webinterface.git

@@ -1,3 +0,0 @@

-# allow client certs

-SSLVerifyClient optional_no_ca

-SSLoptions +StdEnvVars +ExportCertData

@@ -1,140 +0,0 @@

-<?php

-

-/*

-This file belongs to the Webinterface of schokokeks.org Hosting

-

-Written by schokokeks.org Hosting, namely

-  Bernd Wurst <bernd@schokokeks.org>

-  Hanno Böck <hanno@schokokeks.org>

-

-This code is published under a 0BSD license.

-

-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

-*/

-

-// Setze das Arbeitsverzeichnis auf das Stammverzeichnis, damit die Voraussetzungen gleich sind wie bei allen anderen Requests

-chdir('..');

-

-require_once('config.php');

-global $prefix;

-$prefix = '../';

-

-// Das Parent-Verzeichnis in den Include-Pfad, da wir uns jetzt in einem anderen Verzeichnis befinden.

-ini_set('include_path', ini_get('include_path') . ':../');

-

-require_once('session/start.php');

-require_once('inc/base.php');

-require_once('inc/debug.php');

-require_once('inc/error.php');

-require_once('inc/theme.php');

-require_once('modules/index/include/x509.php');

-

-

-DEBUG('$_SERVER:');

-DEBUG($_SERVER);

-

-$redirect = "";

-if (!isset($_SERVER['SSL_CLIENT_CERT']) && isset($_SERVER['REDIRECT_SSL_CLIENT_CERT'])) {

-    $redirect = "REDIRECT_";

-}

-

-if ($_SESSION['role'] != ROLE_ANONYMOUS && isset($_REQUEST['record']) && isset($_REQUEST['backto']) && check_path($_REQUEST['backto'])) {

-    DEBUG('recording client-cert');

-    if (isset($_SERVER[$redirect . 'SSL_CLIENT_CERT']) && isset($_SERVER[$redirect . 'SSL_CLIENT_S_DN'])

-      && isset($_SERVER[$redirect . 'SSL_CLIENT_I_DN']) && isset($_SERVER[$redirect . 'SSL_CLIENT_M_SERIAL'])

-      && isset($_SERVER[$redirect . 'SSL_CLIENT_V_START']) && isset($_SERVER[$redirect . 'SSL_CLIENT_V_END'])

-    ) {

-        $_SESSION['clientcert_cert'] = $_SERVER[$redirect . 'SSL_CLIENT_CERT'];

-        $_SESSION['clientcert_dn'] = $_SERVER[$redirect . 'SSL_CLIENT_S_DN'];

-        $_SESSION['clientcert_issuer'] = $_SERVER[$redirect . 'SSL_CLIENT_I_DN'];

-        $_SESSION['clientcert_serial'] = $_SERVER[$redirect . 'SSL_CLIENT_M_SERIAL'];

-        $vstart = new DateTime($_SERVER[$redirect . 'SSL_CLIENT_V_START']);

-        $_SESSION['clientcert_valid_from'] = date_format($vstart, 'Y-m-d');

-        $vend = new DateTime($_SERVER[$redirect . 'SSL_CLIENT_V_END']);

-        $_SESSION['clientcert_valid_until'] = date_format($vend, 'Y-m-d');

-        header('Location: ' . $prefix . $_REQUEST['backto'] . encode_querystring(''));

-        die();

-    } else {

-        warning('Ihr Browser hat kein Client-Zertifikat gesendet');

-        header('Location: ' . $prefix . $_REQUEST['backto'] . encode_querystring(''));

-        die();

-    }

-} elseif (isset($_REQUEST['type']) && isset($_REQUEST['username'])) {

-    if (!isset($_SERVER[$redirect . 'SSL_CLIENT_CERT'])) {

-        system_failure('Ihr Browser hat kein Client-Zertifikat gesendet');

-    }

-

-    $ret = get_logins_by_cert($_SERVER[$redirect . 'SSL_CLIENT_CERT']);

-    DEBUG($ret);

-    foreach ($ret as $account) {

-        DEBUG('/' . $account['type'] . '/' . $_REQUEST['type'] . '/    /' . $account['username'] . '/' . $_REQUEST['username'] . '/    =>');

-        if (($account['type'] == urldecode($_REQUEST['type'])) && ($account['username'] == urldecode($_REQUEST['username']))) {

-            $uid = $account['username'];

-            $role = find_role($uid, '', true);

-            setup_session($role, $uid);

-            $destination = 'go/index/index';

-            if (check_path($account['startpage'])) {

-                $destination = $account['startpage'];

-            }

-            if (isset($_REQUEST['destination']) && check_path($_REQUEST['destination'])) {

-                $destination = $_REQUEST['destination'];

-            }

-            header('Location: ../' . ltrim($destination, '/'));

-            die();

-        }

-    }

-    system_failure('Der angegebene Account kann mit diesem Client-Zertifikat nicht eingeloggt werden.');

-} elseif ($_SESSION['role'] != ROLE_ANONYMOUS && isset($_REQUEST['destination']) && $_REQUEST['destination'] != '') {

-    # User hat sich grade eingeloggt

-    header('Location: ../' . ltrim($destination, '/'));

-} else {

-    if (isset($_SERVER[$redirect . 'SSL_CLIENT_CERT'])

-      && isset($_SERVER[$redirect . 'SSL_CLIENT_S_DN']) && $_SERVER[$redirect . 'SSL_CLIENT_S_DN'] != ''

-      && isset($_SERVER[$redirect . 'SSL_CLIENT_I_DN']) && $_SERVER[$redirect . 'SSL_CLIENT_I_DN'] != ''

-      && isset($_SERVER[$redirect . 'SSL_CLIENT_M_SERIAL']) && $_SERVER[$redirect . 'SSL_CLIENT_M_SERIAL'] != '') {

-        $ret = get_logins_by_cert($_SERVER[$redirect . 'SSL_CLIENT_CERT']);

-        if ($ret === null) {

-            login_screen('Ihr Browser hat ein Client-Zertifikat gesendet, dieses ist aber noch nicht für den Zugang hinterlegt. Melden Sie sich bitte per Benutzername und Passwort an.');

-        }

-        if (count($ret) == 1) {

-            $uid = $ret[0]['username'];

-            $role = find_role($uid, '', true);

-            setup_session($role, $uid);

-            DEBUG("Set Cookie!");

-            setcookie('CLIENTCERT_AUTOLOGIN', '1', ['expires' => strtotime("+ 1 year"), 'path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'Lax']);

-            $destination = 'go/index/index';

-            if (check_path($ret[0]['startpage'])) {

-                $destination = $ret[0]['startpage'];

-            }

-            if (isset($_REQUEST['destination']) && check_path($_REQUEST['destination'])) {

-                $destination = $_REQUEST['destination'];

-            }

-            header('Location: ../' . ltrim($destination, '/'));

-            die();

-        }

-        output('<p>Ihr Browser hat ein gültiges SSL-Client-Zertifikat gesendet, mit dem Sie sich auf dieser Seite einloggen können. Allerdings haben Sie dieses Client-Zertifikat für mehrere Zugänge hinterlegt. Wählen Sie bitte den Zugang aus, mit dem Sie sich anmelden möchten.</p>

-      <ul>');

-        foreach ($ret as $account) {

-            $type = 'System-Account';

-            if ($account['type'] == 'email') {

-                $type = 'E-Mail-Konto';

-            } elseif ($account['type'] == 'subuser') {

-                $type = 'Unter-Nutzer';

-            } elseif ($account['type'] == 'customer') {

-                $type = 'Kundenaccount';

-            }

-            $destination = 'go/index/index';

-            if ($account['startpage'] && check_path($account['startpage'])) {

-                $destination = $account['startpage'];

-            }

-            output('<li>' . internal_link('', $type . ': <strong>' . $account['username'] . '</strong>', 'type=' . $account['type'] . '&username=' . urlencode($account['username']) . '&destination=' . urlencode($destination)) . '</li>');

-        }

-        output('</ul>');

-    } else {

-        warning('Ihr Browser hat kein Client-Zertifikat gesendet. Eventuell müssen Sie in den Einstellungen des Browsers diese Funktion einschalten.');

-        redirect('/');

-        die();

-    }

-}

-

-show_page('certlogin');

@@ -142,11 +142,6 @@ function login_screen($why = null)

         $title = '';

         system_failure("Zu viele fehlgeschlagenen Login-Versuche! Bitte warten Sie einige Minuten bis zum nächsten Versuch!");

     }

-    if (!$why) {

-        if (isset($_COOKIE['CLIENTCERT_AUTOLOGIN']) && $_COOKIE['CLIENTCERT_AUTOLOGIN'] == '1') {

-            redirect("/certlogin/index.php?destination=" . urlencode($_SERVER['REQUEST_URI']));

-        }

-    }

     require_once('inc/theme.php');

     if ($why) {

         warning($why);

@@ -1,77 +0,0 @@

-<?php

-

-/*

-This file belongs to the Webinterface of schokokeks.org Hosting

-

-Written by schokokeks.org Hosting, namely

-  Bernd Wurst <bernd@schokokeks.org>

-  Hanno Böck <hanno@schokokeks.org>

-

-This code is published under a 0BSD license.

-

-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

-*/

-

-require_once('inc/base.php');

-require_once('x509.php');

-

-require_role([ROLE_SYSTEMUSER, ROLE_SUBUSER, ROLE_VMAIL_ACCOUNT]);

-

-title('Anmeldung über Client-Zertifikat');

-output('<p>Sie können Sie an diesem Webinterface wahlweise auch über ein SSL-Client-Zertifikat anmelden. Dazu muss das gewünschte Zertifikat <em>vorher</em> in Ihrem Browser installiert werden und kann dann hier hinzugefügt werden.</p>

-<p>Wenn Sie ein Zertifikat mit der entsprechenden Funktion unten auf dieser Seite hinzufügen, wird Sie Ihr Browser fragen, welches Zertifikat verwendet werden soll. Sollte Ihr Browser nicht fragen, ist entweder kein Zertifikat im Browser installiert oder Sie haben Ihren Browser auf <em>Niemals fragen</em> (o.Ä.) eingestellt.</p>

-');

-

-

-

-if (isset($_GET['clear'])) {

-    unset($_SESSION['clientcert_cert']);

-    unset($_SESSION['clientcert_dn']);

-    unset($_SESSION['clientcert_issuer']);

-    unset($_SESSION['clientcert_serial']);

-}

-

-$username = null;

-if ($_SESSION['role'] & ROLE_SYSTEMUSER) {

-    $username = $_SESSION['userinfo']['username'];

-    if (isset($_SESSION['subuser'])) {

-        $username = $_SESSION['subuser'];

-    }

-} elseif ($_SESSION['role'] & ROLE_VMAIL_ACCOUNT) {

-    $username = $_SESSION['mailaccount'];

-}

-

-if (isset($_SESSION['clientcert_cert'])) {

-    // FIXME: Es gibt keine Duplikaterkennung.

-    global $menu;

-    output('<div style="margin: 1em; padding: 1em; border: 2px solid green;">');

-    output('<p>Es wurde folgendes Client-Zertifikat von Ihrem Browser gesendet:</p>

-<div style="margin-left: 2em;"><strong>DN:</strong> ' . filter_output_html($_SESSION['clientcert_dn']) . '<br />

-<strong>Aussteller-DN:</strong> ' . filter_output_html($_SESSION['clientcert_issuer']) . '<br />

-<strong>Seriennummer:</strong> ' . filter_output_html($_SESSION['clientcert_serial']) . '<br />

-<strong>Gültigkeit:</strong> ' . filter_output_html($_SESSION['clientcert_valid_from']) . ' bis ' . filter_output_html($_SESSION['clientcert_valid_until']) . '</div>

-<p>Soll dieses Zertifikat für den Zugang für <strong>' . $username . '</strong> verwendet werden?</p>');

-    output(html_form('clientcert_add', 'certsave.php', 'action=new', '<p><input type="submit" name="submit" value="Ja, dieses Zertifikat einrichten" /> &#160; ' . internal_link('cert', 'Nein', 'clear') . '</p>'));

-    output('</div>');

-}

-

-

-DEBUG($username);

-$certs = get_certs_by_username($username);

-if ($certs != null) {

-    output('<p>Sie haben bereits Zertifikate für den Zugang eingerichtet.</p>

-  <ul>');

-    foreach ($certs as $cert) {

-        output('<li>' . filter_output_html($cert['dn'] . ' / Seriennummer ' . $cert['serial'] . ' / ' . 'Gültig von ' . $cert['valid_from'] . ' bis ' . $cert['valid_until']) . '<br />');

-        output('<em>ausgestellt von </em>' . filter_output_html($cert['issuer']));

-        output('<br />' . internal_link('certsave', 'Dieses Zertifikat löschen', 'action=delete&id=' . $cert['id']));

-        output('</li>');

-    }

-    output('</ul>');

-} else {

-    output('<p><em>Bisher sind keine Zertifikate für Ihren Zugang eingerichtet</em></p>');

-}

-

-$backurl = 'go/index/cert';

-

-addnew('../../certlogin/index.php', 'Neues Client-Zertifikat hinzufügen', 'record&backto=' . $backurl);

@@ -1,20 +0,0 @@

-<?php

-

-/*

-This file belongs to the Webinterface of schokokeks.org Hosting

-

-Written by schokokeks.org Hosting, namely

-  Bernd Wurst <bernd@schokokeks.org>

-  Hanno Böck <hanno@schokokeks.org>

-

-This code is published under a 0BSD license.

-

-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

-*/

-

-title('Login über SSL-Client-Zertifikat');

-output('<p>Sie können Sich an diesem Interface auch per SSL-Client-Zertifikat anmelden. Dazu müssen Sie dieses Zertifikat vorab hinterlegt haben.</p>

-

-<p>Um den Login über ein Client-Zertifikat zu nutzen, nutzen Sie bitte diesen Link:</p>

-<p><strong>' . internal_link('../../certlogin/', 'Login über SSL-Client-Zertifikat') . '</strong></p>

-');

@@ -1,76 +0,0 @@

-<?php

-

-/*

-This file belongs to the Webinterface of schokokeks.org Hosting

-

-Written by schokokeks.org Hosting, namely

-  Bernd Wurst <bernd@schokokeks.org>

-  Hanno Böck <hanno@schokokeks.org>

-

-This code is published under a 0BSD license.

-

-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

-*/

-

-require_once('session/start.php');

-require_once('x509.php');

-

-require_role([ROLE_SYSTEMUSER, ROLE_SUBUSER, ROLE_VMAIL_ACCOUNT]);

-

-

-if ($_GET['action'] == 'new') {

-    check_form_token('clientcert_add');

-    if (!isset($_SESSION['clientcert_cert'])) {

-        system_failure('Kein Zertifikat');

-    }

-

-    add_clientcert(

-        $_SESSION['clientcert_cert'],

-        $_SESSION['clientcert_dn'],

-        $_SESSION['clientcert_issuer'],

-        $_SESSION['clientcert_serial'],

-        $_SESSION['clientcert_valid_from'],

-        $_SESSION['clientcert_valid_until']

-    );

-

-    // Räume session auf

-    unset($_SESSION['clientcert_cert']);

-    unset($_SESSION['clientcert_dn']);

-    unset($_SESSION['clientcert_issuer']);

-    unset($_SESSION['clientcert_serial']);

-    unset($_SESSION['clientcert_valid_from']);

-    unset($_SESSION['clientcert_valid_until']);

-    header('Location: cert');

-} elseif ($_GET['action'] == 'delete') {

-    $cert = get_cert_by_id($_GET['id']);

-    if (!$cert) {

-        system_failure('no ID');

-    }

-    $username = null;

-    if ($_SESSION['role'] & ROLE_SYSTEMUSER) {

-        $username = $_SESSION['userinfo']['username'];

-        if (isset($_SESSION['subuser'])) {

-            $username = $_SESSION['subuser'];

-        }

-    } elseif ($_SESSION['role'] & ROLE_VMAIL_ACCOUNT) {

-        $username = $_SESSION['mailaccount'];

-    }

-    if (!($cert['username'] == $username)) {

-        system_failure('Das Zertifikat ist nicht für Ihren Zugang eingerichtet');

-    }

-    $sure = user_is_sure();

-    if ($sure === null) {

-        are_you_sure("action=delete&id={$cert['id']}", filter_output_html("Möchten Sie das Zertifikat »{$cert['dn']}« (Seriennummer {$cert['serial']}, Gültig von {$cert['valid_from']} bis {$cert['valid_until']}) wirklich löschen?"));

-    } elseif ($sure === true) {

-        delete_clientcert($cert['id']);

-        if (!$debugmode) {

-            header("Location: cert");

-        }

-    } elseif ($sure === false) {

-        if (!$debugmode) {

-            header("Location: cert");

-        }

-    }

-} else {

-    system_failure('Kein Kommando');

-}

@@ -1,131 +0,0 @@

-<?php

-

-/*

-This file belongs to the Webinterface of schokokeks.org Hosting

-

-Written by schokokeks.org Hosting, namely

-  Bernd Wurst <bernd@schokokeks.org>

-  Hanno Böck <hanno@schokokeks.org>

-

-This code is published under a 0BSD license.

-

-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

-*/

-

-require_once('inc/security.php');

-

-function get_logins_by_cert($cert)

-{

-    $result = db_query("SELECT type,username,startpage FROM system.clientcert WHERE cert=? ORDER BY type,username", [$cert]);

-    if ($result->rowCount() < 1) {

-        DEBUG("No certlogin found for this cert!");

-        return null;

-    } else {

-        $ret = [];

-        while ($row = $result->fetch()) {

-            $ret[] = $row;

-        }

-        DEBUG("Logins for this cert:");

-        DEBUG($ret);

-        return $ret;

-    }

-}

-

-function get_cert_by_id($id)

-{

-    $id = (int) $id;

-    if ($id == 0) {

-        system_failure('no ID');

-    }

-    $result = db_query("SELECT id,dn,issuer,serial,valid_from,valid_until,cert,username,startpage FROM system.clientcert WHERE `id`=?", [$id]);

-    if ($result->rowCount() < 1) {

-        return null;

-    }

-    $ret = $result->fetch();

-    DEBUG($ret);

-    return $ret;

-}

-

-

-function get_certs_by_username($username)

-{

-    if ($username == '') {

-        system_failure('empty username');

-    }

-    $result = db_query("SELECT id,dn,issuer,serial,valid_from,valid_until,cert,startpage FROM system.clientcert WHERE `username`=?", [$username]);

-    if ($result->rowCount() < 1) {

-        return null;

-    }

-    while ($row = $result->fetch()) {

-        $ret[] = $row;

-    }

-    return $ret;

-}

-

-

-function add_clientcert($certdata, $dn, $issuer, $serial, $vstart, $vend, $startpage = null)

-{

-    $type = null;

-    $username = null;

-    if ($_SESSION['role'] & ROLE_SYSTEMUSER) {

-        $type = 'user';

-        $username = $_SESSION['userinfo']['username'];

-        if (isset($_SESSION['subuser'])) {

-            $username = $_SESSION['subuser'];

-            $type = 'subuser';

-        }

-    } elseif ($_SESSION['role'] & ROLE_VMAIL_ACCOUNT) {

-        $type = 'email';

-        $username = $_SESSION['mailaccount'];

-    }

-    if (!$type || !$username) {

-        system_failure('cannot get type or username of login');

-    }

-    if ($startpage && !check_path($startpage)) {

-        system_failure('Startseite kaputt');

-    }

-

-    if ($certdata == '') {

-        system_failure('Kein Zertifikat');

-    }

-

-    $args = [":dn" => $dn,

-        ":issuer" => $issuer,

-        ":serial" => $serial,

-        ":vstart" => $vstart,

-        ":vend" => $vend,

-        ":certdata" => $certdata,

-        ":type" => $type,

-        ":username" => $username,

-        ":startpage" => $startpage, ];

-    DEBUG($args);

-

-    db_query("INSERT INTO system.clientcert (`dn`, `issuer`, `serial`, `valid_from`, `valid_until`, `cert`, `type`, `username`, `startpage`) 

-VALUES (:dn, :issuer, :serial, :vstart, :vend, :certdata, :type, :username, :startpage)", $args);

-}

-

-

-function delete_clientcert($id)

-{

-    $id = (int) $id;

-    $type = null;

-    $username = null;

-    if ($_SESSION['role'] & ROLE_SYSTEMUSER) {

-        $type = 'user';

-        $username = $_SESSION['userinfo']['username'];

-        if (isset($_SESSION['subuser'])) {

-            $username = $_SESSION['subuser'];

-            $type = 'subuser';

-        }

-    } elseif ($_SESSION['role'] & ROLE_VMAIL_ACCOUNT) {

-        $type = 'email';

-        $username = $_SESSION['mailaccount'];

-    }

-    if (!$type || !$username) {

-        system_failure('cannot get type or username of login');

-    }

-    db_query(

-        "DELETE FROM system.clientcert WHERE id=:id AND type=:type AND username=:username",

-        [":id" => $id, ":type" => $type, ":username" => $username]

-    );

-}

@@ -17,9 +17,6 @@ $role = $_SESSION['role'];

 if ($role == ROLE_ANONYMOUS) {

     $menu["index_login"] = ["label" => "Login", "file" => "index", "weight" => 0];

 } else {

-    if ($role & (ROLE_SYSTEMUSER | ROLE_SUBUSER | ROLE_VMAIL_ACCOUNT)) {

-        $menu["index_cert"] = ["label" => "Client-Zertifikat", "file" => "cert", "weight" => 10, "submenu" => "index_index"];

-    }

     if ($role & (ROLE_SYSTEMUSER | ROLE_CUSTOMER)) {

         $menu["index_chpass"] = ["label" => "Passwort ändern", "file" => "chpass", "weight" => 98];

     }

@@ -8,10 +8,8 @@ async function check_passkey() {

         PublicKeyCredential.isConditionalMediationAvailable) {

         const newButton = document.createElement('button');

         newButton.textContent = 'Mit Passkey/FIDO2-Gerät anmelden!';

-        const newPara = document.createElement('p');

+        newPara = document.getElementById("passkeybutton");

         newPara.appendChild(newButton)

-        certlogin = document.getElementById("certlogin")

-        certlogin.parentNode.insertBefore(newPara, certlogin)

         newButton.addEventListener('click', passkey_login);

     }

 }

@@ -71,8 +71,7 @@ if ($messages) {

 <p>Sie können sich hier mit Ihrem System-Benutzernamen, Ihrer E-Mail-Adresse oder Ihrer Kundennummer (jeweils mit zugehörigem Passwort) anmelden. Je nach gewählten Daten erhalten Sie unterschiedliche Zugriffsrechte.</p>

 <?php /* <p>Sollten Sie Ihr Benutzer-Passwort nicht mehr kennen, wenden Sie sich bitte an den Support. Passwörter für E-Mail-Konten kann der Eigentümer des Benutzeraccounts neu setzen.</p> */ ?>

-<p id="certlogin"><em><a href="../../certlogin/?destination=go/<?php echo $go; ?>"  >Mit einem Client-Zertifikat anmelden</a></em> (<a href="../../go/index/certinfo"  >Wie geht das?</a>)</p>

-

+<p id="passkeybutton"></p>

 <?php if ($footnotes) {

     echo '<div class="footnotes">';