Browse code

Entferne Javascript-Konstrukt für den automatischen Certlogin, das kann man auch voll transparent über PHP machen.

Bernd Wurst authored on13/02/2018 12:31:52
Showing6 changed files
1 1
deleted file mode 100644
... ...
@@ -1,79 +0,0 @@
1
-<?php
2
-/*
3
-This file belongs to the Webinterface of schokokeks.org Hosting
4
-
5
-Written 2008-2018 by schokokeks.org Hosting, namely
6
-  Bernd Wurst <bernd@schokokeks.org>
7
-  Hanno Böck <hanno@schokokeks.org>
8
-
9
-To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.
10
-
11
-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 
12
-http://creativecommons.org/publicdomain/zero/1.0/
13
-
14
-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
15
-*/
16
-
17
-// Setze das Arbeitsverzeichnis auf das Stammverzeichnis, damit die Voraussetzungen gleich sind wie bei allen anderen Requests
18
-chdir('..');
19
-
20
-require_once('config.php');
21
-global $prefix;
22
-$prefix = '../';
23
-
24
-// Das Parent-Verzeichnis in den Include-Pfad, da wir uns jetzt in einem anderen Verzeichnis befinden.
25
-ini_set('include_path', ini_get('include_path').':../');
26
-
27
-require_once('session/start.php');
28
-require_once('inc/base.php');
29
-require_once('inc/debug.php');
30
-require_once('inc/error.php');
31
-require_once('inc/theme.php');
32
-
33
-
34
-function prepare_cert($cert)
35
-{
36
-	return str_replace(array('-----BEGIN CERTIFICATE-----', '-----END CERTIFICATE-----', ' ', "\n"), array(), $cert);
37
-}
38
-
39
-
40
-function get_logins_by_cert($cert) 
41
-{
42
-	$cert = prepare_cert($cert);
43
-	$result = db_query("SELECT type,username,startpage FROM system.clientcert WHERE cert=?", array($cert));
44
-	if ($result->rowCount() < 1)
45
-		return NULL;
46
-	else {
47
-		$ret = array();
48
-		while ($row = $result->fetch()) {
49
-			$ret[] = $row;
50
-		}
51
-		return $ret;
52
-	}
53
-}
54
-
55
-DEBUG('$_SERVER:');
56
-DEBUG($_SERVER);
57
-
58
-header('Content-type: text/plain');
59
-
60
-if (isset($_SERVER['REDIRECT_SSL_CLIENT_CERT']) && 
61
-    isset($_SERVER['REDIRECT_SSL_CLIENT_S_DN']) && $_SERVER['REDIRECT_SSL_CLIENT_S_DN'] != '' && 
62
-    isset($_SERVER['REDIRECT_SSL_CLIENT_I_DN']) && $_SERVER['REDIRECT_SSL_CLIENT_I_DN'] != '') {
63
-  $ret = get_logins_by_cert($_SERVER['REDIRECT_SSL_CLIENT_CERT']);
64
-  if ($ret === NULL) {
65
-    echo 'error';
66
-    die();
67
-  }
68
-  if (count($ret) == 1) {
69
-    $uid = $ret[0]['username'];
70
-    $role = find_role($uid, '', True);
71
-    setup_session($role, $uid);
72
-    setcookie('CLIENTCERT_AUTOLOGIN', '1', time()+3600*24*365, '/');
73
-    echo 'ok';
74
-    die();
75
-  }
76
-}
77
-echo 'error';
78
-die();
79
-?>
... ...
@@ -107,7 +107,8 @@ else
107 107
       $uid = $ret[0]['username'];
108 108
       $role = find_role($uid, '', True);
109 109
       setup_session($role, $uid);
110
-      setcookie('CLIENTCERT_AUTOLOGIN', '1', time()+3600*24*365, '/');
110
+      DEBUG("Set Cookie!");
111
+      setcookie('CLIENTCERT_AUTOLOGIN', '1', strtotime("+ 1 year"), '/', '', true, true);
111 112
       $destination = 'go/index/index';
112 113
       if (check_path($ret[0]['startpage']))
113 114
         $destination = $ret[0]['startpage'];
... ...
@@ -120,7 +120,7 @@ function require_role($roles)
120 120
       $allow = true;
121 121
   if (! $allow)
122 122
     if ($_SESSION['role'] == ROLE_ANONYMOUS)
123
-      login_screen("Diese Seite können Sie erst benutzen, wenn Sie sich mit Ihren Zugangsdaten anmelden.");
123
+      login_screen();
124 124
     else
125 125
       login_screen("Diese Seite können Sie mit Ihren aktuellen Zugriffsrechten nicht benutzen, bitte melden Sie sich mit den benötigten Zugriffsrechten an!");
126 126
 }
... ...
@@ -129,12 +129,9 @@ function require_role($roles)
129 129
 function login_screen($why = NULL)
130 130
 {
131 131
   if (! $why) {
132
-    if (have_module('index')) {
133 132
       if (isset($_COOKIE['CLIENTCERT_AUTOLOGIN']) && $_COOKIE['CLIENTCERT_AUTOLOGIN'] == '1') {
134
-        require_once('modules/index/include/x509.php');
135
-        do_ajax_cert_login();
133
+          redirect("/certlogin/index.php?destination=".urlencode($_SERVER['REQUEST_URI']));
136 134
       }
137
-    }
138 135
   }
139 136
   require_once('inc/theme.php');
140 137
   if ($why) {
141 138
deleted file mode 100644
... ...
@@ -1,12 +0,0 @@
1
-function redirect(status) {
2
-  if (status == "ok") {
3
-    window.location.reload();
4
-  } else {
5
-    window.location.href="../../certlogin/";
6
-  }
7
-}
8
-
9
-$(function () {
10
-  $.get("../../certlogin/ajax.php", redirect);
11
-}
12
-);
13 0
deleted file mode 100644
... ...
@@ -1,34 +0,0 @@
1
-<?php
2
-/*
3
-This file belongs to the Webinterface of schokokeks.org Hosting
4
-
5
-Written 2008-2018 by schokokeks.org Hosting, namely
6
-  Bernd Wurst <bernd@schokokeks.org>
7
-  Hanno Böck <hanno@schokokeks.org>
8
-
9
-To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.
10
-
11
-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 
12
-http://creativecommons.org/publicdomain/zero/1.0/
13
-
14
-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
15
-*/
16
-
17
-require_once('x509.php');
18
-
19
-title('Login über SSL-Client-Zertifikat');
20
-
21
-if ($_SESSION['role'] == ROLE_ANONYMOUS) {
22
-  do_ajax_cert_login();
23
-} else {
24
-  redirect('index');
25
-}
26
-
27
-output('<p>Sie werden nun über Ihr SSL-Client-Zertifikat eingeloggt. Möglicherweise werden Sie von Ihrem Browser zunächst gebeten, ein Zertifikat auszuwählen.</p>');
28
-
29
-output('<p>Sollte der Login nicht funktionieren, klicken Sie bitte diesen Link:</p>
30
-<p><strong>'.internal_link('../../certlogin/', 'Login über SSL-Client-Zertifikat').'</strong></p>
31
-');
32
-
33
-
34
-
... ...
@@ -25,13 +25,16 @@ function do_ajax_cert_login() {
25 25
 function get_logins_by_cert($cert) 
26 26
 {
27 27
 	$result = db_query("SELECT type,username,startpage FROM system.clientcert WHERE cert=? ORDER BY type,username", array($cert));
28
-	if ($result->rowCount() < 1)
28
+	if ($result->rowCount() < 1) {
29
+        DEBUG("No certlogin found for this cert!");
29 30
 		return NULL;
30
-	else {
31
+	} else {
31 32
 		$ret = array();
32 33
 		while ($row = $result->fetch()) {
33 34
 			$ret[] = $row;
34 35
 		}
36
+        DEBUG("Logins for this cert:");
37
+        DEBUG($ret);
35 38
 		return $ret;
36 39
 	}
37 40
 }