View | Details | Raw Unified | Return to bug 9611
Collapse All | Expand All

(-)a/C4/Auth.pm (-23 / +28 lines)
Lines 48-54 BEGIN { Link Here
48
    $debug       = $ENV{DEBUG};
48
    $debug       = $ENV{DEBUG};
49
    @ISA         = qw(Exporter);
49
    @ISA         = qw(Exporter);
50
    @EXPORT      = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
50
    @EXPORT      = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions);
51
    @EXPORT_OK   = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions
51
    @EXPORT_OK   = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash
52
                      &get_all_subpermissions &get_user_subpermissions
52
                      ParseSearchHistoryCookie hash_password
53
                      ParseSearchHistoryCookie hash_password
53
                   );
54
                   );
54
    %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
55
    %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] );
Lines 1552-1559 sub generate_salt { Link Here
1552
1553
1553
1554
1554
sub checkpw {
1555
sub checkpw {
1555
1556
    my ( $dbh, $userid, $password, $query ) = @_;
1556
    my ( $dbh, $userid, $password, $query ) = @_;
1557
1557
    if ($ldap) {
1558
    if ($ldap) {
1558
        $debug and print STDERR "## checkpw - checking LDAP\n";
1559
        $debug and print STDERR "## checkpw - checking LDAP\n";
1559
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
1560
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
Lines 1563-1575 sub checkpw { Link Here
1563
    if ($cas && $query && $query->param('ticket')) {
1564
    if ($cas && $query && $query->param('ticket')) {
1564
        $debug and print STDERR "## checkpw - checking CAS\n";
1565
        $debug and print STDERR "## checkpw - checking CAS\n";
1565
    # In case of a CAS authentication, we use the ticket instead of the password
1566
    # In case of a CAS authentication, we use the ticket instead of the password
1566
    my $ticket = $query->param('ticket');
1567
        my $ticket = $query->param('ticket');
1567
        my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query);    # EXTERNAL AUTH
1568
        my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query);    # EXTERNAL AUTH
1568
        ($retval) and return ($retval,$retcard,$retuserid);
1569
        ($retval) and return ($retval,$retcard,$retuserid);
1569
    return 0;
1570
        return 0;
1570
    }
1571
    }
1571
1572
1572
    # INTERNAL AUTH
1573
    return checkpw_internal(@_)
1574
}
1575
1576
sub checkpw_internal {
1577
    my ( $dbh, $userid, $password ) = @_;
1578
1573
    my $sth =
1579
    my $sth =
1574
      $dbh->prepare(
1580
      $dbh->prepare(
1575
"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?"
1581
"select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?"
Lines 1580-1593 sub checkpw { Link Here
1580
            $surname, $branchcode, $flags )
1586
            $surname, $branchcode, $flags )
1581
          = $sth->fetchrow;
1587
          = $sth->fetchrow;
1582
1588
1583
        # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5
1589
        if ( checkpw_hash($password, $stored_hash) ) {
1584
        my $hash;
1585
        if ( substr($stored_hash,0,2) eq '$2') {
1586
            $hash = hash_password($password, $stored_hash);
1587
        } else {
1588
            $hash = md5_base64($password);
1589
        }
1590
        if ( $hash eq $stored_hash and $stored_hash ne "!") {
1591
1590
1592
            C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
1591
            C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber,
1593
                $firstname, $surname, $branchcode, $flags );
1592
                $firstname, $surname, $branchcode, $flags );
Lines 1604-1618 sub checkpw { Link Here
1604
            $surname, $branchcode, $flags )
1603
            $surname, $branchcode, $flags )
1605
          = $sth->fetchrow;
1604
          = $sth->fetchrow;
1606
1605
1607
        # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5
1606
        if ( checkpw_hash($password, $stored_hash) ) {
1608
        my $hash;
1609
        if ( substr($stored_hash,0,2) eq '$2') {
1610
            $hash = hash_password($password, $stored_hash);
1611
        } else {
1612
            $hash = md5_base64($password);
1613
        }
1614
1615
        if ( $hash eq $stored_hash ) {
1616
1607
1617
            C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber,
1608
            C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber,
1618
                $firstname, $surname, $branchcode, $flags );
1609
                $firstname, $surname, $branchcode, $flags );
Lines 1639-1644 sub checkpw { Link Here
1639
    return 0;
1630
    return 0;
1640
}
1631
}
1641
1632
1633
sub checkpw_hash {
1634
    my ( $password, $stored_hash ) = @_;
1635
1636
    return if $stored_hash eq '!';
1637
1638
    # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5
1639
    my $hash;
1640
    if ( substr($stored_hash,0,2) eq '$2') {
1641
        $hash = hash_password($password, $stored_hash);
1642
    } else {
1643
        $hash = md5_base64($password);
1644
    }
1645
    return $hash eq $stored_hash;
1646
}
1647
1642
=head2 getuserflags
1648
=head2 getuserflags
1643
1649
1644
    my $authflags = getuserflags($flags, $userid, [$dbh]);
1650
    my $authflags = getuserflags($flags, $userid, [$dbh]);
1645
- 

Return to bug 9611