include/xorg/session.inc.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2008 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22 require_once 'xorg.misc.inc.php';
  23
  24 class XorgSession
  25 {
  26     public function __construct() {
  27         XorgSession::init();
  28     }
  29
  30     // {{{ public static function init
  31
  32     public static function init()
  33     {
  34         S::init();
  35         if (!S::has('uid')) {
  36             try_cookie();
  37         }
  38         if ((check_ip('dangerous') && S::has('uid')) || check_account()) {
  39             $_SESSION['log']->log("view_page", $_SERVER['REQUEST_URI']);
  40         }
  41     }
  42
  43     // }}}
  44     // {{{ public static function destroy()
  45
  46     public static function destroy()
  47     {
  48         S::destroy();
  49         XorgSession::init();
  50     }
  51
  52     // }}}
  53     // {{{ public static function doAuth()
  54
  55     public static function doAuth($new_name = false)
  56     {
  57         global $globals;
  58         if (S::identified()) { // ok, c'est bon, on n'a rien à faire
  59             return true;
  60         }
  61
  62         if (!Env::has('username') || !Env::has('response')
  63         ||  !S::has('challenge'))
  64         {
  65             return false;
  66         }
  67
  68         // si on vient de recevoir une identification par passwordpromptscreen.tpl
  69         // ou passwordpromptscreenlogged.tpl
  70         if (S::has('suid')) {
  71             $suid = S::v('suid');
  72             $login = $uname = $suid['forlife'];
  73             $redirect = false;
  74         } else {
  75             $uname = Env::v('username');
  76
  77             if (Env::v('domain') == "alias") {
  78                 $res = XDB::query(
  79                     "SELECT redirect
  80                        FROM virtual
  81                  INNER JOIN virtual_redirect USING(vid)
  82                       WHERE alias LIKE {?}", $uname."@".$globals->mail->alias_dom);
  83                 $redirect = $res->fetchOneCell();
  84                 if ($redirect) {
  85                     $login = substr($redirect, 0, strpos($redirect, '@'));
  86                 } else {
  87                     $login = "";
  88                 }
  89             } else {
  90                 $login = $uname;
  91                 $redirect = false;
  92             }
  93         }
  94
  95         $field = (!$redirect && preg_match('/^\d*$/', $uname)) ? 'id' : 'alias';
  96         $res   = XDB::query(
  97                     "SELECT  u.user_id, u.password
  98                        FROM  auth_user_md5 AS u
  99                  INNER JOIN  aliases       AS a ON ( a.id=u.user_id AND type!='homonyme' )
 100                       WHERE  a.$field = {?} AND u.perms IN('admin','user')", $login);
 101
 102         $logger = S::v('log');
 103         if (list($uid, $password) = $res->fetchOneRow()) {
 104             require_once('secure_hash.inc.php');
 105             $expected_response = hash_encrypt("$uname:$password:".S::v('challenge'));
 106             // le password de la base est peut-être encore encodé en md5
 107             if (Env::v('response') != $expected_response) {
 108                 $new_password = hash_xor(Env::v('xorpass'), $password);
 109                 $expected_response = hash_encrypt("$uname:$new_password:".S::v('challenge'));
 110                 if (Env::v('response') == $expected_response) {
 111                       XDB::execute("UPDATE auth_user_md5 SET password = {?} WHERE user_id = {?}",
 112                                    $new_password, $uid);
 113                 }
 114             }
 115             if (Env::v('response') == $expected_response) {
 116                 if (Env::has('domain')) {
 117                     if (($domain = Env::v('domain', 'login')) == 'alias') {
 118                         setcookie('ORGdomain', "alias", (time()+25920000), '/', '', 0);
 119                     } else {
 120                         setcookie('ORGdomain', '', (time()-3600), '/', '', 0);
 121                     }
 122                     // pour que la modification soit effective dans le reste de la page
 123                     $_COOKIE['ORGdomain'] = $domain;
 124                 }
 125
 126                 S::kill('challenge');
 127                 if ($logger) {
 128                     $logger->log('auth_ok');
 129                 }
 130                 if (!start_connexion($uid, true)) {
 131                     return false;
 132                 }
 133                 if (Env::v('remember', 'false') == 'true') {
 134                     $cookie = hash_encrypt(S::v('password'));
 135                     setcookie('ORGaccess',$cookie,(time()+25920000),'/','',0);
 136                     if ($logger) {
 137                         $logger->log("cookie_on");
 138                     }
 139                 } else {
 140                     setcookie('ORGaccess', '', time() - 3600, '/', '', 0);
 141
 142                     if ($logger) {
 143                         $logger->log("cookie_off");
 144                     }
 145                 }
 146                 return true;
 147             } elseif ($logger) {
 148                 $logger->log('auth_fail','bad password');
 149             }
 150         } elseif ($logger) {
 151             $logger->log('auth_fail','bad login');
 152         }
 153
 154         return false;
 155     }
 156
 157     // }}}
 158     // {{{ public static function doAuthCookie()
 159
 160     /** Try to do a cookie-based authentication.
 161      *
 162      * @param page the calling page (by reference)
 163      */
 164     public static function doAuthCookie()
 165
 166     {
 167         if (S::logged()) {
 168             return true;
 169         }
 170
 171         if (Env::has('username') and Env::has('response')) {
 172             return XorgSession::doAuth();
 173         }
 174
 175         if ($r = try_cookie()) {
 176             return XorgSession::doAuth(($r > 0));
 177         }
 178
 179         return false;
 180     }
 181
 182     // }}}
 183     // {{{ public static function make_perms()
 184
 185     public static function &make_perms($perm)
 186     {
 187         $flags = new PlFlagSet();
 188         if ($perm == 'disabled' || $perm == 'ext') {
 189             return $flags;
 190         }
 191         $flags->addFlag(PERMS_USER);
 192         if ($perm == 'admin') {
 193             $flags->addFlag(PERMS_ADMIN);
 194         }
 195         return $flags;
 196     }
 197
 198     // }}}
 199 }
 200
 201 // {{{ function try_cookie()
 202
 203 /** réalise la récupération de $_SESSION pour qqn avec cookie
 204  * @return  int     0 if all OK, -1 if no cookie, 1 if cookie with bad hash,
 205  *                  -2 should not happen
 206  */
 207 function try_cookie()
 208 {
 209     if (Cookie::v('ORGaccess') == '' or !Cookie::has('ORGuid')) {
 210         return -1;
 211     }
 212
 213     $res = @XDB::query(
 214             "SELECT user_id,password FROM auth_user_md5
 215               WHERE user_id = {?} AND perms IN('admin','user')",
 216             Cookie::i('ORGuid'));
 217
 218     if ($res->numRows() != 0) {
 219         list($uid, $password) = $res->fetchOneRow();
 220         require_once('secure_hash.inc.php');
 221         $expected_value       = hash_encrypt($password);
 222         if ($expected_value == Cookie::v('ORGaccess')) {
 223             if (!start_connexion($uid, false)) {
 224                 return -3;
 225             }
 226             return 0;
 227         } else {
 228             return 1;
 229         }
 230     }
 231
 232     return -2;
 233 }
 234
 235 // }}}
 236 // {{{ function start_connexion()
 237
 238 /** place les variables de session dépendants de auth_user_md5
 239  * et met à jour les dates de dernière connexion si nécessaire
 240  * @return void
 241  * @see controlpermanent.inc.php controlauthentication.inc.php
 242  */
 243 function start_connexion ($uid, $identified)
 244 {
 245     $res  = XDB::query("
 246         SELECT  u.user_id AS uid, prenom, prenom_ini, nom, nom_ini, nom_usage, perms, promo, promo_sortie,
 247                 matricule, password, FIND_IN_SET('femme', u.flags) AS femme,
 248                 a.alias AS forlife, a2.alias AS bestalias,
 249                 q.core_mail_fmt AS mail_fmt, UNIX_TIMESTAMP(q.banana_last) AS banana_last, q.watch_last, q.core_rss_hash,
 250                 FIND_IN_SET('watch', u.flags) AS watch_account, q.last_version
 251           FROM  auth_user_md5   AS u
 252     INNER JOIN  auth_user_quick AS q  USING(user_id)
 253     INNER JOIN  aliases         AS a  ON (u.user_id = a.id AND a.type='a_vie')
 254     INNER JOIN  aliases         AS a2 ON (u.user_id = a2.id AND FIND_IN_SET('bestalias',a2.flags))
 255          WHERE  u.user_id = {?} AND u.perms IN('admin','user')", $uid);
 256     $sess = $res->fetchOneAssoc();
 257     $res = XDB::query("SELECT  UNIX_TIMESTAMP(s.start) AS lastlogin, s.host
 258                          FROM  logger.sessions AS s
 259                         WHERE  s.uid = {?} AND s.suid = 0
 260                      ORDER BY  s.start DESC
 261                         LIMIT  1", $uid);
 262     if ($res->numRows()) {
 263         $sess = array_merge($sess, $res->fetchOneAssoc());
 264     }
 265     $suid = S::v('suid');
 266
 267     if ($suid) {
 268         $logger = new PlLogger($uid, $suid['uid']);
 269         $logger->log("suid_start", S::v('forlife')." by {$suid['uid']}");
 270         $sess['suid'] = $suid;
 271     } else {
 272         $logger = S::v('log', new PlLogger($uid));
 273         $logger->log("connexion", Env::v('n'));
 274         setcookie('ORGuid', $uid, (time()+25920000), '/', '', 0);
 275     }
 276
 277     $_SESSION         = array_merge($_SESSION, $sess);
 278     $_SESSION['log']  = $logger;
 279     $_SESSION['auth'] = ($identified ? AUTH_MDP : AUTH_COOKIE);
 280     $_SESSION['perms'] =& XorgSession::make_perms($_SESSION['perms']);
 281     $mail_subject = null;
 282     if (check_account()) {
 283         $mail_subject = "Connexion d'un utilisateur surveillé";
 284     }
 285     if (check_ip('unsafe')) {
 286         if ($mail_subject) {
 287             $mail_subject .= ' - ';
 288         }
 289         $mail_subject .= "Une IP surveillee a tente de se connecter";
 290         if (check_ip('ban')) {
 291             send_warning_mail($mail_subject);
 292             $_SESSION = array();
 293             $_SESSION['perms'] = new PlFlagSet();
 294             global $page;
 295             $newpage = false;
 296             if (!$page) {
 297                 $page =& Platal::page();
 298                 $newpage = true;
 299             }
 300             $page->trigError("Une erreur est survenue lors de la procédure d'authentification. "
 301                        ."Merci de contacter au plus vite "
 302                        ."<a href='mailto:support@polytechnique.org'>support@polytechnique.org</a>");
 303             if ($newpage) {
 304                 $page->run();
 305             }
 306             return false;
 307         }
 308     }
 309     if ($mail_subject) {
 310         send_warning_mail($mail_subject);
 311     }
 312     set_skin();
 313     update_NbNotifs();
 314     check_redirect();
 315     return true;
 316 }
 317
 318 // }}}
 319
 320 function set_skin()
 321 {
 322     global $globals;
 323     if (S::logged() && (!S::has('skin') || S::has('suid'))) {
 324         $uid = S::v('uid');
 325         $res = XDB::query("SELECT  skin_tpl
 326                           FROM  auth_user_quick AS a
 327                           INNER JOIN  skins           AS s ON a.skin = s.id
 328                           WHERE  user_id = {?} AND skin_tpl != ''", $uid);
 329         if ($_SESSION['skin'] = $res->fetchOneCell()) {
 330             return;
 331         }
 332     }
 333 }
 334
 335 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 336 ?>