Attachment #40672 for bug #7174

View | Details | Raw Unified | Return to bug 7174
Collapse All | Expand All

Lines 19-29 package C4::Auth; Link Here

(-)a/C4/Auth.pm (-38 / +83 lines)
19		19
20	use strict;	20	use strict;
21	use warnings;	21	use warnings;
22	use Digest::MD5 qw(md5_base64);	22	use Digest::MD5 qw(md5_base64); #@DEPRECATED Digest::MD5, don't use it or you will get hurt.
23	use JSON qw/encode_json/;	23	use JSON qw/encode_json/;
24	use URI::Escape;	24	use URI::Escape;
25	use CGI::Session;	25	use CGI::Session;
26	use Scalar::Util qw(blessed);	26	use Scalar::Util qw(blessed);
		27	use Try::Tiny;
27		28
28	require Exporter;	29	require Exporter;
29	use C4::Context;	30	use C4::Context;
Lines 34-39 use C4::Search::History; Link Here
34	use Koha;	35	use Koha;
35	use Koha::Borrowers;	36	use Koha::Borrowers;
36	use Koha::AuthUtils qw(hash_password);	37	use Koha::AuthUtils qw(hash_password);
		38	use Koha::Auth;
		39	use Koha::Auth::Component;
37	use POSIX qw/strftime/;	40	use POSIX qw/strftime/;
38	use List::MoreUtils qw/ any /;	41	use List::MoreUtils qw/ any /;
39	use Encode qw( encode is_utf8);	42	use Encode qw( encode is_utf8);
Lines 639-688 has authenticated. Link Here
639		642
640	=cut	643	=cut
641		644
		645	=head _version_check
		646	#@DEPRECATED See Bug 7174
		647	use Koha::Auth::Component::* instead
		648	=cut
		649
642	sub _version_check {	650	sub _version_check {
643	my $type = shift;	651	my $type = shift;
644	my $query = shift;	652	my $query = shift;
645	my $version;	653	my $version;
646		654
647	# If version syspref is unavailable, it means Koha is being installed,	655	try {
648	# and so we must redirect to OPAC maintenance page or to the WebInstaller	656	Koha::Auth::Component::checkOPACMaintenance() if ( $type eq 'opac' );
649	# also, if OpacMaintenance is ON, OPAC should redirect to maintenance	657	Koha::Auth::Component::checkVersion();
650	if ( C4::Context->preference('OpacMaintenance') && $type eq 'opac' ) {	658	} catch {
651	warn "OPAC Install required, redirecting to maintenance";	659	if (blessed($_)) {
652	print $query->redirect("/cgi-bin/koha/maintenance.pl");	660	if ($_->isa('Koha::Exception::VersionMismatch')) {
653	safe_exit;	661	# check that database and koha version are the same
654	}	662	# there is no DB version, it's a fresh install,
655	unless ( $version = C4::Context->preference('Version') ) { # assignment, not comparison	663	# go to web installer
656	if ( $type ne 'opac' ) {	664	# there is a DB version, compare it to the code version
657	warn "Install required, redirecting to Installer";	665	my $warning = $_->error()." Redirecting to %s.";
658	print $query->redirect("/cgi-bin/koha/installer/install.pl");	666	if ( $type ne 'opac' ) {
659	} else {	667	warn sprintf( $warning, 'Installer' );
660	warn "OPAC Install required, redirecting to maintenance";	668	print $query->redirect("/cgi-bin/koha/installer/install.pl?step=1&op=updatestructure");
661	print $query->redirect("/cgi-bin/koha/maintenance.pl");	669	} else {
		670	warn sprintf( "OPAC: " . $warning, 'maintenance' );
		671	print $query->redirect("/cgi-bin/koha/maintenance.pl");
		672	}
		673	safe_exit;
		674	}
		675	elsif ($_->isa('Koha::Exception::ServiceTemporarilyUnavailable')) {
		676	# also, if OpacMaintenance is ON, OPAC should redirect to maintenance
		677	warn "OPAC Install required, redirecting to maintenance";
		678	print $query->redirect("/cgi-bin/koha/maintenance.pl");
		679	safe_exit;
		680	}
		681	elsif ($_->isa('Koha::Exception::BadSystemPreference')) {
		682	# If version syspref is unavailable, it means Koha is being installed,
		683	# and so we must redirect to OPAC maintenance page or to the WebInstaller
		684	if ( $type ne 'opac' ) {
		685	warn "Install required, redirecting to Installer";
		686	print $query->redirect("/cgi-bin/koha/installer/install.pl");
		687	} else {
		688	warn "OPAC Install required, redirecting to maintenance";
		689	print $query->redirect("/cgi-bin/koha/maintenance.pl");
		690	}
		691	safe_exit;
		692	}
		693	else {
		694	warn "Unknown exception class ".ref($_)."\n";
		695	die $_; #Unhandled exception case
		696	}
662	}	697	}
663	safe_exit;	698	else {
664	}	699	die $_; #Not a Koha::Exception-object, so rethrow it
665
666	# check that database and koha version are the same
667	# there is no DB version, it's a fresh install,
668	# go to web installer
669	# there is a DB version, compare it to the code version
670	my $kohaversion = Koha::version();
671
672	# remove the 3 last . to have a Perl number
673	$kohaversion =~ s/(.\..)\.(.)\.(.)/$1$2$3/;
674	$debug and print STDERR "kohaversion : $kohaversion\n";
675	if ( $version < $kohaversion ) {
676	my $warning = "Database update needed, redirecting to %s. Database is $version and Koha is $kohaversion";
677	if ( $type ne 'opac' ) {
678	warn sprintf( $warning, 'Installer' );
679	print $query->redirect("/cgi-bin/koha/installer/install.pl?step=1&op=updatestructure");
680	} else {
681	warn sprintf( "OPAC: " . $warning, 'maintenance' );
682	print $query->redirect("/cgi-bin/koha/maintenance.pl");
683	}	700	}
684	safe_exit;	701	};
685	}
686	}	702	}
687		703
688	sub _session_log {	704	sub _session_log {
Lines 702-708 sub _timeout_syspref { Link Here
702	return $timeout;	718	return $timeout;
703	}	719	}
704		720
		721	=head checkauth
		722	@DEPRECATED See Bug 7174
		723
		724	Compatibility layer for old Koha authentication system.
		725	Tries to authenticate using Koha::Auth, but if no authentication mechanism is
		726	identified, falls back to the deprecated legacy behaviour.
		727	=cut
		728
705	sub checkauth {	729	sub checkauth {
		730	my @params = @_; #Clone params so we don't accidentally change them if we fallback to checkauth_legacy()
		731	#Koha::Auth::checkAuth(@params);
		732	return checkauth_legacy(@params);
		733	}
		734
		735	=head checkauth_legacy
		736	@DEPRECATED See Bug 7174
		737
		738	We are calling this because the given authentication mechanism is not yet supported
		739	in Koha::Auth.
		740
		741	See checkauth-documentation floating somewhere in this file for info about the
		742	legacy authentication.
		743	=cut
		744
		745	sub checkauth_legacy {
706	my $query = shift;	746	my $query = shift;
707	$debug and warn "Checking Auth";	747	$debug and warn "Checking Auth";
708		748
Lines 1682-1687 sub get_session { Link Here
1682	return $session;	1722	return $session;
1683	}	1723	}
1684		1724
		1725	#@DEPRECATED See Bug 7174
1685	sub checkpw {	1726	sub checkpw {
1686	my ( $dbh, $userid, $password, $query, $type ) = @_;	1727	my ( $dbh, $userid, $password, $query, $type ) = @_;
1687	$type = 'opac' unless $type;	1728	$type = 'opac' unless $type;
Lines 1726-1731 sub checkpw { Link Here
1726	return checkpw_internal(@_)	1767	return checkpw_internal(@_)
1727	}	1768	}
1728		1769
		1770	#@DEPRECATED See Bug 7174
1729	sub checkpw_internal {	1771	sub checkpw_internal {
1730	my ( $dbh, $userid, $password ) = @_;	1772	my ( $dbh, $userid, $password ) = @_;
1731		1773
Lines 1778-1783 sub checkpw_internal { Link Here
1778	return 1, $cardnumber, $userid;	1820	return 1, $cardnumber, $userid;
1779	}	1821	}
1780	}	1822	}
		1823
1781	if ( $userid && $userid eq 'demo'	1824	if ( $userid && $userid eq 'demo'
1782	&& "$password" eq 'demo'	1825	&& "$password" eq 'demo'
1783	&& C4::Context->config('demo') )	1826	&& C4::Context->config('demo') )
Lines 1790-1795 sub checkpw_internal { Link Here
1790	return 0;	1833	return 0;
1791	}	1834	}
1792		1835
		1836	#@DEPRECATED See Bug 7174
1793	sub checkpw_hash {	1837	sub checkpw_hash {
1794	my ( $password, $stored_hash ) = @_;	1838	my ( $password, $stored_hash ) = @_;
1795		1839
Lines 1800-1805 sub checkpw_hash { Link Here
1800	if ( substr( $stored_hash, 0, 2 ) eq '$2' ) {	1844	if ( substr( $stored_hash, 0, 2 ) eq '$2' ) {
1801	$hash = hash_password( $password, $stored_hash );	1845	$hash = hash_password( $password, $stored_hash );
1802	} else {	1846	} else {
		1847	#@DEPRECATED Digest::MD5, don't use it or you will get hurt.
1803	$hash = md5_base64($password);	1848	$hash = md5_base64($password);
1804	}	1849	}
1805	return $hash eq $stored_hash;	1850	return $hash eq $stored_hash;

Lines 22-27 use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64); Link Here

(-)a/Koha/AuthUtils.pm (-1 / +80 lines)
22	use Encode qw( encode is_utf8 );	22	use Encode qw( encode is_utf8 );
23	use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt	23	use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt
24		24
		25	use Koha::Borrowers;
		26
		27	use Koha::Exception::LoginFailed;
		28
25	use base 'Exporter';	29	use base 'Exporter';
26		30
27	our $VERSION = '1.01';	31	our $VERSION = '1.01';
Lines 133-138 sub generate_salt { Link Here
133	close SOURCE;	137	close SOURCE;
134	return $string;	138	return $string;
135	}	139	}
		140
		141	=head checkKohaPassword
		142
		143	my $isSuperuser = Koha::AuthUtils::checkKohaPassword($userid, $password);
		144
		145	Checks of the given username and password match anybody in the Koha DB
		146	@PARAM1 String, user identifier, either the koha.borrowers.userid, or koha.borrowers.cardnumber
		147	@PARAM2 String, clear text password from the authenticating user
		148	@RETURN String 'superuser', if user is the Koha DB user (superuser account)
		149	undef, if the user is but a man.
		150	@THROWS Koha::Exception::LoginFailed, if no matching password was found for all username aliases in Koha.
		151	=cut
		152
		153	sub checkKohaPassword {
		154	my ($userid, $password) = @_;
		155
		156	if ( $userid && $userid eq C4::Context->config('user') ) {
		157	if ( $password && $password eq C4::Context->config('pass') ) {
		158	# Koha superuser account
		159	# C4::Context->set_userenv(0,0,C4::Context->config('user'),C4::Context->config('user'),C4::Context->config('user'),"",1);
		160	return 'superuser';
		161	}
		162	else {
		163	Koha::Exception::LoginFailed->throw(error => "Password authentication failed");
		164	}
		165	}
		166
		167	my $usernameFound = 0; #Report to the user if userid/barcode was found, even if the login failed.
		168	#Check for each username alias if we can confirm a login with that.
		169	my @usernameAliasColumns = ('userid', 'cardnumber');
		170	for my $unameAlias (@usernameAliasColumns) {
		171	my $borrower = Koha::Borrowers->find({$unameAlias => $userid});
		172	if ( $borrower ) {
		173	$usernameFound = 1;
		174	return if ( checkHash( $password, $borrower->password ) );
		175	}
		176	}
		177
		178	Koha::Exception::LoginFailed->throw(error => "Password authentication failed for the given ".( ($usernameFound) ? "password" : "username and password").".");
		179	}
		180
		181	=head checkHash
		182
		183	my $passwordOk = Koha::AuthUtils::checkHash($password1, $password2)
		184
		185	Checks if a clear-text String/password matches the given hash when
		186	MD5 or Bcrypt hashing algorith is applied to it.
		187
		188	Bcrypt is applied if @PARAM2 starts with '$2'
		189	MD5 otherwise
		190
		191	@PARAM1 String, clear text passsword or any other String
		192	@PARAM2 String, hashed text password or any other String.
		193	@RETURN Boolean, 1 if given parameters match
		194	, 0 if not
		195	=cut
		196
		197	sub checkHash {
		198	my ( $password, $stored_hash ) = @_;
		199
		200	$password = Encode::encode( 'UTF-8', $password )
		201	if Encode::is_utf8($password);
		202
		203	return if $stored_hash eq '!';
204
205	my $hash;
206	if ( substr( $stored_hash, 0, 2 ) eq '$2' ) {
207	$hash = hash_password( $password, $stored_hash );
208	} else {
209	#@DEPRECATED Digest::MD5, don't use it or you will get hurt.
210	require Digest::MD5;
211	$hash = Digest::MD5::md5_base64($password);
212	}
213	return $hash eq $stored_hash;
214	}
215
136	1;	216	1;
137		217
138	__END__	218	__END__
139	-

Return to bug 7174