X-Git-Url: http://koha-dev.rot13.org:8081/gitweb/?a=blobdiff_plain;f=C4%2FAuth.pm;h=36a64722cf5c0be446a3a785d43b2ded80bbcd21;hb=a118102d4e2d7cf6bc1157a560c52fd6deb6f7a7;hp=495f04c716e732dabd081ab8d4687231782f6a38;hpb=cbf473d59291e82a95a26c722a9afb72b3c5e7ac;p=koha_fer diff --git a/C4/Auth.pm b/C4/Auth.pm index 495f04c716..36a64722cf 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -26,33 +26,40 @@ use CGI::Session; require Exporter; use C4::Context; -use C4::Output; # to get the template +use C4::Templates; # to get the template use C4::Members; use C4::Koha; use C4::Branch; # GetBranches use C4::VirtualShelves; use POSIX qw/strftime/; +use List::MoreUtils qw/ any /; # use utf8; use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $servers $memcached); BEGIN { - $VERSION = 3.02; # set version for version checking - $debug = $ENV{DEBUG}; - @ISA = qw(Exporter); - @EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); - @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions); - %EXPORT_TAGS = (EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)]); - $ldap = C4::Context->config('useldapserver') || 0; - $cas = C4::Context->preference('casAuthentication'); - $caslogout = C4::Context->preference('casLogout'); + sub psgi_env { any { /^psgi\./ } keys %ENV } + sub safe_exit { + if ( psgi_env ) { die 'psgi:exit' } + else { exit } + } + + $VERSION = 3.02; # set version for version checking + $debug = $ENV{DEBUG}; + @ISA = qw(Exporter); + @EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); + @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions); + %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); + $ldap = C4::Context->config('useldapserver') || 0; + $cas = C4::Context->preference('casAuthentication'); + $caslogout = C4::Context->preference('casLogout'); + require C4::Auth_with_cas; # no import if ($ldap) { - require C4::Auth_with_ldap; # no import - import C4::Auth_with_ldap qw(checkpw_ldap); + require C4::Auth_with_ldap; + import C4::Auth_with_ldap qw(checkpw_ldap); } if ($cas) { - require C4::Auth_with_cas; # no import - import C4::Auth_with_cas qw(checkpw_cas login_cas logout_cas login_cas_url); + import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); } $servers = C4::Context->config('memcached_servers'); if ($servers) { @@ -131,12 +138,12 @@ Output.pm module. my $SEARCH_HISTORY_INSERT_SQL =<{'template_name'}, $in->{'type'}, $in->{'query'} ); + C4::Templates::gettemplate( $in->{'template_name'}, $in->{'type'}, $in->{'query'} ); my ( $user, $cookie, $sessionID, $flags ); if ( $in->{'template_name'} !~m/maintenance/ ) { ( $user, $cookie, $sessionID, $flags ) = checkauth( @@ -270,7 +277,7 @@ sub get_template_and_user { $_->{'query_cgi'}, $_->{'total'}, $_->{'time'}, - ) foreach @recentSearches; + ) foreach @recentSearches; # And then, delete the cookie's content my $newsearchcookie = $in->{'query'}->cookie( @@ -382,6 +389,7 @@ sub get_template_and_user { virtualshelves => C4::Context->preference("virtualshelves"), StaffSerialIssueDisplayCount => C4::Context->preference("StaffSerialIssueDisplayCount"), NoZebra => C4::Context->preference('NoZebra'), + EasyAnalyticalRecords => C4::Context->preference('EasyAnalyticalRecords'), ); } else { @@ -435,8 +443,10 @@ sub get_template_and_user { opac_limit_override => $opac_limit_override, OpacBrowser => C4::Context->preference("OpacBrowser"), OpacCloud => C4::Context->preference("OpacCloud"), + OpacKohaUrl => C4::Context->preference("OpacKohaUrl"), OpacMainUserBlock => "" . C4::Context->preference("OpacMainUserBlock"), OpacNav => "" . C4::Context->preference("OpacNav"), + OpacNavBottom => "" . C4::Context->preference("OpacNavBottom"), OpacPasswordChange => C4::Context->preference("OpacPasswordChange"), OPACPatronDetails => C4::Context->preference("OPACPatronDetails"), OPACPrivacy => C4::Context->preference("OPACPrivacy"), @@ -572,19 +582,18 @@ sub _version_check ($$) { # and so we must redirect to OPAC maintenance page or to the WebInstaller # also, if OpacMaintenance is ON, OPAC should redirect to maintenance if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') { - warn "OPAC Install required, redirecting to maintenance"; - print $query->redirect("/cgi-bin/koha/maintenance.pl"); - } - unless ($version = C4::Context->preference('Version')) { # assignment, not comparison - if ($type ne 'opac') { - warn "Install required, redirecting to Installer"; - print $query->redirect("/cgi-bin/koha/installer/install.pl"); - } - else { warn "OPAC Install required, redirecting to maintenance"; print $query->redirect("/cgi-bin/koha/maintenance.pl"); - } - exit; + } + unless ( $version = C4::Context->preference('Version') ) { # assignment, not comparison + if ( $type ne 'opac' ) { + warn "Install required, redirecting to Installer"; + print $query->redirect("/cgi-bin/koha/installer/install.pl"); + } else { + warn "OPAC Install required, redirecting to maintenance"; + print $query->redirect("/cgi-bin/koha/maintenance.pl"); + } + safe_exit; } # check that database and koha version are the same @@ -604,7 +613,7 @@ sub _version_check ($$) { warn sprintf("OPAC: " . $warning, 'maintenance'); print $query->redirect("/cgi-bin/koha/maintenance.pl"); } - exit; + safe_exit; } } @@ -639,6 +648,10 @@ sub checkauth { my ( $userid, $cookie, $sessionID, $flags, $barshelves, $pubshelves ); my $logout = $query->param('logout.x'); + # This parameter is the name of the CAS server we want to authenticate against, + # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml + my $casparam = $query->param('cas'); + if ( $userid = $ENV{'REMOTE_USER'} ) { # Using Basic Authentication, no cookies required $cookie = $query->cookie( @@ -742,7 +755,7 @@ sub checkauth { $info{'invalidCasLogin'} = 1 unless ($return); } else { my $retuserid; - ( $return, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); + ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); $userid = $retuserid if ($retuserid ne ''); } if ($return) { @@ -936,7 +949,7 @@ sub checkauth { } my $template_name = ( $type eq 'opac' ) ? 'opac-auth.tmpl' : 'auth.tmpl'; - my $template = gettemplate( $template_name, $type, $query ); + my $template = C4::Templates::gettemplate( $template_name, $type, $query ); $template->param(branchloop => \@branch_loop,); my $checkstyle = C4::Context->preference("opaccolorstylesheet"); if ($checkstyle =~ /\//) @@ -956,6 +969,7 @@ sub checkauth { LibraryName => C4::Context->preference("LibraryName"), opacuserlogin => C4::Context->preference("opacuserlogin"), OpacNav => C4::Context->preference("OpacNav"), + OpacNavBottom => C4::Context->preference("OpacNavBottom"), opaccredits => C4::Context->preference("opaccredits"), OpacFavicon => C4::Context->preference("OpacFavicon"), opacreadinghistory => C4::Context->preference("opacreadinghistory"), @@ -986,11 +1000,28 @@ sub checkauth { $template->param( OpacPublic => C4::Context->preference("OpacPublic")); $template->param( loginprompt => 1 ) unless $info{'nopermission'}; - if ($cas) { + if ($cas) { + + # Is authentication against multiple CAS servers enabled? + if (C4::Auth_with_cas::multipleAuth && !$casparam) { + my $casservers = C4::Auth_with_cas::getMultipleAuth(); + my @tmplservers; + foreach my $key (keys %$casservers) { + push @tmplservers, {name => $key, value => login_cas_url($query, $key) . "?cas=$key" }; + } + #warn Data::Dumper::Dumper(\@tmplservers); + $template->param( + casServersLoop => \@tmplservers + ); + } else { + $template->param( + casServerUrl => login_cas_url($query), + ); + } + $template->param( - casServerUrl => login_cas_url(), - invalidCasLogin => $info{'invalidCasLogin'} - ); + invalidCasLogin => $info{'invalidCasLogin'} + ); } my $self_url = $query->url( -absolute => 1 ); @@ -1007,7 +1038,7 @@ sub checkauth { -cookie => $cookie ), $template->output; - exit; + safe_exit; } =head2 check_api_auth @@ -1080,7 +1111,7 @@ sub check_api_auth { unless ($query->param('userid')) { $sessionID = $query->cookie("CGISESSID"); } - if ($sessionID) { + if ($sessionID && not $cas) { my $session = get_session($sessionID); C4::Context->_new_userenv($sessionID); if ($session) { @@ -1130,18 +1161,24 @@ sub check_api_auth { # new login my $userid = $query->param('userid'); my $password = $query->param('password'); - unless ($userid and $password) { - # caller did something wrong, fail the authenticateion - return ("failed", undef, undef); - } - my ($return, $cardnumber); - if ($cas && $query->param('ticket')) { + my ($return, $cardnumber); + + # Proxy CAS auth + if ($cas && $query->param('PT')) { my $retuserid; - ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); - $userid = $retuserid; + $debug and print STDERR "## check_api_auth - checking CAS\n"; + # In case of a CAS authentication, we use the ticket instead of the password + my $PT = $query->param('PT'); + ($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query); # EXTERNAL AUTH } else { + # User / password auth + unless ($userid and $password) { + # caller did something wrong, fail the authenticateion + return ("failed", undef, undef); + } ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query ); } + if ($return and haspermission( $userid, $flagsrequired)) { my $session = get_session(""); return ("failed", undef, undef) unless $session; @@ -1394,11 +1431,11 @@ sub checkpw { my ( $dbh, $userid, $password, $query ) = @_; if ($ldap) { $debug and print "## checkpw - checking LDAP\n"; - my ($retval,$retcard) = checkpw_ldap(@_); # EXTERNAL AUTH - ($retval) and return ($retval,$retcard); + my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH + ($retval) and return ($retval,$retcard,$retuserid); } - if ($cas && $query->param('ticket')) { + if ($cas && $query && $query->param('ticket')) { $debug and print STDERR "## checkpw - checking CAS\n"; # In case of a CAS authentication, we use the ticket instead of the password my $ticket = $query->param('ticket'); @@ -1421,7 +1458,7 @@ sub checkpw { C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, $firstname, $surname, $branchcode, $flags ); - return 1, $userid; + return 1, $cardnumber, $userid; } } $sth = @@ -1437,7 +1474,7 @@ sub checkpw { C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, $firstname, $surname, $branchcode, $flags ); - return 1, $userid; + return 1, $cardnumber, $userid; } } if ( $userid && $userid eq C4::Context->config('user')