class.xorg.auth.php

   1 <?php
   2
   3 if (!defined('DC_BLOG_ID')) {
   4   define('DC_BLOG_ID', $_SERVER['DC_BLOG_ID']);
   5 }
   6
   7 class xorgAuth extends dcAuth {
   8   public $xorg_infos = array('forlife' => null,
   9                              'prenom' => null,
  10                              'nom' => null,
  11                              'grpauth' => null,
  12                              'perms' => null);
  13   static public function behavior_coreBlogConstruct(&$blog) {
  14     global $core;
  15     $core->auth->sudo(array($core->auth, 'updateUserPerms'), $blog);
  16   }
  17
  18   public function __construct(&$core) {
  19     parent::__construct($core);
  20     $core->addBehavior('coreBlogConstruct', array('xorgAuth', 'behavior_coreBlogConstruct'));
  21   }
  22
  23   public function buildFromSession() {
  24     global $core;
  25     @header('Last-Modified:');
  26     if (!isset($core) || !isset($core->session)) {
  27       return;
  28     }
  29     if (!session_id()) {
  30       $core->session->start();
  31     }
  32     $_SESSION['sess_blog_id'] = $_SERVER['DC_BLOG_ID'];
  33     $user = @$_SESSION['auth-xorg'];
  34     if ($user && is_null($this->xorg_infos['forlife'])) {
  35       foreach ($this->xorg_infos as $key => $val) {
  36         $this->xorg_infos[$key] = $_SESSION['auth-xorg-' . $key];
  37       }
  38       $this->user_id = $user;
  39       $this->user_admin = ($_SESSION['auth-xorg-perms'] == 'admin');
  40       parent::checkUser($this->user_id);
  41       $core->getUserBlogs();
  42     }
  43   }
  44
  45   public function createUser() {
  46     global $core;
  47     if (!$core->userExists($_SESSION['auth-xorg'])) {
  48       $cur = new cursor($this->con, 'dc_user');
  49       $cur->user_id = $_SESSION['auth-xorg'];
  50       $cur->user_pwd = md5(rand());
  51       $cur->user_super = ($_SESSION['auth-xorg-perms'] == 'admin') ? '1' : '0';
  52       $cur->user_lang = 'fr';
  53       $cur->user_name = $_SESSION['auth-xorg-nom'];
  54       $cur->user_firstname = $_SESSION['auth-xorg-prenom'];
  55       $cur->user_displayname = $cur->user_firstname . ' ' . $cur->user_name;
  56       $cur->user_email = $_SESSION['auth-xorg'] . '@polytechnique.org';
  57       $cur->user_url = 'https://www.polytechnique.org/profile/' . $_SESSION['auth-xorg'];
  58       $defaults = $core->userDefaults();
  59       $defaults['post_xorg_perms'] = 'public';
  60       $cur->user_options = $defaults;
  61       $cur->user_lang = 'fr';
  62       $cur->user_tz = 'Europe/Paris';
  63       $cur->user_default_blog = $_SERVER['DC_BLOG_ID'];
  64       $core->addUser($cur);
  65     }
  66   }
  67
  68   public function updateUserPerms(&$blog) {
  69     global $core;
  70     $this->buildFromSession();
  71     if (!isset($_SESSION['auth-xorg'])) {
  72       return;
  73     }
  74     $type = $blog->settings->get('xorg_blog_type');
  75     $owner = $blog->settings->get('xorg_blog_owner');
  76     $level = $this->xorg_infos['grpauth'];
  77     $rec = $core->getUser($this->user_id);
  78     $wasAdmin = $rec->f('user_super');
  79     $isAdmin = $this->xorg_infos['perms'] == 'admin';
  80     if (($wasAdmin && !$isAdmin) || (!$wasAdmin && $isAdmin)) {
  81       $cur = new cursor($this->con, 'dc_user');
  82       $cur->user_super = $isAdmin ? '1' : '0';
  83       $core->updUser($this->user_id, $cur);
  84     }
  85     if ($_SESSION['xorg-group'] != $owner) {
  86       $this->killSession();
  87       return;
  88     }
  89     if (($type == 'group-admin' || $type == 'group-member') && $level == 'admin') {
  90       $perms = array('usage' => true,
  91                      'contentadmin' => true,
  92                      'admin' => true);
  93     } else if ($type == 'group-member' && $level == 'membre') {
  94       $perms = array('usage' => true);
  95     } else if ($type == 'user' && $owner == $this->xorg_infos['forlife']) {
  96       $perms = array('usage' => true,
  97                      'contentadmin' => true,
  98                      'admin' => true);
  99     } else if ($type != 'user') {
 100       $perms = array();
 101     } else {
 102       return;
 103     }
 104     $core->setUserBlogPermissions($_SESSION['auth-xorg'],
 105                                   $blog->id,
 106                                   $perms);
 107   }
 108
 109
 110   /** Xorg SSO API */
 111
 112   public function callXorg($path = null) {
 113     $this->buildFromSession();
 114     if (@$_SESSION['auth-xorg']) {
 115       return true;
 116     }
 117     global $core;
 118     if (!session_id()) {
 119       $core->session->start();
 120     }
 121     if (is_null($path)) {
 122       $path = @$_SERVER['PATH_INFO'];
 123     }
 124     $_SESSION["auth-x-challenge"] = md5(uniqid(rand(), 1));
 125     $_SESSION['xorg-group'] = $core->blog->settings->get('xorg_blog_owner');
 126     $url = "https://www.polytechnique.org/auth-groupex/utf8";
 127     $url .= "?session=" . session_id();
 128     $url .= "&challenge=" . $_SESSION["auth-x-challenge"];
 129     $url .= "&pass=" . md5($_SESSION["auth-x-challenge"] . XORG_AUTH_KEY);
 130     $type = $core->blog->settings->get('xorg_blog_type');
 131     if ($type == 'group-member' || $type == 'group-admin') {
 132       $url .= '&group=' . $core->blog->settings->get('xorg_blog_owner');
 133     }
 134     $url .= "&url=" . urlencode($core->blog->url . "auth/XorgReturn?path=" . $path);
 135     session_write_close();
 136     header("Location: $url");
 137     exit;
 138   }
 139
 140   public function returnXorg() {
 141     if (!isset($_GET['auth'])) {
 142       return false;
 143     }
 144     $params = '';
 145     global $core;
 146     $_COOKIE[DC_SESSION_NAME] = $_GET['PHPSESSID'];
 147     unset($_GET['PHPSESSID']);
 148     if (!session_id()) {
 149       $core->session->start();
 150     }
 151     foreach($this->xorg_infos as $key => $val) {
 152       if(!isset($_GET[$key])) {
 153         return false;
 154       }
 155       $_SESSION['auth-xorg-' . $key] = $_GET[$key];
 156       $params .= $_GET[$key];
 157     }
 158     if (md5('1' . $_SESSION['auth-x-challenge'] . XORG_AUTH_KEY . $params . '1') == $_GET['auth']) {
 159       unset($_GET['auth']);
 160       $_SESSION['sess_user_id'] = $_SESSION['auth-xorg'] = $_GET['forlife'];
 161                   $_SESSION['sess_browser_uid'] = http::browserUID(DC_MASTER_KEY);
 162       $_SESSION['sess_blog_id'] = 'default';
 163       $this->sudo(array($this, 'createUser'));
 164       $path = $_GET['path'];
 165       header('Location: ' . $core->blog->url . $_GET['path']);
 166       exit;
 167     }
 168     unset($_SESSION['auth-xorg']);
 169     unset($_SESSION['sess_user_id']);
 170     unset($_GET['auth']);
 171     echo "Failed !!!";
 172     return false;
 173   }
 174
 175   public function killSession() {
 176     global $core;
 177     if (!session_id()) {
 178       $core->session->start();
 179     }
 180     $core->session->destroy();
 181     if (!isset($core->blog)) {
 182       $blog = $core->getBlog(DC_BLOG_ID);
 183     } else {
 184       $blog = $core->blog;
 185     }
 186     $url = @$blog->url;
 187     if (!$url) {
 188       $url = $blog->f('blog_url');
 189     }
 190
 191     header('Location: ' . $url);
 192     exit;
 193   }
 194
 195
 196   /** Dotclear dcAuth API */
 197
 198   public function checkUser($user_id, $pwd = null, $user_key = null) {
 199     return $this->callXorg();
 200   }
 201
 202   public function check($permissions, $blog_id) {
 203     $this->buildFromSession();
 204     return parent::check($permissions, $blog_id);
 205   }
 206
 207   public function checkPassword($pwd) {
 208     $this->buildFromSession();
 209     return !empty($this->user_id);
 210   }
 211
 212   public function allowPassChange() {
 213     return false;
 214   }
 215
 216   public function userID() {
 217     $this->buildFromSession();
 218     $isadmin = preg_match('@/admin/[^/]+\.php$@i', $_SERVER['SCRIPT_FILENAME']);
 219     if (!$isadmin) {
 220       return null;
 221     }
 222     return parent::userID();
 223   }
 224
 225   public function getPermissions() {
 226     $this->buildFromSession();
 227     return parent::getPermissions();
 228   }
 229
 230   public function getInfo($n) {
 231     $this->buildFromSession();
 232     if ($n == 'xorg_group_member') {
 233       global $core;
 234       if ($core->blog->settings('xorg_blog_owner') != $_SESSION['xorg-group']) {
 235         return false;
 236       }
 237       $perm = $this->xorg_infos['grpauth'];
 238       return $this->isSuperAdmin() || $perm == 'admin' || $perm == 'membre';
 239     }
 240     return parent::getInfo($n);
 241   }
 242
 243   public function getOption($n) {
 244     $this->buildFromSession();
 245     return parent::getOption($n);
 246   }
 247
 248   public function getOptions() {
 249     $this->buildFromSession();
 250     return parent::getOptions();
 251   }
 252
 253   public function authForm() {
 254     global $core;
 255     if (!isset($core->blog)) {
 256       $blog = @$core->getBlog(DC_BLOG_ID);
 257     } else {
 258       $blog = $core->blog;
 259     }
 260     $path = @$blog->url;
 261     if (!$path) {
 262       $path = $blog->f('blog_url');
 263     }
 264
 265     return '<fieldset>'.
 266       '<p><a href="' . $path . 'auth/Xorg?path=/admin/index.php">Via Polytechnique.org</a></p>' .
 267       '</fieldset>'.
 268       '<p>'.__('You must accept cookies in order to use the private area.').'</p>';
 269   }
 270 }
 271
 272 ?>