X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=class.xorg.auth.php;h=e2290b8424e33fe55a0a035bf2c52492ff6a90d6;hb=HEAD;hp=5fe2e08be8e55fad1eb26a3edc820c66ad001352;hpb=ccfabbd3840033817a7aff4df6c014042c64b27b;p=dotclear.git

diff --git a/class.xorg.auth.php b/class.xorg.auth.php
index 5fe2e08..e2290b8 100644
--- a/class.xorg.auth.php
+++ b/class.xorg.auth.php
@@ -1,78 +1,151 @@
 <?php
 
-require_once dirname(__FILE__) . '/../../inc/core/class.dc.auth.php';
+if (!defined('DC_BLOG_ID')) {
+  define('DC_BLOG_ID', $_SERVER['DC_BLOG_ID']);
+}
 
 class xorgAuth extends dcAuth {
-  private $forceSU = false;
-
   public $xorg_infos = array('forlife' => null,
                              'prenom' => null,
-                             'nom' => null);
+                             'nom' => null,
+                             'grpauth' => null,
+                             'perms' => null);
+  static public function behavior_coreBlogConstruct($blog) {
+    global $core;
+    $core->auth->sudo(array($core->auth, 'updateUserPerms'), $blog);
+  }
 
-  public function __construct(&$core) {
+  public function __construct($core) {
     parent::__construct($core);
+    $core->addBehavior('coreBlogConstruct', array('xorgAuth', 'behavior_coreBlogConstruct'));
   }
 
-  private function buildFromSession() {
+  public function buildFromSession() {
     global $core;
+    @header('Last-Modified:');
     if (!isset($core) || !isset($core->session)) {
       return;
     }
-    $core->session->start();
-    if (@$_SESSION['auth-xorg'] && is_null($this->xorg_infos['forlife'])) {
+    if (!session_id()) {
+      $core->session->start();
+    }
+    $_SESSION['sess_blog_id'] = $_SERVER['DC_BLOG_ID'];
+    $user = @$_SESSION['auth-xorg'];
+    if ($user && is_null($this->xorg_infos['forlife'])) {
       foreach ($this->xorg_infos as $key => $val) {
         $this->xorg_infos[$key] = $_SESSION['auth-xorg-' . $key];
       }
-      $this->user_id = $_SESSION['auth-xorg'];
+      $this->user_id = $user;
+      $this->user_admin = ($_SESSION['auth-xorg-perms'] == 'admin');
+      parent::checkUser($this->user_id);
+//      $core->getUserBlogs();
+      $this->setCommentCookie();
     }
   }
 
-  public function callXorg($path = null) {
-    if (is_null($path)) {
-      $path = $_SERVER['REQUEST_URI'];
-    }
-    $this->buildFromSession();
-    if (@$_SESSION['auth-xorg']) {
-      return true;
+  private function setCommentCookie() {
+    if (!isset($_COOKIE['comment_info_xorg']) || $_COOKIE['comment_info_xorg'] != $this->user_id) {
+      $cookie = $this->getInfo('user_displayname') . "\n" . $this->getInfo('user_email') . "\n" . $this->getInfo('user_url');
+      setcookie('comment_info_xorg', $this->user_id, time() + 30 * 86400, '/');
+      setrawcookie('comment_info', rawurlencode($cookie), time() + 30 * 86400, '/');
     }
-    $_SESSION["auth-x-challenge"] = md5(uniqid(rand(), 1));
-    $url = "https://www.polytechnique.org/auth-groupex/utf8";
-    $url .= "?session=" . session_id();
-    $url .= "&challenge=" . $_SESSION["auth-x-challenge"];
-    $url .= "&pass=" . md5($_SESSION["auth-x-challenge"] . XORG_AUTH_KEY);
-    $url .= "&url=http://murphy.m4x.org/~x2003bruneau/dotclear/auth/XorgReturn" . urlencode("?path=" . $path);
-    session_write_close();
-    header("Location: $url");
-    exit;
-  }
-
-  private function acquireAdminRights() {
-    $this->forceSU = true;
   }
 
-  private function releaseAdminRights() {
-    $this->forceSU = false;
-  }
-
-  private function createUser() {
+  public function createUser() {
     global $core;
-    $this->acquireAdminRights();
     if (!$core->userExists($_SESSION['auth-xorg'])) {
       $cur = new cursor($this->con, 'dc_user');
       $cur->user_id = $_SESSION['auth-xorg'];
       $cur->user_pwd = md5(rand());
+      $cur->user_super = ($_SESSION['auth-xorg-perms'] == 'admin') ? '1' : '0';
       $cur->user_lang = 'fr';
       $cur->user_name = $_SESSION['auth-xorg-nom'];
       $cur->user_firstname = $_SESSION['auth-xorg-prenom'];
+      $cur->user_displayname = $cur->user_firstname . ' ' . $cur->user_name;
       $cur->user_email = $_SESSION['auth-xorg'] . '@polytechnique.org';
-      $cur->user_options = $core->userDefaults();
-      $cur->user_default_blog = 'default'; // FIXME
+      $cur->user_url = 'https://www.polytechnique.org/profile/' . $_SESSION['auth-xorg'];
+      $defaults = $core->userDefaults();
+      $defaults['post_xorg_perms'] = 'public';
+      $cur->user_options = $defaults;
+      $cur->user_lang = 'fr';
+      $cur->user_tz = 'Europe/Paris';
+      $cur->user_default_blog = $_SERVER['DC_BLOG_ID'];
       $core->addUser($cur);
-      $core->setUserBlogPermissions($_SESSION['auth-xorg'], 'default', array('usage' => true,
-                                                                             'contentadmin' => true,
-                                                                             'admin' => true));
     }
-    $this->releaseAdminRights();
+  }
+
+  public function updateUserPerms($blog) {
+    global $core;
+    $this->buildFromSession();
+    if (!isset($_SESSION['auth-xorg'])) {
+      return;
+    }
+    $type = $blog->settings->xorgauth->get('xorg_blog_type');
+    $owner = $blog->settings->xorgauth->get('xorg_blog_owner');
+    $level = $this->xorg_infos['grpauth'];
+    $rec = $core->getUser($this->user_id);
+    $wasAdmin = $rec->f('user_super');
+    $isAdmin = $this->xorg_infos['perms'] == 'admin';
+    if (($wasAdmin && !$isAdmin) || (!$wasAdmin && $isAdmin)) {
+      $cur = new cursor($this->con, 'dc_user');
+      $cur->user_super = $isAdmin ? '1' : '0';
+      $core->updUser($this->user_id, $cur);
+    }
+    if ($_SESSION['xorg-group'] != $owner) {
+      $this->killSession();
+      return;
+    }
+    if (($type == 'group-admin' || $type == 'group-member' || $type == 'connected') && $level == 'admin') {
+      $perms = array('usage' => true,
+                     'contentadmin' => true,
+                     'admin' => true);
+    } else if ($type == 'group-member' && $level == 'membre') {
+      $perms = array('usage' => true);
+    } else if ($type == 'connected' && $this->xorg_infos['forlife'] != '') {
+      $perms = array('usage' => true);
+    } else if ($type == 'user' && $owner == $this->xorg_infos['forlife']) {
+      $perms = array('usage' => true,
+                     'contentadmin' => true,
+                     'admin' => true);
+    } else if ($type != 'user') {
+      $perms = array();
+    } else {
+      return;
+    }
+    $core->setUserBlogPermissions($_SESSION['auth-xorg'],
+                                  $blog->id,
+                                  $perms);
+  }
+
+
+  /** Xorg SSO API */
+
+  public function callXorg($path = null) {
+    $this->buildFromSession();
+    if (@$_SESSION['auth-xorg']) {
+      return true;
+    }
+    global $core;
+    if (!session_id()) {
+      $core->session->start();
+    }
+    if (is_null($path)) {
+      $path = @$_SERVER['PATH_INFO'];
+    }
+    $_SESSION["auth-x-challenge"] = md5(uniqid(rand(), 1));
+    $_SESSION['xorg-group'] = $core->blog->settings->xorgauth->get('xorg_blog_owner');
+    $url = "https://www.polytechnique.org/auth-groupex/utf8";
+    $url .= "?session=" . session_id();
+    $url .= "&challenge=" . $_SESSION["auth-x-challenge"];
+    $url .= "&pass=" . md5($_SESSION["auth-x-challenge"] . XORG_AUTH_KEY);
+    $type = $core->blog->settings->xorgauth->get('xorg_blog_type');
+    if ($type == 'group-member' || $type == 'group-admin' || $type == 'connected') {
+      $url .= '&group=' . $core->blog->settings->xorgauth->get('xorg_blog_owner');
+    }
+    $url .= "&url=" . urlencode($core->blog->url . "auth/XorgReturn?path=" . $path);
+    session_write_close();
+    header("Location: $url");
+    exit;
   }
 
   public function returnXorg() {
@@ -81,7 +154,11 @@ class xorgAuth extends dcAuth {
     }
     $params = '';
     global $core;
-    $core->session->start();
+    $_COOKIE[DC_SESSION_NAME] = $_GET['PHPSESSID'];
+    unset($_GET['PHPSESSID']);
+    if (!session_id()) {
+      $core->session->start();
+    }
     foreach($this->xorg_infos as $key => $val) {
       if(!isset($_GET[$key])) {
         return false;
@@ -94,8 +171,9 @@ class xorgAuth extends dcAuth {
       $_SESSION['sess_user_id'] = $_SESSION['auth-xorg'] = $_GET['forlife'];
 		  $_SESSION['sess_browser_uid'] = http::browserUID(DC_MASTER_KEY);
       $_SESSION['sess_blog_id'] = 'default';
-      $this->createUser();
-      header("Location: http://murphy.m4x.org" . $_GET['path']);
+      $this->sudo(array($this, 'createUser'));
+      $path = $_GET['path'];
+      header('Location: ' . $core->blog->url . $_GET['path']);
       exit;
     }
     unset($_SESSION['auth-xorg']);
@@ -107,17 +185,29 @@ class xorgAuth extends dcAuth {
 
   public function killSession() {
     global $core;
-    $core->session->start();
+    if (!session_id()) {
+      $core->session->start();
+    }
     $core->session->destroy();
-    header('Location: http://murphy.m4x.org/~x2003bruneau/dotclear/');
+    if (!isset($core->blog)) {
+      $blog = $core->getBlog(DC_BLOG_ID);
+    } else {
+      $blog = $core->blog;
+    }
+    $url = @$blog->url;
+    if (!$url) {
+      $url = $blog->f('blog_url');
+    }
+
+    header('Location: ' . $url);
     exit;
   }
 
+
+  /** Dotclear dcAuth API */
+
   public function checkUser($user_id, $pwd = null, $user_key = null) {
-    if (!$this->callXorg() || $user_id != $this->user_id) {
-      return false;
-    }
-    return parent::checkUser($this->user_id);
+    return $this->callXorg();
   }
 
   public function check($permissions, $blog_id) {
@@ -125,22 +215,39 @@ class xorgAuth extends dcAuth {
     return parent::check($permissions, $blog_id);
   }
 
+  public function checkPassword($pwd) {
+    $this->buildFromSession();
+    return !empty($this->user_id);
+  }
+
   public function allowPassChange() {
     return false;
   }
 
   public function userID() {
     $this->buildFromSession();
+    $isadmin = preg_match('@/admin/[^/]+\.php$@i', $_SERVER['SCRIPT_FILENAME']);
+    if (!$isadmin) {
+      return null;
+    }
     return parent::userID();
   }
 
-  public function getPermissions() {
+  public function getPermissions($blog_id) {
     $this->buildFromSession();
-    return parent::getPermissions();
+    return parent::getPermissions($blog_id);
   }
 
   public function getInfo($n) {
     $this->buildFromSession();
+    if ($n == 'xorg_group_member') {
+      global $core;
+      if ($core->blog->settings->xorgauth->get('xorg_blog_owner') != $_SESSION['xorg-group']) {
+        return false;
+      }
+      $perm = $this->xorg_infos['grpauth'];
+      return $this->isSuperAdmin() || $perm == 'admin' || $perm == 'membre';
+    }
     return parent::getInfo($n);
   }
 
@@ -149,14 +256,28 @@ class xorgAuth extends dcAuth {
     return parent::getOption($n);
   }
 
-  public function isSuperAdmin() {
-    return $this->forceSU || ($this->user_id == 'florent.bruneau.2003');
-  }
-
   public function getOptions() {
     $this->buildFromSession();
     return parent::getOptions();
   }
+
+  public function authForm() {
+    global $core;
+    if (!isset($core->blog)) {
+      $blog = @$core->getBlog(DC_BLOG_ID);
+    } else {
+      $blog = $core->blog;
+    }
+    $path = @$blog->url;
+    if (!$path) {
+      $path = $blog->f('blog_url');
+    }
+
+    return '<fieldset>'.
+      '<p><a href="' . $path . 'auth/Xorg?path=/admin/index.php">Via Polytechnique.org</a></p>' .
+      '</fieldset>'.
+      '<p>'.__('You must accept cookies in order to use the private area.').'</p>';
+  }
 }
 
 ?>