|
Lines 48-54
BEGIN {
Link Here
|
| 48 |
$debug = $ENV{DEBUG}; |
48 |
$debug = $ENV{DEBUG}; |
| 49 |
@ISA = qw(Exporter); |
49 |
@ISA = qw(Exporter); |
| 50 |
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); |
50 |
@EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); |
| 51 |
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions |
51 |
@EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash |
|
|
52 |
&get_all_subpermissions &get_user_subpermissions |
| 52 |
ParseSearchHistoryCookie hash_password |
53 |
ParseSearchHistoryCookie hash_password |
| 53 |
); |
54 |
); |
| 54 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
55 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
|
Lines 1552-1559
sub generate_salt {
Link Here
|
| 1552 |
|
1553 |
|
| 1553 |
|
1554 |
|
| 1554 |
sub checkpw { |
1555 |
sub checkpw { |
| 1555 |
|
|
|
| 1556 |
my ( $dbh, $userid, $password, $query ) = @_; |
1556 |
my ( $dbh, $userid, $password, $query ) = @_; |
|
|
1557 |
|
| 1557 |
if ($ldap) { |
1558 |
if ($ldap) { |
| 1558 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1559 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
| 1559 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
1560 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
|
Lines 1563-1575
sub checkpw {
Link Here
|
| 1563 |
if ($cas && $query && $query->param('ticket')) { |
1564 |
if ($cas && $query && $query->param('ticket')) { |
| 1564 |
$debug and print STDERR "## checkpw - checking CAS\n"; |
1565 |
$debug and print STDERR "## checkpw - checking CAS\n"; |
| 1565 |
# In case of a CAS authentication, we use the ticket instead of the password |
1566 |
# In case of a CAS authentication, we use the ticket instead of the password |
| 1566 |
my $ticket = $query->param('ticket'); |
1567 |
my $ticket = $query->param('ticket'); |
| 1567 |
my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH |
1568 |
my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH |
| 1568 |
($retval) and return ($retval,$retcard,$retuserid); |
1569 |
($retval) and return ($retval,$retcard,$retuserid); |
| 1569 |
return 0; |
1570 |
return 0; |
| 1570 |
} |
1571 |
} |
| 1571 |
|
1572 |
|
| 1572 |
# INTERNAL AUTH |
1573 |
return checkpw_internal(@_) |
|
|
1574 |
} |
| 1575 |
|
| 1576 |
sub checkpw_internal { |
| 1577 |
my ( $dbh, $userid, $password ) = @_; |
| 1578 |
|
| 1573 |
my $sth = |
1579 |
my $sth = |
| 1574 |
$dbh->prepare( |
1580 |
$dbh->prepare( |
| 1575 |
"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" |
1581 |
"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" |
|
Lines 1580-1593
sub checkpw {
Link Here
|
| 1580 |
$surname, $branchcode, $flags ) |
1586 |
$surname, $branchcode, $flags ) |
| 1581 |
= $sth->fetchrow; |
1587 |
= $sth->fetchrow; |
| 1582 |
|
1588 |
|
| 1583 |
# check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 |
1589 |
if ( checkpw_hash($password, $stored_hash) ) { |
| 1584 |
my $hash; |
|
|
| 1585 |
if ( substr($stored_hash,0,2) eq '$2') { |
| 1586 |
$hash = hash_password($password, $stored_hash); |
| 1587 |
} else { |
| 1588 |
$hash = md5_base64($password); |
| 1589 |
} |
| 1590 |
if ( $hash eq $stored_hash and $stored_hash ne "!") { |
| 1591 |
|
1590 |
|
| 1592 |
C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, |
1591 |
C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, |
| 1593 |
$firstname, $surname, $branchcode, $flags ); |
1592 |
$firstname, $surname, $branchcode, $flags ); |
|
Lines 1604-1618
sub checkpw {
Link Here
|
| 1604 |
$surname, $branchcode, $flags ) |
1603 |
$surname, $branchcode, $flags ) |
| 1605 |
= $sth->fetchrow; |
1604 |
= $sth->fetchrow; |
| 1606 |
|
1605 |
|
| 1607 |
# check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 |
1606 |
if ( checkpw_hash($password, $stored_hash) ) { |
| 1608 |
my $hash; |
|
|
| 1609 |
if ( substr($stored_hash,0,2) eq '$2') { |
| 1610 |
$hash = hash_password($password, $stored_hash); |
| 1611 |
} else { |
| 1612 |
$hash = md5_base64($password); |
| 1613 |
} |
| 1614 |
|
| 1615 |
if ( $hash eq $stored_hash ) { |
| 1616 |
|
1607 |
|
| 1617 |
C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, |
1608 |
C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, |
| 1618 |
$firstname, $surname, $branchcode, $flags ); |
1609 |
$firstname, $surname, $branchcode, $flags ); |
|
Lines 1639-1644
sub checkpw {
Link Here
|
| 1639 |
return 0; |
1630 |
return 0; |
| 1640 |
} |
1631 |
} |
| 1641 |
|
1632 |
|
|
|
1633 |
sub checkpw_hash { |
| 1634 |
my ( $password, $stored_hash ) = @_; |
| 1635 |
|
| 1636 |
return if $stored_hash eq '!'; |
| 1637 |
|
| 1638 |
# check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 |
| 1639 |
my $hash; |
| 1640 |
if ( substr($stored_hash,0,2) eq '$2') { |
| 1641 |
$hash = hash_password($password, $stored_hash); |
| 1642 |
} else { |
| 1643 |
$hash = md5_base64($password); |
| 1644 |
} |
| 1645 |
return $hash eq $stored_hash; |
| 1646 |
} |
| 1647 |
|
| 1642 |
=head2 getuserflags |
1648 |
=head2 getuserflags |
| 1643 |
|
1649 |
|
| 1644 |
my $authflags = getuserflags($flags, $userid, [$dbh]); |
1650 |
my $authflags = getuserflags($flags, $userid, [$dbh]); |
| 1645 |
- |
|
|