X-Git-Url: http://git.rot13.org/?a=blobdiff_plain;f=C4%2FAuth.pm;h=996117bfc2df9b72e563396425b5acbbdf507d3d;hb=db91682c80eb71b6165f6bbfb13879a339d37d48;hp=7af27845dd1d4f3a8376ecb0898f2dd6d442e876;hpb=e0ddd34a4c819ee186fba0ba5edc5896f915f346;p=koha.git diff --git a/C4/Auth.pm b/C4/Auth.pm index 7af27845dd..996117bfc2 100755 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1,3 +1,4 @@ + # -*- tab-width: 8 -*- # NOTE: This file uses 8-character tabs; do not change the tab size! @@ -32,11 +33,20 @@ use C4::Koha; use C4::Branch; # GetBranches # use utf8; - -use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); - -# set the version for version checking -$VERSION = 3.00; +use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap); + +BEGIN { + $VERSION = 3.01; # set version for version checking + $debug = $ENV{DEBUG} || 0 ; + @ISA = qw(Exporter); + @EXPORT = qw(&checkauth &get_template_and_user); + @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw); + $ldap = C4::Context->config('useldapserver') || 0; + if ($ldap) { + require C4::Auth_with_ldap; # no import + import C4::Auth_with_ldap qw(checkpw_ldap); + } +} =head1 NAME @@ -50,13 +60,15 @@ C4::Auth - Authenticates Koha users my $query = new CGI; my ($template, $borrowernumber, $cookie) - = get_template_and_user({ + = get_template_and_user( + { template_name => "opac-main.tmpl", query => $query, - type => "opac", - authnotrequired => 1, - flagsrequired => {borrow => 1}, - }); + type => "opac", + authnotrequired => 1, + flagsrequired => {borrow => 1}, + } + ); print $query->header( -type => 'utf-8', @@ -75,26 +87,18 @@ C4::Auth - Authenticates Koha users =over 2 -=cut - -@ISA = qw(Exporter); -@EXPORT = qw( - &checkauth - &get_template_and_user -); - =item get_template_and_user - my ($template, $borrowernumber, $cookie) - = get_template_and_user( - { - template_name => "opac-main.tmpl", - query => $query, - type => "opac", - authnotrequired => 1, - flagsrequired => {borrow => 1}, - } - ); + my ($template, $borrowernumber, $cookie) + = get_template_and_user( + { + template_name => "opac-main.tmpl", + query => $query, + type => "opac", + authnotrequired => 1, + flagsrequired => {borrow => 1}, + } + ); This call passes the C, C and C to C<&checkauth> (in this module) to perform authentification. @@ -127,28 +131,33 @@ sub get_template_and_user { my $insecure = C4::Context->preference('insecure'); if ($user or $insecure) { - # load the template variables for stylesheets and JavaScript - foreach (qw(css_libs css_module css_page css_widgets - js_libs js_module js_page js_widgets)) - { - $template->param($_ => $in->{$_}); - } + # load the template variables for stylesheets and JavaScript + $template->param( css_libs => $in->{'css_libs'} ); + $template->param( css_module => $in->{'css_module'} ); + $template->param( css_page => $in->{'css_page'} ); + $template->param( css_widgets => $in->{'css_widgets'} ); - # user info + $template->param( js_libs => $in->{'js_libs'} ); + $template->param( js_module => $in->{'js_module'} ); + $template->param( js_page => $in->{'js_page'} ); + $template->param( js_widgets => $in->{'js_widgets'} ); + + # user info $template->param( loggedinusername => $user ); $template->param( sessionID => $sessionID ); $borrowernumber = getborrowernumber($user); - my ($borr, $alternativeflags) = GetMemberDetails($borrowernumber); - my @bordat = ($borr); + my ( $borr, $alternativeflags ) = + GetMemberDetails( $borrowernumber ); + my @bordat; + $bordat[0] = $borr; $template->param( "USER_INFO" => \@bordat ); + my @flagroots = qw(circulate catalogue parameters borrowers permissions reserveforothers borrow + editcatalogue updatecharges management tools editauthorities serials reports); # We are going to use the $flags returned by checkauth # to create the template's parameters that will indicate # which menus the user can access. - my @params = (qw(circulate catalogue parameters borrowers permissions reserveforothers borrow - editcatalogue updatecharges acquisition tools editauthorities serials reports)); - # Not incl. management if (( $flags && $flags->{superlibrarian}==1) or $insecure==1) { $template->param( CAN_user_circulate => 1 ); $template->param( CAN_user_catalogue => 1 ); @@ -158,38 +167,108 @@ sub get_template_and_user { $template->param( CAN_user_reserveforothers => 1 ); $template->param( CAN_user_borrow => 1 ); $template->param( CAN_user_editcatalogue => 1 ); - $template->param( CAN_user_updatecharge => 1 ); + $template->param( CAN_user_updatecharges => 1 ); $template->param( CAN_user_acquisition => 1 ); $template->param( CAN_user_management => 1 ); $template->param( CAN_user_tools => 1 ); $template->param( CAN_user_editauthorities => 1 ); $template->param( CAN_user_serials => 1 ); $template->param( CAN_user_reports => 1 ); + $template->param( CAN_user_staffaccess => 1 ); + } + + if ( $flags && $flags->{circulate} == 1 ) { + $template->param( CAN_user_circulate => 1 ); + } + + if ( $flags && $flags->{catalogue} == 1 ) { + $template->param( CAN_user_catalogue => 1 ); + } + + if ( $flags && $flags->{parameters} == 1 ) { + $template->param( CAN_user_parameters => 1 ); + $template->param( CAN_user_management => 1 ); + } + + if ( $flags && $flags->{borrowers} == 1 ) { + $template->param( CAN_user_borrowers => 1 ); + } + + if ( $flags && $flags->{permissions} == 1 ) { + $template->param( CAN_user_permission => 1 ); + } + + if ( $flags && $flags->{reserveforothers} == 1 ) { + $template->param( CAN_user_reserveforothers => 1 ); + } + + if ( $flags && $flags->{borrow} == 1 ) { + $template->param( CAN_user_borrow => 1 ); + } + + if ( $flags && $flags->{editcatalogue} == 1 ) { + $template->param( CAN_user_editcatalogue => 1 ); + } + + if ( $flags && $flags->{updatecharges} == 1 ) { + $template->param( CAN_user_updatecharges => 1 ); + } + + if ( $flags && $flags->{acquisition} == 1 ) { + $template->param( CAN_user_acquisition => 1 ); } - if ($flags) { - ($flags->{parameters} == 1) and $template->param(CAN_user_management => 1); - foreach (@params) { - ($flags->{$_} == 1) and $template->param('CAN_user_' . $_ => 1); - } - # terrible non-conformant param names ("s" gets dropped from the end!?) - ($flags->{permissions} == 1) and $template->param(CAN_user_permission => 1); - ($flags->{updatechanges} == 1) and $template->param(CAN_user_updatechange => 1); - } + if ( $flags && $flags->{tools} == 1 ) { + $template->param( CAN_user_tools => 1 ); + } + + if ( $flags && $flags->{editauthorities} == 1 ) { + $template->param( CAN_user_editauthorities => 1 ); + } + + if ( $flags && $flags->{serials} == 1 ) { + $template->param( CAN_user_serials => 1 ); + } + + if ( $flags && $flags->{reports} == 1 ) { + $template->param( CAN_user_reports => 1 ); + } + if ( $flags && $flags->{staffaccess} == 1 ) { + $template->param( CAN_user_staffaccess => 1 ); + } } if ( $in->{'type'} eq "intranet" ) { $template->param( intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"), - intranetstylesheet => C4::Context->preference("intranetstylesheet"), - IntranetNav => C4::Context->preference("IntranetNav"), - intranetuserjs => C4::Context->preference("intranetuserjs"), - LoginBranchnamei => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:"insecure"), - AutoLocation => C4::Context->preference("AutoLocation"), - advancedMARCEditor => C4::Context->preference("advancedMARCEditor"), - IntranetmainUserblock => C4::Context->preference("IntranetmainUserblock"), - IndependantBranches => C4::Context->preference("IndependantBranches"), + intranetstylesheet => C4::Context->preference("intranetstylesheet"), + IntranetNav => C4::Context->preference("IntranetNav"), + intranetuserjs => C4::Context->preference("intranetuserjs"), + TemplateEncoding => C4::Context->preference("TemplateEncoding"), + AmazonContent => C4::Context->preference("AmazonContent"), + LibraryName => C4::Context->preference("LibraryName"), + LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{"branch"}:"insecure"), + LoginBranchname => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:"insecure"), + LoginFirstname => (C4::Context->userenv?C4::Context->userenv->{"firstname"}:"Bel"), + LoginSurname => C4::Context->userenv?C4::Context->userenv->{"surname"}:"Inconnu", + AutoLocation => C4::Context->preference("AutoLocation"), + hide_marc => C4::Context->preference("hide_marc"), + patronimages => C4::Context->preference("patronimages"), "BiblioDefaultView".C4::Context->preference("IntranetBiblioDefaultView") => 1, - CircAutocompl => C4::Context->preference("CircAutocompl"), + advancedMARCEditor => C4::Context->preference("advancedMARCEditor"), + suggestion => C4::Context->preference("suggestion"), + virtualshelves => C4::Context->preference("virtualshelves"), + LibraryName => C4::Context->preference("LibraryName"), + KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"), + IntranetmainUserblock => C4::Context->preference("IntranetmainUserblock"), + IndependantBranches => C4::Context->preference("IndependantBranches"), + CircAutocompl => C4::Context->preference("CircAutocompl"), + yuipath => C4::Context->preference("yuipath"), + FRBRizeEditions => C4::Context->preference("FRBRizeEditions"), + AmazonSimilarItems => C4::Context->preference("AmazonSimilarItems"), + 'item-level_itypes' => C4::Context->preference('item-level_itypes'), + canreservefromotherbranches => C4::Context->preference('canreservefromotherbranches'), + intranetreadinghistory => C4::Context->preference("intranetreadinghistory"), + noItemTypeImages => C4::Context->preference("noItemTypeImages"), ); } else { @@ -197,19 +276,29 @@ sub get_template_and_user { my $LibraryNameTitle = C4::Context->preference("LibraryName"); $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; - $template->param( + $template->param( + KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"), + AnonSuggestions => "" . C4::Context->preference("AnonSuggestions"), + suggestion => "" . C4::Context->preference("suggestion"), + virtualshelves => "" . C4::Context->preference("virtualshelves"), OpacNav => "" . C4::Context->preference("OpacNav"), opacheader => "" . C4::Context->preference("opacheader"), opaccredits => "" . C4::Context->preference("opaccredits"), opacsmallimage => "" . C4::Context->preference("opacsmallimage"), opaclargeimage => "" . C4::Context->preference("opaclargeimage"), - opaclayoutstylesheet => "" . C4::Context->preference("opaclayoutstylesheet"), - opaccolorstylesheet => "" . C4::Context->preference("opaccolorstylesheet"), - opaclanguagesdisplay => "" . C4::Context->preference("opaclanguagesdisplay"), + opaclayoutstylesheet => "". C4::Context->preference("opaclayoutstylesheet"), + opaccolorstylesheet => "". C4::Context->preference("opaccolorstylesheet"), + opaclanguagesdisplay => "". C4::Context->preference("opaclanguagesdisplay"), opacuserlogin => "" . C4::Context->preference("opacuserlogin"), opacbookbag => "" . C4::Context->preference("opacbookbag"), + TemplateEncoding => "". C4::Context->preference("TemplateEncoding"), + AmazonContent => "" . C4::Context->preference("AmazonContent"), + LibraryName => "" . C4::Context->preference("LibraryName"), LibraryNameTitle => "" . $LibraryNameTitle, - LoginBranchname => (C4::Context->userenv?C4::Context->userenv->{"branchname"}:""), + LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{"branch"}:"insecure"), + LoginBranchname => C4::Context->userenv?C4::Context->userenv->{"branchname"}:"", + LoginFirstname => (C4::Context->userenv?C4::Context->userenv->{"firstname"}:"Bel"), + LoginSurname => C4::Context->userenv?C4::Context->userenv->{"surname"}:"Inconnu", OpacPasswordChange => C4::Context->preference("OpacPasswordChange"), opacreadinghistory => C4::Context->preference("opacreadinghistory"), opacuserjs => C4::Context->preference("opacuserjs"), @@ -219,25 +308,15 @@ sub get_template_and_user { OpacBrowser => C4::Context->preference("OpacBrowser"), RequestOnOpac => C4::Context->preference("RequestOnOpac"), reviewson => C4::Context->preference("reviewson"), - mylibraryfirst => C4::Context->preference("SearchMyLibraryFirst"), + hide_marc => C4::Context->preference("hide_marc"), + patronimages => C4::Context->preference("patronimages"), + mylibraryfirst => C4::Context->preference("SearchMyLibraryFirst"), "BiblioDefaultView".C4::Context->preference("BiblioDefaultView") => 1, + OPACFRBRizeEditions => C4::Context->preference("OPACFRBRizeEditions"), + 'item-level_itypes' => C4::Context->preference('item-level_itypes'), ); } - # These are universal: used by both OPAC and INTRANET. - $template->param( - TemplateEncoding => "" . C4::Context->preference("TemplateEncoding"), - suggestion => "" . C4::Context->preference("suggestion"), - virtualshelves => "" . C4::Context->preference("virtualshelves"), - KohaAdminEmailAddress => "" . C4::Context->preference("KohaAdminEmailAddress"), - hide_marc => C4::Context->preference("hide_marc"), - patronimages => C4::Context->preference("patronimages"), - AmazonContent => C4::Context->preference("AmazonContent"), - LibraryName => C4::Context->preference("LibraryName"), - LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{ "branch" }:"insecure"), - LoginFirstname => (C4::Context->userenv?C4::Context->userenv->{"firstname"}: "Bel" ), - LoginSurname => (C4::Context->userenv?C4::Context->userenv->{ "surname" }:"Inconnu" ), - ); - return ( $template, $borrowernumber, $cookie ); + return ( $template, $borrowernumber, $cookie, $flags); } =item checkauth @@ -298,24 +377,14 @@ has authenticated. =cut -sub checkauth { +sub _version_check ($$) { + my $type = shift; my $query = shift; - # warn "Checking Auth"; - # $authnotrequired will be set for scripts which will run without authentication - my $authnotrequired = shift; - my $flagsrequired = shift; - my $type = shift; - $type = 'opac' unless $type; - - my $dbh = C4::Context->dbh; - my $timeout = C4::Context->preference('timeout'); - $timeout = 600 unless $timeout; - - + my $version; # If Version syspref is unavailable, it means Koha is beeing installed, # and so we must redirect to OPAC maintenance page or to the WebInstaller #warn "about to check version"; - unless (C4::Context->preference('Version')) { + unless ($version = C4::Context->preference('Version')) { # assignment, not comparison if ($type ne 'opac') { warn "Install required, redirecting to Installer"; print $query->redirect("/cgi-bin/koha/installer/install.pl"); @@ -327,7 +396,53 @@ sub checkauth { exit; } + # check that database and koha version are the same + # there is no DB version, it's a fresh install, + # go to web installer + # there is a DB version, compare it to the code version + my $kohaversion=C4::Context::KOHAVERSION; + # remove the 3 last . to have a Perl number + $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/; + $debug and print STDERR "kohaversion : $kohaversion\n"; + if ($version < $kohaversion){ + my $warning = "Database update needed, redirecting to %s. Database is $version and Koha is " + . C4::Context->config("kohaversion"); + if ($type ne 'opac'){ + warn sprintf($warning, 'Installer'); + print $query->redirect("/cgi-bin/koha/installer/install.pl?step=3"); + } else { + warn sprintf("OPAC: " . $warning, 'maintenance'); + print $query->redirect("/cgi-bin/koha/maintenance.pl"); + } + exit; + } +} +sub _session_log { + (@_) or return 0; + open L, ">>/tmp/sessionlog"; + printf L join("\n",@_); + close L; +} + +sub checkauth { + my $query = shift; + # warn "Checking Auth"; + # $authnotrequired will be set for scripts which will run without authentication + my $authnotrequired = shift; + my $flagsrequired = shift; + my $type = shift; + $type = 'opac' unless $type; + + my $dbh = C4::Context->dbh; + my $timeout = C4::Context->preference('timeout'); + # days + if ($timeout =~ /(\d+)[dD]/) { + $timeout = $1 * 86400; + }; + $timeout = 600 unless $timeout; + + _version_check($type,$query); # state variables my $loggedin = 0; my %info; @@ -342,16 +457,8 @@ sub checkauth { ); $loggedin = 1; } - elsif ( $sessionID = $query->cookie("CGISESSID")) { - my $storage_method = C4::Context->preference('SessionStorage'); - my $session; - if ($storage_method eq 'mysql'){ - $session = new CGI::Session("driver:MySQL", $sessionID, {Handle=>$dbh}); - } - else { - # catch all defaults to tmp should work on all systems - $session = new CGI::Session("driver:File", $sessionID, {Directory=>'/tmp'}); - } + elsif ( $sessionID = $query->cookie("CGISESSID")) { # assignment, not comparison + my $session = get_session($sessionID); C4::Context->_new_userenv($sessionID); if ($session){ C4::Context::set_userenv( @@ -361,32 +468,24 @@ sub checkauth { $session->param('branchname'), $session->param('flags'), $session->param('emailaddress'), $session->param('branchprinter') ); -# warn "".$session->param('cardnumber').", ".$session->param('firstname').", -# ".$session->param('surname').", ".$session->param('branch'); + $debug and printf STDERR "AUTH_SESSION: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; } my $ip; my $lasttime; if ($session) { - $ip = $session->param('ip'); - $lasttime = $session->param('lasttime'); - $userid = $session->param('id'); + $ip = $session->param('ip'); + $lasttime = $session->param('lasttime'); + $userid = $session->param('id'); } - if ($logout) { - # voluntary logout the user - $session->flush; - $session->delete(); + $session->delete(); C4::Context->_unset_userenv($sessionID); $sessionID = undef; $userid = undef; - open L, ">>/tmp/sessionlog"; - my $time = localtime(); - printf L "%20s from %16s logged out at %30s (manually).\n", $userid, - $ip, $time; - close L; + _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,localtime); } if ($userid) { if ( $lasttime < time() - $timeout ) { @@ -396,27 +495,18 @@ sub checkauth { C4::Context->_unset_userenv($sessionID); $userid = undef; $sessionID = undef; - open L, ">>/tmp/sessionlog"; - my $time = localtime( time() ); - printf L "%20s from %16s logged out at %30s (inactivity).\n", - $userid, $ip, $time; - close L; + _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,localtime); } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { # Different ip than originally logged in from $info{'oldip'} = $ip; $info{'newip'} = $ENV{'REMOTE_ADDR'}; $info{'different_ip'} = 1; - $session->delete(); + $session->delete(); C4::Context->_unset_userenv($sessionID); $sessionID = undef; $userid = undef; - open L, ">>/tmp/sessionlog"; - my $time = localtime( time() ); - printf L -"%20s from logged out at %30s (ip changed from %16s to %16s).\n", - $userid, $time, $ip, $info{'newip'}; - close L; + _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,localtime, $info{'newip'}); } else { $cookie = $query->cookie( CGISESSID => $session->id ); @@ -432,29 +522,21 @@ sub checkauth { } } unless ($userid) { - my $storage_method = C4::Context->preference('SessionStorage'); - my $session = ($storage_method eq 'mysql') ? - CGI::Session->new("driver:MySQL", $sessionID, {Handle=>$dbh} ) : - CGI::Session->new("driver:File" , $sessionID, {Directory=>'/tmp'}) ; - # catch all defaults to tmp should work on all systems + my $session = get_session(""); my $sessionID; - if ($session) { - $sessionID = $session->id; - } + if ($session) { + $sessionID = $session->id; + } $userid = $query->param('userid'); C4::Context->_new_userenv($sessionID); my $password = $query->param('password'); C4::Context->_new_userenv($sessionID); my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password ); if ($return) { - open L, ">>/tmp/sessionlog"; - my $time = localtime(); - printf L "%20s from %16s logged in at %30s.\n", $userid, - $ENV{'REMOTE_ADDR'}, $time; - close L; + _session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},localtime); $cookie = $query->cookie(CGISESSID => $sessionID); if ( $flags = haspermission( $dbh, $userid, $flagsrequired ) ) { - $loggedin = 1; + $loggedin = 1; } else { $info{'nopermission'} = 1; @@ -462,56 +544,62 @@ sub checkauth { } if ( $return == 1 ) { my ( - $borrowernumber, $firstname, $surname, - $userflags, $branchcode, $branchname, - $branchprinter, $emailaddress + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress ); - my $sth = $dbh->prepare( -"SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname,branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where userid=?" - ); + my $select = " + SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, + branches.branchname as branchname, + branches.branchprinter as branchprinter, + email + FROM borrowers + LEFT JOIN branches on borrowers.branchcode=branches.branchcode + "; + my $sth = $dbh->prepare("$select where userid=?"); $sth->execute($userid); - ( - $borrowernumber, $firstname, $surname, - $userflags, $branchcode, $branchname, - $branchprinter, $emailaddress - ) - = $sth->fetchrow - if ( $sth->rows ); + ($sth->rows) and ( + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress + ) = $sth->fetchrow; -# warn "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress"; + $debug and print STDERR "AUTH_1: $cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n"; unless ( $sth->rows ) { - my $sth = $dbh->prepare( -"SELECT borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname, branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where cardnumber=?" - ); + my $sth = $dbh->prepare("$select where cardnumber=?"); $sth->execute($cardnumber); - ( - $borrowernumber, $firstname, $surname, - $userflags, $branchcode, $branchname, - $branchprinter, $emailaddress - ) - = $sth->fetchrow - if ( $sth->rows ); + ($sth->rows) and ( + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress + ) = $sth->fetchrow; -# warn "$cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress"; + $debug and print STDERR "AUTH_2: $cardnumber,$borrowernumber,$userid,$firstname,$surname,$userflags,$branchcode,$emailaddress\n"; unless ( $sth->rows ) { $sth->execute($userid); - ( + ($sth->rows) and ( $borrowernumber, $firstname, $surname, $userflags, $branchcode, $branchname, $branchprinter, $emailaddress - ) - = $sth->fetchrow - if ( $sth->rows ); + ) = $sth->fetchrow; } } -# launch a sequence to check if we have a ip for the branch, if we have one we replace the branchcode of the userenv by the branch bound in the ip. - my $ip = $ENV{'REMOTE_ADDR'}; +# launch a sequence to check if we have a ip for the branch, i +# if we have one we replace the branchcode of the userenv by the branch bound in the ip. + + my $ip = $ENV{'REMOTE_ADDR'}; # if they specify at login, use that if ($query->param('branch')) { $branchcode = $query->param('branch'); $branchname = GetBranchName($branchcode); } my $branches = GetBranches(); + if (C4::Context->boolean_preference('IndependantBranches') && C4::Context->boolean_preference('Autolocation')){ + # we have to check they are coming from the right ip range + my $domain = $branches->{$branchcode}->{'branchip'}; + if ($ip !~ /^$domain/){ + $loggedin=0; + $info{'wrongip'} = 1; + } + } + my @branchesloop; foreach my $br ( keys %$branches ) { # now we work with the treatment of ip @@ -535,39 +623,38 @@ sub checkauth { $session->param('emailaddress',$emailaddress); $session->param('ip',$session->remote_addr()); $session->param('lasttime',time()); -# warn "".$session->param('cardnumber').", ".$session->param('firstname').", -# ".$session->param('surname').", ".$session->param('branch'); + $debug and printf STDERR "AUTH_3: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; } elsif ( $return == 2 ) { #We suppose the user is the superlibrarian - $session->param('number',0); - $session->param('id',C4::Context->config('user')); - $session->param('cardnumber',C4::Context->config('user')); - $session->param('firstname',C4::Context->config('user')); - $session->param('surname',C4::Context->config('user')); - $session->param('branch','NO_LIBRARY_SET'); - $session->param('branchname','NO_LIBRARY_SET'); - $session->param('flags',1); - $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); - $session->param('ip',$session->remote_addr()); - $session->param('lasttime',time()); - } - if ($session){ + $session->param('number',0); + $session->param('id',C4::Context->config('user')); + $session->param('cardnumber',C4::Context->config('user')); + $session->param('firstname',C4::Context->config('user')); + $session->param('surname',C4::Context->config('user')); + $session->param('branch','NO_LIBRARY_SET'); + $session->param('branchname','NO_LIBRARY_SET'); + $session->param('flags',1); + $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); + $session->param('ip',$session->remote_addr()); + $session->param('lasttime',time()); + } + if ($session) { C4::Context::set_userenv( - $session->param('number'), $session->param('id'), - $session->param('cardnumber'), $session->param('firstname'), - $session->param('surname'), $session->param('branch'), - $session->param('branchname'), $session->param('flags'), - $session->param('emailaddress'), $session->param('branchprinter') - ); - } + $session->param('number'), $session->param('id'), + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('branchprinter') + ); + } } - else { if ($userid) { $info{'invalid_username_or_password'} = 1; C4::Context->_unset_userenv($sessionID); } + } } my $insecure = C4::Context->boolean_preference('insecure'); @@ -577,9 +664,9 @@ sub checkauth { { # successful login unless ($cookie) { - $cookie = $query->cookie( CGISESSID => ''); + $cookie = $query->cookie( CGISESSID => '' ); } - return ( $userid, $cookie, $sessionID, $flags ); + return ( $userid, $cookie, $sessionID, $flags ); } # @@ -602,29 +689,11 @@ sub checkauth { push @branch_loop, {branchcode => "$branch_hash", branchname => $branches->{$branch_hash}->{'branchname'}, }; } - # check that database and koha version are the same - # there is no DB version, it's a fresh install, - # go to web installer - # there is a DB version, compare it to the code version - my $kohaversion=C4::Context::KOHAVERSION; - # remove the 3 last . to have a Perl number - $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/; -# warn "kohaversion : $kohaversion"; - if (C4::Context->preference('Version') < $kohaversion){ - if ($type ne 'opac'){ - warn "Database update needed, redirecting to Installer. Database is ".C4::Context->preference('Version')." and Koha is : ".C4::Context->config("kohaversion"); - print $query->redirect("/cgi-bin/koha/installer/install.pl?step=3"); - } else { - warn "OPAC :Database update needed, redirecting to maintenance. Database is ".C4::Context->preference('Version')." and Koha is : ".C4::Context->config("kohaversion"); - print $query->redirect("/cgi-bin/koha/maintenance.pl"); - } - exit; - } - my $template_name = ($type eq 'opac') ? 'opac-auth.tmpl' : 'auth.tmpl'; + my $template_name = ( $type eq 'opac' ) ? 'opac-auth.tmpl' : 'auth.tmpl'; my $template = gettemplate( $template_name, $type, $query ); $template->param(branchloop => \@branch_loop,); $template->param( - login => 1, + login => 1, INPUTS => \@inputs, suggestion => C4::Context->preference("suggestion"), virtualshelves => C4::Context->preference("virtualshelves"), @@ -638,13 +707,19 @@ sub checkauth { opaccolorstylesheet => C4::Context->preference("opaccolorstylesheet"), opaclanguagesdisplay => C4::Context->preference("opaclanguagesdisplay"), opacuserjs => C4::Context->preference("opacuserjs"), - intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"), - intranetstylesheet => C4::Context->preference("intranetstylesheet"), - IntranetNav => C4::Context->preference("IntranetNav"), - intranetuserjs => C4::Context->preference("intranetuserjs"), - TemplateEncoding => C4::Context->preference("TemplateEncoding"), - IndependantBranches => C4::Context->preference("IndependantBranches"), + + intranetcolorstylesheet => + C4::Context->preference("intranetcolorstylesheet"), + intranetstylesheet => C4::Context->preference("intranetstylesheet"), + IntranetNav => C4::Context->preference("IntranetNav"), + intranetuserjs => C4::Context->preference("intranetuserjs"), + TemplateEncoding => C4::Context->preference("TemplateEncoding"), + IndependantBranches => C4::Context->preference("IndependantBranches"), + AutoLocation => C4::Context->preference("AutoLocation"), + yuipath => C4::Context->preference("yuipath"), + wrongip => $info{'wrongip'} ); + $template->param( loginprompt => 1 ) unless $info{'nopermission'}; my $self_url = $query->url( -absolute => 1 ); @@ -656,7 +731,7 @@ sub checkauth { # $cookie = $query->cookie(CGISESSID => $session->id # ); print $query->header( - -type => 'text/html', + -type => 'text/html', -charset => 'utf-8', -cookie => $cookie ), @@ -664,12 +739,388 @@ sub checkauth { exit; } +=item check_api_auth + + ($status, $cookie, $sessionId) = check_api_auth($query, $userflags); + +Given a CGI query containing the parameters 'userid' and 'password' and/or a session +cookie, determine if the user has the privileges specified by C<$userflags>. + +C is is meant for authenticating users of web services, and +consequently will always return and will not attempt to redirect the user +agent. + +If a valid session cookie is already present, check_api_auth will return a status +of "ok", the cookie, and the Koha session ID. + +If no session cookie is present, check_api_auth will check the 'userid' and 'password +parameters and create a session cookie and Koha session if the supplied credentials +are OK. + +Possible return values in C<$status> are: + +=over 4 + +=item "ok" -- user authenticated; C<$cookie> and C<$sessionid> have valid values. + +=item "failed" -- credentials are not correct; C<$cookie> and C<$sessionid> are undef + +=item "maintenance" -- DB is in maintenance mode; no login possible at the moment + +=item "expired -- session cookie has expired; API user should resubmit userid and password + +=back + +=cut + +sub check_api_auth { + my $query = shift; + my $flagsrequired = shift; + + my $dbh = C4::Context->dbh; + my $timeout = C4::Context->preference('timeout'); + $timeout = 600 unless $timeout; + + unless (C4::Context->preference('Version')) { + # database has not been installed yet + return ("maintenance", undef, undef); + } + my $kohaversion=C4::Context::KOHAVERSION; + $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/; + if (C4::Context->preference('Version') < $kohaversion) { + # database in need of version update; assume that + # no API should be called while databsae is in + # this condition. + return ("maintenance", undef, undef); + } + + # FIXME -- most of what follows is a copy-and-paste + # of code from checkauth. There is an obvious need + # for refactoring to separate the various parts of + # the authentication code, but as of 2007-11-19 this + # is deferred so as to not introduce bugs into the + # regular authentication code for Koha 3.0. + + # see if we have a valid session cookie already + # however, if a userid parameter is present (i.e., from + # a form submission, assume that any current cookie + # is to be ignored + my $sessionID = undef; + unless ($query->param('userid')) { + $sessionID = $query->cookie("CGISESSID"); + } + if ($sessionID) { + my $session = get_session($sessionID); + C4::Context->_new_userenv($sessionID); + if ($session) { + C4::Context::set_userenv( + $session->param('number'), $session->param('id'), + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('branchprinter') + ); + + my $ip = $session->param('ip'); + my $lasttime = $session->param('lasttime'); + my $userid = $session->param('id'); + if ( $lasttime < time() - $timeout ) { + # time out + $session->delete(); + C4::Context->_unset_userenv($sessionID); + $userid = undef; + $sessionID = undef; + return ("expired", undef, undef); + } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + # IP address changed + $session->delete(); + C4::Context->_unset_userenv($sessionID); + $userid = undef; + $sessionID = undef; + return ("expired", undef, undef); + } else { + my $cookie = $query->cookie( CGISESSID => $session->id ); + $session->param('lasttime',time()); + my $flags = haspermission( $dbh, $userid, $flagsrequired ); + if ($flags) { + return ("ok", $cookie, $sessionID); + } else { + $session->delete(); + C4::Context->_unset_userenv($sessionID); + $userid = undef; + $sessionID = undef; + return ("failed", undef, undef); + } + } + } else { + return ("expired", undef, undef); + } + } else { + # new login + my $userid = $query->param('userid'); + my $password = $query->param('password'); + unless ($userid and $password) { + # caller did something wrong, fail the authenticateion + return ("failed", undef, undef); + } + my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password ); + if ($return and haspermission( $dbh, $userid, $flagsrequired)) { + my $session = get_session(""); + return ("failed", undef, undef) unless $session; + + my $sessionID = $session->id; + C4::Context->_new_userenv($sessionID); + my $cookie = $query->cookie(CGISESSID => $sessionID); + if ( $return == 1 ) { + my ( + $borrowernumber, $firstname, $surname, + $userflags, $branchcode, $branchname, + $branchprinter, $emailaddress + ); + my $sth = + $dbh->prepare( +"select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname,branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where userid=?" + ); + $sth->execute($userid); + ( + $borrowernumber, $firstname, $surname, + $userflags, $branchcode, $branchname, + $branchprinter, $emailaddress + ) = $sth->fetchrow if ( $sth->rows ); + + unless ($sth->rows ) { + my $sth = $dbh->prepare( +"select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname, branches.branchprinter as branchprinter, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where cardnumber=?" + ); + $sth->execute($cardnumber); + ( + $borrowernumber, $firstname, $surname, + $userflags, $branchcode, $branchname, + $branchprinter, $emailaddress + ) = $sth->fetchrow if ( $sth->rows ); + + unless ( $sth->rows ) { + $sth->execute($userid); + ( + $borrowernumber, $firstname, $surname, $userflags, + $branchcode, $branchname, $branchprinter, $emailaddress + ) = $sth->fetchrow if ( $sth->rows ); + } + } + + my $ip = $ENV{'REMOTE_ADDR'}; + # if they specify at login, use that + if ($query->param('branch')) { + $branchcode = $query->param('branch'); + $branchname = GetBranchName($branchcode); + } + my $branches = GetBranches(); + my @branchesloop; + foreach my $br ( keys %$branches ) { + # now we work with the treatment of ip + my $domain = $branches->{$br}->{'branchip'}; + if ( $domain && $ip =~ /^$domain/ ) { + $branchcode = $branches->{$br}->{'branchcode'}; + + # new op dev : add the branchprinter and branchname in the cookie + $branchprinter = $branches->{$br}->{'branchprinter'}; + $branchname = $branches->{$br}->{'branchname'}; + } + } + $session->param('number',$borrowernumber); + $session->param('id',$userid); + $session->param('cardnumber',$cardnumber); + $session->param('firstname',$firstname); + $session->param('surname',$surname); + $session->param('branch',$branchcode); + $session->param('branchname',$branchname); + $session->param('flags',$userflags); + $session->param('emailaddress',$emailaddress); + $session->param('ip',$session->remote_addr()); + $session->param('lasttime',time()); + } elsif ( $return == 2 ) { + #We suppose the user is the superlibrarian + $session->param('number',0); + $session->param('id',C4::Context->config('user')); + $session->param('cardnumber',C4::Context->config('user')); + $session->param('firstname',C4::Context->config('user')); + $session->param('surname',C4::Context->config('user')); + $session->param('branch','NO_LIBRARY_SET'); + $session->param('branchname','NO_LIBRARY_SET'); + $session->param('flags',1); + $session->param('emailaddress', C4::Context->preference('KohaAdminEmailAddress')); + $session->param('ip',$session->remote_addr()); + $session->param('lasttime',time()); + } + C4::Context::set_userenv( + $session->param('number'), $session->param('id'), + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('branchprinter') + ); + return ("ok", $cookie, $sessionID); + } else { + return ("failed", undef, undef); + } + } +} + +=item check_cookie_auth + + ($status, $sessionId) = check_api_auth($cookie, $userflags); + +Given a CGISESSID cookie set during a previous login to Koha, determine +if the user has the privileges specified by C<$userflags>. + +C is meant for authenticating special services +such as tools/upload-file.pl that are invoked by other pages that +have been authenticated in the usual way. + +Possible return values in C<$status> are: + +=over 4 + +=item "ok" -- user authenticated; C<$sessionID> have valid values. + +=item "failed" -- credentials are not correct; C<$sessionid> are undef + +=item "maintenance" -- DB is in maintenance mode; no login possible at the moment + +=item "expired -- session cookie has expired; API user should resubmit userid and password + +=back + +=cut + +sub check_cookie_auth { + my $cookie = shift; + my $flagsrequired = shift; + + my $dbh = C4::Context->dbh; + my $timeout = C4::Context->preference('timeout'); + $timeout = 600 unless $timeout; + + unless (C4::Context->preference('Version')) { + # database has not been installed yet + return ("maintenance", undef); + } + my $kohaversion=C4::Context::KOHAVERSION; + $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/; + if (C4::Context->preference('Version') < $kohaversion) { + # database in need of version update; assume that + # no API should be called while databsae is in + # this condition. + return ("maintenance", undef); + } + + # FIXME -- most of what follows is a copy-and-paste + # of code from checkauth. There is an obvious need + # for refactoring to separate the various parts of + # the authentication code, but as of 2007-11-23 this + # is deferred so as to not introduce bugs into the + # regular authentication code for Koha 3.0. + + # see if we have a valid session cookie already + # however, if a userid parameter is present (i.e., from + # a form submission, assume that any current cookie + # is to be ignored + unless (defined $cookie and $cookie) { + return ("failed", undef); + } + my $sessionID = $cookie; + my $session = get_session($sessionID); + C4::Context->_new_userenv($sessionID); + if ($session) { + C4::Context::set_userenv( + $session->param('number'), $session->param('id'), + $session->param('cardnumber'), $session->param('firstname'), + $session->param('surname'), $session->param('branch'), + $session->param('branchname'), $session->param('flags'), + $session->param('emailaddress'), $session->param('branchprinter') + ); + + my $ip = $session->param('ip'); + my $lasttime = $session->param('lasttime'); + my $userid = $session->param('id'); + if ( $lasttime < time() - $timeout ) { + # time out + $session->delete(); + C4::Context->_unset_userenv($sessionID); + $userid = undef; + $sessionID = undef; + return ("expired", undef); + } elsif ( $ip ne $ENV{'REMOTE_ADDR'} ) { + # IP address changed + $session->delete(); + C4::Context->_unset_userenv($sessionID); + $userid = undef; + $sessionID = undef; + return ("expired", undef); + } else { + $session->param('lasttime',time()); + my $flags = haspermission( $dbh, $userid, $flagsrequired ); + if ($flags) { + return ("ok", $sessionID); + } else { + $session->delete(); + C4::Context->_unset_userenv($sessionID); + $userid = undef; + $sessionID = undef; + return ("failed", undef); + } + } + } else { + return ("expired", undef); + } +} + +=item get_session + + use CGI::Session; + my $session = get_session($sessionID); + +Given a session ID, retrieve the CGI::Session object used to store +the session's state. The session object can be used to store +data that needs to be accessed by different scripts during a +user's session. + +If the C<$sessionID> parameter is an empty string, a new session +will be created. + +=cut + +sub get_session { + my $sessionID = shift; + my $storage_method = C4::Context->preference('SessionStorage'); + my $dbh = C4::Context->dbh; + my $session; + if ($storage_method eq 'mysql'){ + $session = new CGI::Session("driver:MySQL;serializer:yaml", $sessionID, {Handle=>$dbh}); + } + elsif ($storage_method eq 'Pg') { + $session = new CGI::Session("driver:PostgreSQL;serializer:yaml", $sessionID, {Handle=>$dbh}); + } + else { + # catch all defaults to tmp should work on all systems + $session = new CGI::Session("driver:File;serializer:yaml", $sessionID, {Directory=>'/tmp'}); + } + return $session; +} + sub checkpw { + my ( $dbh, $userid, $password ) = @_; + if ($ldap) { + $debug and print "## checkpw - checking LDAP\n"; + my ($retval,$retcard) = checkpw_ldap(@_); # EXTERNAL AUTH + ($retval) and return ($retval,$retcard); + } # INTERNAL AUTH - my $sth = $dbh->prepare( -"SELECT password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" + my $sth = + $dbh->prepare( +"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" ); $sth->execute($userid); if ( $sth->rows ) { @@ -678,13 +1129,14 @@ sub checkpw { = $sth->fetchrow; if ( md5_base64($password) eq $md5password ) { - C4::Context->set_userenv($borrowernumber, $userid, $cardnumber, + C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, $firstname, $surname, $branchcode, $flags ); return 1, $cardnumber; } } - $sth = $dbh->prepare( -"SELECT password,cardnumber,borrowernumber,userid, firstname,surname,branchcode,flags from borrowers where cardnumber=?" + $sth = + $dbh->prepare( +"select password,cardnumber,borrowernumber,userid, firstname,surname,branchcode,flags from borrowers where cardnumber=?" ); $sth->execute($userid); if ( $sth->rows ) { @@ -699,7 +1151,7 @@ sub checkpw { } } if ( $userid && $userid eq C4::Context->config('user') - && $password eq C4::Context->config('pass') ) + && "$password" eq C4::Context->config('pass') ) { # Koha superuser account @@ -707,7 +1159,7 @@ sub checkpw { return 2; } if ( $userid && $userid eq 'demo' - && $password eq 'demo' + && "$password" eq 'demo' && C4::Context->config('demo') ) { @@ -718,15 +1170,22 @@ sub checkpw { return 0; } +=item getuserflags + + $authflags = getuserflags($flags,$dbh); +Translates integer flags into permissions strings hash. + +C<$flags> is the integer userflags value ( borrowers.userflags ) +C<$authflags> is a hashref of permissions + +=cut + sub getuserflags { - my $cardnumber = shift; - my $dbh = shift; + my $flags = shift; + my $dbh = shift; my $userflags; - my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE cardnumber=?"); - $sth->execute($cardnumber); - my ($flags) = $sth->fetchrow; $flags = 0 unless $flags; - $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags"); + my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags"); $sth->execute; while ( my ( $bit, $flag, $defaulton ) = $sth->fetchrow ) { @@ -740,31 +1199,46 @@ sub getuserflags { return $userflags; } +=item haspermission + + $flags = ($dbh,$member,$flagsrequired); + +C<$member> may be either userid or overloaded with $borrower hashref from GetMemberDetails. +C<$flags> is a hashref of required flags lik C<$borrower-<{authflags}> + +Returns member's flags or 0 if a permission is not met. + +=cut + sub haspermission { my ( $dbh, $userid, $flagsrequired ) = @_; - my $sth = $dbh->prepare("SELECT cardnumber FROM borrowers WHERE userid=?"); - $sth->execute($userid); - my ($cardnumber) = $sth->fetchrow; - ($cardnumber) || ( $cardnumber = $userid ); - my $flags = getuserflags( $cardnumber, $dbh ); - my $configfile; + my ($flags,$intflags); + $dbh=C4::Context->dbh unless($dbh); + if(ref($userid)) { + $intflags = $userid->{'flags'}; + } else { + my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE userid=?"); + $sth->execute($userid); + my ($intflags) = $sth->fetchrow; + $flags = getuserflags( $intflags, $dbh ); + } if ( $userid eq C4::Context->config('user') ) { - # Super User Account from /etc/koha.conf $flags->{'superlibrarian'} = 1; } if ( $userid eq 'demo' && C4::Context->config('demo') ) { - # Demo user that can do "anything" (demo=1 in /etc/koha.conf) $flags->{'superlibrarian'} = 1; } return $flags if $flags->{superlibrarian}; foreach ( keys %$flagsrequired ) { - return $flags if $flags->{$_}; + return 0 unless( $flags->{$_} ); } - return 0; + return $flags; + #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered. } + sub getborrowernumber { my ($userid) = @_; my $dbh = C4::Context->dbh; @@ -780,6 +1254,7 @@ sub getborrowernumber { return 0; } +END { } # module clean-up code here (global destructor) 1; __END__