include/diogenes.session.inc.php

   1 <?php
   2 /*
   3  * Copyright (C) 2003-2004 Polytechnique.org
   4  * http://opensource.polytechnique.org/
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21
  22 require_once 'diogenes/diogenes.core.session.inc.php';
  23 require_once 'diogenes/diogenes.core.logger.inc.php';
  24
  25 /** This class describes a Diogenes session.
  26  */
  27 class DiogenesSession extends DiogenesCoreSession {
  28   /** full name */
  29   var $fullname;
  30   /** is this a native Diogenes account? */
  31   var $auth = "native";
  32
  33
  34   /** The constructor.
  35    */
  36   function DiogenesSession() {
  37     $this->DiogenesCoreSession();
  38     $this->username = "anonymous";
  39     $this->perms->addFlag('public');
  40   }
  41
  42
  43   /** Try to do a Diogenes authentication.
  44    *
  45    * @param page the calling page (by reference)
  46    */
  47   function doAuth(&$page) {
  48     global $globals;
  49
  50     if ($this->perms->hasflag("auth"))
  51       return;
  52
  53     /* do we have authentication tokens for auth ? */
  54     if (isset($_REQUEST['login']) && isset($_REQUEST['response'])) {
  55       // remember login for a year
  56       setcookie('DiogenesLogin',$_REQUEST['login'],(time()+25920000));
  57
  58       // check response
  59       $res = $globals->db->query( "SELECT user_id,password FROM {$globals->tauth['native']} WHERE username='{$_REQUEST['login']}'");
  60
  61       if (!list($uid,$password) = mysql_fetch_row($res)) {
  62         $page->info(__("Authentication error!"));
  63         $this->doLogin($page);
  64       }
  65
  66       if ($_REQUEST['response'] != md5("{$_REQUEST['login']}:$password:{$this->challenge}"))
  67       {
  68         // log the login failure
  69         $logger = new DiogenesCoreLogger($uid);
  70         $logger->log("auth_fail",$_REQUEST['login']);
  71         $page->info(__("Authentication error!"));
  72         $this->doLogin($page);
  73       }
  74
  75       // retrieve user info
  76       $res = $globals->db->query("select user_id,username,firstname,lastname,perms from {$globals->tauth['native']} where username='{$_REQUEST['login']}'");
  77       list($this->uid,$this->username,$firstname,$lastname,$perms) = mysql_fetch_row($res);
  78       $this->fullname = $firstname . ($lastname ? " $lastname" : "");
  79
  80       // create logger
  81       $logstr = $this->username . (empty($page->alias) ? "" : "@{$page->alias}");
  82       $_SESSION['log'] = new DiogenesCoreLogger($this->uid);
  83       $_SESSION['log']->log("auth_ok",$logstr);
  84
  85       // set user permissions
  86       $this->perms->addFlag('auth');
  87       if ($perms == "admin") {
  88         $this->perms->addflag('root');
  89       }
  90
  91     } else {
  92       $this->doLogin($page);
  93     }
  94   }
  95
  96
  97   /** Try to login for WebDAV (plain-text password).
  98    *
  99    *  Return true for success, false for failure.
 100    */
 101   function doAuthWebDAV($user,$pass)
 102   {
 103     global $globals;
 104
 105     if ($this->perms->hasflag("auth"))
 106       return true;
 107
 108     // check credentials
 109     $pass = md5($pass);
 110     $res = $globals->db->query("select user_id,username,perms from {$globals->tauth['native']} where username='$user' and password='$pass'");
 111     if (!list($uid,$user,$perms) = mysql_fetch_row($res))
 112       return false;
 113
 114     // retrieve user info
 115     $this->uid = $uid;
 116     $this->username = $user;
 117
 118     // create logger
 119     $_SESSION['log'] = new DiogenesWebDAVLogger($this->uid,$this->auth,$this->username);
 120
 121     // set user permissions
 122     $this->perms->addFlag('auth');
 123     if ($perms == "admin") {
 124       $this->perms->addflag('root');
 125     }
 126
 127     return true;
 128   }
 129
 130
 131   /** Display login screen.
 132    */
 133   function doLogin(&$page) {
 134     $page->assign('greeting',__("Diogenes login"));
 135     $page->assign('msg_connexion', __("Connexion"));
 136     $page->assign('msg_password',__("password"));
 137     $page->assign('msg_submit',__("Submit"));
 138     $page->assign('msg_username', __("username"));
 139
 140     if (isset($_COOKIE['DiogenesLogin']))
 141       $page->assign('username', $_COOKIE['DiogenesLogin']);
 142     $page->assign('post',htmlentities($page->script_uri()));
 143     $page->assign('challenge',$this->challenge);
 144     $page->assign('md5',$page->url("md5.js"));
 145     $page->display('login.tpl');
 146     exit;
 147   }
 148
 149
 150   /** Read a user's permissions for a given barrel.
 151    *
 152    * @param alias the name of the barrel
 153    */
 154   function setBarrelPerms($alias) {
 155     global $globals;
 156
 157     // if the user is logged in, refresh his/her permissions
 158     if ($this->perms->hasflag('auth')) {
 159       if ($this->perms->hasflag('root')) {
 160         $this->perms->addflag('user');
 161         $this->perms->addflag('admin');
 162       } else {
 163         $this->perms->rmflag('user');
 164         $this->perms->rmflag('admin');
 165       }
 166
 167       // read site specific permissions
 168       $res = $globals->db->query("select perms from diogenes_perm where alias='{$alias}'".
 169                          " and auth='{$this->auth}' and uid='{$this->uid}'");
 170       if (mysql_num_rows($res)>0) {
 171         $this->perms->addflag('user');
 172         list($tmp) = mysql_fetch_row($res);
 173         $this->perms->addflag($tmp);
 174       }
 175       mysql_free_result($res);
 176     }
 177   }
 178
 179 }
 180
 181 ?>