Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Newer
Older
100644 438 lines (367 sloc) 14.965 kB
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
1 # -*- tab-width: 8 -*-
2 # NOTE: This file uses 8-character tabs; do not change the tab size!
3
4 package InstallAuth;
5
6 # Copyright 2000-2002 Katipo Communications
7 #
8 # This file is part of Koha.
9 #
10 # Koha is free software; you can redistribute it and/or modify it under the
11 # terms of the GNU General Public License as published by the Free Software
12 # Foundation; either version 2 of the License, or (at your option) any later
13 # version.
14 #
15 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
16 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
17 # A PARTICULAR PURPOSE. See the GNU General Public License for more details.
18 #
19 # You should have received a copy of the GNU General Public License along with
20 # Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
21 # Suite 330, Boston, MA 02111-1307 USA
22
23 use strict;
24 use Digest::MD5 qw(md5_base64);
25
26 require Exporter;
27 use C4::Context;
100e6a9 functions that were in C4::Interface::CGI::Output are now in C4::Output.
hdl authored
28 use C4::Output;
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
29 use C4::Koha;
24d5e31 Changing InstallAuth to use CGI::Session and fixing install.pl which …
Chris Cormack authored
30 use CGI::Session;
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
31
32 use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
33
34 # set the version for version checking
b9c20fa Patch from Galen Charlton, removing $Id$ $Log$ and $Revision$ from files
Chris Cormack authored
35 $VERSION = 3.00;
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
36
37 =head1 NAME
38
39 InstallAuth - Authenticates Koha users for Install process
40
41 =head1 SYNOPSIS
42
43 use CGI;
44 use InstallAuth;
45
46 my $query = new CGI;
47
48 my ($template, $borrowernumber, $cookie)
49 = get_template_and_user({template_name => "opac-main.tmpl",
50 query => $query,
51 type => "opac",
52 authnotrequired => 1,
53 flagsrequired => {borrow => 1},
54 });
55
56 print $query->header(
6f276fa removing guessencoding, hard-coding utf-8
tipaul authored
57 -type => 'utf-8',
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
58 -cookie => $cookie
59 ), $template->output;
60
61
62 =head1 DESCRIPTION
63
64 The main function of this module is to provide
65 authentification. However the get_template_and_user function has
66 been provided so that a users login information is passed along
67 automatically. This gets loaded into the template.
68 This package is different from C4::Auth in so far as
69 C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
70
71 As in C4::Auth, Authentication is based on cookies.
72
73 =head1 FUNCTIONS
74
75 =over 2
76
77 =cut
78
79 @ISA = qw(Exporter);
80 @EXPORT = qw(
81 &checkauth
82 &get_template_and_user
83 &setlanguagecookie
84 );
85
86 =item get_template_and_user
87
88 my ($template, $borrowernumber, $cookie)
89 = get_template_and_user({template_name => "opac-main.tmpl",
90 query => $query,
91 type => "opac",
92 authnotrequired => 1,
93 flagsrequired => {borrow => 1},
94 });
95
96 This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
97 to C<&checkauth> (in this module) to perform authentification.
98 See C<&checkauth> for an explanation of these parameters.
99
100 The C<template_name> is then used to find the correct template for
101 the page. The authenticated users details are loaded onto the
102 template in the HTML::Template LOOP variable C<USER_INFO>. Also the
103 C<sessionID> is passed to the template. This can be used in templates
104 if cookies are disabled. It needs to be put as and input to every
105 authenticated page.
106
107 More information on the C<gettemplate> sub can be found in the
108 Output.pm module.
109
110 =cut
111
112 sub get_template_and_user {
113 my $in = shift;
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
114 my $query = $in->{'query'};
115 my $language = $query->cookie('KohaOpacLanguage');
116 my $path =
117 C4::Context->config('intrahtdocs') . "/prog/"
118 . ( $language ? $language : "en" );
119 my $template = HTML::Template::Pro->new(
d1f6407 moved images to img fixed installer path for templates
Joshua Ferraro authored
120 filename => "$path/modules/" . $in->{template_name},
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
121 die_on_bad_params => 1,
122 global_vars => 1,
123 case_sensitive => 1,
124 path => ["$path/includes"]
125 );
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
126
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
127 my ( $user, $cookie, $sessionID, $flags ) = checkauth(
128 $in->{'query'},
129 $in->{'authnotrequired'},
130 $in->{'flagsrequired'},
131 $in->{'type'}
132 );
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
133
134 # use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
135
136 my $borrowernumber;
137 if ($user) {
138 $template->param( loggedinusername => $user );
139 $template->param( sessionID => $sessionID );
140
141 # We are going to use the $flags returned by checkauth
142 # to create the template's parameters that will indicate
143 # which menus the user can access.
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
144 if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
145 $template->param( CAN_user_circulate => 1 );
146 $template->param( CAN_user_catalogue => 1 );
147 $template->param( CAN_user_parameters => 1 );
148 $template->param( CAN_user_borrowers => 1 );
149 $template->param( CAN_user_permission => 1 );
150 $template->param( CAN_user_reserveforothers => 1 );
151 $template->param( CAN_user_borrow => 1 );
152 $template->param( CAN_user_editcatalogue => 1 );
fbc151c Auth.pm should have "CAN_user_updatecharges" (plural), and this chang…
Joe Atzberger authored
153 $template->param( CAN_user_updatecharges => 1 );
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
154 $template->param( CAN_user_acquisition => 1 );
155 $template->param( CAN_user_management => 1 );
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
156 $template->param( CAN_user_tools => 1 );
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
157 $template->param( CAN_user_editauthorities => 1 );
158 $template->param( CAN_user_serials => 1 );
159 $template->param( CAN_user_reports => 1 );
160 }
161 }
162 return ( $template, $borrowernumber, $cookie );
163 }
164
165 =item checkauth
166
167 ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
168
169 Verifies that the user is authorized to run this script. If
170 the user is authorized, a (userid, cookie, session-id, flags)
171 quadruple is returned. If the user is not authorized but does
172 not have the required privilege (see $flagsrequired below), it
173 displays an error page and exits. Otherwise, it displays the
174 login page and exits.
175
176 Note that C<&checkauth> will return if and only if the user
177 is authorized, so it should be called early on, before any
178 unfinished operations (e.g., if you've opened a file, then
179 C<&checkauth> won't close it for you).
180
181 C<$query> is the CGI object for the script calling C<&checkauth>.
182
183 The C<$noauth> argument is optional. If it is set, then no
184 authorization is required for the script.
185
186 C<&checkauth> fetches user and session information from C<$query> and
187 ensures that the user is authorized to run scripts that require
188 authorization.
189
190 The C<$flagsrequired> argument specifies the required privileges
191 the user must have if the username and password are correct.
192 It should be specified as a reference-to-hash; keys in the hash
193 should be the "flags" for the user, as specified in the Members
194 intranet module. Any key specified must correspond to a "flag"
195 in the userflags table. E.g., { circulate => 1 } would specify
196 that the user must have the "circulate" privilege in order to
197 proceed. To make sure that access control is correct, the
198 C<$flagsrequired> parameter must be specified correctly.
199
200 The C<$type> argument specifies whether the template should be
201 retrieved from the opac or intranet directory tree. "opac" is
202 assumed if it is not specified; however, if C<$type> is specified,
203 "intranet" is assumed if it is not "opac".
204
205 If C<$query> does not have a valid session ID associated with it
206 (i.e., the user has not logged in) or if the session has expired,
207 C<&checkauth> presents the user with a login page (from the point of
208 view of the original script, C<&checkauth> does not return). Once the
209 user has authenticated, C<&checkauth> restarts the original script
210 (this time, C<&checkauth> returns).
211
212 The login page is provided using a HTML::Template, which is set in the
213 systempreferences table or at the top of this file. The variable C<$type>
214 selects which template to use, either the opac or the intranet
215 authentification template.
216
217 C<&checkauth> returns a user ID, a cookie, and a session ID. The
218 cookie should be sent back to the browser; it verifies that the user
219 has authenticated.
220
221 =cut
222
223 sub checkauth {
224 my $query = shift;
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
225
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
226 # $authnotrequired will be set for scripts which will run without authentication
227 my $authnotrequired = shift;
228 my $flagsrequired = shift;
229 my $type = shift;
230 $type = 'intranet' unless $type;
231
24d5e31 Changing InstallAuth to use CGI::Session and fixing install.pl which …
Chris Cormack authored
232 my $dbh = C4::Context->dbh();
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
233 my $template_name;
234 $template_name = "installer/auth.tmpl";
235
236 # state variables
237 my $loggedin = 0;
238 my %info;
239 my ( $userid, $cookie, $sessionID, $flags, $envcookie );
240 my $logout = $query->param('logout.x');
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
241 if ( $sessionID = $query->cookie("CGISESSID") ) {
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
242 C4::Context->_new_userenv($sessionID);
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
243 my $session =
8d7d372 @PaulPoulain use YAML for installer auth like we do for Koha itself
PaulPoulain authored
244 new CGI::Session( "driver:File;serializer:yaml", $sessionID,
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
245 { Directory => '/tmp' } );
f14a897 Fixing a bug that was causing the installer to not check the password
Chris Cormack authored
246 if ( $session->param('cardnumber') ) {
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
247 C4::Context::set_userenv(
248 $session->param('number'),
249 $session->param('id'),
250 $session->param('cardnumber'),
251 $session->param('firstname'),
252 $session->param('surname'),
253 $session->param('branch'),
254 $session->param('branchname'),
255 $session->param('flags'),
256 $session->param('emailaddress'),
257 $session->param('branchprinter')
258 );
259 $cookie = $query->cookie( CGISESSID => $session->id );
260 $loggedin = 1;
261 $userid = $session->param('cardnumber');
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
262 }
263 my ( $ip, $lasttime );
264
265 if ($logout) {
266
267 # voluntary logout the user
268 C4::Context->_unset_userenv($sessionID);
269 $sessionID = undef;
270 $userid = undef;
271 open L, ">>/tmp/sessionlog";
272 my $time = localtime( time() );
273 printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
274 $ip, $time;
275 close L;
276 }
277 }
278 unless ($userid) {
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
279 my $session =
280 new CGI::Session( "driver:File", undef, { Directory => '/tmp' } );
281 $sessionID = $session->id;
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
282 $userid = $query->param('userid');
283 C4::Context->_new_userenv($sessionID);
284 my $password = $query->param('password');
285 C4::Context->_new_userenv($sessionID);
286 my ( $return, $cardnumber ) = checkpw( $userid, $password );
287 if ($return) {
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
288 $loggedin = 1;
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
289 open L, ">>/tmp/sessionlog";
290 my $time = localtime( time() );
291 printf L "%20s from %16s logged in at %30s.\n", $userid,
292 $ENV{'REMOTE_ADDR'}, $time;
293 close L;
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
294 $cookie = $query->cookie( CGISESSID => $sessionID );
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
295 if ( $return == 2 ) {
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
296
297 #Only superlibrarian should have access to this page.
298 #Since if it is a user, it is supposed that there is a borrower table
299 #And thus that data structure is loaded.
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
300 my $hash = C4::Context::set_userenv(
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
301 0, 0,
302 C4::Context->config('user'), C4::Context->config('user'),
303 C4::Context->config('user'), "",
304 "NO_LIBRARY_SET", 1,
305 ""
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
306 );
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
307 $session->param( 'number', 0 );
308 $session->param( 'id', C4::Context->config('user') );
309 $session->param( 'cardnumber', C4::Context->config('user') );
310 $session->param( 'firstname', C4::Context->config('user') );
311 $session->param( 'surname', C4::Context->config('user'), );
312 $session->param( 'branch', 'NO_LIBRARY_SET' );
313 $session->param( 'branchname', 'NO_LIBRARY_SET' );
314 $session->param( 'flags', 1 );
315 $session->param( 'emailaddress',
316 C4::Context->preference('KohaAdminEmailAddress') );
317 $session->param( 'ip', $session->remote_addr() );
318 $session->param( 'lasttime', time() );
319 $userid = C4::Context->config('user');
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
320 }
321 }
322 else {
323 if ($userid) {
324 $info{'invalid_username_or_password'} = 1;
325 C4::Context->_unset_userenv($sessionID);
326 }
327 }
328 }
329
330 # finished authentification, now respond
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
331 if ($loggedin) {
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
332
333 # successful login
334 unless ($cookie) {
335 $cookie = $query->cookie(
8494eff Removing warn in Auth.pm
Chris Cormack authored
336 -name => 'CGISESSID',
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
337 -value => '',
338 -expires => ''
339 );
340 }
341 if ($envcookie) {
342 return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
343 }
344 else {
345 return ( $userid, $cookie, $sessionID, $flags );
346 }
347 }
348
349 # else we have a problem...
350 # get the inputs from the incoming query
351 my @inputs = ();
352 foreach my $name ( param $query) {
353 (next) if ( $name eq 'userid' || $name eq 'password' );
354 my $value = $query->param($name);
355 push @inputs, { name => $name, value => $value };
356 }
357
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
358 my $path =
359 C4::Context->config('intrahtdocs') . "/prog/"
360 . ( $query->param('language') ? $query->param('language') : "en" );
361 my $template = HTML::Template::Pro->new(
d1f6407 moved images to img fixed installer path for templates
Joshua Ferraro authored
362 filename => "$path/modules/$template_name",
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
363 die_on_bad_params => 1,
364 global_vars => 1,
365 case_sensitive => 1,
366 path => ["$path/includes"]
367 );
368 $template->param(
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
369 INPUTS => \@inputs,
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
370
371 );
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
372 $template->param( login => 1 );
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
373 $template->param( loginprompt => 1 ) unless $info{'nopermission'};
374
375 my $self_url = $query->url( -absolute => 1 );
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
376 $template->param( url => $self_url, );
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
377 $template->param( \%info );
378 $cookie = $query->cookie(
24d5e31 Changing InstallAuth to use CGI::Session and fixing install.pl which …
Chris Cormack authored
379 -name => 'CGISESSID',
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
380 -value => $sessionID,
381 -expires => ''
382 );
383 print $query->header(
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
384 -type => 'text/html; charset=utf-8',
385 -cookie => $cookie
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
386 ),
387 $template->output;
388 exit;
389 }
390
391 sub checkpw {
392
393 my ( $userid, $password ) = @_;
394
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
395 if ( $userid
396 && $userid eq C4::Context->config('user')
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
397 && "$password" eq C4::Context->config('pass') )
398 {
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
399
400 # Koha superuser account
401 C4::Context->set_userenv(
402 0, 0,
403 C4::Context->config('user'),
404 C4::Context->config('user'),
405 C4::Context->config('user'),
406 "", 1
407 );
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
408 return 2;
409 }
836b985 content-type was incorrectly set in InstallAuth.pm
Joshua Ferraro authored
410 if ( $userid
411 && $userid eq 'demo'
f8e9fb6 rel_3_0 moved to HEAD (introducing new files)
tipaul authored
412 && "$password" eq 'demo'
413 && C4::Context->config('demo') )
414 {
415
416 # DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
417 # some features won't be effective : modify systempref, modify MARC structure,
418 return 2;
419 }
420 return 0;
421 }
422
423 END { } # module clean-up code here (global destructor)
424 1;
425 __END__
426
427 =back
428
429 =head1 SEE ALSO
430
431 CGI(3)
432
433 C4::Output(3)
434
435 Digest::MD5(3)
436
437 =cut
Something went wrong with that request. Please try again.