the real session.
222 $_SESSION = array_merge($_SESSION, $sess);
224 // Starts the session's logger, and sets up the permanent cookie.
226 S
::logger()->log("suid_start", S
::v('hruid') . ' by ' . S
::suid('hruid'));
228 S
::logger()->saveLastSession();
229 Cookie
::set('uid', $user->id(), 300);
231 if (S
::i('auth_by_cookie') == $user->id() || Post
::v('remember', 'false') == 'true') {
232 $this->setAccessCookie(false
, S
::i('auth_by_cookie') != $user->id());
234 $this->killAccessCookie();
238 // Finalizes the session setup.
239 $this->makePerms($perms, S
::b('is_admin'));
240 $this->securityChecks();
242 $this->updateNbNotifs();
245 // We should not have to use this private data anymore
246 S
::kill('auth_by_cookie');
250 private function securityChecks()
252 $mail_subject = array();
253 if (check_account()) {
254 $mail_subject[] = 'Connexion d\'un utilisateur surveillé';
256 if (check_ip('unsafe')) {
257 $mail_subject[] = 'Une IP surveillee a tente de se connecter';
258 if (check_ip('ban')) {
259 send_warning_mail(implode(' - ', $mail_subject));
261 Platal
::page()->kill('Une erreur est survenue lors de la procédure d\'authentification. '
262 . 'Merci de contacter au plus vite '
263 . '<a href="mailto:support@polytechnique.org">support@polytechnique.org</a>');
267 if (count($mail_subject)) {
268 send_warning_mail(implode(' - ', $mail_subject));
272 public function tokenAuth($login, $token)
274 $res = XDB
::query('SELECT a.uid AS user_id, a.hruid
276 INNER JOIN accounts AS a ON (l.id = a.uid AND a.state = \'active\')
277 WHERE a.token = {?} AND l.alias = {?} AND l.type != \'homonyme\'',
279 if ($res->numRows() == 1) {
280 return new User(null
, $res->fetchOneAssoc());
285 protected function makePerms($perm, $is_admin)
287 S
::set('perms', User
::makePerms($perm, $is_admin));
290 public function setSkin()
292 if (S
::logged() && (!S
::has('skin') || S
::suid())) {
293 $res = XDB
::query('SELECT skin_tpl
295 INNER JOIN skins AS s on (a.skin = s.id)
296 WHERE a.uid = {?} AND skin_tpl != \'\'', S
::i('uid'));
297 S
::set('skin', $res->fetchOneCell());
301 public function loggedLevel()
306 public function sureLevel()
312 public function updateNbNotifs()
314 require_once 'notifs.inc.php';
316 $n = Watch
::getCount($user);
317 S
::set('notifs', $n);
320 public function setAccessCookie($replace = false
, $log = true
) {
321 if (S
::suid() ||
($replace && !Cookie
::blank('access'))) {
324 Cookie
::set('access', sha1(S
::user()->password()), 300, true
);
326 S
::logger()->log('cookie_on');
330 public function killAccessCookie($log = true
) {
331 Cookie
::kill('access');
333 S
::logger()->log('cookie_off');
337 public function killLoginFormCookies() {
339 Cookie
::kill('domain');
343 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: