View | Details | Raw Unified | Return to bug 7174
Collapse All | Expand All

(-)a/C4/Auth.pm (-38 / +83 lines)
Lines 19-29 package C4::Auth; Link Here
19
19
20
use strict;
20
use strict;
21
use warnings;
21
use warnings;
22
use Digest::MD5 qw(md5_base64);
22
use Digest::MD5 qw(md5_base64); #@DEPRECATED Digest::MD5, don't use it or you will get hurt.
23
use JSON qw/encode_json/;
23
use JSON qw/encode_json/;
24
use URI::Escape;
24
use URI::Escape;
25
use CGI::Session;
25
use CGI::Session;
26
use Scalar::Util qw(blessed);
26
use Scalar::Util qw(blessed);
27
use Try::Tiny;
27
28
28
require Exporter;
29
require Exporter;
29
use C4::Context;
30
use C4::Context;
Lines 34-39 use C4::Search::History; Link Here
34
use Koha;
35
use Koha;
35
use Koha::Borrowers;
36
use Koha::Borrowers;
36
use Koha::AuthUtils qw(hash_password);
37
use Koha::AuthUtils qw(hash_password);
38
use Koha::Auth;
39
use Koha::Auth::Component;
37
use POSIX qw/strftime/;
40
use POSIX qw/strftime/;
38
use List::MoreUtils qw/ any /;
41
use List::MoreUtils qw/ any /;
39
use Encode qw( encode is_utf8);
42
use Encode qw( encode is_utf8);
Lines 639-688 has authenticated. Link Here
639
642
640
=cut
643
=cut
641
644
645
=head _version_check
646
#@DEPRECATED See Bug 7174
647
use Koha::Auth::Component::* instead
648
=cut
649
642
sub _version_check {
650
sub _version_check {
643
    my $type  = shift;
651
    my $type  = shift;
644
    my $query = shift;
652
    my $query = shift;
645
    my $version;
653
    my $version;
646
654
647
    # If version syspref is unavailable, it means Koha is being installed,
655
    try {
648
    # and so we must redirect to OPAC maintenance page or to the WebInstaller
656
        Koha::Auth::Component::checkOPACMaintenance() if ( $type eq 'opac' );
649
    # also, if OpacMaintenance is ON, OPAC should redirect to maintenance
657
        Koha::Auth::Component::checkVersion();
650
    if ( C4::Context->preference('OpacMaintenance') && $type eq 'opac' ) {
658
    } catch {
651
        warn "OPAC Install required, redirecting to maintenance";
659
        if (blessed($_)) {
652
        print $query->redirect("/cgi-bin/koha/maintenance.pl");
660
            if ($_->isa('Koha::Exception::VersionMismatch')) {
653
        safe_exit;
661
                # check that database and koha version are the same
654
    }
662
                # there is no DB version, it's a fresh install,
655
    unless ( $version = C4::Context->preference('Version') ) {    # assignment, not comparison
663
                # go to web installer
656
        if ( $type ne 'opac' ) {
664
                # there is a DB version, compare it to the code version
657
            warn "Install required, redirecting to Installer";
665
                my $warning = $_->error()." Redirecting to %s.";
658
            print $query->redirect("/cgi-bin/koha/installer/install.pl");
666
                if ( $type ne 'opac' ) {
659
        } else {
667
                    warn sprintf( $warning, 'Installer' );
660
            warn "OPAC Install required, redirecting to maintenance";
668
                    print $query->redirect("/cgi-bin/koha/installer/install.pl?step=1&op=updatestructure");
661
            print $query->redirect("/cgi-bin/koha/maintenance.pl");
669
                } else {
670
                    warn sprintf( "OPAC: " . $warning, 'maintenance' );
671
                    print $query->redirect("/cgi-bin/koha/maintenance.pl");
672
                }
673
                safe_exit;
674
            }
675
            elsif ($_->isa('Koha::Exception::ServiceTemporarilyUnavailable')) {
676
                # also, if OpacMaintenance is ON, OPAC should redirect to maintenance
677
                warn "OPAC Install required, redirecting to maintenance";
678
                print $query->redirect("/cgi-bin/koha/maintenance.pl");
679
                safe_exit;
680
            }
681
            elsif ($_->isa('Koha::Exception::BadSystemPreference')) {
682
                # If version syspref is unavailable, it means Koha is being installed,
683
                # and so we must redirect to OPAC maintenance page or to the WebInstaller
684
                if ( $type ne 'opac' ) {
685
                    warn "Install required, redirecting to Installer";
686
                    print $query->redirect("/cgi-bin/koha/installer/install.pl");
687
                } else {
688
                    warn "OPAC Install required, redirecting to maintenance";
689
                    print $query->redirect("/cgi-bin/koha/maintenance.pl");
690
                }
691
                safe_exit;
692
            }
693
            else {
694
                warn "Unknown exception class ".ref($_)."\n";
695
                die $_; #Unhandled exception case
696
            }
662
        }
697
        }
663
        safe_exit;
698
        else {
664
    }
699
            die $_; #Not a Koha::Exception-object, so rethrow it
665
666
    # check that database and koha version are the same
667
    # there is no DB version, it's a fresh install,
668
    # go to web installer
669
    # there is a DB version, compare it to the code version
670
    my $kohaversion = Koha::version();
671
672
    # remove the 3 last . to have a Perl number
673
    $kohaversion =~ s/(.*\..*)\.(.*)\.(.*)/$1$2$3/;
674
    $debug and print STDERR "kohaversion : $kohaversion\n";
675
    if ( $version < $kohaversion ) {
676
        my $warning = "Database update needed, redirecting to %s. Database is $version and Koha is $kohaversion";
677
        if ( $type ne 'opac' ) {
678
            warn sprintf( $warning, 'Installer' );
679
            print $query->redirect("/cgi-bin/koha/installer/install.pl?step=1&op=updatestructure");
680
        } else {
681
            warn sprintf( "OPAC: " . $warning, 'maintenance' );
682
            print $query->redirect("/cgi-bin/koha/maintenance.pl");
683
        }
700
        }
684
        safe_exit;
701
    };
685
    }
686
}
702
}
687
703
688
sub _session_log {
704
sub _session_log {
Lines 702-708 sub _timeout_syspref { Link Here
702
    return $timeout;
718
    return $timeout;
703
}
719
}
704
720
721
=head checkauth
722
@DEPRECATED See Bug 7174
723
724
Compatibility layer for old Koha authentication system.
725
Tries to authenticate using Koha::Auth, but if no authentication mechanism is
726
identified, falls back to the deprecated legacy behaviour.
727
=cut
728
705
sub checkauth {
729
sub checkauth {
730
    my @params = @_; #Clone params so we don't accidentally change them if we fallback to checkauth_legacy()
731
    #Koha::Auth::checkAuth(@params);
732
    return checkauth_legacy(@params);
733
}
734
735
=head checkauth_legacy
736
@DEPRECATED See Bug 7174
737
738
We are calling this because the given authentication mechanism is not yet supported
739
in Koha::Auth.
740
741
See checkauth-documentation floating somewhere in this file for info about the
742
legacy authentication.
743
=cut
744
745
sub checkauth_legacy {
706
    my $query = shift;
746
    my $query = shift;
707
    $debug and warn "Checking Auth";
747
    $debug and warn "Checking Auth";
708
748
Lines 1682-1687 sub get_session { Link Here
1682
    return $session;
1722
    return $session;
1683
}
1723
}
1684
1724
1725
#@DEPRECATED See Bug 7174
1685
sub checkpw {
1726
sub checkpw {
1686
    my ( $dbh, $userid, $password, $query, $type ) = @_;
1727
    my ( $dbh, $userid, $password, $query, $type ) = @_;
1687
    $type = 'opac' unless $type;
1728
    $type = 'opac' unless $type;
Lines 1726-1731 sub checkpw { Link Here
1726
    return checkpw_internal(@_)
1767
    return checkpw_internal(@_)
1727
}
1768
}
1728
1769
1770
#@DEPRECATED See Bug 7174
1729
sub checkpw_internal {
1771
sub checkpw_internal {
1730
    my ( $dbh, $userid, $password ) = @_;
1772
    my ( $dbh, $userid, $password ) = @_;
1731
1773
Lines 1778-1783 sub checkpw_internal { Link Here
1778
            return 1, $cardnumber, $userid;
1820
            return 1, $cardnumber, $userid;
1779
        }
1821
        }
1780
    }
1822
    }
1823
1781
    if ( $userid && $userid eq 'demo'
1824
    if ( $userid && $userid eq 'demo'
1782
        && "$password" eq 'demo'
1825
        && "$password" eq 'demo'
1783
        && C4::Context->config('demo') )
1826
        && C4::Context->config('demo') )
Lines 1790-1795 sub checkpw_internal { Link Here
1790
    return 0;
1833
    return 0;
1791
}
1834
}
1792
1835
1836
#@DEPRECATED See Bug 7174
1793
sub checkpw_hash {
1837
sub checkpw_hash {
1794
    my ( $password, $stored_hash ) = @_;
1838
    my ( $password, $stored_hash ) = @_;
1795
1839
Lines 1800-1805 sub checkpw_hash { Link Here
1800
    if ( substr( $stored_hash, 0, 2 ) eq '$2' ) {
1844
    if ( substr( $stored_hash, 0, 2 ) eq '$2' ) {
1801
        $hash = hash_password( $password, $stored_hash );
1845
        $hash = hash_password( $password, $stored_hash );
1802
    } else {
1846
    } else {
1847
        #@DEPRECATED Digest::MD5, don't use it or you will get hurt.
1803
        $hash = md5_base64($password);
1848
        $hash = md5_base64($password);
1804
    }
1849
    }
1805
    return $hash eq $stored_hash;
1850
    return $hash eq $stored_hash;
(-)a/Koha/AuthUtils.pm (-1 / +80 lines)
Lines 22-27 use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64); Link Here
22
use Encode qw( encode is_utf8 );
22
use Encode qw( encode is_utf8 );
23
use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt
23
use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt
24
24
25
use Koha::Borrowers;
26
27
use Koha::Exception::LoginFailed;
28
25
use base 'Exporter';
29
use base 'Exporter';
26
30
27
our $VERSION = '1.01';
31
our $VERSION = '1.01';
Lines 133-138 sub generate_salt { Link Here
133
    close SOURCE;
137
    close SOURCE;
134
    return $string;
138
    return $string;
135
}
139
}
140
141
=head checkKohaPassword
142
143
    my $isSuperuser = Koha::AuthUtils::checkKohaPassword($userid, $password);
144
145
Checks of the given username and password match anybody in the Koha DB
146
@PARAM1 String, user identifier, either the koha.borrowers.userid, or koha.borrowers.cardnumber
147
@PARAM2 String, clear text password from the authenticating user
148
@RETURN String 'superuser', if user is the Koha DB user (superuser account)
149
        undef, if the user is but a man.
150
@THROWS Koha::Exception::LoginFailed, if no matching password was found for all username aliases in Koha.
151
=cut
152
153
sub checkKohaPassword {
154
    my ($userid, $password) = @_;
155
156
    if ( $userid && $userid eq C4::Context->config('user') ) {
157
        if ( $password && $password eq C4::Context->config('pass') ) {
158
            # Koha superuser account
159
            #     C4::Context->set_userenv(0,0,C4::Context->config('user'),C4::Context->config('user'),C4::Context->config('user'),"",1);
160
            return 'superuser';
161
        }
162
        else {
163
            Koha::Exception::LoginFailed->throw(error => "Password authentication failed");
164
        }
165
    }
166
167
    my $usernameFound = 0; #Report to the user if userid/barcode was found, even if the login failed.
168
    #Check for each username alias if we can confirm a login with that.
169
    my @usernameAliasColumns = ('userid', 'cardnumber');
170
    for my $unameAlias (@usernameAliasColumns) {
171
        my $borrower = Koha::Borrowers->find({$unameAlias => $userid});
172
        if ( $borrower ) {
173
            $usernameFound = 1;
174
            return if ( checkHash( $password, $borrower->password ) );
175
        }
176
    }
177
178
    Koha::Exception::LoginFailed->throw(error => "Password authentication failed for the given ".( ($usernameFound) ? "password" : "username and password").".");
179
}
180
181
=head checkHash
182
183
    my $passwordOk = Koha::AuthUtils::checkHash($password1, $password2)
184
185
Checks if a clear-text String/password matches the given hash when
186
MD5 or Bcrypt hashing algorith is applied to it.
187
188
Bcrypt is applied if @PARAM2 starts with '$2'
189
MD5 otherwise
190
191
@PARAM1 String, clear text passsword or any other String
192
@PARAM2 String, hashed text password or any other String.
193
@RETURN Boolean, 1 if given parameters match
194
               , 0 if not
195
=cut
196
197
sub checkHash {
198
    my ( $password, $stored_hash ) = @_;
199
200
    $password = Encode::encode( 'UTF-8', $password )
201
            if Encode::is_utf8($password);
202
203
    return if $stored_hash eq '!';
204
205
    my $hash;
206
    if ( substr( $stored_hash, 0, 2 ) eq '$2' ) {
207
        $hash = hash_password( $password, $stored_hash );
208
    } else {
209
        #@DEPRECATED Digest::MD5, don't use it or you will get hurt.
210
        require Digest::MD5;
211
        $hash = Digest::MD5::md5_base64($password);
212
    }
213
    return $hash eq $stored_hash;
214
}
215
136
1;
216
1;
137
217
138
__END__
218
__END__
139
- 

Return to bug 7174