split authentication to separate modules
Andrew Dolgov
12 years ago
parent
7e18f8e710
commit
0d421af86f
@ -0,0 +1,55 @@
|
||||
<?php
|
||||
class Auth_Base {
|
||||
protected $link;
|
||||
|
||||
function __construct($link) {
|
||||
$this->link = $link;
|
||||
}
|
||||
|
||||
function authenticate($login, $password) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Auto-creates specified user if allowed by system configuration
|
||||
// Can be used instead of find_user_by_login() by external auth modules
|
||||
function auto_create_user($login) {
|
||||
if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
|
||||
$user_id = $this->find_user_by_login($login);
|
||||
|
||||
if (!$user_id) {
|
||||
$login = db_escape_string($login);
|
||||
$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
|
||||
$pwd_hash = encrypt_password($password, $salt, true);
|
||||
|
||||
$query = "INSERT INTO ttrss_users
|
||||
(login,access_level,last_login,created,pwd_hash,salt)
|
||||
VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
|
||||
|
||||
db_query($this->link, $query);
|
||||
|
||||
return $this->find_user_by_login($login);
|
||||
|
||||
} else {
|
||||
return $user_id;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
function find_user_by_login($login) {
|
||||
$login = db_escape_string($login);
|
||||
|
||||
$result = db_query($this->link, "SELECT id FROM ttrss_users WHERE
|
||||
login = '$login'");
|
||||
|
||||
if (db_num_rows($result) > 0) {
|
||||
return db_fetch_result($result, 0, "id");
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
@ -0,0 +1,75 @@
|
||||
<?php
|
||||
class Auth_Internal extends Auth_Base {
|
||||
|
||||
function authenticate($login, $password) {
|
||||
|
||||
$pwd_hash1 = encrypt_password($password);
|
||||
$pwd_hash2 = encrypt_password($password, $login);
|
||||
$login = db_escape_string($login);
|
||||
|
||||
if (get_schema_version($this->link) > 87) {
|
||||
|
||||
$result = db_query($this->link, "SELECT salt FROM ttrss_users WHERE
|
||||
login = '$login'");
|
||||
|
||||
if (db_num_rows($result) != 1) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$salt = db_fetch_result($result, 0, "salt");
|
||||
|
||||
if ($salt == "") {
|
||||
|
||||
$query = "SELECT id
|
||||
FROM ttrss_users WHERE
|
||||
login = '$login' AND (pwd_hash = '$pwd_hash1' OR
|
||||
pwd_hash = '$pwd_hash2')";
|
||||
|
||||
// verify and upgrade password to new salt base
|
||||
|
||||
$result = db_query($this->link, $query);
|
||||
|
||||
if (db_num_rows($result) == 1) {
|
||||
// upgrade password to MODE2
|
||||
|
||||
$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
|
||||
$pwd_hash = encrypt_password($password, $salt, true);
|
||||
|
||||
db_query($this->link, "UPDATE ttrss_users SET
|
||||
pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
|
||||
|
||||
$query = "SELECT id
|
||||
FROM ttrss_users WHERE
|
||||
login = '$login' AND pwd_hash = '$pwd_hash'";
|
||||
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
$pwd_hash = encrypt_password($password, $salt, true);
|
||||
|
||||
$query = "SELECT id
|
||||
FROM ttrss_users WHERE
|
||||
login = '$login' AND pwd_hash = '$pwd_hash'";
|
||||
|
||||
}
|
||||
|
||||
} else {
|
||||
$query = "SELECT id
|
||||
FROM ttrss_users WHERE
|
||||
login = '$login' AND (pwd_hash = '$pwd_hash1' OR
|
||||
pwd_hash = '$pwd_hash2')";
|
||||
}
|
||||
|
||||
$result = db_query($this->link, $query);
|
||||
|
||||
if (db_num_rows($result) == 1) {
|
||||
return db_fetch_result($result, 0, "id");
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
?>
|
||||
@ -0,0 +1,61 @@
|
||||
<?php
|
||||
class Auth_Remote extends Auth_Base {
|
||||
function get_login_by_ssl_certificate() {
|
||||
$cert_serial = db_escape_string(get_ssl_certificate_id());
|
||||
|
||||
if ($cert_serial) {
|
||||
$result = db_query($this->link, "SELECT login FROM ttrss_user_prefs, ttrss_users
|
||||
WHERE pref_name = 'SSL_CERT_SERIAL' AND value = '$cert_serial' AND
|
||||
owner_uid = ttrss_users.id");
|
||||
|
||||
if (db_num_rows($result) != 0) {
|
||||
return db_escape_string(db_fetch_result($result, 0, "login"));
|
||||
}
|
||||
}
|
||||
|
||||
return "";
|
||||
}
|
||||
|
||||
|
||||
function authenticate($login, $password) {
|
||||
$try_login = db_escape_string($_SERVER["REMOTE_USER"]);
|
||||
|
||||
if (!$try_login) $try_login = $this->get_login_by_ssl_certificate();
|
||||
# if (!$try_login) $try_login = "test_qqq";
|
||||
|
||||
if ($try_login) {
|
||||
$user_id = $this->auto_create_user($try_login);
|
||||
|
||||
if ($user_id) {
|
||||
$_SESSION["fake_login"] = $try_login;
|
||||
$_SESSION["fake_password"] = "******";
|
||||
$_SESSION["hide_hello"] = true;
|
||||
$_SESSION["hide_logout"] = true;
|
||||
|
||||
// LemonLDAP can send user informations via HTTP HEADER
|
||||
if (defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE){
|
||||
// update user name
|
||||
$fullname = $_SERVER['HTTP_USER_NAME'] ? $_SERVER['HTTP_USER_NAME'] : $_SERVER['AUTHENTICATE_CN'];
|
||||
if ($fullname){
|
||||
$fullname = db_escape_string($fullname);
|
||||
db_query($this->link, "UPDATE ttrss_users SET full_name = '$fullname' WHERE id = " .
|
||||
$user_id);
|
||||
}
|
||||
// update user mail
|
||||
$email = $_SERVER['HTTP_USER_MAIL'] ? $_SERVER['HTTP_USER_MAIL'] : $_SERVER['AUTHENTICATE_MAIL'];
|
||||
if ($email){
|
||||
$email = db_escape_string($email);
|
||||
db_query($this->link, "UPDATE ttrss_users SET email = '$email' WHERE id = " .
|
||||
$user_id);
|
||||
}
|
||||
}
|
||||
|
||||
return $user_id;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
@ -1,3 +1,3 @@
|
||||
<?php # This file has been generated at: Mon Jul 9 12:33:19 MSK 2012
|
||||
<?php # This file has been generated at: Thu Aug 16 14:47:22 MSK 2012
|
||||
define('GENERATED_CONFIG_CHECK', 25);
|
||||
$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'DEFAULT_UPDATE_METHOD', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ALLOW_REMOTE_USER_AUTH', 'AUTO_LOGIN', 'AUTO_CREATE_USER', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_EXPIRE_TIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CONSUMER_KEY', 'CONSUMER_SECRET', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'FEEDBACK_URL', 'ARTICLE_BUTTON_PLUGINS', 'CONFIG_VERSION'); ?>
|
||||
$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'AUTH_MODULES', 'AUTH_AUTO_CREATE', 'AUTH_AUTO_LOGIN', 'DEFAULT_UPDATE_METHOD', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_EXPIRE_TIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CONSUMER_KEY', 'CONSUMER_SECRET', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'FEEDBACK_URL', 'ARTICLE_BUTTON_PLUGINS', 'CONFIG_VERSION'); ?>
|
||||
|
||||
Loading…
Reference in New Issue