class.xorg.auth.php

   1 <?php
   2
   3 class xorgAuth extends dcAuth {
   4   public $xorg_infos = array('forlife' => null,
   5                              'prenom' => null,
   6                              'nom' => null,
   7                              'grpauth' => null,
   8                              'perms' => null);
   9   static public function behavior_coreBlogConstruct(&$blog) {
  10     global $core;
  11     $core->auth->sudo(array($core->auth, 'updateUserPerms'), $blog);
  12   }
  13
  14
  15   public function __construct(&$core) {
  16     parent::__construct($core);
  17     $core->addBehavior('coreBlogConstruct', array('xorgAuth', 'behavior_coreBlogConstruct'));
  18   }
  19
  20   public function buildFromSession() {
  21     global $core;
  22     @header('Last-Modified:');
  23     if (!isset($core) || !isset($core->session)) {
  24       return;
  25     }
  26     if (!session_id()) {
  27       $core->session->start();
  28     }
  29     $user = @$_SESSION['auth-xorg'];
  30     if ($user && is_null($this->xorg_infos['forlife'])) {
  31       foreach ($this->xorg_infos as $key => $val) {
  32         $this->xorg_infos[$key] = $_SESSION['auth-xorg-' . $key];
  33       }
  34       $this->user_id = $user;
  35       $this->user_admin = ($_SESSION['auth-xorg-perms'] == 'admin');
  36       parent::checkUser($this->user_id);
  37       $core->getUserBlogs();
  38     }
  39   }
  40
  41   public function createUser() {
  42     global $core;
  43     if (!$core->userExists($_SESSION['auth-xorg'])) {
  44       $cur = new cursor($this->con, 'dc_user');
  45       $cur->user_id = $_SESSION['auth-xorg'];
  46       $cur->user_pwd = md5(rand());
  47       $cur->user_super = ($_SESSION['auth-xorg-perms'] == 'admin');
  48       $cur->user_lang = 'fr';
  49       $cur->user_name = $_SESSION['auth-xorg-nom'];
  50       $cur->user_firstname = $_SESSION['auth-xorg-prenom'];
  51       $cur->user_displayname = $cur->user_firstname . ' ' . $cur->user_name;
  52       $cur->user_email = $_SESSION['auth-xorg'] . '@polytechnique.org';
  53       $cur->user_options = $core->userDefaults();
  54       $cur->user_options['post_xorg_perms'] = 'public';
  55       $cur->user_default_blog = 'default'; // FIXME
  56       $core->addUser($cur);
  57     }
  58   }
  59
  60   public function updateUserPerms(&$blog) {
  61     global $core;
  62     $this->buildFromSession();
  63     if (!isset($_SESSION['auth-xorg'])) {
  64       return;
  65     }
  66     $type = $blog->settings->get('xorg_blog_type');
  67     $owner = $blog->settings->get('xorg_blog_owner');
  68     $level = $this->xorg_infos['grpauth'];
  69     $rec = $core->getUser($this->userID());
  70     $wasAdmin = $rec->f('user_super');
  71     $isAdmin = $this->xorg_infos['perms'] == 'admin';
  72     if (($wasAdmin && !$isAdmin) || (!$wasAdmin && $isAdmin)) {
  73       $cur = new cursor($this->con, 'dc_user');
  74       $cur->user_super = $isAdmin ? '1' : '0';
  75       $core->updUser($this->userID(), $cur);
  76     }
  77     if (($type == 'group-admin' || $type == 'group-member') && $level == 'admin') {
  78       if ($owner != $_SESSION['xorg-group']) {
  79         return;
  80       }
  81       $perms = array('usage' => true,
  82                      'contentadmin' => true,
  83                      'admin' => true);
  84     } else if ($type == 'group-member' && $level == 'membre') {
  85       if ($owner != $_SESSION['xorg-group']) {
  86         return;
  87       }
  88       $perms = array('usage' => true);
  89     } else if ($type == 'user' && $owner == $this->xorg_infos['forlife']) {
  90       $perms = array('usage' => true,
  91                      'contentadmin' => true,
  92                      'admin' => true);
  93     } else {
  94       $perms = array();
  95     }
  96     $core->setUserBlogPermissions($_SESSION['auth-xorg'],
  97                                   $blog->id,
  98                                   $perms);
  99   }
 100
 101
 102   /** Xorg SSO API */
 103
 104   public function callXorg($path = null) {
 105     if (is_null($path)) {
 106       $path = $_SERVER['REQUEST_URI'];
 107     }
 108     $this->buildFromSession();
 109     if (@$_SESSION['auth-xorg']) {
 110       return true;
 111     }
 112     global $core;
 113     if (!session_id()) {
 114       $core->session->start();
 115     }
 116     $_SESSION["auth-x-challenge"] = md5(uniqid(rand(), 1));
 117     $url = "https://www.polytechnique.org/auth-groupex/utf8";
 118     $url .= "?session=" . session_id();
 119     $url .= "&challenge=" . $_SESSION["auth-x-challenge"];
 120     $url .= "&pass=" . md5($_SESSION["auth-x-challenge"] . XORG_AUTH_KEY);
 121     $type = $core->blog->settings->get('xorg_blog_type');
 122     if ($type == 'group-member' || $type == 'group-admin') {
 123       $_SESSION['xorg-group'] = $core->blog->settings->get('xorg_blog_owner');
 124       $url .= '&group=' . $core->blog->settings->get('xorg_blog_owner');
 125     } else {
 126       unset($_SESSION['xorg-group']);
 127     }
 128     $url .= "&url=" . urlencode($core->blog->url . "auth/XorgReturn?path=" . $path);
 129     session_write_close();
 130     header("Location: $url");
 131     exit;
 132   }
 133
 134   public function returnXorg() {
 135     if (!isset($_GET['auth'])) {
 136       return false;
 137     }
 138     $params = '';
 139     global $core;
 140     $_COOKIE[DC_SESSION_NAME] = $_GET['PHPSESSID'];
 141     unset($_GET['PHPSESSID']);
 142     if (!session_id()) {
 143       $core->session->start();
 144     }
 145     foreach($this->xorg_infos as $key => $val) {
 146       if(!isset($_GET[$key])) {
 147         return false;
 148       }
 149       $_SESSION['auth-xorg-' . $key] = $_GET[$key];
 150       $params .= $_GET[$key];
 151     }
 152     if (md5('1' . $_SESSION['auth-x-challenge'] . XORG_AUTH_KEY . $params . '1') == $_GET['auth']) {
 153       unset($_GET['auth']);
 154       $_SESSION['sess_user_id'] = $_SESSION['auth-xorg'] = $_GET['forlife'];
 155                   $_SESSION['sess_browser_uid'] = http::browserUID(DC_MASTER_KEY);
 156       $_SESSION['sess_blog_id'] = 'default';
 157       $this->sudo(array($this, 'createUser'));
 158       $path = $_GET['path'];
 159       header("Location: http://murphy.m4x.org" . $_GET['path']);
 160       exit;
 161     }
 162     unset($_SESSION['auth-xorg']);
 163     unset($_SESSION['sess_user_id']);
 164     unset($_GET['auth']);
 165     echo "Failed !!!";
 166     return false;
 167   }
 168
 169   public function killSession() {
 170     global $core;
 171     if (!session_id()) {
 172       $core->session->start();
 173     }
 174     $core->session->destroy();
 175     header('Location: ' . $core->blog->url);
 176     exit;
 177   }
 178
 179
 180   /** Dotclear dcAuth API */
 181
 182   public function checkUser($user_id, $pwd = null, $user_key = null) {
 183     return $this->callXorg();
 184   }
 185
 186   public function check($permissions, $blog_id) {
 187     $this->buildFromSession();
 188     return parent::check($permissions, $blog_id);
 189   }
 190
 191   public function checkPassword($pwd) {
 192     $this->buildFromSession();
 193     return !empty($this->user_id);
 194   }
 195
 196   public function allowPassChange() {
 197     return false;
 198   }
 199
 200   public function userID() {
 201     $this->buildFromSession();
 202     return parent::userID();
 203   }
 204
 205   public function getPermissions() {
 206     $this->buildFromSession();
 207     return parent::getPermissions();
 208   }
 209
 210   public function getInfo($n) {
 211     $this->buildFromSession();
 212     if ($n == 'xorg_group_member') {
 213       global $core;
 214       if ($core->blog->settings('xorg_blog_owner') != $_SESSION['xorg-group']) {
 215         return false;
 216       }
 217       $perm = $this->xorg_infos['grpauth'];
 218       return $this->isSuperAdmin() || $perm == 'admin' || $perm == 'membre';
 219     }
 220     return parent::getInfo($n);
 221   }
 222
 223   public function getOption($n) {
 224     $this->buildFromSession();
 225     return parent::getOption($n);
 226   }
 227
 228   public function getOptions() {
 229     $this->buildFromSession();
 230     return parent::getOptions();
 231   }
 232
 233   public function authForm() {
 234     global $core;
 235     $path = "http://murphy.m4x.org/~x2003bruneau/dotclear/";
 236     return '<fieldset>'.
 237       '<p><a href="' . $path . 'auth/Xorg?path=/~x2003bruneau/dotclear/admin/index.php">Via Polytechnique.org</a></p>' .
 238       '</fieldset>'.
 239       '<p>'.__('You must accept cookies in order to use the private area.').'</p>';
 240   }
 241 }
 242
 243 ?>