harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Some documentation of include/auth.php.

Browse Source
This commit is contained in:
Klaus Weidenbach 2014-10-05 14:51:58 +02:00
parent 82ba42586c
commit 0875448ab9
1 changed files with 74 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
include/auth.php
View File

@ -1,11 +1,23 @@
<?php /** @file */ <?php
/**
* @file include/auth.php
* @brief Functions and inline functionality for authentication.
*
* This file provides some functions for authentication handling and inline
* functionality. Look for auth parameters or re-validate an existing session
* also handles logout.
* Also provides a function for OpenID identiy matching.
*/
require_once('include/security.php'); require_once('include/security.php');
/**
* @brief Resets the current session.
*
* @return void
*/
function nuke_session() { function nuke_session() {
new_cookie(0); // 0 means delete on browser exit
new_cookie(0);
unset($_SESSION['authenticated']); unset($_SESSION['authenticated']);
unset($_SESSION['account_id']); unset($_SESSION['account_id']);
@ -27,16 +39,19 @@ function nuke_session() {
} }
/** /**
* Verify login credentials * @brief Verify login credentials.
*
* Returns account record on success, null on failure
* *
* @param string $email
* The email address to verify.
* @param string $pass
* The provided password to verify.
* @return array|null
* Returns account record on success, null on failure.
*/ */
function account_verify_password($email, $pass) {
function account_verify_password($email,$pass) { $email_verify = get_config('system', 'verify_email');
$register_policy = get_config('system', 'register_policy');
$email_verify = get_config('system','verify_email');
$register_policy = get_config('system','register_policy');
// Currently we only verify email address if there is an open registration policy. // Currently we only verify email address if there is an open registration policy.
// This isn't because of any policy - it's because the workflow gets too complicated if // This isn't because of any policy - it's because the workflow gets too complicated if
@ -51,9 +66,10 @@ function account_verify_password($email,$pass) {
); );
if(! ($r && count($r))) if(! ($r && count($r)))
return null; return null;
foreach($r as $record) { foreach($r as $record) {
if(($record['account_flags'] == ACCOUNT_OK) if(($record['account_flags'] == ACCOUNT_OK)
&& (hash('whirlpool',$record['account_salt'] . $pass) === $record['account_password'])) { && (hash('whirlpool', $record['account_salt'] . $pass) === $record['account_password'])) {
logger('password verified for ' . $email); logger('password verified for ' . $email);
return $record; return $record;
} }
@ -61,7 +77,6 @@ function account_verify_password($email,$pass) {
$error = 'password failed for ' . $email; $error = 'password failed for ' . $email;
logger($error); logger($error);
if($record['account_flags'] & ACCOUNT_UNVERIFIED) if($record['account_flags'] & ACCOUNT_UNVERIFIED)
logger('Account is unverified. account_flags = ' . $record['account_flags']); logger('Account is unverified. account_flags = ' . $record['account_flags']);
if($record['account_flags'] & ACCOUNT_BLOCKED) if($record['account_flags'] & ACCOUNT_BLOCKED)
@ -88,14 +103,12 @@ function account_verify_password($email,$pass) {
* also handles logout * also handles logout
*/ */
if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-params'))) || ($_POST['auth-params'] !== 'login'))) { ((! (x($_POST, 'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
// process a logout request // process a logout request
if(((x($_POST,'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) { if(((x($_POST, 'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
// process logout request // process logout request
$args = array('channel_id' => local_user()); $args = array('channel_id' => local_user());
call_hooks('logging_out', $args); call_hooks('logging_out', $args);
@ -106,16 +119,16 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
// re-validate a visitor, optionally invoke "su" if permitted to do so // re-validate a visitor, optionally invoke "su" if permitted to do so
if(x($_SESSION,'visitor_id') && (! x($_SESSION,'uid'))) { if(x($_SESSION, 'visitor_id') && (! x($_SESSION, 'uid'))) {
// if our authenticated guest is allowed to take control of the admin channel, make it so. // if our authenticated guest is allowed to take control of the admin channel, make it so.
$admins = get_config('system','remote_admin'); $admins = get_config('system', 'remote_admin');
if($admins && is_array($admins) && in_array($_SESSION['visitor_id'],$admins)) { if($admins && is_array($admins) && in_array($_SESSION['visitor_id'], $admins)) {
$x = q("select * from account where account_email = '%s' and account_email != '' and ( account_flags & %d ) limit 1", $x = q("select * from account where account_email = '%s' and account_email != '' and ( account_flags & %d ) limit 1",
dbesc(get_config('system','admin_email')), dbesc(get_config('system', 'admin_email')),
intval(ACCOUNT_ROLE_ADMIN) intval(ACCOUNT_ROLE_ADMIN)
); );
if($x) { if($x) {
new_cookie(60*60*24); // one day new_cookie(60 * 60 * 24); // one day
$_SESSION['last_login_date'] = datetime_convert(); $_SESSION['last_login_date'] = datetime_convert();
unset($_SESSION['visitor_id']); // no longer a visitor unset($_SESSION['visitor_id']); // no longer a visitor
authenticate_success($x[0], true, true); authenticate_success($x[0], true, true);
@ -137,20 +150,19 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
// already logged in user returning // already logged in user returning
if(x($_SESSION,'uid') || x($_SESSION,'account_id')) { if(x($_SESSION, 'uid') || x($_SESSION, 'account_id')) {
// first check if we're enforcing that sessions can't change IP address // first check if we're enforcing that sessions can't change IP address
// @todo what to do with IPv6 addresses
if($_SESSION['addr'] && $_SESSION['addr'] != $_SERVER['REMOTE_ADDR']) { if($_SESSION['addr'] && $_SESSION['addr'] != $_SERVER['REMOTE_ADDR']) {
logger('SECURITY: Session IP address changed: ' . $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']); logger('SECURITY: Session IP address changed: ' . $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
$partial1 = substr($_SESSION['addr'],0,strrpos($_SESSION['addr'],'.')); $partial1 = substr($_SESSION['addr'], 0, strrpos($_SESSION['addr'], '.'));
$partial2 = substr($_SERVER['REMOTE_ADDR'],0,strrpos($_SERVER['REMOTE_ADDR'],'.')); $partial2 = substr($_SERVER['REMOTE_ADDR'], 0, strrpos($_SERVER['REMOTE_ADDR'], '.'));
$paranoia = intval(get_pconfig($_SESSION['uid'], 'system', 'paranoia'));
$paranoia = intval(get_pconfig($_SESSION['uid'],'system','paranoia'));
if(! $paranoia) if(! $paranoia)
$paranoia = intval(get_config('system','paranoia')); $paranoia = intval(get_config('system', 'paranoia'));
switch($paranoia) { switch($paranoia) {
case 0: case 0:
@ -158,8 +170,8 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
break; break;
case 2: case 2:
// check 2 octets // check 2 octets
$partial1 = substr($partial1,0,strrpos($partial1,'.')); $partial1 = substr($partial1, 0, strrpos($partial1, '.'));
$partial2 = substr($partial2,0,strrpos($partial2,'.')); $partial2 = substr($partial2, 0, strrpos($partial2, '.'));
if($partial1 == $partial2) if($partial1 == $partial2)
break; break;
case 1: case 1:
@ -174,7 +186,6 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
nuke_session(); nuke_session();
goaway(z_root()); goaway(z_root());
break; break;
} }
} }
@ -199,9 +210,7 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
nuke_session(); nuke_session();
goaway(z_root()); goaway(z_root());
} }
} // end logged in user returning
}
} }
else { else {
@ -211,10 +220,10 @@ else {
// handle a fresh login request // handle a fresh login request
if((x($_POST,'password')) && strlen($_POST['password'])) if((x($_POST, 'password')) && strlen($_POST['password']))
$encrypted = hash('whirlpool',trim($_POST['password'])); $encrypted = hash('whirlpool', trim($_POST['password']));
if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') { if((x($_POST, 'auth-params')) && $_POST['auth-params'] === 'login') {
$record = null; $record = null;
@ -239,8 +248,7 @@ else {
$record = $addon_auth['user_record']; $record = $addon_auth['user_record'];
} }
else { else {
$record = get_app()->account = account_verify_password($_POST['username'], $_POST['password']);
$record = get_app()->account = account_verify_password($_POST['username'],$_POST['password']);
if(get_app()->account) { if(get_app()->account) {
$_SESSION['account_id'] = get_app()->account['account_id']; $_SESSION['account_id'] = get_app()->account['account_id'];
@ -249,8 +257,7 @@ else {
notice( t('Failed authentication') . EOL); notice( t('Failed authentication') . EOL);
} }
logger('authenticate: ' . print_r(get_app()->account,true), LOGGER_DEBUG); logger('authenticate: ' . print_r(get_app()->account, true), LOGGER_DEBUG);
} }
if((! $record) || (! count($record))) { if((! $record) || (! count($record))) {
@ -293,8 +300,22 @@ else {
} }
/**
* @brief Returns the channel_id for a given openid_identity.
*
* Queries the values from pconfig configuration for the given openid_identity
* and returns the corresponding channel_id.
*
* @fixme How do we prevent that an OpenID identity is used more than once?
*
* @param string $authid
* The given openid_identity
* @return int|bool
* Return channel_id from pconfig or false.
*/
function match_openid($authid) { function match_openid($authid) {
$r = q("select * from pconfig where cat = 'system' and k = 'openid' and v = '%s' limit 1", // Query the uid/channel_id from pconfig for a given value.
$r = q("SELECT uid FROM pconfig WHERE cat = 'system' AND k = 'openid' AND v = '%s' LIMIT 1",
dbesc($authid) dbesc($authid)
); );
if($r) if($r)