Bug 9044: (follow-up) fix merge conflict typo that broke this script

[koha.git] / C4 / Auth.pm

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 1e17e59..9801f76 100644 (file)
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -29,6 +29,7 @@ use C4::Context;
 use C4::Templates;    # to get the template
 use C4::Branch; # GetBranches
 use C4::VirtualShelves;
+use Koha::AuthUtils qw(hash_password);
 use POSIX qw/strftime/;
 use List::MoreUtils qw/ any /;
 
@@ -46,7 +47,8 @@ BEGIN {
     $debug       = $ENV{DEBUG};
     @ISA         = qw(Exporter);
     @EXPORT      = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
-    @EXPORT_OK   = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions
+    @EXPORT_OK   = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
+                      &get_all_subpermissions &get_user_subpermissions
                       ParseSearchHistoryCookie
                    );
     %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
@@ -133,10 +135,17 @@ VALUES                    (     ?,         ?,          ?,         ?,          ?,
 EOQ
 
 sub get_template_and_user {
+
     my $in       = shift;
-    my $template =
-      C4::Templates::gettemplate( $in->{'template_name'}, $in->{'type'}, $in->{'query'}, $in->{'is_plugin'} );
     my ( $user, $cookie, $sessionID, $flags );
+
+    my $template = C4::Templates::gettemplate(
+        $in->{'template_name'},
+        $in->{'type'},
+        $in->{'query'},
+        $in->{'is_plugin'}
+    );
+
     if ( $in->{'template_name'} !~m/maintenance/ ) {
         ( $user, $cookie, $sessionID, $flags ) = checkauth(
             $in->{'query'},
@@ -280,10 +289,10 @@ sub get_template_and_user {
         $template->param( sessionID        => $sessionID );
         
         my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
-    $template->param(
-        pubshelves     => $total->{pubtotal},
-        pubshelvesloop => $pubshelves,
-    );
+        $template->param(
+            pubshelves     => $total->{pubtotal},
+            pubshelvesloop => $pubshelves,
+        );
     }
      # Anonymous opac search history
      # If opac search history is enabled and at least one search has already been performed
@@ -458,6 +467,20 @@ sub get_template_and_user {
 
         $template->param(OpacPublic => '1') if ($user || C4::Context->preference("OpacPublic"));
     }
+
+    # Check if we were asked using parameters to force a specific language
+    if ( defined $in->{'query'}->param('language') ) {
+        # Extract the language, let C4::Templates::getlanguage choose
+        # what to do
+        my $language = C4::Templates::getlanguage($in->{'query'},$in->{'type'});
+        my $languagecookie = C4::Templates::getlanguagecookie($in->{'query'},$language);
+        if ( ref $cookie eq 'ARRAY' ) {
+            push @{ $cookie }, $languagecookie;
+        } else {
+            $cookie = [$cookie, $languagecookie];
+        }
+    }
+
     return ( $template, $borrowernumber, $cookie, $flags);
 }
 
@@ -1465,8 +1488,8 @@ sub get_session {
 }
 
 sub checkpw {
-
     my ( $dbh, $userid, $password, $query ) = @_;
+
     if ($ldap) {
         $debug and print STDERR "## checkpw - checking LDAP\n";
         my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
@@ -1476,23 +1499,29 @@ sub checkpw {
     if ($cas && $query && $query->param('ticket')) {
         $debug and print STDERR "## checkpw - checking CAS\n";
     # In case of a CAS authentication, we use the ticket instead of the password
-    my $ticket = $query->param('ticket');
+        my $ticket = $query->param('ticket');
         my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query);    # EXTERNAL AUTH
         ($retval) and return ($retval,$retcard,$retuserid);
-    return 0;
+        return 0;
     }
 
-    # INTERNAL AUTH
+    return checkpw_internal(@_)
+}
+
+sub checkpw_internal {
+    my ( $dbh, $userid, $password ) = @_;
+
     my $sth =
       $dbh->prepare(
 "select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?"
       );
     $sth->execute($userid);
     if ( $sth->rows ) {
-        my ( $md5password, $cardnumber, $borrowernumber, $userid, $firstname,
+        my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname,
             $surname, $branchcode, $flags )
           = $sth->fetchrow;
-        if ( md5_base64($password) eq $md5password and $md5password ne "!") {
+
+        if ( checkpw_hash($password, $stored_hash) ) {
 
             C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
                 $firstname, $surname, $branchcode, $flags );
@@ -1505,10 +1534,11 @@ sub checkpw {
       );
     $sth->execute($userid);
     if ( $sth->rows ) {
-        my ( $md5password, $cardnumber, $borrowernumber, $userid, $firstname,
+        my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname,
             $surname, $branchcode, $flags )
           = $sth->fetchrow;
-        if ( md5_base64($password) eq $md5password ) {
+
+        if ( checkpw_hash($password, $stored_hash) ) {
 
             C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber,
                 $firstname, $surname, $branchcode, $flags );
@@ -1535,6 +1565,21 @@ sub checkpw {
     return 0;
 }
 
+sub checkpw_hash {
+    my ( $password, $stored_hash ) = @_;
+
+    return if $stored_hash eq '!';
+
+    # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5
+    my $hash;
+    if ( substr($stored_hash,0,2) eq '$2') {
+        $hash = hash_password($password, $stored_hash);
+    } else {
+        $hash = md5_base64($password);
+    }
+    return $hash eq $stored_hash;
+}
+
 =head2 getuserflags
 
     my $authflags = getuserflags($flags, $userid, [$dbh]);
@@ -1570,7 +1615,6 @@ sub getuserflags {
             $userflags->{$flag} = 0;
         }
     }
-
     # get subpermissions and merge with top-level permissions
     my $user_subperms = get_user_subpermissions($userid);
     foreach my $module (keys %$user_subperms) {
@@ -1666,7 +1710,8 @@ sub haspermission {
     my ($userid, $flagsrequired) = @_;
     my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
     $sth->execute($userid);
-    my $flags = getuserflags($sth->fetchrow(), $userid);
+    my $row = $sth->fetchrow();
+    my $flags = getuserflags($row, $userid);
     if ( $userid eq C4::Context->config('user') ) {
         # Super User Account from /etc/koha.conf
         $flags->{'superlibrarian'} = 1;
@@ -1735,6 +1780,8 @@ CGI(3)
 
 C4::Output(3)
 
+Crypt::Eksblowfish::Bcrypt(3)
+
 Digest::MD5(3)
 
 =cut