View | Details | Raw Unified | Return to bug 13932
Collapse All | Expand All

(-)a/C4/Auth.pm (-4 / +66 lines)
Lines 678-683 sub _version_check { Link Here
678
    }
678
    }
679
}
679
}
680
680
681
=head2 get_header
682
683
    my $header_val = get_header($header);
684
685
This retrieves the HTTP header from the CGI request. Note that this seems to
686
not work with regular CGI (those values end up in the environment anyway), but
687
it does work with plack.
688
689
If there is no matching header, C<undef> is returned.
690
691
=cut
692
693
sub get_header {
694
    my ($header) = @_;
695
696
    my $q = CGI->new();
697
    # Prepend HTTP_ as that's how they come through
698
    my $h_val = $q->http('HTTP_' . $header);
699
    return $h_val;
700
}
701
681
sub _session_log {
702
sub _session_log {
682
    (@_) or return 0;
703
    (@_) or return 0;
683
    open my $fh, '>>', "/tmp/sessionlog" or warn "ERROR: Cannot append to /tmp/sessionlog";
704
    open my $fh, '>>', "/tmp/sessionlog" or warn "ERROR: Cannot append to /tmp/sessionlog";
Lines 723-728 sub checkauth { Link Here
723
    # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml
744
    # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml
724
    my $casparam = $query->param('cas');
745
    my $casparam = $query->param('cas');
725
    my $q_userid = $query->param('userid') // '';
746
    my $q_userid = $query->param('userid') // '';
747
    my $trusted_header = C4::Context->config('trusted_header');
748
    my $trust_head_val = get_header($trusted_header) if $trusted_header;
726
749
727
    # Basic authentication is incompatible with the use of Shibboleth,
750
    # Basic authentication is incompatible with the use of Shibboleth,
728
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
751
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 744-755 sub checkauth { Link Here
744
        );
767
        );
745
        $loggedin = 1;
768
        $loggedin = 1;
746
    }
769
    }
770
    elsif ( $userid = $trust_head_val ) {
771
772
        # This uses something like
773
        # <trusted_header>X_REMOTE_USER</trusted_header>
774
        # in koha-conf.xml, and checks that header on the incoming request.
775
        # If it is there and contains a user ID, we believe it and log the
776
        # user in with that. This is intended for things like plack behind a
777
        # reverse proxy that does auth, and puts the user ID into a header.
778
        #
779
        # Basically, we treat it just like basic auth.
780
        $cookie = $query->cookie(
781
            -name     => 'CGISESSID',
782
            -value    => '',
783
            -expires  => '',
784
            -HttpOnly => 1,
785
        );
786
        $loggedin = check_user_exists($userid);
787
    }
747
    elsif ($persona) {
788
    elsif ($persona) {
748
789
749
        # we dont want to set a session because we are being called by a persona callback
790
        # we dont want to set a session because we are being called by a persona callback
750
    }
791
    }
751
    elsif ( $sessionID = $query->cookie("CGISESSID") )
792
    elsif ( $sessionID = $query->cookie("CGISESSID") ) {    # assignment, not comparison
752
    {    # assignment, not comparison
753
        my $session = get_session($sessionID);
793
        my $session = get_session($sessionID);
754
        C4::Context->_new_userenv($sessionID);
794
        C4::Context->_new_userenv($sessionID);
755
        my ( $ip, $lasttime, $sessiontype );
795
        my ( $ip, $lasttime, $sessiontype );
Lines 884-890 sub checkauth { Link Here
884
            || $userid
924
            || $userid
885
            || ( $shib && $shib_login )
925
            || ( $shib && $shib_login )
886
            || $pki_field ne 'None'
926
            || $pki_field ne 'None'
887
            || $persona )
927
            || $persona
928
            || $trusted_header )
888
        {
929
        {
889
            my $password    = $query->param('password');
930
            my $password    = $query->param('password');
890
            my $shibSuccess = 0;
931
            my $shibSuccess = 0;
Lines 1798-1803 sub checkpw_hash { Link Here
1798
    return $hash eq $stored_hash;
1839
    return $hash eq $stored_hash;
1799
}
1840
}
1800
1841
1842
=head2 check_user_exists
1843
1844
    my $exists = check_user_exists($userid);
1845
1846
This does a very simple check to see if a user could log in with the provided
1847
userid. That is, does the userid exist as a person's userid or cardnumber
1848
in the database. Returns a true value if it does, false otherwise.
1849
1850
This is to allow koha to ensure that third party auth systems give us a real
1851
user ID for a user, not just assuming they're real.
1852
1853
=cut
1854
1855
sub check_user_exists {
1856
    my ($userid) = @_;
1857
1858
    my $dbh = C4::Context->dbh();
1859
    my $sth = $dbh->prepare('SELECT userid FROM borrowers WHERE userid=? OR cardnumber=? LIMIT 1');
1860
    $sth->execute($userid, $userid);
1861
    return !!$sth->fetchrow_arrayref(); # coerce to boolean
1862
}
1863
1801
=head2 getuserflags
1864
=head2 getuserflags
1802
1865
1803
    my $authflags = getuserflags($flags, $userid, [$dbh]);
1866
    my $authflags = getuserflags($flags, $userid, [$dbh]);
1804
- 

Return to bug 13932