'webservices/manageurs.php' => $this->make_hook('manageurs', AUTH_PUBLIC, 'user', NO_HTTPS),
'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE, 'user'),
- 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE, 'user'),
- 'auth-groupex' => $this->make_hook('groupex', AUTH_PUBLIC),
- 'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_MDP, 'admin'),
+ 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE, ''),
+ 'auth-groupex' => $this->make_hook('groupex', AUTH_PUBLIC, ''),
+ 'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_PASSWD, 'admin'),
);
}
*/
function handler_groupex($page, $charset = 'utf8')
{
+ $ext_url = urldecode(Get::s('url'));
+
if (!S::logged()) {
- $page->assign('referer', true);
+ $page->assign('external_auth', true);
+ $page->assign('ext_url', $ext_url);
$page->setTitle('Authentification');
$page->setDefaultSkin('group_login');
} else {
$page->assign('group', null);
}
+ // Add a P3P header for compatibility with IE in iFrames (http://www.w3.org/TR/P3P11/#compact_policies)
+ header('P3P: CP="CAO COR CURa ADMa DEVa OUR IND PHY ONL COM NAV DEM CNT STA PRE"');
return PL_DO_AUTH;
}
+ if (!S::user()->checkPerms('groups')) {
+ return PL_FORBIDDEN;
+ }
+
$this->load('auth.inc.php');
$gpex_pass = Get::s('pass');
- $gpex_url = urldecode(Get::s('url'));
if (Get::has('session')) {
- if (strpos($gpex_url, '?') === false) {
- $gpex_url .= "?PHPSESSID=" . Get::s('session');
+ if (strpos($ext_url, '?') === false) {
+ $ext_url .= "?PHPSESSID=" . Get::s('session');
} else {
- $gpex_url .= "&PHPSESSID=" . Get::s('session');
+ $ext_url .= "&PHPSESSID=" . Get::s('session');
}
}
// Normalize the return URL.
- if (!preg_match("/^(http|https):\/\/.*/",$gpex_url)) {
- $gpex_url = "http://$gpex_url";
+ if (!preg_match("/^(http|https):\/\/.*/",$ext_url)) {
+ $ext_url = "http://$ext_url";
}
$gpex_challenge = Get::s('challenge');
}
if (Get::has('group')) {
- $req_group_id = XDB::fetchOneCell('SELECT asso_id
+ $req_group_id = XDB::fetchOneCell('SELECT id
FROM groups
WHERE diminutif = {?}',
Get::s('group'));
// We check that the return url matches a per-key regexp to prevent
// replay attacks (more exactly to force replay attacks to redirect
// the user to the real GroupeX website, which defeats the attack).
- if (empty($returnurls) || @preg_match($returnurls, $gpex_url)) {
- $returl = $gpex_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
+ if (empty($returnurls) || @preg_match($returnurls, $ext_url)) {
+ $returl = $ext_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
XDB::execute('UPDATE group_auth
SET last_used = DATE(NOW())
WHERE name = {?}',
$page->kill("Le site demandé est réservé aux polytechniciens.");
}
+ // If we logged in specifically for this 'external_auth' request
+ // and didn't want to "keep access to services", we kill the session
+ // just before returning.
+ // See classes/xorgsession.php:startSessionAs
+ if (S::b('external_auth_exit')) {
+ S::logger()->log('decconnexion', @$_SERVER['HTTP_REFERER']);
+ Platal::session()->killAccessCookie();
+ Platal::session()->destroy();
+ }
http_redirect($returl);
} else if (S::admin()) {
- $page->kill("La requête d'authentification a échouée (url de retour invalide).");
+ $page->kill("La requête d'authentification a échoué (url de retour invalide).");
}
}
}