X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fauth.php;h=e222eebb05a657a9de4d8b47e9ba3ab2f4943af9;hb=e9a46d1a6839b5efc9a651a601fca80b9af70e7f;hp=f302f1bdcb3fcb3c89d4ffeeccab7f355395f36f;hpb=e22ff176d83e1f4ffd866e6ad928ee247906c6a5;p=platal.git diff --git a/modules/auth.php b/modules/auth.php index f302f1b..e222eeb 100644 --- a/modules/auth.php +++ b/modules/auth.php @@ -29,10 +29,10 @@ class AuthModule extends PLModule 'webservices/manageurs.php' => $this->make_hook('manageurs', AUTH_PUBLIC, 'user', NO_HTTPS), - 'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE), - 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE), - 'auth-groupex' => $this->make_hook('groupex', AUTH_COOKIE), - 'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_MDP, 'admin'), + 'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE, 'user'), + 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE, ''), + 'auth-groupex' => $this->make_hook('groupex', AUTH_PUBLIC, ''), + 'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_PASSWD, 'admin'), ); } @@ -109,24 +109,54 @@ class AuthModule extends PLModule return $this->handler_groupex($page, 'iso-8859-1'); } + /** Handles the 'auth-groupe-x' authentication. + * Expects the following GET parameters: + * - pass: the 'password' for the authentication + * - challenge: the authentication challenge + * - url: the return URL + * - session: the remote PHP session ID + */ function handler_groupex($page, $charset = 'utf8') { + $ext_url = urldecode(Get::s('url')); + + if (!S::logged()) { + $page->assign('external_auth', true); + $page->assign('ext_url', $ext_url); + $page->setTitle('Authentification'); + $page->setDefaultSkin('group_login'); + + if (Get::has('group')) { + $res = XDB::query('SELECT nom + FROM groups + WHERE diminutif = {?}', Get::s('group')); + $page->assign('group', $res->fetchOneCell()); + } else { + $page->assign('group', null); + } + return PL_DO_AUTH; + } + + if (!S::user()->checkPerms('groups')) { + return PL_FORBIDDEN; + } + $this->load('auth.inc.php'); - $page->assign('referer', true); - $gpex_pass = $_GET["pass"]; - $gpex_url = urldecode($_GET["url"]); - if (strpos($gpex_url, '?') === false) { - $gpex_url .= "?PHPSESSID=" . $_GET["session"]; - } else { - $gpex_url .= "&PHPSESSID=" . $_GET["session"]; + $gpex_pass = Get::s('pass'); + if (Get::has('session')) { + if (strpos($ext_url, '?') === false) { + $ext_url .= "?PHPSESSID=" . Get::s('session'); + } else { + $ext_url .= "&PHPSESSID=" . Get::s('session'); + } } // Normalize the return URL. - if (!preg_match("/^(http|https):\/\/.*/",$gpex_url)) { - $gpex_url = "http://$gpex_url"; + if (!preg_match("/^(http|https):\/\/.*/",$ext_url)) { + $ext_url = "http://$ext_url"; } - $gpex_challenge = $_GET["challenge"]; + $gpex_challenge = Get::s('challenge'); // Update the last login information (unless the user is in SUID). $uid = S::i('uid'); @@ -135,23 +165,78 @@ class AuthModule extends PLModule S::logger($uid)->log('connexion_auth_ext', $platal->path.' '.urldecode($_GET['url'])); } + if (Get::has('group')) { + $req_group_id = XDB::fetchOneCell('SELECT id + FROM groups + WHERE diminutif = {?}', + Get::s('group')); + } else { + $req_group_id = null; + } + // Iterate over the auth token to find which one did sign the request. - $res = XDB::iterRow('SELECT privkey, name, datafields, returnurls FROM group_auth'); - while (list($privkey,$name,$datafields,$returnurls) = $res->next()) { + $res = XDB::iterRow( + 'SELECT ga.privkey, ga.name, ga.datafields, ga.returnurls, + ga.group_id, ga.flags, g.nom + FROM group_auth AS ga + LEFT JOIN groups AS g ON (g.id = ga.group_id)'); + + while (list($privkey, $name, $datafields, $returnurls, $group_id, $group_flags, $group_name) = $res->next()) { if (md5($gpex_challenge.$privkey) == $gpex_pass) { $returnurls = trim($returnurls); // We check that the return url matches a per-key regexp to prevent // replay attacks (more exactly to force replay attacks to redirect // the user to the real GroupeX website, which defeats the attack). - if (empty($returnurls) || @preg_match($returnurls, $gpex_url)) { - $returl = $gpex_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset); + if (empty($returnurls) || @preg_match($returnurls, $ext_url)) { + $returl = $ext_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset); XDB::execute('UPDATE group_auth SET last_used = DATE(NOW()) WHERE name = {?}', $name); + + // Two conditions control access to the return URL: + // - If that URL is attached to a group: + // - If the user belongs to the group, OK + // - If the user is 'xnet' and doesn't belong, NOK + // - If the user is not 'xnet' and the group is not 'strict', OK + // - If the user is not 'xnet' and the group is 'strict', NOK + // - Otherwise, all but 'xnet' accounts may access the URL. + $user_is_xnet = S::user()->type == 'xnet'; + $group_flags = new PlFlagSet($group_flags); + + // If this key is not attached to a group, but a group was + // requested (e.g query from wiki / blogs / ...), use the + // requested group_id. + if (!$group_id && $req_group_id) { + $group_id = $req_group_id; + } + + if ($group_id) { + // Check group permissions + $is_member = XDB::fetchOneCell('SELECT COUNT(*) + FROM group_members + WHERE uid = {?} AND asso_id = {?}', + S::user()->id(), $group_id); + if (!$is_member && ($user_is_xnet || $group_flags->hasFlag('group_only'))) { + $page->kill("Le site demandé est réservé aux membres du groupe $group_name."); + } + + } else if ($user_is_xnet && !$group_flags->hasFlag('allow_xnet')) { + $page->kill("Le site demandé est réservé aux polytechniciens."); + } + + // If we logged in specifically for this 'external_auth' request + // and didn't want to "keep access to services", we kill the session + // just before returning. + // See classes/xorgsession.php:startSessionAs + if (S::b('external_auth_exit')) { + S::logger()->log('decconnexion', @$_SERVER['HTTP_REFERER']); + Platal::session()->killAccessCookie(); + Platal::session()->destroy(); + } http_redirect($returl); } else if (S::admin()) { - $page->kill("La requête d'authentification a échouée (url de retour invalide)."); + $page->kill("La requête d'authentification a échoué (url de retour invalide)."); } } }