C4/InstallAuth.pm

   1 package C4::InstallAuth;
   2
   3 # Copyright 2000-2002 Katipo Communications
   4 #
   5 # This file is part of Koha.
   6 #
   7 # Koha is free software; you can redistribute it and/or modify it under the
   8 # terms of the GNU General Public License as published by the Free Software
   9 # Foundation; either version 2 of the License, or (at your option) any later
  10 # version.
  11 #
  12 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
  13 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
  14 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
  15 #
  16 # You should have received a copy of the GNU General Public License along
  17 # with Koha; if not, write to the Free Software Foundation, Inc.,
  18 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19
  20 use strict;
  21 #use warnings; FIXME - Bug 2505
  22 use Digest::MD5 qw(md5_base64);
  23
  24 require Exporter;
  25 use C4::Context;
  26 use C4::Output;
  27 use C4::Templates;
  28 use C4::Koha;
  29 use CGI::Session;
  30
  31 use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
  32
  33 # set the version for version checking
  34 $VERSION = 3.00;
  35
  36 =head1 NAME
  37
  38 InstallAuth - Authenticates Koha users for Install process
  39
  40 =head1 SYNOPSIS
  41
  42   use CGI;
  43   use InstallAuth;
  44   use C4::Output;
  45
  46   my $query = new CGI;
  47
  48   my ($template, $borrowernumber, $cookie)
  49     = get_template_and_user({template_name   => "opac-main.tmpl",
  50                              query           => $query,
  51                              type            => "opac",
  52                              authnotrequired => 1,
  53                              flagsrequired   => {borrow => 1},
  54                           });
  55
  56   output_html_with_http_headers $query, $cookie, $template->output;
  57
  58 =head1 DESCRIPTION
  59
  60     The main function of this module is to provide
  61     authentification. However the get_template_and_user function has
  62     been provided so that a users login information is passed along
  63     automatically. This gets loaded into the template.
  64     This package is different from C4::Auth in so far as
  65     C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
  66
  67     As in C4::Auth, Authentication is based on cookies.
  68
  69 =head1 FUNCTIONS
  70
  71 =over 2
  72
  73 =cut
  74
  75 @ISA    = qw(Exporter);
  76 @EXPORT = qw(
  77   &checkauth
  78   &get_template_and_user
  79 );
  80
  81 =item get_template_and_user
  82
  83   my ($template, $borrowernumber, $cookie)
  84     = get_template_and_user({template_name   => "opac-main.tmpl",
  85                              query           => $query,
  86                              type            => "opac",
  87                              authnotrequired => 1,
  88                              flagsrequired   => {borrow => 1},
  89                           });
  90
  91     This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
  92     to C<&checkauth> (in this module) to perform authentification.
  93     See C<&checkauth> for an explanation of these parameters.
  94
  95     The C<template_name> is then used to find the correct template for
  96     the page. The authenticated users details are loaded onto the
  97     template in the HTML::Template LOOP variable C<USER_INFO>. Also the
  98     C<sessionID> is passed to the template. This can be used in templates
  99     if cookies are disabled. It needs to be put as and input to every
 100     authenticated page.
 101
 102     More information on the C<gettemplate> sub can be found in the
 103     Templates.pm module.
 104
 105 =cut
 106
 107 sub get_template_and_user {
 108     my $in       = shift;
 109     my $query    = $in->{'query'};
 110     my $language =_get_template_language($query->cookie('KohaOpacLanguage'));
 111     my $path     = C4::Context->config('intrahtdocs'). "/prog/". $language;
 112
 113     my $tmplbase = $in->{template_name};
 114     $tmplbase=~ s/\.tmpl$/.tt/;
 115     my $filename = "$path/modules/" . $tmplbase;
 116     my $interface = 'intranet';
 117     my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query);
 118
 119     my ( $user, $cookie, $sessionID, $flags ) = checkauth(
 120         $in->{'query'},
 121         $in->{'authnotrequired'},
 122         $in->{'flagsrequired'},
 123         $in->{'type'}
 124     );
 125
 126     #     use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
 127
 128     my $borrowernumber;
 129     if ($user) {
 130         $template->param( loggedinusername => $user );
 131         $template->param( sessionID        => $sessionID );
 132
 133         # We are going to use the $flags returned by checkauth
 134         # to create the template's parameters that will indicate
 135         # which menus the user can access.
 136         if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
 137             $template->param( CAN_user_circulate        => 1 );
 138             $template->param( CAN_user_catalogue        => 1 );
 139             $template->param( CAN_user_parameters       => 1 );
 140             $template->param( CAN_user_borrowers        => 1 );
 141             $template->param( CAN_user_permission       => 1 );
 142             $template->param( CAN_user_reserveforothers => 1 );
 143             $template->param( CAN_user_borrow           => 1 );
 144             $template->param( CAN_user_editcatalogue    => 1 );
 145             $template->param( CAN_user_updatecharges    => 1 );
 146             $template->param( CAN_user_acquisition      => 1 );
 147             $template->param( CAN_user_management       => 1 );
 148             $template->param( CAN_user_tools            => 1 );
 149             $template->param( CAN_user_editauthorities  => 1 );
 150             $template->param( CAN_user_serials          => 1 );
 151             $template->param( CAN_user_reports          => 1 );
 152         }
 153     }
 154     return ( $template, $borrowernumber, $cookie );
 155 }
 156
 157 sub _get_template_language {
 158
 159     #verify if opac language exists in staff (bug 5660)
 160     #conditions are 1) dir exists and 2) enabled in prefs
 161     my ($opaclang) = @_;
 162     return 'en' unless $opaclang;
 163     $opaclang =~ s/[^a-zA-Z_-]*//g;
 164     my $path = C4::Context->config('intrahtdocs') . "/prog/$opaclang";
 165     -d $path ? $opaclang : 'en';
 166 }
 167
 168 =item checkauth
 169
 170   ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
 171
 172 Verifies that the user is authorized to run this script.  If
 173 the user is authorized, a (userid, cookie, session-id, flags)
 174 quadruple is returned.  If the user is not authorized but does
 175 not have the required privilege (see $flagsrequired below), it
 176 displays an error page and exits.  Otherwise, it displays the
 177 login page and exits.
 178
 179 Note that C<&checkauth> will return if and only if the user
 180 is authorized, so it should be called early on, before any
 181 unfinished operations (e.g., if you've opened a file, then
 182 C<&checkauth> won't close it for you).
 183
 184 C<$query> is the CGI object for the script calling C<&checkauth>.
 185
 186 The C<$noauth> argument is optional. If it is set, then no
 187 authorization is required for the script.
 188
 189 C<&checkauth> fetches user and session information from C<$query> and
 190 ensures that the user is authorized to run scripts that require
 191 authorization.
 192
 193 The C<$flagsrequired> argument specifies the required privileges
 194 the user must have if the username and password are correct.
 195 It should be specified as a reference-to-hash; keys in the hash
 196 should be the "flags" for the user, as specified in the Members
 197 intranet module. Any key specified must correspond to a "flag"
 198 in the userflags table. E.g., { circulate => 1 } would specify
 199 that the user must have the "circulate" privilege in order to
 200 proceed. To make sure that access control is correct, the
 201 C<$flagsrequired> parameter must be specified correctly.
 202
 203 The C<$type> argument specifies whether the template should be
 204 retrieved from the opac or intranet directory tree.  "opac" is
 205 assumed if it is not specified; however, if C<$type> is specified,
 206 "intranet" is assumed if it is not "opac".
 207
 208 If C<$query> does not have a valid session ID associated with it
 209 (i.e., the user has not logged in) or if the session has expired,
 210 C<&checkauth> presents the user with a login page (from the point of
 211 view of the original script, C<&checkauth> does not return). Once the
 212 user has authenticated, C<&checkauth> restarts the original script
 213 (this time, C<&checkauth> returns).
 214
 215 The login page is provided using a HTML::Template, which is set in the
 216 systempreferences table or at the top of this file. The variable C<$type>
 217 selects which template to use, either the opac or the intranet
 218 authentification template.
 219
 220 C<&checkauth> returns a user ID, a cookie, and a session ID. The
 221 cookie should be sent back to the browser; it verifies that the user
 222 has authenticated.
 223
 224 =cut
 225
 226 sub checkauth {
 227     my $query = shift;
 228
 229 # $authnotrequired will be set for scripts which will run without authentication
 230     my $authnotrequired = shift;
 231     my $flagsrequired   = shift;
 232     my $type            = shift;
 233     $type = 'intranet' unless $type;
 234
 235     my $dbh = C4::Context->dbh();
 236     my $template_name;
 237     $template_name = "installer/auth.tmpl";
 238
 239     # state variables
 240     my $loggedin = 0;
 241     my %info;
 242     my ( $userid, $cookie, $sessionID, $flags, $envcookie );
 243     my $logout = $query->param('logout.x');
 244     if ( $sessionID = $query->cookie("CGISESSID") ) {
 245         C4::Context->_new_userenv($sessionID);
 246         my $session =
 247           new CGI::Session( "driver:File;serializer:yaml", $sessionID,
 248             { Directory => '/tmp' } );
 249         if ( $session->param('cardnumber') ) {
 250             C4::Context::set_userenv(
 251                 $session->param('number'),
 252                 $session->param('id'),
 253                 $session->param('cardnumber'),
 254                 $session->param('firstname'),
 255                 $session->param('surname'),
 256                 $session->param('branch'),
 257                 $session->param('branchname'),
 258                 $session->param('flags'),
 259                 $session->param('emailaddress'),
 260                 $session->param('branchprinter')
 261             );
 262             $cookie = $query->cookie(
 263                 -name     => 'CGISESSID',
 264                 -value    => $session->id,
 265                 -HttpOnly => 1,
 266             );
 267             $loggedin = 1;
 268             $userid   = $session->param('cardnumber');
 269         }
 270         my ( $ip, $lasttime );
 271
 272         if ($logout) {
 273
 274             # voluntary logout the user
 275             C4::Context->_unset_userenv($sessionID);
 276             $sessionID = undef;
 277             $userid    = undef;
 278            # Commented out due to its lack of usefulness
 279            # open L, ">>/tmp/sessionlog";
 280            # my $time = localtime( time() );
 281            # printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
 282            #   $ip, $time;
 283            # close L;
 284         }
 285     }
 286     unless ($userid) {
 287         my $session =
 288           new CGI::Session( "driver:File;serializer:yaml", undef, { Directory => '/tmp' } );
 289         $sessionID = $session->id;
 290         $userid    = $query->param('userid');
 291         C4::Context->_new_userenv($sessionID);
 292         my $password = $query->param('password');
 293         C4::Context->_new_userenv($sessionID);
 294         my ( $return, $cardnumber ) = checkpw( $userid, $password );
 295         if ($return) {
 296             $loggedin = 1;
 297             # open L, ">>/tmp/sessionlog";
 298             # my $time = localtime( time() );
 299             # printf L "%20s from %16s logged in  at %30s.\n", $userid,
 300             #  $ENV{'REMOTE_ADDR'}, $time;
 301             # close L;
 302             $cookie = $query->cookie(
 303                 -name     => 'CGISESSID',
 304                 -value    => $sessionID,
 305                 -HttpOnly => 1,
 306             );
 307             if ( $return == 2 ) {
 308
 309            #Only superlibrarian should have access to this page.
 310            #Since if it is a user, it is supposed that there is a borrower table
 311            #And thus that data structure is loaded.
 312                 my $hash = C4::Context::set_userenv(
 313                     0,                           0,
 314                     C4::Context->config('user'), C4::Context->config('user'),
 315                     C4::Context->config('user'), "",
 316                     "NO_LIBRARY_SET",            1,
 317                     ""
 318                 );
 319                 $session->param( 'number',     0 );
 320                 $session->param( 'id',         C4::Context->config('user') );
 321                 $session->param( 'cardnumber', C4::Context->config('user') );
 322                 $session->param( 'firstname',  C4::Context->config('user') );
 323                 $session->param( 'surname',    C4::Context->config('user'), );
 324                 $session->param( 'branch',     'NO_LIBRARY_SET' );
 325                 $session->param( 'branchname', 'NO_LIBRARY_SET' );
 326                 $session->param( 'flags',      1 );
 327                 $session->param( 'emailaddress',
 328                     C4::Context->preference('KohaAdminEmailAddress') );
 329                 $session->param( 'ip',       $session->remote_addr() );
 330                 $session->param( 'lasttime', time() );
 331                 $userid = C4::Context->config('user');
 332             }
 333         }
 334         else {
 335             if ($userid) {
 336                 $info{'invalid_username_or_password'} = 1;
 337                 C4::Context->_unset_userenv($sessionID);
 338             }
 339         }
 340     }
 341
 342     # finished authentification, now respond
 343     if ($loggedin) {
 344
 345         # successful login
 346         unless ($cookie) {
 347             $cookie = $query->cookie(
 348                 -name    => 'CGISESSID',
 349                 -value   => '',
 350                 -HttpOnly => 1,
 351                 -expires => ''
 352             );
 353         }
 354         if ($envcookie) {
 355             return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
 356         }
 357         else {
 358             return ( $userid, $cookie, $sessionID, $flags );
 359         }
 360     }
 361
 362     # else we have a problem...
 363     # get the inputs from the incoming query
 364     my @inputs = ();
 365     foreach my $name ( param $query) {
 366         (next) if ( $name eq 'userid' || $name eq 'password' );
 367         my $value = $query->param($name);
 368         push @inputs, { name => $name, value => $value };
 369     }
 370
 371     my $path =
 372       C4::Context->config('intrahtdocs') . "/prog/"
 373       . ( $query->param('language') ? $query->param('language') : "en" );
 374     my $filename = "$path/modules/$template_name";
 375     $filename =~ s/\.tmpl$/.tt/;
 376     my $interface = 'intranet';
 377     my $template = C4::Templates->new( $interface, $filename, '', $query);
 378     $template->param(
 379         INPUTS => \@inputs,
 380
 381     );
 382     $template->param( login => 1 );
 383     $template->param( loginprompt => 1 ) unless $info{'nopermission'};
 384
 385     my $self_url = $query->url( -absolute => 1 );
 386     $template->param( url => $self_url, );
 387     $template->param( \%info );
 388     $cookie = $query->cookie(
 389         -name    => 'CGISESSID',
 390         -value   => $sessionID,
 391         -HttpOnly => 1,
 392         -expires => ''
 393     );
 394     print $query->header(
 395         -type    => 'text/html; charset=utf-8',
 396         -cookie  => $cookie
 397       ),
 398       $template->output;
 399     exit;
 400 }
 401
 402 sub checkpw {
 403
 404     my ( $userid, $password ) = @_;
 405
 406     if (   $userid
 407         && $userid     eq C4::Context->config('user')
 408         && "$password" eq C4::Context->config('pass') )
 409     {
 410
 411         # Koha superuser account
 412         C4::Context->set_userenv(
 413             0, 0,
 414             C4::Context->config('user'),
 415             C4::Context->config('user'),
 416             C4::Context->config('user'),
 417             "", 1
 418         );
 419         return 2;
 420     }
 421     if (   $userid
 422         && $userid     eq 'demo'
 423         && "$password" eq 'demo'
 424         && C4::Context->config('demo') )
 425     {
 426
 427 # DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
 428 # some features won't be effective : modify systempref, modify MARC structure,
 429         return 2;
 430     }
 431     return 0;
 432 }
 433
 434 END { }    # module clean-up code here (global destructor)
 435 1;
 436 __END__
 437
 438 =back
 439
 440 =head1 SEE ALSO
 441
 442 CGI(3)
 443
 444 C4::Output(3)
 445
 446 Digest::MD5(3)
 447
 448 =cut