class.xorg.auth.php

   1 <?php
   2
   3 if (!defined('DC_BLOG_ID')) {
   4   define('DC_BLOG_ID', $_SERVER['DC_BLOG_ID']);
   5 }
   6
   7 class xorgAuth extends dcAuth {
   8   public $xorg_infos = array('forlife' => null,
   9                              'prenom' => null,
  10                              'nom' => null,
  11                              'grpauth' => null,
  12                              'perms' => null);
  13   static public function behavior_coreBlogConstruct(&$blog) {
  14     global $core;
  15     $core->auth->sudo(array($core->auth, 'updateUserPerms'), $blog);
  16   }
  17
  18   public function __construct(&$core) {
  19     parent::__construct($core);
  20     $core->addBehavior('coreBlogConstruct', array('xorgAuth', 'behavior_coreBlogConstruct'));
  21   }
  22
  23   public function buildFromSession() {
  24     global $core;
  25     @header('Last-Modified:');
  26     if (!isset($core) || !isset($core->session)) {
  27       return;
  28     }
  29     if (!session_id()) {
  30       $core->session->start();
  31     }
  32     $_SESSION['sess_blog_id'] = $_SERVER['DC_BLOG_ID'];
  33     $user = @$_SESSION['auth-xorg'];
  34     if ($user && is_null($this->xorg_infos['forlife'])) {
  35       foreach ($this->xorg_infos as $key => $val) {
  36         $this->xorg_infos[$key] = $_SESSION['auth-xorg-' . $key];
  37       }
  38       $this->user_id = $user;
  39       $this->user_admin = ($_SESSION['auth-xorg-perms'] == 'admin');
  40       parent::checkUser($this->user_id);
  41       $core->getUserBlogs();
  42     }
  43   }
  44
  45   public function createUser() {
  46     global $core;
  47     if (!$core->userExists($_SESSION['auth-xorg'])) {
  48       $cur = new cursor($this->con, 'dc_user');
  49       $cur->user_id = $_SESSION['auth-xorg'];
  50       $cur->user_pwd = md5(rand());
  51       $cur->user_super = ($_SESSION['auth-xorg-perms'] == 'admin');
  52       $cur->user_lang = 'fr';
  53       $cur->user_name = $_SESSION['auth-xorg-nom'];
  54       $cur->user_firstname = $_SESSION['auth-xorg-prenom'];
  55       $cur->user_displayname = $cur->user_firstname . ' ' . $cur->user_name;
  56       $cur->user_email = $_SESSION['auth-xorg'] . '@polytechnique.org';
  57       $defaults = $core->userDefaults();
  58       $defaults['post_xorg_perms'] = 'public';
  59       $cur->user_options = $defaults;
  60       $cur->user_default_blog = $_SERVER['DC_BLOG_ID'];
  61       $core->addUser($cur);
  62     }
  63   }
  64
  65   public function updateUserPerms(&$blog) {
  66     global $core;
  67     $this->buildFromSession();
  68     if (!isset($_SESSION['auth-xorg'])) {
  69       return;
  70     }
  71     $type = $blog->settings->get('xorg_blog_type');
  72     $owner = $blog->settings->get('xorg_blog_owner');
  73     $level = $this->xorg_infos['grpauth'];
  74     $rec = $core->getUser($this->userID());
  75     $wasAdmin = $rec->f('user_super');
  76     $isAdmin = $this->xorg_infos['perms'] == 'admin';
  77     if (($wasAdmin && !$isAdmin) || (!$wasAdmin && $isAdmin)) {
  78       $cur = new cursor($this->con, 'dc_user');
  79       $cur->user_super = $isAdmin ? '1' : '0';
  80       $core->updUser($this->userID(), $cur);
  81     }
  82     if ($_SESSION['xorg-group'] != $owner) {
  83       $this->killSession();
  84       return;
  85     }
  86     if (($type == 'group-admin' || $type == 'group-member') && $level == 'admin') {
  87       $perms = array('usage' => true,
  88                      'contentadmin' => true,
  89                      'admin' => true);
  90     } else if ($type == 'group-member' && $level == 'membre') {
  91       $perms = array('usage' => true);
  92     } else if ($type == 'user' && $owner == $this->xorg_infos['forlife']) {
  93       $perms = array('usage' => true,
  94                      'contentadmin' => true,
  95                      'admin' => true);
  96     } else if ($type != 'user') {
  97       $perms = array();
  98     } else {
  99         echo "bad session";
 100       return;
 101     }
 102     $core->setUserBlogPermissions($_SESSION['auth-xorg'],
 103                                   $blog->id,
 104                                   $perms);
 105   }
 106
 107
 108   /** Xorg SSO API */
 109
 110   public function callXorg($path = null) {
 111     $this->buildFromSession();
 112     if (@$_SESSION['auth-xorg']) {
 113       return true;
 114     }
 115     global $core;
 116     if (!session_id()) {
 117       $core->session->start();
 118     }
 119     if (is_null($path)) {
 120       $path = @$_SERVER['PATH_INFO'];
 121     }
 122     $_SESSION["auth-x-challenge"] = md5(uniqid(rand(), 1));
 123     $_SESSION['xorg-group'] = $core->blog->settings->get('xorg_blog_owner');
 124     $url = "https://www.polytechnique.org/auth-groupex/utf8";
 125     $url .= "?session=" . session_id();
 126     $url .= "&challenge=" . $_SESSION["auth-x-challenge"];
 127     $url .= "&pass=" . md5($_SESSION["auth-x-challenge"] . XORG_AUTH_KEY);
 128     $type = $core->blog->settings->get('xorg_blog_type');
 129     if ($type == 'group-member' || $type == 'group-admin') {
 130       $url .= '&group=' . $core->blog->settings->get('xorg_blog_owner');
 131     }
 132     $url .= "&url=" . urlencode($core->blog->url . "auth/XorgReturn?path=" . $path);
 133     session_write_close();
 134     header("Location: $url");
 135     exit;
 136   }
 137
 138   public function returnXorg() {
 139     if (!isset($_GET['auth'])) {
 140       return false;
 141     }
 142     $params = '';
 143     global $core;
 144     $_COOKIE[DC_SESSION_NAME] = $_GET['PHPSESSID'];
 145     unset($_GET['PHPSESSID']);
 146     if (!session_id()) {
 147       $core->session->start();
 148     }
 149     foreach($this->xorg_infos as $key => $val) {
 150       if(!isset($_GET[$key])) {
 151         return false;
 152       }
 153       $_SESSION['auth-xorg-' . $key] = $_GET[$key];
 154       $params .= $_GET[$key];
 155     }
 156     if (md5('1' . $_SESSION['auth-x-challenge'] . XORG_AUTH_KEY . $params . '1') == $_GET['auth']) {
 157       unset($_GET['auth']);
 158       $_SESSION['sess_user_id'] = $_SESSION['auth-xorg'] = $_GET['forlife'];
 159                   $_SESSION['sess_browser_uid'] = http::browserUID(DC_MASTER_KEY);
 160       $_SESSION['sess_blog_id'] = 'default';
 161       $this->sudo(array($this, 'createUser'));
 162       $path = $_GET['path'];
 163       header('Location: ' . $core->blog->url . $_GET['path']);
 164       exit;
 165     }
 166     unset($_SESSION['auth-xorg']);
 167     unset($_SESSION['sess_user_id']);
 168     unset($_GET['auth']);
 169     echo "Failed !!!";
 170     return false;
 171   }
 172
 173   public function killSession() {
 174     global $core;
 175     if (!session_id()) {
 176       $core->session->start();
 177     }
 178     $core->session->destroy();
 179     if (!isset($core->blog)) {
 180       $blog = $core->getBlog(DC_BLOG_ID);
 181     } else {
 182       $blog = $core->blog;
 183     }
 184     $url = @$blog->url;
 185     if (!$url) {
 186       $url = $blog->f('blog_url');
 187     }
 188
 189     header('Location: ' . $url);
 190     exit;
 191   }
 192
 193
 194   /** Dotclear dcAuth API */
 195
 196   public function checkUser($user_id, $pwd = null, $user_key = null) {
 197     return $this->callXorg();
 198   }
 199
 200   public function check($permissions, $blog_id) {
 201     $this->buildFromSession();
 202     return parent::check($permissions, $blog_id);
 203   }
 204
 205   public function checkPassword($pwd) {
 206     $this->buildFromSession();
 207     return !empty($this->user_id);
 208   }
 209
 210   public function allowPassChange() {
 211     return false;
 212   }
 213
 214   public function userID() {
 215     $this->buildFromSession();
 216     return parent::userID();
 217   }
 218
 219   public function getPermissions() {
 220     $this->buildFromSession();
 221     return parent::getPermissions();
 222   }
 223
 224   public function getInfo($n) {
 225     $this->buildFromSession();
 226     if ($n == 'xorg_group_member') {
 227       global $core;
 228       if ($core->blog->settings('xorg_blog_owner') != $_SESSION['xorg-group']) {
 229         return false;
 230       }
 231       $perm = $this->xorg_infos['grpauth'];
 232       return $this->isSuperAdmin() || $perm == 'admin' || $perm == 'membre';
 233     }
 234     return parent::getInfo($n);
 235   }
 236
 237   public function getOption($n) {
 238     $this->buildFromSession();
 239     return parent::getOption($n);
 240   }
 241
 242   public function getOptions() {
 243     $this->buildFromSession();
 244     return parent::getOptions();
 245   }
 246
 247   public function authForm() {
 248     global $core;
 249     if (!isset($core->blog)) {
 250       $blog = @$core->getBlog(DC_BLOG_ID);
 251     } else {
 252       $blog = $core->blog;
 253     }
 254     $path = @$blog->url;
 255     if (!$path) {
 256       $path = $blog->f('blog_url');
 257     }
 258
 259     return '<fieldset>'.
 260       '<p><a href="' . $path . 'auth/Xorg?path=/admin/index.php">Via Polytechnique.org</a></p>' .
 261       '</fieldset>'.
 262       '<p>'.__('You must accept cookies in order to use the private area.').'</p>';
 263   }
 264 }
 265
 266 ?>