[Koha-cvs] CVS: koha/C4 Auth.pm,1.9.2.6,1.9.2.7

Sat Jul 27 06:33:59 CEST 2002

Update of /cvsroot/koha/koha/C4
In directory usw-pr-cvs1:/tmp/cvs-serv15939/C4

Modified Files:
      Tag: rel-1-2
	Auth.pm 
Log Message:
Beginning flags based authentication.  All of the member*pl scripts now require
the borrower to have either the "borrowers" or "superlibrarian" flags set.


Index: Auth.pm
===================================================================
RCS file: /cvsroot/koha/koha/C4/Auth.pm,v
retrieving revision 1.9.2.6
retrieving revision 1.9.2.7
diff -C2 -r1.9.2.6 -r1.9.2.7
*** Auth.pm	14 Jul 2002 19:37:13 -0000	1.9.2.6
--- Auth.pm	27 Jul 2002 04:33:57 -0000	1.9.2.7
***************
*** 20,23 ****
--- 20,39 ----
  
  
+ sub getuserflags {
+     my $cardnumber=shift;
+     my $dbh=shift;
+     my $userflags;
+     my $sth=$dbh->prepare("select flags from borrowers where cardnumber=?");
+     $sth->execute($cardnumber);
+     my ($flags) = $sth->fetchrow;
+     $sth=$dbh->prepare("select bit,flag from userflags");
+     $sth->execute;
+     while (my ($bit, $flag) = $sth->fetchrow) {
+ 	if ($flags & (2**$bit)) {
+ 	    $userflags->{$flag}=1;
+ 	}
+     }
+     return $userflags;
+ }
  
  sub checkauth {
***************
*** 25,28 ****
--- 41,45 ----
      # $authnotrequired will be set for scripts which will run without authentication
      my $authnotrequired=shift;
+     my $flagsrequired=shift;
      if (my $userid=$ENV{'REMOTE_USER'}) {
  	# Using Basic Authentication, no cookies required
***************
*** 64,68 ****
  	    my $sti=$dbh->prepare("update sessions set lasttime=? where sessionID=?");
  	    $sti->execute(time(), $sessionID);
! 	    return ($userid, $cookie, $sessionID);
  	}
      }
--- 81,107 ----
  	    my $sti=$dbh->prepare("update sessions set lasttime=? where sessionID=?");
  	    $sti->execute(time(), $sessionID);
! 	    my $sth=$dbh->prepare("select cardnumber from borrowers where userid=?");
! 	    $sth->execute($userid);
! 	    my ($cardnumber) = $sth->fetchrow;
! 	    my $flags=getuserflags($cardnumber,$dbh);
! 	    foreach (keys %$flagsrequired) {
! 		warn "Checking required flag $_";
! 		unless ($flags->{superlibrarian}) {
! 		    unless ($flags->{$_}) {
! 			print qq|Content-type: text/html
! 
! <html>
! <body>
! REJECTED
! <hr>
! You do not have access to this portion of Koha
! </body>
! </html>
! |;
! 			exit;
! 		    }
! 		}
! 	    }
! 	    return ($userid, $cookie, $sessionID, $flags);
  	}
      }
***************
*** 79,88 ****
  	my $userid=$query->param('userid');
  	my $password=$query->param('password');
! 	if (checkpw($dbh, $userid, $password)) {
  	    my $sti=$dbh->prepare("delete from sessions where sessionID=? and userid=?");
  	    $sti->execute($sessionID, $userid);
  	    $sti=$dbh->prepare("insert into sessions (sessionID, userid, ip,lasttime) values (?, ?, ?, ?)");
  	    $sti->execute($sessionID, $userid, $ENV{'REMOTE_ADDR'}, time());
! 	    $sti=$dbh->prepare("select value from sessionqueries where sessionID=? and userid=?");
  	    $sti->execute($sessionID, $userid);
  	    if ($sti->rows) {
--- 118,128 ----
  	my $userid=$query->param('userid');
  	my $password=$query->param('password');
! 	my ($return, $cardnumber) = checkpw($dbh,$userid,$password);
! 	if ($return) {
  	    my $sti=$dbh->prepare("delete from sessions where sessionID=? and userid=?");
  	    $sti->execute($sessionID, $userid);
  	    $sti=$dbh->prepare("insert into sessions (sessionID, userid, ip,lasttime) values (?, ?, ?, ?)");
  	    $sti->execute($sessionID, $userid, $ENV{'REMOTE_ADDR'}, time());
! 	    $sti=$dbh->prepare("select url from sessionqueries where sessionID=? and userid=?");
  	    $sti->execute($sessionID, $userid);
  	    if ($sti->rows) {
***************
*** 101,105 ****
  				      -value => $sessionID,
  				      -expires => '+1y');
! 	    return ($userid, $cookie, $sessionID);
  	} else {
  	    if ($userid) {
--- 141,169 ----
  				      -value => $sessionID,
  				      -expires => '+1y');
! 	    my $flags;
! 	    if ($return==2) {
! 		$flags->{'superlibrarian'}=1;
! 	    } else {
! 		$flags=getuserflags($cardnumber, $dbh);
! 	    }
! 	    foreach (keys %$flagsrequired) {
! 		warn "Checking required flag $_";
! 		unless ($flags->{superlibrarian}) {
! 		    unless ($flags->{$_}) {
! 			print qq|Content-type: text/html
! 
! <html>
! <body>
! REJECTED
! <hr>
! You do not have access to this portion of Koha
! </body>
! </html>
! |;
! 			exit;
! 		    }
! 		}
! 	    }
! 	    return ($userid, $cookie, $sessionID, $flags);
  	} else {
  	    if ($userid) {
***************
*** 170,179 ****
  
      my ($dbh, $userid, $password) = @_;
!     my $sth=$dbh->prepare("select password from borrowers where userid=?");
      $sth->execute($userid);
      if ($sth->rows) {
! 	my ($md5password) = $sth->fetchrow;
  	if (md5_base64($password) eq $md5password) {
! 	    return 1;
  	}
      }
--- 234,243 ----
  
      my ($dbh, $userid, $password) = @_;
!     my $sth=$dbh->prepare("select password,cardnumber from borrowers where userid=?");
      $sth->execute($userid);
      if ($sth->rows) {
! 	my ($md5password,$cardnumber) = $sth->fetchrow;
  	if (md5_base64($password) eq $md5password) {
! 	    return 1,$cardnumber;
  	}
      }
***************
*** 183,187 ****
  	my ($md5password) = $sth->fetchrow;
  	if (md5_base64($password) eq $md5password) {
! 	    return 1;
  	}
      }
--- 247,251 ----
  	my ($md5password) = $sth->fetchrow;
  	if (md5_base64($password) eq $md5password) {
! 	    return 1,$userid;
  	}
      }
***************
*** 189,193 ****
      if ($userid eq $configfile->{'user'} && $password eq $configfile->{'pass'}) {
          # Koha superuser account
! 	return 1;
      }
      return 0;
--- 253,257 ----
      if ($userid eq $configfile->{'user'} && $password eq $configfile->{'pass'}) {
          # Koha superuser account
! 	return 2;
      }
      return 0;