Changeset 2095 in ExiteCMS for trunk/setuser.php


Ignore:
Timestamp:
12/07/08 01:22:46 (3 years ago)
Author:
WanWizard
Message:

updated the authentication system to allow new authentication methods to be 'plugged in'

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/setuser.php

    r2084 r2095  
    2020require_once PATH_INCLUDES."theme_functions.php"; 
    2121 
    22 // used by the auth functions to store the retrieved local user_id 
    23 // this value is needed in some of the error handling code 
    24 $user_id = 0; 
    25  
    26 /*---------------------------------------------------+ 
    27 | User authentication functions                      | 
    28 +----------------------------------------------------*/ 
    29  
    30 // authentication against the local user database 
    31 function auth_local($userid, $password) { 
    32     global $db_prefix, $user_id; 
    33      
    34     // check and validate the given userid and pasword 
    35     $user_pass = md5(md5($password)); 
    36     $user_name = preg_replace(array("/\=/","/\#/","/\sOR\s/"), "", stripinput($userid)); 
    37  
    38     // check if we have a user record for this userid and password 
    39     $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_name='$user_name' AND user_password='".$user_pass."'"); 
    40     if (dbrows($result) == 0) { 
    41         // not found, display an error message 
    42         return 3; 
    43     } else { 
    44         // retrieve the record 
    45         $data = dbarray($result); 
    46         // store the global user_id for reference outside this function 
    47         $user_id = $data['user_id']; 
    48         // found, get the record and do some more validation 
    49         $ret = auth_user_validate($data); 
    50         return $ret; 
    51     } 
    52 } 
    53  
    54 // authentication against an LDAP server 
    55 function auth_ldap($userid, $password) { 
    56     terminate('auth_ldap not defined yet!'); 
    57 } 
    58  
    59 // authentication against an Active Directory server 
    60 function auth_ad($userid, $password) { 
    61     terminate('auth_ad not defined yet!'); 
    62 } 
    63  
    64 // authentication using an OpenID 
    65 function auth_openid($openid_url) { 
    66     global $settings; 
    67  
    68     // check if the URL is valid 
    69     if (isURL($openid_url)) { 
    70         require_once(PATH_INCLUDES."class.openid.php"); 
    71         $openid = new SimpleOpenID; 
    72         $openid->SetIdentity($openid_url); 
    73         $openid->SetApprovedURL($settings['siteurl']."setuser.php"); 
    74         $openid->SetTrustRoot($settings['siteurl']); 
    75         $server_url = $openid->GetOpenIDServer(); 
    76         if ($server_url) { 
    77             redirect($openid->GetRedirectURL() , "script"); 
    78             exit; 
    79         } 
    80     } else { 
    81         // for now... 
    82         return 0; 
    83     } 
    84 } 
    85  
    86 // further validation on the userid found 
    87 function auth_user_validate($userrecord) { 
    88     global $settings; 
    89  
    90     // if the account is suspended, check for an expiry date 
    91     if ($userrecord['user_status'] == 1 && $userrecord['user_ban_expire'] > 0 && $userrecord['user_ban_expire'] < time() ) { 
    92         // if this user's email address is marked as bad, reset the countdown counter 
    93         $userrecord['user_bad_email'] = $userrecord['user_bad_email'] == 0 ? 0 : time(); 
    94         // reset the user status and the expiry date 
    95         $result = dbquery("UPDATE ".$db_prefix."users SET user_status='0', user_ban_expire='0', user_bad_email = '".$userrecord['user_bad_email']."' WHERE user_id='".$userrecord['user_id']."'"); 
    96         $userrecord['user_status'] = 0; 
    97     } 
    98     if ($userrecord['user_status'] == 0) {   
    99         header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
    100         // set the 'remember me' status value  
    101         $_SESSION['remember_me'] = isset($_POST['remember_me']) ? "yes" : "no"; 
    102         $_SESSION['userinfo'] = $userrecord['user_id'].".".$userrecord['user_password']; 
    103         // login expiry defined? 
    104         if ($settings['login_expire']) { 
    105             if (isset($_POST['remember_me']) && $_POST['remember_me'] == "yes") { 
    106                 $_SESSION['login_expire'] = time() + $settings['login_extended_expire']; 
    107             } else { 
    108                 $_SESSION['login_expire'] = time() + $settings['login_expire']; 
    109             } 
    110         } else { 
    111             $_SESSION['login_expire'] = mktime(0,0,0,1,1,2038); // do not expire 
    112         } 
    113         return 4; 
    114     } elseif ($userrecord['user_status'] == 1) { 
    115         return 1; 
    116     } elseif ($userrecord['user_status'] == 2) { 
    117         return 2; 
    118     } else { 
    119         return 0; 
    120     } 
    121 } 
    122  
    123  
    124 /*---------------------------------------------------+ 
    125 | Main code                                          | 
    126 +----------------------------------------------------*/ 
    127  
    12822// temp storage for template variables 
    12923$variables = array(); 
    … …  
    13125// array to store the lines of the setuser message 
    13226$message = array(); 
     27 
     28// set the P3P header                
     29header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
    13330 
    13431// make sure the error variable has a value 
    … …  
    14845 
    14946    // process the logout request 
     47    $cms_authentication->logoff(); 
    15048 
    151     header("P3P: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'"); 
    15249    // make sure the user info is erased from the session 
    153     unset($_SESSION['user']); 
    154     unset($_SESSION['userinfo']); 
    155     unset($_SESSION['login_expire']); 
    156     $result = dbquery("DELETE FROM ".$db_prefix."online WHERE online_ip='".USER_IP."'"); 
    15750    if (isset($userdata['user_name'])) { 
    15851        $message['line2'] =  "<b>".$locale['192'].$userdata['user_name']."</b>"; 
    … …  
    16154} elseif (isset($_GET['login']) && $_GET['login'] == "yes") { 
    16255 
    163     // process the login request 
    164     $auth_methods = isset($settings['auth_type']) ? explode(",",$settings['auth_type'].",") : array('local'); 
    165     foreach($auth_methods as $auth_method) { 
    166         switch($auth_method) { 
    167             case "local": 
    168                 // authentication against the local user database 
    169                 if (!empty($_POST['user_name']) && !empty($_POST['user_pass'])) { 
    170                     $error = auth_local($_POST['user_name'], $_POST['user_pass']); 
    171                 } 
    172                 break; 
    173             case "ldap": 
    174                 break; 
    175             case "ad": 
    176                 break; 
    177             case "openid": 
    178                 // authentication against an openid provider 
    179                 if (!empty($_POST['user_openid_url'])) { 
    180                     $error = auth_openid($_POST['user_openid_url']); 
    181                 } 
    182                 break; 
    183             case "default": 
    184                 // empty or unknown entry, ignore 
    185                 break; 
    186         } 
     56    // store any login parameters to be passed 
     57    $params = array(); 
     58    if (!empty($_POST['user_name'])) { 
     59        $params['username'] = stripinput($_POST['user_name']); 
     60    } 
     61    if (!empty($_POST['user_pass'])) { 
     62        $params['password'] = stripinput($_POST['user_pass']); 
     63    } 
     64    if (!empty($_POST['user_openid_url']) && isURL($_POST['user_openid_url'])) { 
     65        $params['openid_url'] = stripinput($_POST['user_openid_url']); 
    18766    } 
    18867 
    189 } else { 
     68    // process the logon request 
     69    if ($cms_authentication->logon($params)) { 
     70        // get the logon status 
     71        $error = $cms_authentication->status; 
     72    } else { 
     73        $error = 3; // // credentials not correct 
     74    } 
    19075 
    191     if (isset($_GET['openid_mode'])) { 
    192         // handle openid login 
    193         require_once(PATH_INCLUDES."class.openid.php"); 
    194         $openid = new SimpleOpenID; 
    195         $openid->SetIdentity(urldecode($_GET['openid_identity'])); 
    196         if ($openid->ValidateWithServer()) { 
    197             $openid_url = strtolower($openid->OpenID_Standarize($_GET['openid_identity'])); 
    198             $result = dbquery("SELECT * FROM ".$db_prefix."users WHERE user_openid_url='".$openid_url."'"); 
    199             if (dbrows($result) != 0) { 
    200                 // found, get the record and do some more validation 
    201                 $error = auth_user_validate(dbarray($result)); 
    202             } else { 
    203                 $message['line2'] =  "<b>".$locale['196']."</b>"; 
    204             } 
    205         } else { 
    206             trigger_error($openid->GetError()); 
    207             exit; 
    208         } 
     76} elseif (isset($_GET['openid_mode'])) { 
     77 
     78    // store any login parameters to be passed 
     79    $params = array(); 
     80 
     81    if (!empty($_GET['openid_mode'])) { 
     82        $params['openid_mode'] = stripinput($_GET['openid_mode']); 
     83    } 
     84 
     85    // process the openid logon request 
     86    if ($cms_authentication->logon($params)) { 
     87        $error = $cms_authentication->status; 
     88    } else { 
     89        $error = 3; // credentials not correct 
    20990    } 
    21091 
    … …  
    21394// check the result of the authentication attempt, and process it 
    21495switch($error) { 
    215     case 0: 
     96    case 0: // no errors 
    21697        //  
    21798        $refresh = 1; 
    21899        break; 
    219     case 1: 
     100    case 1: // account is suspended 
    220101        $message['line1'] = "<b>".$locale['194']."</b>"; 
    221102        $data = dbarray(dbquery("SELECT user_ban_reason, user_ban_expire FROM ".$db_prefix."users WHERE user_id='".$user_id."'")); 
    … …  
    226107        $refresh = 10; 
    227108        break; 
    228     case 2: 
     109    case 2: // account not activated (yet) 
    229110        $message['line2'] =  "<b>".$locale['195']."</b>"; 
    230111        $refresh = 10; 
    231112        break; 
    232     case 3: 
     113    case 3: // credentials not correct 
    233114        $message['line2'] =  "<b>".$locale['196']."</b>"; 
    234115        $refresh = 10; 
    235116        break; 
    236     case 4: 
     117    case 4: // successful logon 
    237118        if (isset($_SESSION['userinfo'])) { 
    238119            // now that we have user info, finish the login validation 
    … …  
    257138        } 
    258139        break; 
    259     case 5: 
     140    case 5: // logon requires https 
    260141        $message['line2'] =  "<b>".$locale['https']."</b>"; 
    261142        $refresh = 99999; 
    262143        break; 
    263     case 6: 
     144    case 6: // user is banned 
    264145        $message['line2'] =  "<font style='color:red;font-weight:bold'>".($locale['banned'])."</font>"; 
    265146        // get the reason for this ban 
Note: See TracChangeset for help on using the changeset viewer.