Bug 20892: Correct basketgroup link in histsearch.pl
[koha.git] / C4 / InstallAuth.pm
blob500d740c967bb69fb109f0bf1eaa40ad37e0ac83
1 package C4::InstallAuth;
3 # Copyright 2000-2002 Katipo Communications
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use strict;
21 #use warnings; FIXME - Bug 2505
22 use Digest::MD5 qw(md5_base64);
23 use File::Spec;
25 require Exporter;
26 use C4::Context;
27 use C4::Output;
28 use C4::Templates;
29 use C4::Koha;
30 use CGI::Session;
32 use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
35 =head1 NAME
37 InstallAuth - Authenticates Koha users for Install process
39 =head1 SYNOPSIS
41 use CGI qw ( -utf8 );
42 use InstallAuth;
43 use C4::Output;
45 my $query = new CGI;
47 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
48 { template_name => "opac-main.tt",
49 query => $query,
50 type => "opac",
51 authnotrequired => 1,
52 flagsrequired => { acquisition => '*' },
56 output_html_with_http_headers $query, $cookie, $template->output;
58 =head1 DESCRIPTION
60 The main function of this module is to provide
61 authentification. However the get_template_and_user function has
62 been provided so that a users login information is passed along
63 automatically. This gets loaded into the template.
64 This package is different from C4::Auth in so far as
65 C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
67 As in C4::Auth, Authentication is based on cookies.
69 =head1 FUNCTIONS
71 =over 2
73 =cut
75 @ISA = qw(Exporter);
76 @EXPORT = qw(
77 &checkauth
78 &get_template_and_user
81 =item get_template_and_user
83 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
84 { template_name => "opac-main.tt",
85 query => $query,
86 type => "opac",
87 authnotrequired => 1,
88 flagsrequired => { acquisition => '*' },
92 This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
93 to C<&checkauth> (in this module) to perform authentification.
94 See C<&checkauth> for an explanation of these parameters.
96 The C<template_name> is then used to find the correct template for
97 the page. The authenticated users details are loaded onto the
98 template in the HTML::Template LOOP variable C<USER_INFO>. Also the
99 C<sessionID> is passed to the template. This can be used in templates
100 if cookies are disabled. It needs to be put as and input to every
101 authenticated page.
103 More information on the C<gettemplate> sub can be found in the
104 Templates.pm module.
106 =cut
108 sub get_template_and_user {
109 my $in = shift;
110 my $query = $in->{'query'};
111 my $language =_get_template_language($query->cookie('KohaOpacLanguage'));
112 my $path = C4::Context->config('intrahtdocs'). "/prog/". $language;
114 my $tmplbase = $in->{template_name};
115 my $filename = "$path/modules/" . $tmplbase;
116 my $interface = 'intranet';
117 my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query);
119 my ( $user, $cookie, $sessionID, $flags ) = checkauth(
120 $in->{'query'},
121 $in->{'authnotrequired'},
122 $in->{'flagsrequired'},
123 $in->{'type'}
126 # use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
128 my $borrowernumber;
129 if ($user) {
130 $template->param( loggedinusername => $user );
131 $template->param( sessionID => $sessionID );
133 # We are going to use the $flags returned by checkauth
134 # to create the template's parameters that will indicate
135 # which menus the user can access.
136 if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
137 $template->param( CAN_user_circulate => 1 );
138 $template->param( CAN_user_catalogue => 1 );
139 $template->param( CAN_user_parameters => 1 );
140 $template->param( CAN_user_borrowers => 1 );
141 $template->param( CAN_user_permission => 1 );
142 $template->param( CAN_user_reserveforothers => 1 );
143 $template->param( CAN_user_editcatalogue => 1 );
144 $template->param( CAN_user_updatecharges => 1 );
145 $template->param( CAN_user_acquisition => 1 );
146 $template->param( CAN_user_tools => 1 );
147 $template->param( CAN_user_editauthorities => 1 );
148 $template->param( CAN_user_serials => 1 );
149 $template->param( CAN_user_reports => 1 );
152 my $minPasswordLength = C4::Context->preference('minPasswordLength');
153 $minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;
154 $template->param(minPasswordLength => $minPasswordLength,);
156 return ( $template, $borrowernumber, $cookie );
159 sub _get_template_language {
161 #verify if opac language exists in staff (bug 5660)
162 #conditions are 1) dir exists and 2) enabled in prefs
163 my ($opaclang) = @_;
164 return 'en' unless $opaclang;
165 $opaclang =~ s/[^a-zA-Z_-]*//g;
166 my $path = C4::Context->config('intrahtdocs') . "/prog/$opaclang";
167 -d $path ? $opaclang : 'en';
170 =item checkauth
172 ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
174 Verifies that the user is authorized to run this script. If
175 the user is authorized, a (userid, cookie, session-id, flags)
176 quadruple is returned. If the user is not authorized but does
177 not have the required privilege (see $flagsrequired below), it
178 displays an error page and exits. Otherwise, it displays the
179 login page and exits.
181 Note that C<&checkauth> will return if and only if the user
182 is authorized, so it should be called early on, before any
183 unfinished operations (e.g., if you've opened a file, then
184 C<&checkauth> won't close it for you).
186 C<$query> is the CGI object for the script calling C<&checkauth>.
188 The C<$noauth> argument is optional. If it is set, then no
189 authorization is required for the script.
191 C<&checkauth> fetches user and session information from C<$query> and
192 ensures that the user is authorized to run scripts that require
193 authorization.
195 The C<$flagsrequired> argument specifies the required privileges
196 the user must have if the username and password are correct.
197 It should be specified as a reference-to-hash; keys in the hash
198 should be the "flags" for the user, as specified in the Members
199 intranet module. Any key specified must correspond to a "flag"
200 in the userflags table. E.g., { circulate => 1 } would specify
201 that the user must have the "circulate" privilege in order to
202 proceed. To make sure that access control is correct, the
203 C<$flagsrequired> parameter must be specified correctly.
205 The C<$type> argument specifies whether the template should be
206 retrieved from the opac or intranet directory tree. "opac" is
207 assumed if it is not specified; however, if C<$type> is specified,
208 "intranet" is assumed if it is not "opac".
210 If C<$query> does not have a valid session ID associated with it
211 (i.e., the user has not logged in) or if the session has expired,
212 C<&checkauth> presents the user with a login page (from the point of
213 view of the original script, C<&checkauth> does not return). Once the
214 user has authenticated, C<&checkauth> restarts the original script
215 (this time, C<&checkauth> returns).
217 The login page is provided using a HTML::Template, which is set in the
218 systempreferences table or at the top of this file. The variable C<$type>
219 selects which template to use, either the opac or the intranet
220 authentification template.
222 C<&checkauth> returns a user ID, a cookie, and a session ID. The
223 cookie should be sent back to the browser; it verifies that the user
224 has authenticated.
226 =cut
228 sub checkauth {
229 my $query = shift;
231 # $authnotrequired will be set for scripts which will run without authentication
232 my $authnotrequired = shift;
233 my $flagsrequired = shift;
234 my $type = shift;
235 $type = 'intranet' unless $type;
237 my $dbh = C4::Context->dbh();
238 my $template_name;
239 $template_name = "installer/auth.tt";
240 my $sessdir = File::Spec->catdir( File::Spec->tmpdir, 'cgisess_' . C4::Context->config('database') ); # same construction as in C4/Auth
242 # state variables
243 my $loggedin = 0;
244 my %info;
245 my ( $userid, $cookie, $sessionID, $flags, $envcookie );
246 my $logout = $query->param('logout.x');
247 if ( $sessionID = $query->cookie("CGISESSID") ) {
248 C4::Context->_new_userenv($sessionID);
249 my $session =
250 new CGI::Session( "driver:File;serializer:yaml", $sessionID,
251 { Directory => $sessdir } );
252 if ( $session->param('cardnumber') ) {
253 C4::Context->set_userenv(
254 $session->param('number'),
255 $session->param('id'),
256 $session->param('cardnumber'),
257 $session->param('firstname'),
258 $session->param('surname'),
259 $session->param('branch'),
260 $session->param('branchname'),
261 $session->param('flags'),
262 $session->param('emailaddress'),
263 $session->param('branchprinter')
265 $cookie = $query->cookie(
266 -name => 'CGISESSID',
267 -value => $session->id,
268 -HttpOnly => 1,
270 $loggedin = 1;
271 $userid = $session->param('cardnumber');
273 my ( $ip, $lasttime );
275 if ($logout) {
277 # voluntary logout the user
278 C4::Context->_unset_userenv($sessionID);
279 $sessionID = undef;
280 $userid = undef;
281 # Commented out due to its lack of usefulness
282 # open L, ">>/tmp/sessionlog";
283 # my $time = localtime( time() );
284 # printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
285 # $ip, $time;
286 # close L;
289 unless ($userid) {
290 my $session =
291 new CGI::Session( "driver:File;serializer:yaml", undef, { Directory => $sessdir } );
292 $sessionID = $session->id;
293 $userid = $query->param('userid');
294 C4::Context->_new_userenv($sessionID);
295 my $password = $query->param('password');
296 C4::Context->_new_userenv($sessionID);
297 my ( $return, $cardnumber ) = checkpw( $userid, $password );
298 if ($return) {
299 $loggedin = 1;
300 # open L, ">>/tmp/sessionlog";
301 # my $time = localtime( time() );
302 # printf L "%20s from %16s logged in at %30s.\n", $userid,
303 # $ENV{'REMOTE_ADDR'}, $time;
304 # close L;
305 $cookie = $query->cookie(
306 -name => 'CGISESSID',
307 -value => $sessionID,
308 -HttpOnly => 1,
310 if ( $return == 2 ) {
312 #Only superlibrarian should have access to this page.
313 #Since if it is a user, it is supposed that there is a borrower table
314 #And thus that data structure is loaded.
315 my $hash = C4::Context->set_userenv(
316 0, 0,
317 C4::Context->config('user'), C4::Context->config('user'),
318 C4::Context->config('user'), "",
319 "NO_LIBRARY_SET", 1,
322 $session->param( 'number', 0 );
323 $session->param( 'id', C4::Context->config('user') );
324 $session->param( 'cardnumber', C4::Context->config('user') );
325 $session->param( 'firstname', C4::Context->config('user') );
326 $session->param( 'surname', C4::Context->config('user'), );
327 $session->param( 'branch', 'NO_LIBRARY_SET' );
328 $session->param( 'branchname', 'NO_LIBRARY_SET' );
329 $session->param( 'flags', 1 );
330 $session->param( 'emailaddress',
331 C4::Context->preference('KohaAdminEmailAddress') );
332 $session->param( 'ip', $session->remote_addr() );
333 $session->param( 'lasttime', time() );
334 $userid = C4::Context->config('user');
337 else {
338 if ($userid) {
339 $info{'invalid_username_or_password'} = 1;
340 C4::Context->_unset_userenv($sessionID);
345 # finished authentification, now respond
346 if ($loggedin) {
348 # successful login
349 unless ($cookie) {
350 $cookie = $query->cookie(
351 -name => 'CGISESSID',
352 -value => '',
353 -HttpOnly => 1,
354 -expires => ''
357 if ($envcookie) {
358 return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
360 else {
361 return ( $userid, $cookie, $sessionID, $flags );
365 # else we have a problem...
366 # get the inputs from the incoming query
367 my @inputs = ();
368 foreach my $name ( param $query) {
369 (next) if ( $name eq 'userid' || $name eq 'password' );
370 my $value = $query->param($name);
371 push @inputs, { name => $name, value => $value };
374 my $path =
375 C4::Context->config('intrahtdocs') . "/prog/"
376 . ( $query->param('language') ? $query->param('language') : "en" );
377 my $filename = "$path/modules/$template_name";
378 my $interface = 'intranet';
379 my $template = C4::Templates->new( $interface, $filename, '', $query);
380 $template->param(
381 INPUTS => \@inputs,
384 $template->param( login => 1 );
385 $template->param( loginprompt => 1 ) unless $info{'nopermission'};
387 if ($info{'invalid_username_or_password'} == 1) {
388 $template->param( 'invalid_username_or_password' => $info{'invalid_username_or_password'});
391 $template->param( \%info );
392 $cookie = $query->cookie(
393 -name => 'CGISESSID',
394 -value => $sessionID,
395 -HttpOnly => 1,
396 -expires => ''
398 print $query->header(
399 -type => 'text/html; charset=utf-8',
400 -cookie => $cookie
402 $template->output;
403 exit;
406 sub checkpw {
408 my ( $userid, $password ) = @_;
410 if ( $userid
411 && $userid eq C4::Context->config('user')
412 && "$password" eq C4::Context->config('pass') )
415 # Koha superuser account
416 C4::Context->set_userenv(
417 0, 0,
418 C4::Context->config('user'),
419 C4::Context->config('user'),
420 C4::Context->config('user'),
421 "", "NO_LIBRARY_SET", 1
423 return 2;
425 return 0;
428 END { } # module clean-up code here (global destructor)
430 __END__
432 =back
434 =head1 SEE ALSO
436 CGI(3)
438 C4::Output(3)
440 Digest::MD5(3)
442 =cut