Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/installer/InstallAuth.pm
Jonathan Druart bc5f5f4f01 Bug 9102 : Followup Set HttpOnly on the CGISESSID cookie 
Signed-off-by: Galen Charlton <gmc@esilibrary.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
2013-02-01 10:50:12 -05:00

451 lines
15 KiB
Perl
Raw Blame History

# -*- tab-width: 8 -*-
# NOTE: This file uses 8-character tabs; do not change the tab size!
package InstallAuth;
# Copyright 2000-2002 Katipo Communications
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with Koha; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
use strict;
#use warnings; FIXME - Bug 2505
use Digest::MD5 qw(md5_base64);
require Exporter;
use C4::Context;
use C4::Output;
use C4::Templates;
use C4::Koha;
use CGI::Session;
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
# set the version for version checking
$VERSION = 3.00;
=head1 NAME
InstallAuth - Authenticates Koha users for Install process
=head1 SYNOPSIS
use CGI;
use InstallAuth;
use C4::Output;
my $query = new CGI;
my ($template, $borrowernumber, $cookie)
= get_template_and_user({template_name => "opac-main.tmpl",
query => $query,
type => "opac",
authnotrequired => 1,
flagsrequired => {borrow => 1},
});
output_html_with_http_headers $query, $cookie, $template->output;
=head1 DESCRIPTION
The main function of this module is to provide
authentification. However the get_template_and_user function has
been provided so that a users login information is passed along
automatically. This gets loaded into the template.
This package is different from C4::Auth in so far as
C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
As in C4::Auth, Authentication is based on cookies.
=head1 FUNCTIONS
=over 2
=cut
@ISA = qw(Exporter);
@EXPORT = qw(
&checkauth
&get_template_and_user
);
=item get_template_and_user
my ($template, $borrowernumber, $cookie)
= get_template_and_user({template_name => "opac-main.tmpl",
query => $query,
type => "opac",
authnotrequired => 1,
flagsrequired => {borrow => 1},
});
This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
to C<&checkauth> (in this module) to perform authentification.
See C<&checkauth> for an explanation of these parameters.
The C<template_name> is then used to find the correct template for
the page. The authenticated users details are loaded onto the
template in the HTML::Template LOOP variable C<USER_INFO>. Also the
C<sessionID> is passed to the template. This can be used in templates
if cookies are disabled. It needs to be put as and input to every
authenticated page.
More information on the C<gettemplate> sub can be found in the
Templates.pm module.
=cut
sub get_template_and_user {
my $in = shift;
my $query = $in->{'query'};
my $language =_get_template_language($query->cookie('KohaOpacLanguage'));
my $path = C4::Context->config('intrahtdocs'). "/prog/". $language;
my $tmplbase = $in->{template_name};
$tmplbase=~ s/\.tmpl$/.tt/;
my $filename = "$path/modules/" . $tmplbase;
my $interface = 'intranet';
my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query);
my ( $user, $cookie, $sessionID, $flags ) = checkauth(
$in->{'query'},
$in->{'authnotrequired'},
$in->{'flagsrequired'},
$in->{'type'}
);
# use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
my $borrowernumber;
if ($user) {
$template->param( loggedinusername => $user );
$template->param( sessionID => $sessionID );
# We are going to use the $flags returned by checkauth
# to create the template's parameters that will indicate
# which menus the user can access.
if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
$template->param( CAN_user_circulate => 1 );
$template->param( CAN_user_catalogue => 1 );
$template->param( CAN_user_parameters => 1 );
$template->param( CAN_user_borrowers => 1 );
$template->param( CAN_user_permission => 1 );
$template->param( CAN_user_reserveforothers => 1 );
$template->param( CAN_user_borrow => 1 );
$template->param( CAN_user_editcatalogue => 1 );
$template->param( CAN_user_updatecharges => 1 );
$template->param( CAN_user_acquisition => 1 );
$template->param( CAN_user_management => 1 );
$template->param( CAN_user_tools => 1 );
$template->param( CAN_user_editauthorities => 1 );
$template->param( CAN_user_serials => 1 );
$template->param( CAN_user_reports => 1 );
}
}
return ( $template, $borrowernumber, $cookie );
}
sub _get_template_language {
#verify if opac language exists in staff (bug 5660)
#conditions are 1) dir exists and 2) enabled in prefs
my ($opaclang) = @_;
return 'en' unless $opaclang;
$opaclang =~ s/[^a-zA-Z_-]*//g;
my $path = C4::Context->config('intrahtdocs') . "/prog/$opaclang";
-d $path ? $opaclang : 'en';
}
=item checkauth
($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
Verifies that the user is authorized to run this script. If
the user is authorized, a (userid, cookie, session-id, flags)
quadruple is returned. If the user is not authorized but does
not have the required privilege (see $flagsrequired below), it
displays an error page and exits. Otherwise, it displays the
login page and exits.
Note that C<&checkauth> will return if and only if the user
is authorized, so it should be called early on, before any
unfinished operations (e.g., if you've opened a file, then
C<&checkauth> won't close it for you).
C<$query> is the CGI object for the script calling C<&checkauth>.
The C<$noauth> argument is optional. If it is set, then no
authorization is required for the script.
C<&checkauth> fetches user and session information from C<$query> and
ensures that the user is authorized to run scripts that require
authorization.
The C<$flagsrequired> argument specifies the required privileges
the user must have if the username and password are correct.
It should be specified as a reference-to-hash; keys in the hash
should be the "flags" for the user, as specified in the Members
intranet module. Any key specified must correspond to a "flag"
in the userflags table. E.g., { circulate => 1 } would specify
that the user must have the "circulate" privilege in order to
proceed. To make sure that access control is correct, the
C<$flagsrequired> parameter must be specified correctly.
The C<$type> argument specifies whether the template should be
retrieved from the opac or intranet directory tree. "opac" is
assumed if it is not specified; however, if C<$type> is specified,
"intranet" is assumed if it is not "opac".
If C<$query> does not have a valid session ID associated with it
(i.e., the user has not logged in) or if the session has expired,
C<&checkauth> presents the user with a login page (from the point of
view of the original script, C<&checkauth> does not return). Once the
user has authenticated, C<&checkauth> restarts the original script
(this time, C<&checkauth> returns).
The login page is provided using a HTML::Template, which is set in the
systempreferences table or at the top of this file. The variable C<$type>
selects which template to use, either the opac or the intranet
authentification template.
C<&checkauth> returns a user ID, a cookie, and a session ID. The
cookie should be sent back to the browser; it verifies that the user
has authenticated.
=cut
sub checkauth {
my $query = shift;
# $authnotrequired will be set for scripts which will run without authentication
my $authnotrequired = shift;
my $flagsrequired = shift;
my $type = shift;
$type = 'intranet' unless $type;
my $dbh = C4::Context->dbh();
my $template_name;
$template_name = "installer/auth.tmpl";
# state variables
my $loggedin = 0;
my %info;
my ( $userid, $cookie, $sessionID, $flags, $envcookie );
my $logout = $query->param('logout.x');
if ( $sessionID = $query->cookie("CGISESSID") ) {
C4::Context->_new_userenv($sessionID);
my $session =
new CGI::Session( "driver:File;serializer:yaml", $sessionID,
{ Directory => '/tmp' } );
if ( $session->param('cardnumber') ) {
C4::Context::set_userenv(
$session->param('number'),
$session->param('id'),
$session->param('cardnumber'),
$session->param('firstname'),
$session->param('surname'),
$session->param('branch'),
$session->param('branchname'),
$session->param('flags'),
$session->param('emailaddress'),
$session->param('branchprinter')
);
$cookie = $query->cookie(
-name => 'CGISESSID',
-value => $session->id,
-HttpOnly => 1,
);
$loggedin = 1;
$userid = $session->param('cardnumber');
}
my ( $ip, $lasttime );
if ($logout) {
# voluntary logout the user
C4::Context->_unset_userenv($sessionID);
$sessionID = undef;
$userid = undef;
# Commented out due to its lack of usefulness
# open L, ">>/tmp/sessionlog";
# my $time = localtime( time() );
# printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
# $ip, $time;
# close L;
}
}
unless ($userid) {
my $session =
new CGI::Session( "driver:File;serializer:yaml", undef, { Directory => '/tmp' } );
$sessionID = $session->id;
$userid = $query->param('userid');
C4::Context->_new_userenv($sessionID);
my $password = $query->param('password');
C4::Context->_new_userenv($sessionID);
my ( $return, $cardnumber ) = checkpw( $userid, $password );
if ($return) {
$loggedin = 1;
# open L, ">>/tmp/sessionlog";
# my $time = localtime( time() );
# printf L "%20s from %16s logged in at %30s.\n", $userid,
# $ENV{'REMOTE_ADDR'}, $time;
# close L;
$cookie = $query->cookie(
-name => 'CGISESSID',
-value => $sessionID,
-HttpOnly => 1,
);
if ( $return == 2 ) {
#Only superlibrarian should have access to this page.
#Since if it is a user, it is supposed that there is a borrower table
#And thus that data structure is loaded.
my $hash = C4::Context::set_userenv(
0, 0,
C4::Context->config('user'), C4::Context->config('user'),
C4::Context->config('user'), "",
"NO_LIBRARY_SET", 1,
""
);
$session->param( 'number', 0 );
$session->param( 'id', C4::Context->config('user') );
$session->param( 'cardnumber', C4::Context->config('user') );
$session->param( 'firstname', C4::Context->config('user') );
$session->param( 'surname', C4::Context->config('user'), );
$session->param( 'branch', 'NO_LIBRARY_SET' );
$session->param( 'branchname', 'NO_LIBRARY_SET' );
$session->param( 'flags', 1 );
$session->param( 'emailaddress',
C4::Context->preference('KohaAdminEmailAddress') );
$session->param( 'ip', $session->remote_addr() );
$session->param( 'lasttime', time() );
$userid = C4::Context->config('user');
}
}
else {
if ($userid) {
$info{'invalid_username_or_password'} = 1;
C4::Context->_unset_userenv($sessionID);
}
}
}
# finished authentification, now respond
if ($loggedin) {
# successful login
unless ($cookie) {
$cookie = $query->cookie(
-name => 'CGISESSID',
-value => '',
-HttpOnly => 1,
-expires => ''
);
}
if ($envcookie) {
return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
}
else {
return ( $userid, $cookie, $sessionID, $flags );
}
}
# else we have a problem...
# get the inputs from the incoming query
my @inputs = ();
foreach my $name ( param $query) {
(next) if ( $name eq 'userid' || $name eq 'password' );
my $value = $query->param($name);
push @inputs, { name => $name, value => $value };
}
my $path =
C4::Context->config('intrahtdocs') . "/prog/"
. ( $query->param('language') ? $query->param('language') : "en" );
my $filename = "$path/modules/$template_name";
$filename =~ s/\.tmpl$/.tt/;
my $interface = 'intranet';
my $template = C4::Templates->new( $interface, $filename, '', $query);
$template->param(
INPUTS => \@inputs,
);
$template->param( login => 1 );
$template->param( loginprompt => 1 ) unless $info{'nopermission'};
my $self_url = $query->url( -absolute => 1 );
$template->param( url => $self_url, );
$template->param( \%info );
$cookie = $query->cookie(
-name => 'CGISESSID',
-value => $sessionID,
-HttpOnly => 1,
-expires => ''
);
print $query->header(
-type => 'text/html; charset=utf-8',
-cookie => $cookie
),
$template->output;
exit;
}
sub checkpw {
my ( $userid, $password ) = @_;
if ( $userid
&& $userid eq C4::Context->config('user')
&& "$password" eq C4::Context->config('pass') )
{
# Koha superuser account
C4::Context->set_userenv(
0, 0,
C4::Context->config('user'),
C4::Context->config('user'),
C4::Context->config('user'),
"", 1
);
return 2;
}
if ( $userid
&& $userid eq 'demo'
&& "$password" eq 'demo'
&& C4::Context->config('demo') )
{
# DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
# some features won't be effective : modify systempref, modify MARC structure,
return 2;
}
return 0;
}
END { } # module clean-up code here (global destructor)
1;
__END__
=back
=head1 SEE ALSO
CGI(3)
C4::Output(3)
Digest::MD5(3)
=cut
View git blame Copy permalink