harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'mike/master' into dev

Browse Source
This commit is contained in:
Mario Vavti 2017-09-01 10:37:59 +02:00
commit 7a42aed1f6
7 changed files with 213 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Zotlabs/Daemon/Gprobe.php
View File

@ -17,7 +17,7 @@ class Gprobe {
if(! strpos($url,'@')) if(! strpos($url,'@'))
return; return;
$r = q("select * from xchan where xchan_addr = '%s' limit 1", $r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
dbesc($url) dbesc($url)
); );

80
Zotlabs/Module/Cdav.php
View File

@ -3,30 +3,80 @@ namespace Zotlabs\Module;
require_once('include/event.php'); require_once('include/event.php');
require_once('include/auth.php');
require_once('include/security.php');
class Cdav extends \Zotlabs\Web\Controller { class Cdav extends \Zotlabs\Web\Controller {
function init() { function init() {
$record = null;
$channel_login = false;
if((argv(1) !== 'calendar') && (argv(1) !== 'addressbook')) { if((argv(1) !== 'calendar') && (argv(1) !== 'addressbook')) {
// workaround for HTTP-auth in CGI mode foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ; /* Basic authentication */
if(strlen($userpass)) {
list($name, $password) = explode(':', $userpass); if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
$_SERVER['PHP_AUTH_USER'] = $name; $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
$_SERVER['PHP_AUTH_PW'] = $password; if(strlen($userpass)) {
list($name, $password) = explode(':', $userpass);
$_SERVER['PHP_AUTH_USER'] = $name;
$_SERVER['PHP_AUTH_PW'] = $password;
}
break;
}
/* Signature authentication */
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
continue;
}
$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
if($sigblock) {
$keyId = $sigblock['keyId'];
if($keyId) {
$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
dbesc($keyId)
);
if($r) {
$c = channelx_by_hash($r[0]['hubloc_hash']);
if($c) {
$a = q("select * from account where account_id = %d limit 1",
intval($c['channel_account_id'])
);
if($a) {
$record = [ 'channel' => $c, 'account' => $a[0] ];
$channel_login = $c['channel_id'];
}
}
}
if(! $record)
continue;
if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
$record = null;
}
if($record['account']) {
authenticate_success($record['account']);
if($channel_login) {
change_channel($channel_login);
}
}
break;
}
}
}
} }
} }
if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
if(strlen($userpass)) {
list($name, $password) = explode(':', $userpass);
$_SERVER['PHP_AUTH_USER'] = $name;
$_SERVER['PHP_AUTH_PW'] = $password;
}
}
/** /**
* This server combines both CardDAV and CalDAV functionality into a single * This server combines both CardDAV and CalDAV functionality into a single

76
Zotlabs/Module/Dav.php
View File

@ -12,6 +12,9 @@ use \Sabre\DAV as SDAV;
use \Zotlabs\Storage; use \Zotlabs\Storage;
require_once('include/attach.php'); require_once('include/attach.php');
require_once('include/auth.php');
require_once('include/security.php');
class Dav extends \Zotlabs\Web\Controller { class Dav extends \Zotlabs\Web\Controller {
@ -21,22 +24,65 @@ class Dav extends \Zotlabs\Web\Controller {
*/ */
function init() { function init() {
// workaround for HTTP-auth in CGI mode foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
if(strlen($userpass)) {
list($name, $password) = explode(':', $userpass);
$_SERVER['PHP_AUTH_USER'] = $name;
$_SERVER['PHP_AUTH_PW'] = $password;
}
}
if (x($_SERVER, 'HTTP_AUTHORIZATION')) { /* Basic authentication */
$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
if(strlen($userpass)) { if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
list($name, $password) = explode(':', $userpass); $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
$_SERVER['PHP_AUTH_USER'] = $name; if(strlen($userpass)) {
$_SERVER['PHP_AUTH_PW'] = $password; list($name, $password) = explode(':', $userpass);
$_SERVER['PHP_AUTH_USER'] = $name;
$_SERVER['PHP_AUTH_PW'] = $password;
}
break;
}
/* Signature authentication */
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
continue;
}
$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
if($sigblock) {
$keyId = $sigblock['keyId'];
if($keyId) {
$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
dbesc($keyId)
);
if($r) {
$c = channelx_by_hash($r[0]['hubloc_hash']);
if($c) {
$a = q("select * from account where account_id = %d limit 1",
intval($c['channel_account_id'])
);
if($a) {
$record = [ 'channel' => $c, 'account' => $a[0] ];
$channel_login = $c['channel_id'];
}
}
}
if(! $record)
continue;
if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
$record = null;
}
if($record['account']) {
authenticate_success($record['account']);
if($channel_login) {
change_channel($channel_login);
}
}
break;
}
}
}
} }
} }

10
Zotlabs/Web/HTTPSig.php
View File

@ -145,7 +145,7 @@ class HTTPSig {
static function create_sig($request,$head,$prvkey,$keyid = 'Key',$send_headers = false,$alg = 'sha256') { static function create_sig($request,$head,$prvkey,$keyid = 'Key',$send_headers = false,$auth = false,$alg = 'sha256') {
$return_headers = []; $return_headers = [];
@ -155,8 +155,14 @@ class HTTPSig {
$x = self::sign($request,$head,$prvkey,$alg); $x = self::sign($request,$head,$prvkey,$alg);
$sighead = 'Signature: keyId="' . $keyid . '",algorithm="' . $algorithm if($auth) {
$sighead = 'Authorization: Signature keyId="' . $keyid . '",algorithm="' . $algorithm
. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"'; . '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
}
else {
$sighead = 'Signature: keyId="' . $keyid . '",algorithm="' . $algorithm
. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
}
if($head) { if($head) {
foreach($head as $k => $v) { foreach($head as $k => $v) {

12
Zotlabs/Web/Router.php
View File

@ -119,6 +119,18 @@ class Router {
if(! (\App::$module_loaded)) { if(! (\App::$module_loaded)) {
// undo the setting of a letsencrypt acme-challenge rewrite rule
// which blocks access to our .well-known routes.
// Also provide a config setting for sites that have a legitimate need
// for a custom .htaccess in the .well-known directory; but they should
// make the file read-only so letsencrypt doesn't modify it
if(strpos($_SERVER['REQUEST_URI'],'/.well-known/') === 0) {
if(file_exists('.well-known/.htaccess') && get_config('system','fix_apache_acme',true)) {
rename('.well-known/.htaccess','.well-known/.htaccess.old');
}
}
$x = [ $x = [
'module' => $module, 'module' => $module,
'installed' => \App::$module_loaded, 'installed' => \App::$module_loaded,

81
include/api_auth.php
View File

@ -7,6 +7,8 @@
function api_login(&$a){ function api_login(&$a){
$record = null; $record = null;
$remote_auth = false;
$sigblock = null;
require_once('include/oauth.php'); require_once('include/oauth.php');
@ -33,21 +35,66 @@ function api_login(&$a){
// workarounds for HTTP-auth in CGI mode // workarounds for HTTP-auth in CGI mode
if(x($_SERVER,'REDIRECT_REMOTE_USER')) { foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"],6)) ;
if(strlen($userpass)) {
list($name, $password) = explode(':', $userpass);
$_SERVER['PHP_AUTH_USER'] = $name;
$_SERVER['PHP_AUTH_PW'] = $password;
}
}
if(x($_SERVER,'HTTP_AUTHORIZATION')) { /* Basic authentication */
$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"],6)) ;
if(strlen($userpass)) { if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
list($name, $password) = explode(':', $userpass); $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
$_SERVER['PHP_AUTH_USER'] = $name; if(strlen($userpass)) {
$_SERVER['PHP_AUTH_PW'] = $password; list($name, $password) = explode(':', $userpass);
$_SERVER['PHP_AUTH_USER'] = $name;
$_SERVER['PHP_AUTH_PW'] = $password;
}
break;
}
/* Signature authentication */
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
continue;
}
$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
if($sigblock) {
$keyId = $sigblock['keyId'];
if($keyId) {
$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
dbesc($keyId)
);
if($r) {
$c = channelx_by_hash($r[0]['hubloc_hash']);
if($c) {
$a = q("select * from account where account_id = %d limit 1",
intval($c['channel_account_id'])
);
if($a) {
$record = [ 'channel' => $c, 'account' => $a[0] ];
$channel_login = $c['channel_id'];
}
else {
continue;
}
}
else {
continue;
}
}
else {
continue;
}
if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
$record = null;
}
break;
}
}
}
} }
} }
@ -64,8 +111,6 @@ function api_login(&$a){
} }
} }
if($record['account']) { if($record['account']) {
authenticate_success($record['account']); authenticate_success($record['account']);
@ -85,8 +130,8 @@ function api_login(&$a){
} }
function retry_basic_auth() { function retry_basic_auth($method = 'Basic') {
header('WWW-Authenticate: Basic realm="Hubzilla"'); header('WWW-Authenticate: ' . $method . ' realm="Hubzilla"');
header('HTTP/1.0 401 Unauthorized'); header('HTTP/1.0 401 Unauthorized');
echo('This api requires login'); echo('This api requires login');
killme(); killme();

4
include/channel.php
View File

@ -1616,13 +1616,15 @@ function get_my_address() {
function zid_init() { function zid_init() {
$tmp_str = get_my_address(); $tmp_str = get_my_address();
if(validate_email($tmp_str)) { if(validate_email($tmp_str)) {
Zotlabs\Daemon\Master::Summon(array('Gprobe',bin2hex($tmp_str)));
$arr = array('zid' => $tmp_str, 'url' => App::$cmd); $arr = array('zid' => $tmp_str, 'url' => App::$cmd);
call_hooks('zid_init',$arr); call_hooks('zid_init',$arr);
if(! local_channel()) { if(! local_channel()) {
$r = q("select * from hubloc where hubloc_addr = '%s' order by hubloc_connected desc limit 1", $r = q("select * from hubloc where hubloc_addr = '%s' order by hubloc_connected desc limit 1",
dbesc($tmp_str) dbesc($tmp_str)
); );
if(! $r) {
Zotlabs\Daemon\Master::Summon(array('Gprobe',bin2hex($tmp_str)));
}
if($r && remote_channel() && remote_channel() === $r[0]['hubloc_hash']) if($r && remote_channel() && remote_channel() === $r[0]['hubloc_hash'])
return; return;
logger('zid_init: not authenticated. Invoking reverse magic-auth for ' . $tmp_str); logger('zid_init: not authenticated. Invoking reverse magic-auth for ' . $tmp_str);