Lines 48-54
BEGIN {
Link Here
|
48 |
$debug = $ENV{DEBUG}; |
48 |
$debug = $ENV{DEBUG}; |
49 |
@ISA = qw(Exporter); |
49 |
@ISA = qw(Exporter); |
50 |
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); |
50 |
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); |
51 |
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions |
51 |
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash |
|
|
52 |
&get_all_subpermissions &get_user_subpermissions |
52 |
ParseSearchHistoryCookie hash_password |
53 |
ParseSearchHistoryCookie hash_password |
53 |
); |
54 |
); |
54 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
55 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
Lines 1552-1559
sub generate_salt {
Link Here
|
1552 |
|
1553 |
|
1553 |
|
1554 |
|
1554 |
sub checkpw { |
1555 |
sub checkpw { |
1555 |
|
|
|
1556 |
my ( $dbh, $userid, $password, $query ) = @_; |
1556 |
my ( $dbh, $userid, $password, $query ) = @_; |
|
|
1557 |
|
1557 |
if ($ldap) { |
1558 |
if ($ldap) { |
1558 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1559 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1559 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
1560 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
Lines 1563-1575
sub checkpw {
Link Here
|
1563 |
if ($cas && $query && $query->param('ticket')) { |
1564 |
if ($cas && $query && $query->param('ticket')) { |
1564 |
$debug and print STDERR "## checkpw - checking CAS\n"; |
1565 |
$debug and print STDERR "## checkpw - checking CAS\n"; |
1565 |
# In case of a CAS authentication, we use the ticket instead of the password |
1566 |
# In case of a CAS authentication, we use the ticket instead of the password |
1566 |
my $ticket = $query->param('ticket'); |
1567 |
my $ticket = $query->param('ticket'); |
1567 |
my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH |
1568 |
my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH |
1568 |
($retval) and return ($retval,$retcard,$retuserid); |
1569 |
($retval) and return ($retval,$retcard,$retuserid); |
1569 |
return 0; |
1570 |
return 0; |
1570 |
} |
1571 |
} |
1571 |
|
1572 |
|
1572 |
# INTERNAL AUTH |
1573 |
return checkpw_internal(@_) |
|
|
1574 |
} |
1575 |
|
1576 |
sub checkpw_internal { |
1577 |
my ( $dbh, $userid, $password ) = @_; |
1578 |
|
1573 |
my $sth = |
1579 |
my $sth = |
1574 |
$dbh->prepare( |
1580 |
$dbh->prepare( |
1575 |
"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" |
1581 |
"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" |
Lines 1580-1593
sub checkpw {
Link Here
|
1580 |
$surname, $branchcode, $flags ) |
1586 |
$surname, $branchcode, $flags ) |
1581 |
= $sth->fetchrow; |
1587 |
= $sth->fetchrow; |
1582 |
|
1588 |
|
1583 |
# check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 |
1589 |
if ( checkpw_hash($password, $stored_hash) ) { |
1584 |
my $hash; |
|
|
1585 |
if ( substr($stored_hash,0,2) eq '$2') { |
1586 |
$hash = hash_password($password, $stored_hash); |
1587 |
} else { |
1588 |
$hash = md5_base64($password); |
1589 |
} |
1590 |
if ( $hash eq $stored_hash and $stored_hash ne "!") { |
1591 |
|
1590 |
|
1592 |
C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, |
1591 |
C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, |
1593 |
$firstname, $surname, $branchcode, $flags ); |
1592 |
$firstname, $surname, $branchcode, $flags ); |
Lines 1604-1618
sub checkpw {
Link Here
|
1604 |
$surname, $branchcode, $flags ) |
1603 |
$surname, $branchcode, $flags ) |
1605 |
= $sth->fetchrow; |
1604 |
= $sth->fetchrow; |
1606 |
|
1605 |
|
1607 |
# check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 |
1606 |
if ( checkpw_hash($password, $stored_hash) ) { |
1608 |
my $hash; |
|
|
1609 |
if ( substr($stored_hash,0,2) eq '$2') { |
1610 |
$hash = hash_password($password, $stored_hash); |
1611 |
} else { |
1612 |
$hash = md5_base64($password); |
1613 |
} |
1614 |
|
1615 |
if ( $hash eq $stored_hash ) { |
1616 |
|
1607 |
|
1617 |
C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, |
1608 |
C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, |
1618 |
$firstname, $surname, $branchcode, $flags ); |
1609 |
$firstname, $surname, $branchcode, $flags ); |
Lines 1639-1644
sub checkpw {
Link Here
|
1639 |
return 0; |
1630 |
return 0; |
1640 |
} |
1631 |
} |
1641 |
|
1632 |
|
|
|
1633 |
sub checkpw_hash { |
1634 |
my ( $password, $stored_hash ) = @_; |
1635 |
|
1636 |
return if $stored_hash eq '!'; |
1637 |
|
1638 |
# check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 |
1639 |
my $hash; |
1640 |
if ( substr($stored_hash,0,2) eq '$2') { |
1641 |
$hash = hash_password($password, $stored_hash); |
1642 |
} else { |
1643 |
$hash = md5_base64($password); |
1644 |
} |
1645 |
return $hash eq $stored_hash; |
1646 |
} |
1647 |
|
1642 |
=head2 getuserflags |
1648 |
=head2 getuserflags |
1643 |
|
1649 |
|
1644 |
my $authflags = getuserflags($flags, $userid, [$dbh]); |
1650 |
my $authflags = getuserflags($flags, $userid, [$dbh]); |
1645 |
- |
|
|