8f71fdac0a8f4e67cf55a62d47724254318dd6f2
[platal.git] / modules / auth.php
1 <?php
2 /***************************************************************************
3 * Copyright (C) 2003-2011 Polytechnique.org *
4 * http://opensource.polytechnique.org/ *
5 * *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
10 * *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
15 * *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
18 * Foundation, Inc., *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
21
22 class AuthModule extends PLModule
23 {
24 function handlers()
25 {
26 return array(
27 'groupex/donne-chall.php' => $this->make_hook('chall', AUTH_PUBLIC),
28 'groupex/export-econfiance.php' => $this->make_hook('econf', AUTH_PUBLIC, 'user', NO_HTTPS),
29
30 'webservices/manageurs.php' => $this->make_hook('manageurs', AUTH_PUBLIC, 'user', NO_HTTPS),
31
32 'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE, 'user'),
33 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE, ''),
34 'auth-groupex' => $this->make_hook('groupex', AUTH_PUBLIC, ''),
35 'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_PASSWD, 'admin'),
36 );
37 }
38
39 function handler_chall($page)
40 {
41 $_SESSION["chall"] = uniqid(rand(), 1);
42 echo $_SESSION["chall"] . "\n" . session_id();
43 exit;
44 }
45
46 function handler_econf($page)
47 {
48 global $globals;
49
50 $cle = $globals->core->econfiance;
51
52 $res = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<membres>\n\n";
53
54 if (S::v('chall') && Get::s('PASS') == md5(S::v('chall').$cle)) {
55 $list = new MMList(User::getWithUID(10154), "x-econfiance.polytechnique.org");
56 $members = $list->get_members('membres');
57 if (is_array($members)) {
58 $membres = Array();
59 foreach($members[1] as $member) {
60 $user = User::getSilent($member[1]);
61 if ($user && $user->hasProfile()) {
62 $profile = $user->profile();
63 $res .= "<membre>\n";
64 $res .= "\t<nom>" . $profile->lastName() . "</nom>\n";
65 $res .= "\t<prenom>" . $profile->firstName() . "</prenom>\n";
66 $res .= "\t<email>" . $user->forlifeEmail() . "</email>\n";
67 $res .= "</membre>\n\n";
68 }
69 }
70 }
71 $res .= "</membres>\n\n";
72
73 pl_content_headers("text/xml");
74 echo $res;
75 }
76 exit;
77 }
78
79 function handler_manageurs($page)
80 {
81 global $globals;
82
83 require_once 'webservices/manageurs.server.inc.php';
84
85 $ips = array_flip(explode(' ', $globals->manageurs->authorized_ips));
86 if ($ips && isset($ips[$_SERVER['REMOTE_ADDR']])) {
87 $server = xmlrpc_server_create();
88
89 xmlrpc_server_register_method($server, 'get_annuaire_infos', 'get_annuaire_infos');
90 xmlrpc_server_register_method($server, 'get_nouveau_infos', 'get_nouveau_infos');
91
92 $request = @$GLOBALS['HTTP_RAW_POST_DATA'];
93 $response = xmlrpc_server_call_method($server, $request, null);
94 pl_content_headers("text/xml");
95 print $response;
96 xmlrpc_server_destroy($server);
97 }
98
99 exit;
100 }
101
102 function handler_redirect($page)
103 {
104 http_redirect(Env::v('dest', '/'));
105 }
106
107 function handler_groupex_old($page)
108 {
109 return $this->handler_groupex($page, 'iso-8859-1');
110 }
111
112 /** Handles the 'auth-groupe-x' authentication.
113 * Expects the following GET parameters:
114 * - pass: the 'password' for the authentication
115 * - challenge: the authentication challenge
116 * - url: the return URL
117 * - session: the remote PHP session ID
118 */
119 function handler_groupex($page, $charset = 'utf8')
120 {
121 if (!S::logged()) {
122 $page->assign('referer', true);
123 $page->setTitle('Authentification');
124 $page->setDefaultSkin('group_login');
125
126 if (Get::has('group')) {
127 $res = XDB::query('SELECT nom
128 FROM groups
129 WHERE diminutif = {?}', Get::s('group'));
130 $page->assign('group', $res->fetchOneCell());
131 } else {
132 $page->assign('group', null);
133 }
134 return PL_DO_AUTH;
135 }
136
137 if (!S::user()->checkPerms('groups')) {
138 return PL_FORBIDDEN;
139 }
140
141 $this->load('auth.inc.php');
142
143 $gpex_pass = Get::s('pass');
144 $gpex_url = urldecode(Get::s('url'));
145 if (Get::has('session')) {
146 if (strpos($gpex_url, '?') === false) {
147 $gpex_url .= "?PHPSESSID=" . Get::s('session');
148 } else {
149 $gpex_url .= "&PHPSESSID=" . Get::s('session');
150 }
151 }
152
153 // Normalize the return URL.
154 if (!preg_match("/^(http|https):\/\/.*/",$gpex_url)) {
155 $gpex_url = "http://$gpex_url";
156 }
157 $gpex_challenge = Get::s('challenge');
158
159 // Update the last login information (unless the user is in SUID).
160 $uid = S::i('uid');
161 if (!S::suid()) {
162 global $platal;
163 S::logger($uid)->log('connexion_auth_ext', $platal->path.' '.urldecode($_GET['url']));
164 }
165
166 if (Get::has('group')) {
167 $req_group_id = XDB::fetchOneCell('SELECT id
168 FROM groups
169 WHERE diminutif = {?}',
170 Get::s('group'));
171 } else {
172 $req_group_id = null;
173 }
174
175 // Iterate over the auth token to find which one did sign the request.
176 $res = XDB::iterRow(
177 'SELECT ga.privkey, ga.name, ga.datafields, ga.returnurls,
178 ga.group_id, ga.flags, g.nom
179 FROM group_auth AS ga
180 LEFT JOIN groups AS g ON (g.id = ga.group_id)');
181
182 while (list($privkey, $name, $datafields, $returnurls, $group_id, $group_flags, $group_name) = $res->next()) {
183 if (md5($gpex_challenge.$privkey) == $gpex_pass) {
184 $returnurls = trim($returnurls);
185 // We check that the return url matches a per-key regexp to prevent
186 // replay attacks (more exactly to force replay attacks to redirect
187 // the user to the real GroupeX website, which defeats the attack).
188 if (empty($returnurls) || @preg_match($returnurls, $gpex_url)) {
189 $returl = $gpex_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
190 XDB::execute('UPDATE group_auth
191 SET last_used = DATE(NOW())
192 WHERE name = {?}',
193 $name);
194
195 // Two conditions control access to the return URL:
196 // - If that URL is attached to a group:
197 // - If the user belongs to the group, OK
198 // - If the user is 'xnet' and doesn't belong, NOK
199 // - If the user is not 'xnet' and the group is not 'strict', OK
200 // - If the user is not 'xnet' and the group is 'strict', NOK
201 // - Otherwise, all but 'xnet' accounts may access the URL.
202 $user_is_xnet = S::user()->type == 'xnet';
203 $group_flags = new PlFlagSet($group_flags);
204
205 // If this key is not attached to a group, but a group was
206 // requested (e.g query from wiki / blogs / ...), use the
207 // requested group_id.
208 if (!$group_id && $req_group_id) {
209 $group_id = $req_group_id;
210 }
211
212 if ($group_id) {
213 // Check group permissions
214 $is_member = XDB::fetchOneCell('SELECT COUNT(*)
215 FROM group_members
216 WHERE uid = {?} AND asso_id = {?}',
217 S::user()->id(), $group_id);
218 if (!$is_member && ($user_is_xnet || $group_flags->hasFlag('group_only'))) {
219 $page->kill("Le site demandé est réservé aux membres du groupe $group_name.");
220 }
221
222 } else if ($user_is_xnet && !$group_flags->hasFlag('allow_xnet')) {
223 $page->kill("Le site demandé est réservé aux polytechniciens.");
224 }
225
226 http_redirect($returl);
227 } else if (S::admin()) {
228 $page->kill("La requête d'authentification a échoué (url de retour invalide).");
229 }
230 }
231 }
232
233 // Otherwise (if no valid request was found, or if the return URL is not
234 // acceptable), the user is redirected back to our homepage.
235 pl_redirect('/');
236 }
237
238 function handler_admin_authgroupesx($page, $action = 'list', $id = null)
239 {
240 $page->setTitle('Administration - Auth groupes X');
241 $page->assign('title', 'Gestion de l\'authentification centralisée');
242 $table_editor = new PLTableEditor('admin/auth-groupes-x','group_auth','id');
243 $table_editor->describe('name','nom',true);
244 $table_editor->describe('privkey','clé privée',false, true);
245 $table_editor->describe('datafields','champs renvoyés',true);
246 $table_editor->describe('returnurls','urls de retour',true);
247 $table_editor->describe('last_used', 'dernière utilisation', true);
248 $table_editor->apply($page, $action, $id);
249 }
250 }
251
252 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
253 ?>