Documentation TYPO3 par Ameos

class.t3lib_userauth.php

00001 <?php
00002 /***************************************************************
00003 *  Copyright notice
00004 *
00005 *  (c) 1999-2006 Kasper Skaarhoj (kasperYYYY@typo3.com)
00006 *  All rights reserved
00007 *
00008 *  This script is part of the TYPO3 project. The TYPO3 project is
00009 *  free software; you can redistribute it and/or modify
00010 *  it under the terms of the GNU General Public License as published by
00011 *  the Free Software Foundation; either version 2 of the License, or
00012 *  (at your option) any later version.
00013 *
00014 *  The GNU General Public License can be found at
00015 *  http://www.gnu.org/copyleft/gpl.html.
00016 *  A copy is found in the textfile GPL.txt and important notices to the license
00017 *  from the author is found in LICENSE.txt distributed with these scripts.
00018 *
00019 *
00020 *  This script is distributed in the hope that it will be useful,
00021 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
00022 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00023 *  GNU General Public License for more details.
00024 *
00025 *  This copyright notice MUST APPEAR in all copies of the script!
00026 ***************************************************************/
00088 require_once(t3lib_extMgm::extPath('sv').'class.tx_sv_authbase.php');
00089 
00090 
00091 
00092 
00093 
00094 
00095 
00096 
00097 
00111 class t3lib_userAuth {
00112         var $global_database = '';              // Which global database to connect to
00113         var $session_table = '';                // Table to use for session data.
00114         var $name = '';                                 // Session/Cookie name
00115         var $get_name = '';                             // Session/GET-var name
00116 
00117         var $user_table = '';                   // Table in database with userdata
00118         var $username_column = '';              // Column for login-name
00119         var $userident_column = '';             // Column for password
00120         var $userid_column = '';                // Column for user-id
00121         var $lastLogin_column = '';
00122 
00123         var $enablecolumns = Array (
00124                 'rootLevel' => '',                      // Boolean: If true, 'AND pid=0' will be a part of the query...
00125                 'disabled' => '',
00126                 'starttime' => '',
00127                 'endtime' => '',
00128                 'deleted' => ''
00129         );
00130 
00131         var $formfield_uname = '';                      // formfield with login-name
00132         var $formfield_uident = '';             // formfield with password
00133         var $formfield_chalvalue = '';          // formfield with a unique value which is used to encrypt the password and username
00134         var $formfield_status = '';             // formfield with status: *'login', 'logout'. If empty login is not verified.
00135         var $security_level = 'normal';         // sets the level of security. *'normal' = clear-text. 'challenged' = hashed password/username from form in $formfield_uident. 'superchallenged' = hashed password hashed again with username.
00136 
00137         var $auth_include = '';                 // this is the name of the include-file containing the login form. If not set, login CAN be anonymous. If set login IS needed.
00138 
00139         var $auth_timeout_field = 0;            // Server session lifetime. If > 0: session-timeout in seconds. If false or <0: no timeout. If string: The string is a fieldname from the usertable where the timeout can be found.
00140         var $lifetime = 0;                      // Client session lifetime. 0 = Session-cookies. If session-cookies, the browser will stop the session when the browser is closed. Otherwise this specifies the lifetime of a cookie that keeps the session.
00141         var $gc_time = 0;                       // GarbageCollection. Purge all server session data older than $gc_time seconds. 0 = default to $this->timeout or use 86400 seconds (1 day) if $this->lifetime is 0
00142         var $gc_probability = 1;                // Possibility (in percent) for GarbageCollection to be run.
00143         var $writeStdLog = FALSE;               // Decides if the writelog() function is called at login and logout
00144         var $writeAttemptLog = FALSE;           // If the writelog() functions is called if a login-attempt has be tried without success
00145         var $sendNoCacheHeaders = TRUE;         // If this is set, headers is sent to assure, caching is NOT done
00146         var $getFallBack = FALSE;                       // If this is set, authentication is also accepted by the $_GET. Notice that the identification is NOT 128bit MD5 hash but reduced. This is done in order to minimize the size for mobile-devices, such as WAP-phones
00147         var $hash_length = 32;                          // The ident-hash is normally 32 characters and should be! But if you are making sites for WAP-devices og other lowbandwidth stuff, you may shorten the length. Never let this value drop below 6. A length of 6 would give you more than 16 mio possibilities.
00148         var $getMethodEnabled = FALSE;          // Setting this flag true lets user-authetication happen from GET_VARS if POST_VARS are not set. Thus you may supply username/password from the URL.
00149         var $lockIP = 4;                                        // If set, will lock the session to the users IP address (all four numbers. Reducing to 1-3 means that only first, second or third part of the IP address is used).
00150         var $lockHashKeyWords = 'useragent';    // Keyword list (commalist with no spaces!): "useragent". Each keyword indicates some information that can be included in a integer hash made to lock down usersessions.
00151 
00152         var $warningEmail = '';                         // warning -emailaddress:
00153         var $warningPeriod = 3600;                      // Period back in time (in seconds) in which number of failed logins are collected
00154         var $warningMax = 3;                            // The maximum accepted number of warnings before an email is sent
00155         var $checkPid = TRUE;                           // If set, the user-record must $checkPid_value as pid
00156         var $checkPid_value=0;                          // The pid, the user-record must have as page-id
00157 
00158                 // Internals
00159         var $id;                                                        // Internal: Will contain session_id (MD5-hash)
00160         var $cookieId;                                          // Internal: Will contain the session_id gotten from cookie or GET method. This is used in statistics as a reliable cookie (one which is known to come from $_COOKIE).
00161         var $loginFailure = FALSE;                      // Indicates if an authentication was started but failed
00162         var $loginSessionStarted = FALSE;       // Will be set to true if the login session is actually written during auth-check.
00163 
00164         var $user;                                                      // Internal: Will contain user- AND session-data from database (joined tables)
00165         var $get_URL_ID = '';                           // Internal: Will will be set to the url--ready (eg. '&login=ab7ef8d...') GET-auth-var if getFallBack is true. Should be inserted in links!
00166 
00167         var $newSessionID = FALSE;                      // Will be set to true if a new session ID was created
00168         var $forceSetCookie = FALSE;            // Will force the session cookie to be set everytime (lifetime must be 0)
00169         var $dontSetCookie = FALSE;                     // Will prevent the setting of the session cookie (takes precedence over forceSetCookie)
00170         var $challengeStoredInCookie = FALSE;   // If set, the challenge value will be stored in a session as well so the server can check that is was not forged.
00171         var $loginType = '';                            // Login type, used for services.
00172 
00173         var $svConfig = array();                        // "auth" services configuration array from $TYPO3_CONF_VARS['SVCONF']['auth']
00174         var $writeDevLog = FALSE;                       // write messages into the devlog?
00175 
00176 
00177 
00178 
00179 
00180 
00181 
00182 
00183 
00195         function start() {
00196                 global $TYPO3_CONF_VARS;
00197 
00198                         // backend or frontend login - used for auth services
00199                 $this->loginType = ($this->name=='fe_typo_user') ? 'FE' : 'BE';
00200 
00201                         // set level to normal if not already set
00202                 $this->security_level = $this->security_level ? $this->security_level : 'normal';
00203 
00204                         // enable dev logging if set
00205                 if ($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['writeDevLog']) $this->writeDevLog = TRUE;
00206                 if ($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['writeDevLog'.$this->loginType]) $this->writeDevLog = TRUE;
00207                 if (TYPO3_DLOG) $this->writeDevLog = TRUE;
00208 
00209                 if ($this->writeDevLog)         t3lib_div::devLog('## Beginning of auth logging.', 't3lib_userAuth');
00210 
00211                         // Init vars.
00212                 $mode = '';
00213                 $this->newSessionID = FALSE;
00214                         // $id is set to ses_id if cookie is present. Else set to false, which will start a new session
00215                 $id = isset($_COOKIE[$this->name]) ? stripslashes($_COOKIE[$this->name]) : '';
00216                 $this->hash_length = t3lib_div::intInRange($this->hash_length,6,32);
00217                 $this->svConfig = $TYPO3_CONF_VARS['SVCONF']['auth'];
00218 
00219 
00220                         // If fallback to get mode....
00221                 if (!$id && $this->getFallBack && $this->get_name)      {
00222                         $id = isset($_GET[$this->get_name]) ? t3lib_div::_GET($this->get_name) : '';
00223                         if (strlen($id)!=$this->hash_length)    $id='';
00224                         $mode='get';
00225                 }
00226                 $this->cookieId = $id;
00227 
00228                         // If new session...
00229                 if (!$id)       {
00230                                 // New random session-$id is made
00231                 $id = substr(md5(uniqid('').getmypid()),0,$this->hash_length);
00232                         // New session
00233                         $this->newSessionID = TRUE;
00234                 }
00235 
00236                         // Internal var 'id' is set
00237                 $this->id = $id;
00238 
00239                         // If fallback to get mode....
00240                 if ($mode=='get' && $this->getFallBack && $this->get_name)      {
00241                         $this->get_URL_ID = '&'.$this->get_name.'='.$id;
00242                 }
00243                         // Make certain that NO user is set initially
00244                 $this->user = '';
00245 
00246                         // Check to see if anyone has submitted login-information and if so register the user with the session. $this->user[uid] may be used to write log...
00247                 $this->checkAuthentication();
00248 
00249                         // Make certain that NO user is set initially. ->check_authentication may have set a session-record which will provide us with a user record in the next section:
00250                 unset($this->user);
00251 
00252                         // re-read user session
00253                 $this->user = $this->fetchUserSession();
00254 
00255                 if ($this->writeDevLog && is_array($this->user))        t3lib_div::devLog('User session finally read: '.t3lib_div::arrayToLogString($this->user, array($this->userid_column,$this->username_column)), 't3lib_userAuth', -1);
00256                 if ($this->writeDevLog && !is_array($this->user)) t3lib_div::devLog('No user session found.', 't3lib_userAuth', 2);
00257 
00258                         // Setting cookies
00259                 if ($TYPO3_CONF_VARS['SYS']['cookieDomain'])    {
00260                         if ($TYPO3_CONF_VARS['SYS']['cookieDomain']{0} == '/')  {
00261                                 $matchCnt = @preg_match($TYPO3_CONF_VARS['SYS']['cookieDomain'], t3lib_div::getIndpEnv('TYPO3_HOST_ONLY'), $match);
00262                                 if ($matchCnt === FALSE)        {
00263                                         t3lib_div::sysLog('The regular expression of $TYPO3_CONF_VARS[SYS][cookieDomain] contains errors. The session is not shared across sub-domains.', 'Core', 3);
00264                                 } elseif ($matchCnt)    {
00265                                         $cookieDomain = $match[0];
00266                                 }
00267                         } else {
00268                                 $cookieDomain = $TYPO3_CONF_VARS['SYS']['cookieDomain'];
00269                         }
00270                 }
00271 
00272                         // If new session and the cookie is a sessioncookie, we need to set it only once!
00273                 if ($this->isSetSessionCookie())        {
00274                         if (!$this->dontSetCookie)      {
00275                                 if ($cookieDomain)      {
00276                                         SetCookie($this->name, $id, 0, '/', $cookieDomain);
00277                                 } else {
00278                                         SetCookie($this->name, $id, 0, '/');
00279                                 }
00280                                 if ($this->writeDevLog)         t3lib_div::devLog('Set new Cookie: '.$id.($cookieDomain ? ', '.$cookieDomain : ''), 't3lib_userAuth');
00281                         }
00282                 }
00283 
00284                         // If it is NOT a session-cookie, we need to refresh it.
00285                 if ($this->isRefreshTimeBasedCookie())  {
00286                         if (!$this->dontSetCookie)      {
00287                                 if ($cookieDomain)      {
00288                                         SetCookie($this->name, $id, time()+$this->lifetime, '/', $cookieDomain);
00289                                 } else {
00290                                         SetCookie($this->name, $id, time()+$this->lifetime, '/');
00291                                 }
00292                                 if ($this->writeDevLog)         t3lib_div::devLog('Update Cookie: '.$id.($cookieDomain ? ', '.$cookieDomain : ''), 't3lib_userAuth');
00293                         }
00294                 }
00295 
00296                         // Hook for alternative ways of filling the $this->user array (is used by the "timtaw" extension)
00297                 if (is_array($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postUserLookUp']))       {
00298                         foreach ($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postUserLookUp'] as $funcName)       {
00299                                 $_params = array(
00300                                         'pObj' => &$this,
00301                                 );
00302                                 t3lib_div::callUserFunction($funcName,$_params,$this);
00303                         }
00304                 }
00305 
00306                         // If any redirection (inclusion of file) then it will happen in this function
00307                 $this->redirect();
00308 
00309                         // Set all posible headers that could ensure that the script is not cached on the client-side
00310                 if ($this->sendNoCacheHeaders)  {
00311                         header('Expires: 0');
00312                         header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
00313                         header('Cache-Control: no-cache, must-revalidate');
00314                         header('Pragma: no-cache');
00315                 }
00316 
00317                         // Set $this->gc_time if not explicitely specified
00318                 if ($this->gc_time==0)  {
00319                         $this->gc_time = ($this->auth_timeout_field==0 ? 86400 : $this->auth_timeout_field);    // Default to 1 day if $this->auth_timeout_field is 0
00320                 }
00321 
00322                         // If we're lucky we'll get to clean up old sessions....
00323                 if ((rand()%100) <= $this->gc_probability)      {
00324                         $this->gc();
00325                 }
00326         }
00327 
00334         function isSetSessionCookie() {
00335                 return ($this->newSessionID || $this->forceSetCookie) && $this->lifetime==0;
00336         }
00337 
00344         function isRefreshTimeBasedCookie() {
00345                 return $this->lifetime > 0;
00346         }
00347 
00354         function checkAuthentication() {
00355 
00356                         // No user for now - will be searched by service below
00357                 $tempuserArr = array();
00358                 $tempuser = FALSE;
00359 
00360                         // User is not authenticated by default
00361                 $authenticated = FALSE;
00362 
00363                         // User want to login with passed login data (name/password)
00364                 $activeLogin = FALSE;
00365 
00366                         // Indicates if an active authentication failed (not auto login)
00367                 $this->loginFailure = FALSE;
00368 
00369                 if ($this->writeDevLog)         t3lib_div::devLog('Login type: '.$this->loginType, 't3lib_userAuth');
00370 
00371                         // The info array provide additional information for auth services
00372                 $authInfo = $this->getAuthInfoArray();
00373 
00374                         // Get Login/Logout data submitted by a form or params
00375                 $loginData = $this->getLoginFormData();
00376 
00377                 if ($this->writeDevLog)         t3lib_div::devLog('Login data: '.t3lib_div::arrayToLogString($loginData), 't3lib_userAuth');
00378 
00379 
00380                         // active logout (eg. with "logout" button)
00381                 if ($loginData['status']=='logout') {
00382                         if ($this->writeStdLog)         $this->writelog(255,2,0,2,'User %s logged out',Array($this->user['username'])); // Logout written to log
00383                         if ($this->writeDevLog)         t3lib_div::devLog('User logged out. Id: '.$this->id, 't3lib_userAuth', -1);
00384 
00385                         $this->logoff();
00386                 }
00387 
00388                         // active login (eg. with login form)
00389                 if ($loginData['status']=='login') {
00390                         $activeLogin = TRUE;
00391 
00392                         if ($this->writeDevLog)         t3lib_div::devLog('Active login (eg. with login form)', 't3lib_userAuth');
00393 
00394                                 // check referer for submitted login values
00395                         if ($this->formfield_status && $loginData['uident'] && $loginData['uname'])     {
00396                                 $httpHost = t3lib_div::getIndpEnv('TYPO3_HOST_ONLY');
00397                                 if (!$this->getMethodEnabled && ($httpHost!=$authInfo['refInfo']['host'] && !$GLOBALS['TYPO3_CONF_VARS']['SYS']['doNotCheckReferer']))  {
00398                                         die('Error: This host address ("'.$httpHost.'") and the referer host ("'.$authInfo['refInfo']['host'].'") mismatches!<br />
00399                                                 It\'s possible that the environment variable HTTP_REFERER is not passed to the script because of a proxy.<br />
00400                                                 The site administrator can disable this check in the "All Configuration" section of the Install Tool (flag: TYPO3_CONF_VARS[SYS][doNotCheckReferer]).');
00401                                 }
00402 
00403                                         // delete old user session if any
00404                                 $this->logoff();
00405                         }
00406 
00407                                 // Refuse login for _CLI users (used by commandline scripts)
00408                         if ((strtoupper(substr($loginData['uname'],0,5))=='_CLI_') && (!defined('TYPO3_cliMode') || !TYPO3_cliMode))    {       // although TYPO3_cliMode should never be set when using active login...
00409                                 die('Error: You have tried to login using a CLI user. Access prohibited!');
00410                         }
00411                 }
00412 
00413 
00414                 // the following code makes auto-login possible (if configured). No submitted data needed
00415 
00416                         // re-read user session
00417                 $authInfo['userSession'] = $this->fetchUserSession();
00418                 $haveSession = is_array($authInfo['userSession']) ? TRUE : FALSE;
00419 
00420                 if ($this->writeDevLog) {
00421                         if ($haveSession)       {
00422                                 t3lib_div::devLog('User session found: '.t3lib_div::arrayToLogString($authInfo['userSession'], array($this->userid_column,$this->username_column)), 't3lib_userAuth', 0);
00423                         }
00424                         t3lib_div::devLog('SV setup: '.t3lib_div::arrayToLogString($this->svConfig['setup']), 't3lib_userAuth', 0);
00425                 }
00426 
00427                         // fetch user if ...
00428                 if ($activeLogin
00429                                 || (!$haveSession && $this->svConfig['setup'][$this->loginType.'_fetchUserIfNoSession'])
00430                                 || $this->svConfig['setup'][$this->loginType.'_alwaysFetchUser']) {
00431 
00432                                 // use 'auth' service to find the user
00433                                 // first found user will be used
00434                         $serviceChain = '';
00435                         $subType = 'getUser'.$this->loginType;
00436                         while (is_object($serviceObj = t3lib_div::makeInstanceService('auth', $subType, $serviceChain))) {
00437                                 $serviceChain.=','.$serviceObj->getServiceKey();
00438                                 $serviceObj->initAuth($subType, $loginData, $authInfo, $this);
00439                                 if ($row=$serviceObj->getUser()) {
00440                                         $tempuserArr[] = $row;
00441 
00442                                         if ($this->writeDevLog)         t3lib_div::devLog('User found: '.t3lib_div::arrayToLogString($row, array($this->userid_column,$this->username_column)), 't3lib_userAuth', 0);
00443 
00444                                                 // user found, just stop to search for more if not configured to go on
00445                                         if(!$this->svConfig['setup'][$this->loginType.'_fetchAllUsers']) {
00446                                                 break;
00447                                         }
00448                                 }
00449                                 unset($serviceObj);
00450                         }
00451                         unset($serviceObj);
00452 
00453                         if ($this->writeDevLog && $this->svConfig['setup'][$this->loginType.'_alwaysFetchUser'])        t3lib_div::devLog($this->loginType.'_alwaysFetchUser option is enabled', 't3lib_userAuth');
00454                         if ($this->writeDevLog && $serviceChain)        t3lib_div::devLog($subType.' auth services called: '.$serviceChain, 't3lib_userAuth');
00455                         if ($this->writeDevLog && !count($tempuserArr))         t3lib_div::devLog('No user found by services', 't3lib_userAuth');
00456                         if ($this->writeDevLog && count($tempuserArr))  t3lib_div::devLog(count($tempuserArr).' user records found by services', 't3lib_userAuth');
00457                 }
00458 
00459 
00460                         // If no new user was set we use the already found user session
00461                 if (!count($tempuserArr) && $haveSession)       {
00462                         $tempuserArr[] = $authInfo['userSession'];
00463                         $tempuser = $authInfo['userSession'];
00464                                 // User is authenticated because we found a user session
00465                         $authenticated = TRUE;
00466 
00467                         if ($this->writeDevLog)         t3lib_div::devLog('User session used: '.t3lib_div::arrayToLogString($authInfo['userSession'], array($this->userid_column,$this->username_column)), 't3lib_userAuth');
00468                 }
00469 
00470 
00471                         // Re-auth user when 'auth'-service option is set
00472                 if ($this->svConfig['setup'][$this->loginType.'_alwaysAuthUser']) {
00473                         $authenticated = FALSE;
00474                         if ($this->writeDevLog)         t3lib_div::devLog('alwaysAuthUser option is enabled', 't3lib_userAuth');
00475                 }
00476 
00477 
00478                         // Authenticate the user if needed
00479                 if (count($tempuserArr) && !$authenticated)     {
00480 
00481                         foreach ($tempuserArr as $tempuser)     {
00482 
00483                                 // use 'auth' service to authenticate the user
00484                                 // if one service returns FALSE then authentication failed
00485                                 // a service might return 100 which means there's no reason to stop but the user can't be authenticated by that service
00486 
00487                                 if ($this->writeDevLog)         t3lib_div::devLog('Auth user: '.t3lib_div::arrayToLogString($tempuser), 't3lib_userAuth');
00488 
00489                                 $serviceChain='';
00490                                 $subType = 'authUser'.$this->loginType;
00491                                 while (is_object($serviceObj = t3lib_div::makeInstanceService('auth', $subType, $serviceChain))) {
00492                                         $serviceChain.=','.$serviceObj->getServiceKey();
00493                                         $serviceObj->initAuth($subType, $loginData, $authInfo, $this);
00494                                         if (($ret=$serviceObj->authUser($tempuser)) > 0) {
00495 
00496                                                         // if the service returns >=200 then no more checking is needed - useful for IP checking without password
00497                                                 if (intval($ret) >= 200)        {
00498                                                         $authenticated = TRUE;
00499                                                         break;
00500                                                 } elseif (intval($ret) >= 100) {
00501                                                         // Just go on. User is still not authenticated but there's no reason to stop now.
00502                                                 } else {
00503                                                         $authenticated = TRUE;
00504                                                 }
00505 
00506                                         } else {
00507                                                 $authenticated = FALSE;
00508                                                 break;
00509                                         }
00510                                         unset($serviceObj);
00511                                 }
00512                                 unset($serviceObj);
00513 
00514                                 if ($this->writeDevLog && $serviceChain)        t3lib_div::devLog($subType.' auth services called: '.$serviceChain, 't3lib_userAuth');
00515 
00516                                 if ($authenticated) {
00517                                                 // leave foreach() because a user is authenticated
00518                                         break;
00519                                 }
00520                         }
00521                 }
00522 
00523                         // If user is authenticated a valid user is in $tempuser
00524                 if ($authenticated)     {
00525                                 // reset failure flag
00526                         $this->loginFailure = FALSE;
00527 
00528 
00529                                 // Insert session record if needed:
00530                         if (!($haveSession && (
00531                                 $tempuser['ses_id']==$this->id ||       // check if the tempuser has the current session id
00532                                 $tempuser['uid']==$authInfo['userSession']['ses_userid']        // check if the tempuser has the uid of the fetched session user
00533                                 ))) {
00534                                 $this->createUserSession($tempuser);
00535 
00536                                         // The login session is started.
00537                                 $this->loginSessionStarted = TRUE;
00538                         }
00539 
00540                                 // User logged in - write that to the log!
00541                         if ($this->writeStdLog && $activeLogin) {
00542                                 $this->writelog(255,1,0,1,
00543                                         'User %s logged in from %s (%s)',
00544                                         Array($tempuser[$this->username_column], t3lib_div::getIndpEnv('REMOTE_ADDR'), t3lib_div::getIndpEnv('REMOTE_HOST')),
00545                                         '','','',-1,'',$tempuser['uid']
00546                                 );
00547                         }
00548 
00549                         if ($this->writeDevLog && $activeLogin)         t3lib_div::devLog('User '.$tempuser[$this->username_column].' logged in from '.t3lib_div::getIndpEnv('REMOTE_ADDR').' ('.t3lib_div::getIndpEnv('REMOTE_HOST').')', 't3lib_userAuth', -1);
00550                         if ($this->writeDevLog && !$activeLogin)        t3lib_div::devLog('User '.$tempuser[$this->username_column].' authenticated from '.t3lib_div::getIndpEnv('REMOTE_ADDR').' ('.t3lib_div::getIndpEnv('REMOTE_HOST').')', 't3lib_userAuth', -1);
00551 
00552                         if($GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL'] == 3 && $this->user_table == 'be_users')        {
00553                                 $requestStr = substr(t3lib_div::getIndpEnv('TYPO3_REQUEST_SCRIPT'), strlen(t3lib_div::getIndpEnv('TYPO3_SITE_URL').TYPO3_mainDir));
00554                                 if($requestStr == 'alt_main.php' && t3lib_div::getIndpEnv('TYPO3_SSL')) {
00555                                         list(,$url) = explode('://',t3lib_div::getIndpEnv('TYPO3_SITE_URL'),2);
00556                                         header('Location: http://'.$url.TYPO3_mainDir.'alt_main.php');
00557                                         exit;
00558                                 }
00559                         }
00560 
00561                 } elseif ($activeLogin || count($tempuserArr)) {
00562                         $this->loginFailure = TRUE;
00563 
00564                         if ($this->writeDevLog && !count($tempuserArr) && $activeLogin)         t3lib_div::devLog('Login failed: '.t3lib_div::arrayToLogString($loginData), 't3lib_userAuth', 2);
00565                         if ($this->writeDevLog && count($tempuserArr))  t3lib_div::devLog('Login failed: '.t3lib_div::arrayToLogString($tempuser, array($this->userid_column,$this->username_column)), 't3lib_userAuth', 2);
00566                 }
00567 
00568 
00569                         // If there were a login failure, check to see if a warning email should be sent:
00570                 if ($this->loginFailure && $activeLogin)        {
00571                         if ($this->writeDevLog)         t3lib_div::devLog('Call checkLogFailures: '.t3lib_div::arrayToLogString(array('warningEmail'=>$this->warningEmail,'warningPeriod'=>$this->warningPeriod,'warningMax'=>$this->warningMax,)), 't3lib_userAuth', -1);
00572 
00573                         $this->checkLogFailures($this->warningEmail, $this->warningPeriod, $this->warningMax);
00574                 }
00575         }
00576 
00577 
00578 
00579 
00580 
00581 
00582 
00583 
00584 
00585 
00586 
00587 
00588         /*************************
00589          *
00590          * User Sessions
00591          *
00592          *************************/
00593 
00594 
00601         function createUserSession ($tempuser) {
00602 
00603                 if ($this->writeDevLog)         t3lib_div::devLog('Create session ses_id = '.$this->id, 't3lib_userAuth');
00604 
00605                         // delete session entry first
00606                 $GLOBALS['TYPO3_DB']->exec_DELETEquery(
00607                                         $this->session_table,
00608                                         'ses_id = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->id, $this->session_table).'
00609                                                 AND ses_name = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->name, $this->session_table)
00610                                 );
00611 
00612                         // re-create session entry
00613                 $insertFields = $this->getNewSessionRecord($tempuser);
00614                 $GLOBALS['TYPO3_DB']->exec_INSERTquery($this->session_table, $insertFields);
00615 
00616                         // Updating lastLogin_column carrying information about last login.
00617                 if ($this->lastLogin_column)    {
00618                         $GLOBALS['TYPO3_DB']->exec_UPDATEquery(
00619                                                                         $this->user_table,
00620                                                                         $this->userid_column.'='.$GLOBALS['TYPO3_DB']->fullQuoteStr($tempuser[$this->userid_column], $this->user_table),
00621                                                                         array($this->lastLogin_column => $GLOBALS['EXEC_TIME'])
00622                                                                 );
00623                 }
00624         }
00625 
00632         function getNewSessionRecord($tempuser) {
00633                 return array(
00634                         'ses_id' => $this->id,
00635                         'ses_name' => $this->name,
00636                         'ses_iplock' => $tempuser['disableIPlock'] ? '[DISABLED]' : $this->ipLockClause_remoteIPNumber($this->lockIP),
00637                         'ses_hashlock' => $this->hashLockClause_getHashInt(),
00638                         'ses_userid' => $tempuser[$this->userid_column],
00639                         'ses_tstamp' => $GLOBALS['EXEC_TIME']
00640                 );
00641         }
00642 
00648         function fetchUserSession() {
00649 
00650                 $user = '';
00651 
00652                 if ($this->writeDevLog)         t3lib_div::devLog('Fetch session ses_id = '.$this->id, 't3lib_userAuth');
00653 
00654                         // The session_id is used to find user in the database. Two tables are joined: The session-table with user_id of the session and the usertable with its primary key
00655                 $dbres = $GLOBALS['TYPO3_DB']->exec_SELECTquery(
00656                                                 '*',
00657                                                 $this->session_table.','.$this->user_table,
00658                                                 $this->session_table.'.ses_id = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->id, $this->session_table).'
00659                                                         AND '.$this->session_table.'.ses_name = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->name, $this->session_table).'
00660                                                         AND '.$this->session_table.'.ses_userid = '.$this->user_table.'.'.$this->userid_column.'
00661                                                         '.$this->ipLockClause().'
00662                                                         '.$this->hashLockClause().'
00663                                                         '.$this->user_where_clause()
00664                                         );
00665 
00666 
00667                 if ($user = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($dbres))      {
00668                                 // A user was found
00669                         if (is_string($this->auth_timeout_field))       {
00670                                 $timeout = intval($user[$this->auth_timeout_field]);            // Get timeout-time from usertable
00671                         } else {
00672                                 $timeout = intval($this->auth_timeout_field);                                   // Get timeout from object
00673                         }
00674                                 // If timeout > 0 (true) and currenttime has not exceeded the latest sessions-time plus the timeout in seconds then accept user
00675                                 // Option later on: We could check that last update was at least x seconds ago in order not to update twice in a row if one script redirects to another...
00676                         if ($timeout>0 && ($GLOBALS['EXEC_TIME'] < ($user['ses_tstamp']+$timeout)))     {
00677                                         $GLOBALS['TYPO3_DB']->exec_UPDATEquery(
00678                                                                                         $this->session_table,
00679                                                                                         'ses_id='.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->id, $this->session_table).'
00680                                                                                                 AND ses_name='.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->name, $this->session_table),
00681                                                                                         array('ses_tstamp' => $GLOBALS['EXEC_TIME'])
00682                                                                                 );
00683                                         $user['ses_tstamp'] = $GLOBALS['EXEC_TIME'];    // Make sure that the timestamp is also updated in the array
00684                         } else {
00685                                 $this->logoff();                // delete any user set...
00686                         }
00687                 } else {
00688                         $this->logoff();                // delete any user set...
00689                 }
00690                 return $user;
00691         }
00692 
00699         function logoff() {
00700                 if ($this->writeDevLog)         t3lib_div::devLog('logoff: ses_id = '.$this->id, 't3lib_userAuth');
00701 
00702                         // Hook for pre-processing the logoff() method, requested and implemented by andreas.otto@dkd.de:
00703                 if (is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_pre_processing']))     {
00704                         $_params = array();
00705                         foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_pre_processing'] as $_funcRef)     {
00706                                 if ($_funcRef)  {
00707                                         t3lib_div::callUserFunction($_funcRef,$_params,$this);
00708                                 }
00709                         }
00710                 }
00711 
00712                 $GLOBALS['TYPO3_DB']->exec_DELETEquery(
00713                                         $this->session_table,
00714                                         'ses_id = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->id, $this->session_table).'
00715                                                 AND ses_name = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->name, $this->session_table)
00716                                 );
00717 
00718                 $this->user = '';
00719 
00720                         // Hook for post-processing the logoff() method, requested and implemented by andreas.otto@dkd.de:
00721                 if (is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_post_processing']))    {
00722                         $_params = array();
00723                         foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_post_processing'] as $_funcRef)    {
00724                                 if ($_funcRef)  {
00725                                         t3lib_div::callUserFunction($_funcRef,$_params,$this);
00726                                 }
00727                         }
00728                 }
00729         }
00730 
00731 
00732 
00733 
00734 
00735 
00736 
00737 
00738 
00739 
00740 
00741 
00742 
00743         /*************************
00744          *
00745          * SQL Functions
00746          *
00747          *************************/
00748 
00755         function user_where_clause()    {
00756                 return  (($this->enablecolumns['rootLevel']) ? 'AND '.$this->user_table.'.pid=0 ' : '').
00757                                 (($this->enablecolumns['disabled']) ? ' AND '.$this->user_table.'.'.$this->enablecolumns['disabled'].'=0' : '').
00758                                 (($this->enablecolumns['deleted']) ? ' AND '.$this->user_table.'.'.$this->enablecolumns['deleted'].'=0' : '').
00759                                 (($this->enablecolumns['starttime']) ? ' AND ('.$this->user_table.'.'.$this->enablecolumns['starttime'].'<='.time().')' : '').
00760                                 (($this->enablecolumns['endtime']) ? ' AND ('.$this->user_table.'.'.$this->enablecolumns['endtime'].'=0 OR '.$this->user_table.'.'.$this->enablecolumns['endtime'].'>'.time().')' : '');
00761         }
00762 
00769         function ipLockClause() {
00770                 if ($this->lockIP)      {
00771                         $wherePart = 'AND (
00772                                 '.$this->session_table.'.ses_iplock='.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->ipLockClause_remoteIPNumber($this->lockIP),$this->session_table).'
00773                                 OR '.$this->session_table.'.ses_iplock=\'[DISABLED]\'
00774                                 )';
00775                         return $wherePart;
00776                 }
00777         }
00778 
00787         function ipLockClause_remoteIPNumber($parts)    {
00788                 $IP = t3lib_div::getIndpEnv('REMOTE_ADDR');
00789 
00790                 if ($parts>=4)  {
00791                         return $IP;
00792                 } else {
00793                         $parts = t3lib_div::intInRange($parts,1,3);
00794                         $IPparts = explode('.',$IP);
00795                         for($a=4;$a>$parts;$a--)        {
00796                                 unset($IPparts[$a-1]);
00797                         }
00798                         return implode('.',$IPparts);
00799                 }
00800         }
00801 
00808         function hashLockClause()       {
00809                 $wherePart = 'AND '.$this->session_table.'.ses_hashlock='.intval($this->hashLockClause_getHashInt());
00810                 return $wherePart;
00811         }
00812 
00819         function hashLockClause_getHashInt()    {
00820                 $hashStr = '';
00821 
00822                 if (t3lib_div::inList($this->lockHashKeyWords,'useragent'))     $hashStr.=':'.t3lib_div::getIndpEnv('HTTP_USER_AGENT');
00823 
00824                 return t3lib_div::md5int($hashStr);
00825         }
00826 
00827 
00828 
00829 
00830 
00831 
00832 
00833 
00834 
00835 
00836 
00837         /*************************
00838          *
00839          * Session and Configuration Handling
00840          *
00841          *************************/
00842 
00851         function writeUC($variable='')  {
00852                 if (is_array($this->user) && $this->user[$this->userid_column]) {
00853                         if (!is_array($variable)) { $variable = $this->uc; }
00854 
00855                         if ($this->writeDevLog)         t3lib_div::devLog('writeUC: '.$this->userid_column.'='.intval($this->user[$this->userid_column]), 't3lib_userAuth');
00856                         $GLOBALS['TYPO3_DB']->exec_UPDATEquery($this->user_table, $this->userid_column.'='.intval($this->user[$this->userid_column]), array('uc' => serialize($variable)));
00857                 }
00858         }
00859 
00866         function unpack_uc($theUC='') {
00867                 if (!$theUC)    $theUC=unserialize($this->user['uc']);
00868                 if (is_array($theUC))   {
00869                         $this->uc=$theUC;
00870                 }
00871         }
00872 
00882         function pushModuleData($module,$data,$noSave=0)        {
00883                 $this->uc['moduleData'][$module] = $data;
00884                 $this->uc['moduleSessionID'][$module] = $this->id;
00885                 if (!$noSave) $this->writeUC();
00886         }
00887 
00895         function getModuleData($module,$type='')        {
00896                 if ($type!='ses' || $this->uc['moduleSessionID'][$module]==$this->id) {
00897                         return $this->uc['moduleData'][$module];
00898                 }
00899         }
00900 
00908         function getSessionData($key)   {
00909                 $sesDat = unserialize($this->user['ses_data']);
00910                 return $sesDat[$key];
00911         }
00912 
00921         function setAndSaveSessionData($key,$data)      {
00922                 $sesDat = unserialize($this->user['ses_data']);
00923                 $sesDat[$key] = $data;
00924                 $this->user['ses_data'] = serialize($sesDat);
00925 
00926                 if ($this->writeDevLog)         t3lib_div::devLog('setAndSaveSessionData: ses_id = '.$this->user['ses_id'], 't3lib_userAuth');
00927                 $GLOBALS['TYPO3_DB']->exec_UPDATEquery($this->session_table, 'ses_id='.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->user['ses_id'], $this->session_table), array('ses_data' => $this->user['ses_data']));
00928         }
00929 
00930 
00931 
00932 
00933 
00934 
00935 
00936 
00937 
00938 
00939 
00940 
00941 
00942         /*************************
00943          *
00944          * Misc
00945          *
00946          *************************/
00947 
00954         function getLoginFormData() {
00955                 $loginData=array();
00956                 if ($this->getMethodEnabled)    {
00957                         $loginData['status'] = t3lib_div::_GP($this->formfield_status);
00958                         $loginData['uname'] = t3lib_div::_GP($this->formfield_uname);
00959                         $loginData['uident'] = t3lib_div::_GP($this->formfield_uident);
00960                         $loginData['chalvalue'] = t3lib_div::_GP($this->formfield_chalvalue);
00961                 } else {
00962                         $loginData['status'] = t3lib_div::_POST($this->formfield_status);
00963                         $loginData['uname'] = t3lib_div::_POST($this->formfield_uname);
00964                         $loginData['uident'] = t3lib_div::_POST($this->formfield_uident);
00965                         $loginData['chalvalue'] = t3lib_div::_POST($this->formfield_chalvalue);
00966                 }
00967                 $loginData = $this->processLoginData($loginData);
00968 
00969                 return $loginData;
00970         }
00971 
00981         function processLoginData($loginData, $security_level='') {
00982                 global $TYPO3_CONF_VARS;
00983 
00984                 $loginSecurityLevel = $security_level ? $security_level : ($TYPO3_CONF_VARS[$this->loginType]['loginSecurityLevel'] ? $TYPO3_CONF_VARS[$this->loginType]['loginSecurityLevel'] : $this->security_level);
00985 
00986                         // Processing data according to the state it was submitted in.
00987                         // ($loginSecurityLevel should reflect the security level used on the data being submitted in the login form)
00988                 if ($loginSecurityLevel=='normal') {
00989                         $loginData['uident_text'] = $loginData['uident'];
00990                         $loginData['uident_challenged'] = (string)md5($loginData['uname'].':'.$loginData['uident'].':'.$loginData['chalvalue']);
00991                         $loginData['uident_superchallenged'] = (string)md5($loginData['uname'].':'.(md5($loginData['uident'])).':'.$loginData['chalvalue']);
00992                 } elseif ($loginSecurityLevel=='challenged') {
00993                         $loginData['uident_text'] = '';
00994                         $loginData['uident_challenged'] = $loginData['uident'];
00995                         $loginData['uident_superchallenged'] = '';
00996                 } elseif ($loginSecurityLevel=='superchallenged') {
00997                         $loginData['uident_text'] = '';
00998                         $loginData['uident_challenged'] = '';
00999                         $loginData['uident_superchallenged'] = $loginData['uident'];
01000                 }
01001 
01002                         // The password "uident" is set based on the internal security setting of TYPO3
01003                         // Example:
01004                         // $this->security_level for the backend must be "superchallenged" because passwords are stored as md5-hashes in the be_users table
01005                         // $this->security_level for the frontend must be "normal" or "challenged" because passwords are stored as clear-text in the fe_users tables
01006                 if ($this->security_level=='normal') {
01007                         $loginData['uident'] = $loginData['uident_text'];
01008                 } elseif ($this->security_level=='challenged') {
01009                         $loginData['uident'] = $loginData['uident_challenged'];
01010                 } elseif ($this->security_level=='superchallenged') {
01011                         $loginData['uident'] = $loginData['uident_superchallenged'];
01012                 }
01013 
01014                 return $loginData;
01015         }
01016 
01023         function getAuthInfoArray() {
01024                 $authInfo = array();
01025                 $authInfo['loginType'] = $this->loginType;
01026                 $authInfo['refInfo'] = parse_url(t3lib_div::getIndpEnv('HTTP_REFERER'));
01027                 $authInfo['HTTP_HOST'] = t3lib_div::getIndpEnv('HTTP_HOST');
01028                 $authInfo['REMOTE_ADDR'] = t3lib_div::getIndpEnv('REMOTE_ADDR');
01029                 $authInfo['REMOTE_HOST'] = t3lib_div::getIndpEnv('REMOTE_HOST');
01030                 $authInfo['security_level'] = $this->security_level;
01031                 $authInfo['showHiddenRecords'] = $this->showHiddenRecords;
01032                         // can be overidden in localconf by SVCONF:
01033                 $authInfo['db_user']['table'] = $this->user_table;
01034                 $authInfo['db_user']['userid_column'] = $this->userid_column;
01035                 $authInfo['db_user']['username_column'] = $this->username_column;
01036                 $authInfo['db_user']['userident_column'] = $this->userident_column;
01037                 $authInfo['db_user']['usergroup_column'] = $this->usergroup_column;
01038                 $authInfo['db_user']['enable_clause'] = $this->user_where_clause();
01039                 $authInfo['db_user']['checkPidList'] = $this->checkPid ? $this->checkPid_value : '';
01040                 $authInfo['db_user']['check_pid_clause'] = $this->checkPid ? ' AND pid IN ('.$GLOBALS['TYPO3_DB']->cleanIntList($authInfo['db_user']['checkPidList']).')' : '';
01041                 $authInfo['db_groups']['table'] = $this->usergroup_table;
01042                 return $authInfo;
01043         }
01044 
01053         function compareUident($user, $loginData, $security_level='') {
01054 
01055                 $OK = FALSE;
01056                 $security_level = $security_level ? $security_level : $this->security_level;
01057 
01058                 switch ($security_level)        {
01059                         case 'superchallenged':         // If superchallenged the password in the database ($user[$this->userident_column]) must be a md5-hash of the original password.
01060                         case 'challenged':
01061 
01062                                         // Check challenge stored in cookie:
01063                                 if ($this->challengeStoredInCookie)     {
01064                                         session_start();
01065                                         if ($_SESSION['login_challenge'] !== $loginData['chalvalue']) {
01066                                                 if ($this->writeDevLog)         t3lib_div::devLog('PHP Session stored challenge "'.$_SESSION['login_challenge'].'" and submitted challenge "'.$loginData['chalvalue'].'" did not match, so authentication failed!', 't3lib_userAuth', 2);
01067                                                 $this->logoff();
01068                                                 return FALSE;
01069                                         }
01070                                 }
01071 
01072                                 if ((string)$loginData['uident'] === (string)md5($user[$this->username_column].':'.$user[$this->userident_column].':'.$loginData['chalvalue'])) {
01073                                         $OK = TRUE;
01074                                 }
01075                         break;
01076                         default:        // normal
01077                                 if ((string)$loginData['uident'] === (string)$user[$this->userident_column])    {
01078                                         $OK = TRUE;
01079                                 }
01080                         break;
01081                 }
01082 
01083                 return $OK;
01084         }
01085 
01092         function gc() {
01093                 $GLOBALS['TYPO3_DB']->exec_DELETEquery(
01094                                         $this->session_table,
01095                                         'ses_tstamp < '.intval(time()-($this->gc_time)).'
01096                                                 AND ses_name = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->name, $this->session_table)
01097                                 );
01098         }
01099 
01106         function redirect() {
01107                 if (!$this->userid && $this->auth_url)  {        // if no userid AND an include-document for login is given
01108                         include ($this->auth_include);
01109                         exit;
01110                 }
01111         }
01112 
01128         function writelog($type,$action,$error,$details_nr,$details,$data,$tablename,$recuid,$recpid)   {
01129         }
01130 
01137         function checkLogFailures()     {
01138         }
01139 
01150         function setBeUserByUid($uid)   {
01151                 $this->user = $this->getRawUserByUid($uid);
01152         }
01153 
01162         function setBeUserByName($name) {
01163                 $this->user = $this->getRawUserByName($name);
01164         }
01165 
01173         function getRawUserByUid($uid)  {
01174                 $user = FALSE;
01175                 $dbres = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', $this->user_table, 'uid='.intval($uid).' '.$this->user_where_clause());
01176                 if ($dbres)     {
01177                         $user = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($dbres);
01178                         $GLOBALS['TYPO3_DB']->sql_free_result($dbres);
01179                 }
01180                 return $user;
01181         }
01182 
01191         function getRawUserByName($name)        {
01192                 $user = FALSE;
01193                 $dbres = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', $this->user_table, 'username='.$GLOBALS['TYPO3_DB']->fullQuoteStr($name, $this->user_table).' '.$this->user_where_clause());
01194                 if ($dbres)     {
01195                         $user = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($dbres);
01196                         $GLOBALS['TYPO3_DB']->sql_free_result($dbres);
01197                 }
01198                 return $user;
01199         }
01200 
01201 
01202 
01203 
01204 
01205 
01206 
01207 
01208 
01209 
01210 
01211 
01212 
01213 
01214 
01215         /*************************
01216          *
01217          * Create/update user - EXPERIMENTAL
01218          *
01219          *************************/
01220 
01230         function fetchUserRecord($dbUser, $username, $extraWhere='' )   {
01231                 $user = FALSE;
01232 
01233                 $usernameClause = $username ? ($dbUser['username_column'].'='.$GLOBALS['TYPO3_DB']->fullQuoteStr($username, $dbUser['table'])) : '';
01234 
01235                 if ($username || $extraWhere)   {
01236 
01237                                 // Look up the user by the username and/or extraWhere:
01238                         $dbres = $GLOBALS['TYPO3_DB']->exec_SELECTquery(
01239                                                 '*',
01240                                                 $dbUser['table'],
01241                                                         $usernameClause.
01242                                                         $dbUser['check_pid_clause'].
01243                                                         $dbUser['enable_clause'].
01244                                                         $extraWhere
01245                                         );
01246 
01247                         if ($dbres)     {
01248                                 $user = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($dbres);
01249                                 $GLOBALS['TYPO3_DB']->sql_free_result($dbres);
01250                         }
01251                 }
01252                 return $user;
01253         }
01254 }
01255 
01256 
01257 
01258 if (defined('TYPO3_MODE') && $TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['t3lib/class.t3lib_userauth.php'])  {
01259         include_once($TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['t3lib/class.t3lib_userauth.php']);
01260 }
01261 ?>


Généré par Les experts TYPO3 avec  doxygen 1.4.6