X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fauth.php;h=688c5c5eeb31ad106639737562c484abcacfb7be;hb=658cffd4cd8d42cb5c394663b00514dae036f834;hp=73d976074344f0a6a95810d3d26de00912ff4345;hpb=e5ceaa8c8943660e5995c68c22e6646e85613006;p=platal.git

diff --git a/modules/auth.php b/modules/auth.php
index 73d9760..688c5c5 100644
--- a/modules/auth.php
+++ b/modules/auth.php
@@ -30,9 +30,9 @@ class AuthModule extends PLModule
             'webservices/manageurs.php'     => $this->make_hook('manageurs',          AUTH_PUBLIC, 'user', NO_HTTPS),
 
             'auth-redirect.php'             => $this->make_hook('redirect',           AUTH_COOKIE, 'user'),
-            'auth-groupex.php'              => $this->make_hook('groupex_old',        AUTH_COOKIE, 'user'),
-            'auth-groupex'                  => $this->make_hook('groupex',            AUTH_COOKIE, 'user'),
-            'admin/auth-groupes-x'          => $this->make_hook('admin_authgroupesx', AUTH_MDP,    'admin'),
+            'auth-groupex.php'              => $this->make_hook('groupex_old',        AUTH_COOKIE, ''),
+            'auth-groupex'                  => $this->make_hook('groupex',            AUTH_PUBLIC, ''),
+            'admin/auth-groupes-x'          => $this->make_hook('admin_authgroupesx', AUTH_PASSWD, 'admin'),
         );
     }
 
@@ -109,24 +109,52 @@ class AuthModule extends PLModule
         return $this->handler_groupex($page, 'iso-8859-1');
     }
 
+    /** Handles the 'auth-groupe-x' authentication.
+     * Expects the following GET parameters:
+     * - pass: the 'password' for the authentication
+     * - challenge: the authentication challenge
+     * - url: the return URL
+     * - session: the remote PHP session ID
+     */
     function handler_groupex($page, $charset = 'utf8')
     {
+        if (!S::logged()) {
+            $page->assign('referer', true);
+            $page->setTitle('Authentification');
+            $page->setDefaultSkin('group_login');
+
+            if (Get::has('group')) {
+                $res = XDB::query('SELECT  nom
+                                     FROM  groups
+                                    WHERE  diminutif = {?}', Get::s('group'));
+                $page->assign('group', $res->fetchOneCell());
+            } else {
+                $page->assign('group', null);
+            }
+            return PL_DO_AUTH;
+        }
+
+        if (!S::user()->checkPerms('groups')) {
+            return PL_FORBIDDEN;
+        }
+
         $this->load('auth.inc.php');
-        $page->assign('referer', true);
 
-        $gpex_pass = $_GET["pass"];
-        $gpex_url  = urldecode($_GET["url"]);
-        if (strpos($gpex_url, '?') === false) {
-            $gpex_url .= "?PHPSESSID=" . $_GET["session"];
-        } else {
-            $gpex_url .= "&PHPSESSID=" . $_GET["session"];
+        $gpex_pass = Get::s('pass');
+        $gpex_url  = urldecode(Get::s('url'));
+        if (Get::has('session')) {
+            if (strpos($gpex_url, '?') === false) {
+                $gpex_url .= "?PHPSESSID=" . Get::s('session');
+            } else {
+                $gpex_url .= "&PHPSESSID=" . Get::s('session');
+            }
         }
 
         // Normalize the return URL.
         if (!preg_match("/^(http|https):\/\/.*/",$gpex_url)) {
             $gpex_url = "http://$gpex_url";
         }
-        $gpex_challenge = $_GET["challenge"];
+        $gpex_challenge = Get::s('challenge');
 
         // Update the last login information (unless the user is in SUID).
         $uid = S::i('uid');
@@ -135,9 +163,23 @@ class AuthModule extends PLModule
             S::logger($uid)->log('connexion_auth_ext', $platal->path.' '.urldecode($_GET['url']));
         }
 
+        if (Get::has('group')) {
+            $req_group_id = XDB::fetchOneCell('SELECT  id
+                                                 FROM  groups
+                                                WHERE  diminutif = {?}',
+                                              Get::s('group'));
+        } else {
+            $req_group_id = null;
+        }
+
         // Iterate over the auth token to find which one did sign the request.
-        $res = XDB::iterRow('SELECT privkey, name, datafields, returnurls FROM group_auth');
-        while (list($privkey,$name,$datafields,$returnurls) = $res->next()) {
+        $res = XDB::iterRow(
+            'SELECT  ga.privkey, ga.name, ga.datafields, ga.returnurls,
+                     ga.group_id, ga.flags, g.nom
+               FROM  group_auth AS ga
+          LEFT JOIN  groups AS g ON (g.id = ga.group_id)');
+
+        while (list($privkey, $name, $datafields, $returnurls, $group_id, $group_flags, $group_name) = $res->next()) {
             if (md5($gpex_challenge.$privkey) == $gpex_pass) {
                 $returnurls = trim($returnurls);
                 // We check that the return url matches a per-key regexp to prevent
@@ -149,6 +191,38 @@ class AuthModule extends PLModule
                                      SET  last_used = DATE(NOW())
                                    WHERE  name = {?}',
                                  $name);
+
+                    // Two conditions control access to the return URL:
+                    // - If that URL is attached to a group:
+                    //   - If the user belongs to the group, OK
+                    //   - If the user is 'xnet' and doesn't belong, NOK
+                    //   - If the user is not 'xnet' and the group is not 'strict', OK
+                    //   - If the user is not 'xnet' and the group is 'strict', NOK
+                    // - Otherwise, all but 'xnet' accounts may access the URL.
+                    $user_is_xnet = S::user()->type == 'xnet';
+                    $group_flags = new PlFlagSet($group_flags);
+
+                    // If this key is not attached to a group, but a group was
+                    // requested (e.g query from wiki / blogs / ...), use the
+                    // requested group_id.
+                    if (!$group_id && $req_group_id) {
+                        $group_id = $req_group_id;
+                    }
+
+                    if ($group_id) {
+                        // Check group permissions
+                        $is_member = XDB::fetchOneCell('SELECT  COUNT(*)
+                                                          FROM  group_members
+                                                         WHERE  uid = {?} AND asso_id = {?}',
+                                                         S::user()->id(), $group_id);
+                        if (!$is_member && ($user_is_xnet || $group_flags->hasFlag('group_only'))) {
+                            $page->kill("Le site demandé est réservé aux membres du groupe $group_name.");
+                        }
+
+                    } else if ($user_is_xnet && !$group_flags->hasFlag('allow_xnet')) {
+                        $page->kill("Le site demandé est réservé aux polytechniciens.");
+                    }
+
                     http_redirect($returl);
                 } else if (S::admin()) {
                     $page->kill("La requête d'authentification a échouée (url de retour invalide).");