webinterface.git

@@ -63,8 +63,10 @@ elseif (isset($_REQUEST['type']) && isset($_REQUEST['username'])) {

     system_failure('Ihr Browser hat kein Client-Zertifikat gesendet');

   $ret = get_logins_by_cert($_SERVER['REDIRECT_SSL_CLIENT_CERT']);

+  DEBUG($ret);

   foreach ($ret as $account) {

-    if (($account['type'] == $_REQUEST['type']) && ($account['username'] == $_REQUEST['username'])) {

+    DEBUG('/'.$account['type'].'/'.$_REQUEST['type'].'/    /'.$account['username'].'/'.$_REQUEST['username'].'/    =>');

+    if (($account['type'] == urldecode($_REQUEST['type'])) && ($account['username'] == urldecode($_REQUEST['username']))) {

       $uid = $account['username'];

       $role = find_role($uid, '', True);

       setup_session($role, $uid);

@@ -114,7 +116,7 @@ else

         $type = 'Kundenaccount';

       }

       $destination = 'go/index/index';

-      if (check_path($account['startpage']))

+      if ($account['startpage'] && check_path($account['startpage']))

         $destination = $account['startpage'];

       output('<li>'.internal_link('', $type.': <strong>'.$account['username'].'</strong>', 'type='.$account['type'].'&username='.urlencode($account['username']).'&destination='.urlencode($destination)).'</li>');

     }

@@ -3,7 +3,7 @@

 require_once('inc/base.php');

 require_once('x509.php');

-require_role(ROLE_SYSTEMUSER);

+require_role(array(ROLE_SYSTEMUSER, ROLE_SUBUSER, ROLE_VMAIL_ACCOUNT));

 title('Anmeldung über Client-Zertifikat');

 output('<p>Sie können Sie an diesem Webinterface wahlweise auch über ein SSL-Client-Zertifikat anmelden. Dazu muss das gewünschte Zertifikat <em>vorher</em> in Ihrem Browser installiert werden und kann dann hier hinzugefügt werden.</p>

@@ -19,6 +19,15 @@ if (isset($_GET['clear']))

   unset($_SESSION['clientcert_issuer']);

 }

+$username = NULL;

+if ($_SESSION['role'] == ROLE_SYSTEMUSER) {

+  $username = $_SESSION['userinfo']['username'];

+  if (isset($_SESSION['subuser']))

+    $username = $_SESSION['subuser'];

+} elseif ($_SESSION['role'] == ROLE_VMAIL_ACCOUNT) {

+  $username = $_SESSION['mailaccount'];

+}

+

 if (isset($_SESSION['clientcert_cert']))

 {

   // FIXME: Es gibt keine Duplikaterkennung.

@@ -27,15 +36,12 @@ if (isset($_SESSION['clientcert_cert']))

   output('<p>Es wurde folgendes Client-Zertifikat von Ihrem Browser gesendet:</p>

 <div style="margin-left: 2em;"><strong>DN:</strong> '.filter_input_general($_SESSION['clientcert_dn']).'<br />

 <strong>Aussteller-DN:</strong> '.filter_input_general($_SESSION['clientcert_issuer']).'</div>

-<p>Soll dieses Zertifikat für den Zugang zum Benutzerkonto <strong>'.$_SESSION['userinfo']['username'].'</strong> verwendet werden?</p>');

+<p>Soll dieses Zertifikat für den Zugang für <strong>'.$username.'</strong> verwendet werden?</p>');

   output(html_form('clientcert_add', 'certsave.php', 'action=new', '<p><input type="submit" name="submit" value="Ja, dieses Zertifikat einrichten" /> &#160; '.internal_link('cert', 'Nein', 'clear').'</p>'));

   output('</div>');

 }

-$username = $_SESSION['userinfo']['username'];

-if (isset($_SESSION['subuser']))

-  $username = $_SESSION['subuser'];

 $certs = get_certs_by_username($username);

 if ($certs != NULL) {

   output('<p>Sie haben bereits Zertifikate für den Zugang eingerichtet.</p>

@@ -2,7 +2,7 @@

 require_once('session/start.php');

 require_once('x509.php');

-require_role(ROLE_SYSTEMUSER);

+require_role(array(ROLE_SYSTEMUSER, ROLE_SUBUSER, ROLE_VMAIL_ACCOUNT));

 if ($_GET['action'] == 'new')

@@ -24,8 +24,15 @@ elseif ($_GET['action'] == 'delete')

   $cert = get_cert_by_id($_GET['id']);

   if (! $cert)

     system_failure('no ID');

-  if (!((!isset($_SESSION['subuser']) && $cert['username'] == $_SESSION['userinfo']['username']) ||

-        (isset($_SESSION['subuser']) && $cert['username'] == $_SESSION['subuser'])))

+  $username = NULL;

+  if ($_SESSION['role'] == ROLE_SYSTEMUSER) {

+    $username = $_SESSION['userinfo']['username'];

+    if (isset($_SESSION['subuser']))

+      $username = $_SESSION['subuser'];

+  } elseif ($_SESSION['role'] == ROLE_VMAIL_ACCOUNT) {

+    $username = $_SESSION['mailaccount'];

+  }

+  if (! ($cert['username'] == $username))

     system_failure('Das Zertifikat ist nicht für Ihren Zugang eingerichtet');

   $sure = user_is_sure();

   if ($sure === NULL)

@@ -51,9 +51,21 @@ function get_certs_by_username($username)

 function add_clientcert($certdata, $dn, $issuer, $startpage='')

 {

+  $type = NULL;

+  $username = NULL;

+  if ($_SESSION['role'] == ROLE_SYSTEMUSER) {

     $type = 'user';

+    $username = mysql_real_escape_string($_SESSION['userinfo']['username']);

     if (isset($_SESSION['subuser']))

+      $username = mysql_real_escape_string($_SESSION['subuser']);

       $type = 'subuser';

+  } elseif ($_SESSION['role'] == ROLE_VMAIL_ACCOUNT) {

+    $type = 'email';

+    $username = mysql_real_escape_string($_SESSION['mailaccount']);

+  }

+  if (! $type || ! $username) {

+    system_failure('cannot get type or username of login');

+  }

   $certdata = mysql_real_escape_string($certdata);

   $dn = maybe_null(mysql_real_escape_string($dn));

   $issuer = maybe_null(mysql_real_escape_string($issuer));

@@ -61,12 +73,6 @@ function add_clientcert($certdata, $dn, $issuer, $startpage='')

     system_failure('Startseite kaputt');

   $startpage = maybe_null(mysql_real_escape_string($startpage));

-  $username = mysql_real_escape_string($_SESSION['userinfo']['username']);

-  if ($type == 'subuser')

-    $username = $_SESSION['subuser'];

-  if ($username == '')

-    system_failure('Kein Username');

-

   if ($certdata == '')

     system_failure('Kein Zertifikat');

   DEBUG($certdata);

@@ -82,9 +88,21 @@ VALUES ({$dn}, {$issuer}, '{$certdata}', '{$type}', '{$username}', {$startpage})

 function delete_clientcert($id)

 {

   $id = (int) $id;

+  $type = NULL;

+  $username = NULL;

+  if ($_SESSION['role'] == ROLE_SYSTEMUSER) {

+    $type = 'user';

     $username = mysql_real_escape_string($_SESSION['userinfo']['username']);

     if (isset($_SESSION['subuser']))

       $username = mysql_real_escape_string($_SESSION['subuser']);

-  db_query("DELETE FROM system.clientcert WHERE id={$id} AND username='{$username}' LIMIT 1");

+      $type = 'subuser';

+  } elseif ($_SESSION['role'] == ROLE_VMAIL_ACCOUNT) {

+    $type = 'email';

+    $username = mysql_real_escape_string($_SESSION['mailaccount']);

+  }

+  if (! $type || ! $username) {

+    system_failure('cannot get type or username of login');

+  }

+  db_query("DELETE FROM system.clientcert WHERE id={$id} AND type='{$type}' AND username='{$username}' LIMIT 1");

 }

@@ -6,7 +6,7 @@ if ($role == ROLE_ANONYMOUS) {

   $menu["index_login"] = array("label" => "Login", "file" => "index", "weight" => 0);

   $menu["certlogin"] = array("label" => "Client-Zertifikat", "file" => "certinfo", "weight" => 10);

 } else {

-  if ($role & (ROLE_SYSTEMUSER | ROLE_SUBUSER))

+  if ($role & (ROLE_SYSTEMUSER | ROLE_SUBUSER | ROLE_VMAIL_ACCOUNT))

     $menu["index_cert"] = array("label" => "Client-Zertifikat", "file" => "cert", "weight" => 10, "submenu" => "index_index");

   if ($role & (ROLE_SYSTEMUSER | ROLE_CUSTOMER)) {

     $menu["index_chpass"] = array("label" => "Passwort ändern", "file" => "chpass", "weight" => 98);