X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fauth.php;h=e222eebb05a657a9de4d8b47e9ba3ab2f4943af9;hb=82f1afdea040757a970bfd9e859a87981c23d4e9;hp=21f85bfd108bba55009150c2f85fae17cb6fd9c4;hpb=d89a495539357b3ad30f7b891bd23d1805355a52;p=platal.git

diff --git a/modules/auth.php b/modules/auth.php
index 21f85bf..e222eeb 100644
--- a/modules/auth.php
+++ b/modules/auth.php
@@ -30,9 +30,9 @@ class AuthModule extends PLModule
             'webservices/manageurs.php'     => $this->make_hook('manageurs',          AUTH_PUBLIC, 'user', NO_HTTPS),
 
             'auth-redirect.php'             => $this->make_hook('redirect',           AUTH_COOKIE, 'user'),
-            'auth-groupex.php'              => $this->make_hook('groupex_old',        AUTH_COOKIE, 'user'),
-            'auth-groupex'                  => $this->make_hook('groupex',            AUTH_PUBLIC),
-            'admin/auth-groupes-x'          => $this->make_hook('admin_authgroupesx', AUTH_MDP,    'admin'),
+            'auth-groupex.php'              => $this->make_hook('groupex_old',        AUTH_COOKIE, ''),
+            'auth-groupex'                  => $this->make_hook('groupex',            AUTH_PUBLIC, ''),
+            'admin/auth-groupes-x'          => $this->make_hook('admin_authgroupesx', AUTH_PASSWD, 'admin'),
         );
     }
 
@@ -118,8 +118,11 @@ class AuthModule extends PLModule
      */
     function handler_groupex($page, $charset = 'utf8')
     {
+        $ext_url = urldecode(Get::s('url'));
+
         if (!S::logged()) {
-            $page->assign('referer', true);
+            $page->assign('external_auth', true);
+            $page->assign('ext_url', $ext_url);
             $page->setTitle('Authentification');
             $page->setDefaultSkin('group_login');
 
@@ -134,21 +137,24 @@ class AuthModule extends PLModule
             return PL_DO_AUTH;
         }
 
+        if (!S::user()->checkPerms('groups')) {
+            return PL_FORBIDDEN;
+        }
+
         $this->load('auth.inc.php');
 
         $gpex_pass = Get::s('pass');
-        $gpex_url  = urldecode(Get::s('url'));
         if (Get::has('session')) {
-            if (strpos($gpex_url, '?') === false) {
-                $gpex_url .= "?PHPSESSID=" . Get::s('session');
+            if (strpos($ext_url, '?') === false) {
+                $ext_url .= "?PHPSESSID=" . Get::s('session');
             } else {
-                $gpex_url .= "&PHPSESSID=" . Get::s('session');
+                $ext_url .= "&PHPSESSID=" . Get::s('session');
             }
         }
 
         // Normalize the return URL.
-        if (!preg_match("/^(http|https):\/\/.*/",$gpex_url)) {
-            $gpex_url = "http://$gpex_url";
+        if (!preg_match("/^(http|https):\/\/.*/",$ext_url)) {
+            $ext_url = "http://$ext_url";
         }
         $gpex_challenge = Get::s('challenge');
 
@@ -160,7 +166,7 @@ class AuthModule extends PLModule
         }
 
         if (Get::has('group')) {
-            $req_group_id = XDB::fetchOneCell('SELECT  asso_id
+            $req_group_id = XDB::fetchOneCell('SELECT  id
                                                  FROM  groups
                                                 WHERE  diminutif = {?}',
                                               Get::s('group'));
@@ -181,8 +187,8 @@ class AuthModule extends PLModule
                 // We check that the return url matches a per-key regexp to prevent
                 // replay attacks (more exactly to force replay attacks to redirect
                 // the user to the real GroupeX website, which defeats the attack).
-                if (empty($returnurls) || @preg_match($returnurls, $gpex_url)) {
-                    $returl = $gpex_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
+                if (empty($returnurls) || @preg_match($returnurls, $ext_url)) {
+                    $returl = $ext_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
                     XDB::execute('UPDATE  group_auth
                                      SET  last_used = DATE(NOW())
                                    WHERE  name = {?}',
@@ -219,9 +225,18 @@ class AuthModule extends PLModule
                         $page->kill("Le site demandé est réservé aux polytechniciens.");
                     }
 
+                    // If we logged in specifically for this 'external_auth' request
+                    // and didn't want to "keep access to services", we kill the session
+                    // just before returning.
+                    // See classes/xorgsession.php:startSessionAs
+                    if (S::b('external_auth_exit')) {
+                        S::logger()->log('decconnexion', @$_SERVER['HTTP_REFERER']);
+                        Platal::session()->killAccessCookie();
+                        Platal::session()->destroy();
+                    }
                     http_redirect($returl);
                 } else if (S::admin()) {
-                    $page->kill("La requête d'authentification a échouée (url de retour invalide).");
+                    $page->kill("La requête d'authentification a échoué (url de retour invalide).");
                 }
             }
         }