class.xorg.auth.php

   1 <?php
   2
   3 class xorgAuth extends dcAuth {
   4   public $xorg_infos = array('forlife' => null,
   5                              'prenom' => null,
   6                              'nom' => null,
   7                              'grpauth' => null,
   8                              'perms' => null);
   9   static public function behavior_coreBlogConstruct(&$blog) {
  10     global $core;
  11     $core->auth->sudo(array($core->auth, 'updateUserPerms'), $blog);
  12   }
  13
  14   public function __construct(&$core) {
  15     parent::__construct($core);
  16     $core->addBehavior('coreBlogConstruct', array('xorgAuth', 'behavior_coreBlogConstruct'));
  17   }
  18
  19   public function buildFromSession() {
  20     global $core;
  21     @header('Last-Modified:');
  22     if (!isset($core) || !isset($core->session)) {
  23       return;
  24     }
  25     if (!session_id()) {
  26       $core->session->start();
  27     }
  28     $_SESSION['sess_blog_id'] = $_SERVER['DC_BLOG_ID'];
  29     $user = @$_SESSION['auth-xorg'];
  30     if ($user && is_null($this->xorg_infos['forlife'])) {
  31       foreach ($this->xorg_infos as $key => $val) {
  32         $this->xorg_infos[$key] = $_SESSION['auth-xorg-' . $key];
  33       }
  34       $this->user_id = $user;
  35       $this->user_admin = ($_SESSION['auth-xorg-perms'] == 'admin');
  36       parent::checkUser($this->user_id);
  37       $core->getUserBlogs();
  38     }
  39   }
  40
  41   public function createUser() {
  42     global $core;
  43     if (!$core->userExists($_SESSION['auth-xorg'])) {
  44       $cur = new cursor($this->con, 'dc_user');
  45       $cur->user_id = $_SESSION['auth-xorg'];
  46       $cur->user_pwd = md5(rand());
  47       $cur->user_super = ($_SESSION['auth-xorg-perms'] == 'admin');
  48       $cur->user_lang = 'fr';
  49       $cur->user_name = $_SESSION['auth-xorg-nom'];
  50       $cur->user_firstname = $_SESSION['auth-xorg-prenom'];
  51       $cur->user_displayname = $cur->user_firstname . ' ' . $cur->user_name;
  52       $cur->user_email = $_SESSION['auth-xorg'] . '@polytechnique.org';
  53       $cur->user_options = $core->userDefaults();
  54       $cur->user_options['post_xorg_perms'] = 'public';
  55       $cur->user_default_blog = 'default'; // FIXME
  56       $core->addUser($cur);
  57     }
  58   }
  59
  60   public function updateUserPerms(&$blog) {
  61     global $core;
  62     $this->buildFromSession();
  63     if (!isset($_SESSION['auth-xorg'])) {
  64       return;
  65     }
  66     $type = $blog->settings->get('xorg_blog_type');
  67     $owner = $blog->settings->get('xorg_blog_owner');
  68     $level = $this->xorg_infos['grpauth'];
  69     $rec = $core->getUser($this->userID());
  70     $wasAdmin = $rec->f('user_super');
  71     $isAdmin = $this->xorg_infos['perms'] == 'admin';
  72     if (($wasAdmin && !$isAdmin) || (!$wasAdmin && $isAdmin)) {
  73       $cur = new cursor($this->con, 'dc_user');
  74       $cur->user_super = $isAdmin ? '1' : '0';
  75       $core->updUser($this->userID(), $cur);
  76     }
  77     if ($_SESSION['xorg-group'] != $owner) {
  78       $this->killSession();
  79       return;
  80     }
  81     if (($type == 'group-admin' || $type == 'group-member') && $level == 'admin') {
  82       $perms = array('usage' => true,
  83                      'contentadmin' => true,
  84                      'admin' => true);
  85     } else if ($type == 'group-member' && $level == 'membre') {
  86       $perms = array('usage' => true);
  87     } else if ($type == 'user' && $owner == $this->xorg_infos['forlife']) {
  88       $perms = array('usage' => true,
  89                      'contentadmin' => true,
  90                      'admin' => true);
  91     } else if ($type != 'user') {
  92       $perms = array();
  93     } else {
  94         echo "bad session";
  95       return;
  96     }
  97     $core->setUserBlogPermissions($_SESSION['auth-xorg'],
  98                                   $blog->id,
  99                                   $perms);
 100   }
 101
 102
 103   /** Xorg SSO API */
 104
 105   public function callXorg($path = null) {
 106     if (is_null($path)) {
 107       $path = $_SERVER['REQUEST_URI'];
 108     }
 109     $this->buildFromSession();
 110     if (@$_SESSION['auth-xorg']) {
 111       return true;
 112     }
 113     global $core;
 114     if (!session_id()) {
 115       $core->session->start();
 116     }
 117     $_SESSION["auth-x-challenge"] = md5(uniqid(rand(), 1));
 118     $_SESSION['xorg-group'] = $core->blog->settings->get('xorg_blog_owner');
 119     $url = "https://www.polytechnique.org/auth-groupex/utf8";
 120     $url .= "?session=" . session_id();
 121     $url .= "&challenge=" . $_SESSION["auth-x-challenge"];
 122     $url .= "&pass=" . md5($_SESSION["auth-x-challenge"] . XORG_AUTH_KEY);
 123     $type = $core->blog->settings->get('xorg_blog_type');
 124     if ($type == 'group-member' || $type == 'group-admin') {
 125       $url .= '&group=' . $core->blog->settings->get('xorg_blog_owner');
 126     }
 127     $url .= "&url=" . urlencode($core->blog->url . "auth/XorgReturn?path=" . $path);
 128     session_write_close();
 129     header("Location: $url");
 130     exit;
 131   }
 132
 133   public function returnXorg() {
 134     if (!isset($_GET['auth'])) {
 135       return false;
 136     }
 137     $params = '';
 138     global $core;
 139     $_COOKIE[DC_SESSION_NAME] = $_GET['PHPSESSID'];
 140     unset($_GET['PHPSESSID']);
 141     if (!session_id()) {
 142       $core->session->start();
 143     }
 144     foreach($this->xorg_infos as $key => $val) {
 145       if(!isset($_GET[$key])) {
 146         return false;
 147       }
 148       $_SESSION['auth-xorg-' . $key] = $_GET[$key];
 149       $params .= $_GET[$key];
 150     }
 151     if (md5('1' . $_SESSION['auth-x-challenge'] . XORG_AUTH_KEY . $params . '1') == $_GET['auth']) {
 152       unset($_GET['auth']);
 153       $_SESSION['sess_user_id'] = $_SESSION['auth-xorg'] = $_GET['forlife'];
 154                   $_SESSION['sess_browser_uid'] = http::browserUID(DC_MASTER_KEY);
 155       $_SESSION['sess_blog_id'] = 'default';
 156       $this->sudo(array($this, 'createUser'));
 157       $path = $_GET['path'];
 158       header("Location: http://murphy.m4x.org" . $_GET['path']);
 159       exit;
 160     }
 161     unset($_SESSION['auth-xorg']);
 162     unset($_SESSION['sess_user_id']);
 163     unset($_GET['auth']);
 164     echo "Failed !!!";
 165     return false;
 166   }
 167
 168   public function killSession() {
 169     global $core;
 170     if (!session_id()) {
 171       $core->session->start();
 172     }
 173     $core->session->destroy();
 174     if (!isset($core->blog)) {
 175       $blog = $core->getBlog(DC_BLOG_ID);
 176     } else {
 177       $blog = $core->blog;
 178     }
 179     $url = @$blog->url;
 180     if (!$url) {
 181       $url = $blog->f('blog_url');
 182     }
 183
 184     header('Location: ' . $url);
 185     exit;
 186   }
 187
 188
 189   /** Dotclear dcAuth API */
 190
 191   public function checkUser($user_id, $pwd = null, $user_key = null) {
 192     return $this->callXorg();
 193   }
 194
 195   public function check($permissions, $blog_id) {
 196     $this->buildFromSession();
 197     return parent::check($permissions, $blog_id);
 198   }
 199
 200   public function checkPassword($pwd) {
 201     $this->buildFromSession();
 202     return !empty($this->user_id);
 203   }
 204
 205   public function allowPassChange() {
 206     return false;
 207   }
 208
 209   public function userID() {
 210     $this->buildFromSession();
 211     return parent::userID();
 212   }
 213
 214   public function getPermissions() {
 215     $this->buildFromSession();
 216     return parent::getPermissions();
 217   }
 218
 219   public function getInfo($n) {
 220     $this->buildFromSession();
 221     if ($n == 'xorg_group_member') {
 222       global $core;
 223       if ($core->blog->settings('xorg_blog_owner') != $_SESSION['xorg-group']) {
 224         return false;
 225       }
 226       $perm = $this->xorg_infos['grpauth'];
 227       return $this->isSuperAdmin() || $perm == 'admin' || $perm == 'membre';
 228     }
 229     return parent::getInfo($n);
 230   }
 231
 232   public function getOption($n) {
 233     $this->buildFromSession();
 234     return parent::getOption($n);
 235   }
 236
 237   public function getOptions() {
 238     $this->buildFromSession();
 239     return parent::getOptions();
 240   }
 241
 242   public function authForm() {
 243     global $core;
 244     $path = "http://murphy.m4x.org/~x2003bruneau/dotclear/";
 245     return '<fieldset>'.
 246       '<p><a href="' . $path . 'auth/Xorg?path=/~x2003bruneau/dotclear/admin/index.php">Via Polytechnique.org</a></p>' .
 247       '</fieldset>'.
 248       '<p>'.__('You must accept cookies in order to use the private area.').'</p>';
 249   }
 250 }
 251
 252 ?>