Adds a security check on the existence of an hruid at registration time.

[platal.git] / classes / xnetsession.php

diff --git a/classes/xnetsession.php b/classes/xnetsession.php
index 73dd844..839abb2 100644 (file)
--- a/classes/xnetsession.php
+++ b/classes/xnetsession.php
@@ -24,15 +24,10 @@ class XnetSession extends PlSession
     public function __construct()
     {
         parent::__construct();
-        S::bootstrap('perms_backup', new PlFlagSet());
     }
 
     public function startAvailableAuth()
     {
-        if (!(S::v('perms') instanceof PlFlagSet)) {
-            S::set('perms', S::v('perms_backup'));
-        }
-
         if (!S::logged() && Get::has('auth')) {
             if (!$this->start(AUTH_MDP)) {
                 return false;
@@ -74,7 +69,6 @@ class XnetSession extends PlSession
                 $perms->addFlag('groupannu');
             }
             S::set('perms', $perms);
-            S::set('perms_backup', $perms);
         }
         return true;
     }
@@ -103,19 +97,21 @@ class XnetSession extends PlSession
         if ($level == -1) {
             S::set('auth', AUTH_MDP);
         }
-        $res  = XDB::query('SELECT  u.user_id AS uid, prenom, nom, perms, promo, password, FIND_IN_SET(\'femme\', u.flags) AS femme,
-                                    a.alias AS forlife, a2.alias AS bestalias, q.core_mail_fmt AS mail_fmt, q.core_rss_hash
+        $res  = XDB::query("SELECT  u.user_id AS uid, u.hruid, prenom, nom, perms, promo, password, FIND_IN_SET('femme', u.flags) AS femme,
+                                    CONCAT(a.alias, '@{$globals->mail->domain}') AS forlife,
+                                    CONCAT(a2.alias, '@{$globals->mail->domain}') AS bestalias,
+                                    q.core_mail_fmt AS mail_fmt, q.core_rss_hash
                               FROM  auth_user_md5   AS u
                         INNER JOIN  auth_user_quick AS q  USING(user_id)
-                        INNER JOIN  aliases         AS a  ON (u.user_id = a.id AND a.type = \'a_vie\')
-                        INNER JOIN  aliases         AS a2 ON (u.user_id = a2.id AND FIND_IN_SET(\'bestalias\', a2.flags))
-                             WHERE  u.user_id = {?} AND u.perms IN(\'admin\', \'user\')
-                             LIMIT  1', $user);
+                        INNER JOIN  aliases         AS a  ON (u.user_id = a.id AND a.type = 'a_vie')
+                        INNER JOIN  aliases         AS a2 ON (u.user_id = a2.id AND FIND_IN_SET('bestalias', a2.flags))
+                             WHERE  u.user_id = {?} AND u.perms IN('admin', 'user')
+                             LIMIT  1", $user);
         $sess = $res->fetchOneAssoc();
         $perms = $sess['perms'];
         unset($sess['perms']);
         $_SESSION = array_merge($_SESSION, $sess);
-        $this->makePerms($perms);
+        S::set('perms', User::makePerms($perms));
         S::kill('challenge');
         S::kill('loginX');
         S::kill('may_update');
@@ -130,12 +126,26 @@ class XnetSession extends PlSession
         return true;
     }
 
+    public function tokenAuth($login, $token)
+    {
+        $res = XDB::query('SELECT  u.hruid
+                             FROM  aliases         AS a
+                       INNER JOIN  auth_user_md5   AS u ON (a.id = u.user_id AND u.perms IN ("admin", "user"))
+                       INNER JOIN  auth_user_quick AS q ON (a.id = q.user_id AND q.core_rss_hash = {?})
+                            WHERE  a.alias = {?} AND a.type != "homonyme"', $token, $login);
+        if ($res->numRows() == 1) {
+            $data = $res->fetchOneAssoc();
+            return new User($res->fetchOneCell());
+        }
+        return null;
+    }
+
     public function doSelfSuid()
     {
         if (!$this->startSUID(S::i('uid'))) {
             return false;
         }
-        $this->makePerms('user');
+        S::set('perms', User::makePerms('user'));
         return true;
     }
 
@@ -149,7 +159,6 @@ class XnetSession extends PlSession
         S::kill('may_update');
         S::kill('is_member');
         S::set('perms', $suid['perms']);
-        S::set('perms_backup', $suid['perms_backup']);
         return true;
     }
 
@@ -158,7 +167,6 @@ class XnetSession extends PlSession
         $flags = new PlFlagSet();
         if ($perm == 'disabled' || $perm == 'ext') {
             S::set('perms', $flags);
-            S::set('perms_backup', $flags);
             return;
         }
         $flags->addFlag(PERMS_USER);
@@ -166,7 +174,11 @@ class XnetSession extends PlSession
             $flags->addFlag(PERMS_ADMIN);
         }
         S::set('perms', $flags);
-        S::set('perms_backup', $flags);
+    }
+
+    public function loggedLevel()
+    {
+        return AUTH_COOKIE;
     }
 
     public function sureLevel()