'webservices/manageurs.php' => $this->make_hook('manageurs', AUTH_PUBLIC, 'user', NO_HTTPS),
- 'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE),
- 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE),
- 'auth-groupex' => $this->make_hook('groupex', AUTH_COOKIE),
+ 'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE, 'user'),
+ 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE, 'user'),
+ 'auth-groupex' => $this->make_hook('groupex', AUTH_PUBLIC),
'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_MDP, 'admin'),
);
}
return $this->handler_groupex($page, 'iso-8859-1');
}
+ /** Handles the 'auth-groupe-x' authentication.
+ * Expects the following GET parameters:
+ * - pass: the 'password' for the authentication
+ * - challenge: the authentication challenge
+ * - url: the return URL
+ * - session: the remote PHP session ID
+ */
function handler_groupex($page, $charset = 'utf8')
{
+ if (!S::logged()) {
+ $page->assign('referer', true);
+ return PL_DO_AUTH;
+ }
+
$this->load('auth.inc.php');
- $page->assign('referer', true);
-
- $gpex_pass = $_GET["pass"];
- $gpex_url = urldecode($_GET["url"]);
- if (strpos($gpex_url, '?') === false) {
- $gpex_url .= "?PHPSESSID=" . $_GET["session"];
- } else {
- $gpex_url .= "&PHPSESSID=" . $_GET["session"];
+
+ $gpex_pass = Get::s('pass');
+ $gpex_url = urldecode(Get::s('url'));
+ if (Get::has('session')) {
+ if (strpos($gpex_url, '?') === false) {
+ $gpex_url .= "?PHPSESSID=" . Get::s('session');
+ } else {
+ $gpex_url .= "&PHPSESSID=" . Get::s('session');
+ }
}
// Normalize the return URL.
if (!preg_match("/^(http|https):\/\/.*/",$gpex_url)) {
$gpex_url = "http://$gpex_url";
}
- $gpex_challenge = $_GET["challenge"];
+ $gpex_challenge = Get::s('challenge');
// Update the last login information (unless the user is in SUID).
$uid = S::i('uid');
// Iterate over the auth token to find which one did sign the request.
$res = XDB::iterRow('SELECT privkey, name, datafields, returnurls FROM group_auth');
- while (list($privkey,$name,$datafields,$returnurls) = $res->next()) {
+ while (list($privkey, $name, $datafields, $returnurls) = $res->next()) {
if (md5($gpex_challenge.$privkey) == $gpex_pass) {
$returnurls = trim($returnurls);
// We check that the return url matches a per-key regexp to prevent
// the user to the real GroupeX website, which defeats the attack).
if (empty($returnurls) || @preg_match($returnurls, $gpex_url)) {
$returl = $gpex_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
+ XDB::execute('UPDATE group_auth
+ SET last_used = DATE(NOW())
+ WHERE name = {?}',
+ $name);
http_redirect($returl);
} else if (S::admin()) {
$page->kill("La requête d'authentification a échouée (url de retour invalide).");
$page->assign('title', 'Gestion de l\'authentification centralisée');
$table_editor = new PLTableEditor('admin/auth-groupes-x','group_auth','id');
$table_editor->describe('name','nom',true);
- $table_editor->describe('privkey','clé privée',false);
+ $table_editor->describe('privkey','clé privée',false, true);
$table_editor->describe('datafields','champs renvoyés',true);
$table_editor->describe('returnurls','urls de retour',true);
+ $table_editor->describe('last_used', 'dernière utilisation', true);
$table_editor->apply($page, $action, $id);
}
}