installer/InstallAuth.pm

   1 # -*- tab-width: 8 -*-
   2 # NOTE: This file uses 8-character tabs; do not change the tab size!
   3
   4 package InstallAuth;
   5
   6 # Copyright 2000-2002 Katipo Communications
   7 #
   8 # This file is part of Koha.
   9 #
  10 # Koha is free software; you can redistribute it and/or modify it under the
  11 # terms of the GNU General Public License as published by the Free Software
  12 # Foundation; either version 2 of the License, or (at your option) any later
  13 # version.
  14 #
  15 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
  16 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
  17 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License along with
  20 # Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
  21 # Suite 330, Boston, MA  02111-1307 USA
  22
  23 use strict;
  24 use Digest::MD5 qw(md5_base64);
  25
  26 require Exporter;
  27 use C4::Context;
  28 use C4::Output;
  29 use C4::Koha;
  30 use CGI::Session;
  31
  32 use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
  33
  34 # set the version for version checking
  35 $VERSION = 3.00;
  36
  37 =head1 NAME
  38
  39 InstallAuth - Authenticates Koha users for Install process
  40
  41 =head1 SYNOPSIS
  42
  43   use CGI;
  44   use InstallAuth;
  45
  46   my $query = new CGI;
  47
  48   my ($template, $borrowernumber, $cookie)
  49     = get_template_and_user({template_name   => "opac-main.tmpl",
  50                              query           => $query,
  51                              type            => "opac",
  52                              authnotrequired => 1,
  53                              flagsrequired   => {borrow => 1},
  54                           });
  55
  56   print $query->header(
  57     -type => 'utf-8',
  58     -cookie => $cookie
  59   ), $template->output;
  60
  61
  62 =head1 DESCRIPTION
  63
  64     The main function of this module is to provide
  65     authentification. However the get_template_and_user function has
  66     been provided so that a users login information is passed along
  67     automatically. This gets loaded into the template.
  68     This package is different from C4::Auth in so far as
  69     C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
  70
  71     As in C4::Auth, Authentication is based on cookies.
  72
  73 =head1 FUNCTIONS
  74
  75 =over 2
  76
  77 =cut
  78
  79 @ISA    = qw(Exporter);
  80 @EXPORT = qw(
  81   &checkauth
  82   &get_template_and_user
  83   &setlanguagecookie
  84 );
  85
  86 =item get_template_and_user
  87
  88   my ($template, $borrowernumber, $cookie)
  89     = get_template_and_user({template_name   => "opac-main.tmpl",
  90                              query           => $query,
  91                              type            => "opac",
  92                              authnotrequired => 1,
  93                              flagsrequired   => {borrow => 1},
  94                           });
  95
  96     This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
  97     to C<&checkauth> (in this module) to perform authentification.
  98     See C<&checkauth> for an explanation of these parameters.
  99
 100     The C<template_name> is then used to find the correct template for
 101     the page. The authenticated users details are loaded onto the
 102     template in the HTML::Template LOOP variable C<USER_INFO>. Also the
 103     C<sessionID> is passed to the template. This can be used in templates
 104     if cookies are disabled. It needs to be put as and input to every
 105     authenticated page.
 106
 107     More information on the C<gettemplate> sub can be found in the
 108     Output.pm module.
 109
 110 =cut
 111
 112 sub get_template_and_user {
 113     my $in       = shift;
 114     my $query    = $in->{'query'};
 115     my $language = $query->cookie('KohaOpacLanguage');
 116     my $path =
 117       C4::Context->config('intrahtdocs') . "/prog/"
 118       . ( $language ? $language : "en" );
 119     my $template = HTML::Template::Pro->new(
 120         filename          => "$path/modules/" . $in->{template_name},
 121         die_on_bad_params => 1,
 122         global_vars       => 1,
 123         case_sensitive    => 1,
 124         path              => ["$path/includes"]
 125     );
 126
 127     my ( $user, $cookie, $sessionID, $flags ) = checkauth(
 128         $in->{'query'},
 129         $in->{'authnotrequired'},
 130         $in->{'flagsrequired'},
 131         $in->{'type'}
 132     );
 133
 134     #     use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
 135
 136     my $borrowernumber;
 137     if ($user) {
 138         $template->param( loggedinusername => $user );
 139         $template->param( sessionID        => $sessionID );
 140
 141         # We are going to use the $flags returned by checkauth
 142         # to create the template's parameters that will indicate
 143         # which menus the user can access.
 144         if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
 145             $template->param( CAN_user_circulate        => 1 );
 146             $template->param( CAN_user_catalogue        => 1 );
 147             $template->param( CAN_user_parameters       => 1 );
 148             $template->param( CAN_user_borrowers        => 1 );
 149             $template->param( CAN_user_permission       => 1 );
 150             $template->param( CAN_user_reserveforothers => 1 );
 151             $template->param( CAN_user_borrow           => 1 );
 152             $template->param( CAN_user_editcatalogue    => 1 );
 153             $template->param( CAN_user_updatecharge     => 1 );
 154             $template->param( CAN_user_acquisition      => 1 );
 155             $template->param( CAN_user_management       => 1 );
 156             $template->param( CAN_user_tools            => 1 );
 157             $template->param( CAN_user_editauthorities  => 1 );
 158             $template->param( CAN_user_serials          => 1 );
 159             $template->param( CAN_user_reports          => 1 );
 160         }
 161     }
 162     return ( $template, $borrowernumber, $cookie );
 163 }
 164
 165 =item checkauth
 166
 167   ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
 168
 169 Verifies that the user is authorized to run this script.  If
 170 the user is authorized, a (userid, cookie, session-id, flags)
 171 quadruple is returned.  If the user is not authorized but does
 172 not have the required privilege (see $flagsrequired below), it
 173 displays an error page and exits.  Otherwise, it displays the
 174 login page and exits.
 175
 176 Note that C<&checkauth> will return if and only if the user
 177 is authorized, so it should be called early on, before any
 178 unfinished operations (e.g., if you've opened a file, then
 179 C<&checkauth> won't close it for you).
 180
 181 C<$query> is the CGI object for the script calling C<&checkauth>.
 182
 183 The C<$noauth> argument is optional. If it is set, then no
 184 authorization is required for the script.
 185
 186 C<&checkauth> fetches user and session information from C<$query> and
 187 ensures that the user is authorized to run scripts that require
 188 authorization.
 189
 190 The C<$flagsrequired> argument specifies the required privileges
 191 the user must have if the username and password are correct.
 192 It should be specified as a reference-to-hash; keys in the hash
 193 should be the "flags" for the user, as specified in the Members
 194 intranet module. Any key specified must correspond to a "flag"
 195 in the userflags table. E.g., { circulate => 1 } would specify
 196 that the user must have the "circulate" privilege in order to
 197 proceed. To make sure that access control is correct, the
 198 C<$flagsrequired> parameter must be specified correctly.
 199
 200 The C<$type> argument specifies whether the template should be
 201 retrieved from the opac or intranet directory tree.  "opac" is
 202 assumed if it is not specified; however, if C<$type> is specified,
 203 "intranet" is assumed if it is not "opac".
 204
 205 If C<$query> does not have a valid session ID associated with it
 206 (i.e., the user has not logged in) or if the session has expired,
 207 C<&checkauth> presents the user with a login page (from the point of
 208 view of the original script, C<&checkauth> does not return). Once the
 209 user has authenticated, C<&checkauth> restarts the original script
 210 (this time, C<&checkauth> returns).
 211
 212 The login page is provided using a HTML::Template, which is set in the
 213 systempreferences table or at the top of this file. The variable C<$type>
 214 selects which template to use, either the opac or the intranet
 215 authentification template.
 216
 217 C<&checkauth> returns a user ID, a cookie, and a session ID. The
 218 cookie should be sent back to the browser; it verifies that the user
 219 has authenticated.
 220
 221 =cut
 222
 223 sub checkauth {
 224     my $query = shift;
 225
 226 # $authnotrequired will be set for scripts which will run without authentication
 227     my $authnotrequired = shift;
 228     my $flagsrequired   = shift;
 229     my $type            = shift;
 230     $type = 'intranet' unless $type;
 231
 232     my $dbh = C4::Context->dbh();
 233     my $template_name;
 234     $template_name = "installer/auth.tmpl";
 235
 236     # state variables
 237     my $loggedin = 0;
 238     my %info;
 239     my ( $userid, $cookie, $sessionID, $flags, $envcookie );
 240     my $logout = $query->param('logout.x');
 241     if ( $sessionID = $query->cookie("CGISESSID") ) {
 242         C4::Context->_new_userenv($sessionID);
 243         my $session =
 244           new CGI::Session( "driver:File", $sessionID,
 245             { Directory => '/tmp' } );
 246         if ( $session->param('cardnumber') ) {
 247             C4::Context::set_userenv(
 248                 $session->param('number'),
 249                 $session->param('id'),
 250                 $session->param('cardnumber'),
 251                 $session->param('firstname'),
 252                 $session->param('surname'),
 253                 $session->param('branch'),
 254                 $session->param('branchname'),
 255                 $session->param('flags'),
 256                 $session->param('emailaddress'),
 257                 $session->param('branchprinter')
 258             );
 259             $cookie   = $query->cookie( CGISESSID => $session->id );
 260             $loggedin = 1;
 261             $userid   = $session->param('cardnumber');
 262         }
 263         my ( $ip, $lasttime );
 264
 265         if ($logout) {
 266
 267             # voluntary logout the user
 268             C4::Context->_unset_userenv($sessionID);
 269             $sessionID = undef;
 270             $userid    = undef;
 271             open L, ">>/tmp/sessionlog";
 272             my $time = localtime( time() );
 273             printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
 274               $ip, $time;
 275             close L;
 276         }
 277     }
 278     unless ($userid) {
 279         my $session =
 280           new CGI::Session( "driver:File", undef, { Directory => '/tmp' } );
 281         $sessionID = $session->id;
 282         $userid    = $query->param('userid');
 283         C4::Context->_new_userenv($sessionID);
 284         my $password = $query->param('password');
 285         C4::Context->_new_userenv($sessionID);
 286         my ( $return, $cardnumber ) = checkpw( $userid, $password );
 287         if ($return) {
 288             $loggedin = 1;
 289             open L, ">>/tmp/sessionlog";
 290             my $time = localtime( time() );
 291             printf L "%20s from %16s logged in  at %30s.\n", $userid,
 292               $ENV{'REMOTE_ADDR'}, $time;
 293             close L;
 294             $cookie = $query->cookie( CGISESSID => $sessionID );
 295             if ( $return == 2 ) {
 296
 297            #Only superlibrarian should have access to this page.
 298            #Since if it is a user, it is supposed that there is a borrower table
 299            #And thus that data structure is loaded.
 300                 my $hash = C4::Context::set_userenv(
 301                     0,                           0,
 302                     C4::Context->config('user'), C4::Context->config('user'),
 303                     C4::Context->config('user'), "",
 304                     "NO_LIBRARY_SET",            1,
 305                     ""
 306                 );
 307                 $session->param( 'number',     0 );
 308                 $session->param( 'id',         C4::Context->config('user') );
 309                 $session->param( 'cardnumber', C4::Context->config('user') );
 310                 $session->param( 'firstname',  C4::Context->config('user') );
 311                 $session->param( 'surname',    C4::Context->config('user'), );
 312                 $session->param( 'branch',     'NO_LIBRARY_SET' );
 313                 $session->param( 'branchname', 'NO_LIBRARY_SET' );
 314                 $session->param( 'flags',      1 );
 315                 $session->param( 'emailaddress',
 316                     C4::Context->preference('KohaAdminEmailAddress') );
 317                 $session->param( 'ip',       $session->remote_addr() );
 318                 $session->param( 'lasttime', time() );
 319                 $userid = C4::Context->config('user');
 320             }
 321         }
 322         else {
 323             if ($userid) {
 324                 $info{'invalid_username_or_password'} = 1;
 325                 C4::Context->_unset_userenv($sessionID);
 326             }
 327         }
 328     }
 329
 330     # finished authentification, now respond
 331     if ($loggedin) {
 332
 333         # successful login
 334         unless ($cookie) {
 335             $cookie = $query->cookie(
 336                 -name    => 'CGISESSID',
 337                 -value   => '',
 338                 -expires => ''
 339             );
 340         }
 341         if ($envcookie) {
 342             return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
 343         }
 344         else {
 345             return ( $userid, $cookie, $sessionID, $flags );
 346         }
 347     }
 348
 349     # else we have a problem...
 350     # get the inputs from the incoming query
 351     my @inputs = ();
 352     foreach my $name ( param $query) {
 353         (next) if ( $name eq 'userid' || $name eq 'password' );
 354         my $value = $query->param($name);
 355         push @inputs, { name => $name, value => $value };
 356     }
 357
 358     my $path =
 359       C4::Context->config('intrahtdocs') . "/prog/"
 360       . ( $query->param('language') ? $query->param('language') : "en" );
 361     my $template = HTML::Template::Pro->new(
 362         filename          => "$path/modules/$template_name",
 363         die_on_bad_params => 1,
 364         global_vars       => 1,
 365         case_sensitive    => 1,
 366         path              => ["$path/includes"]
 367     );
 368     $template->param(
 369         INPUTS => \@inputs,
 370
 371     );
 372     $template->param( login => 1 );
 373     $template->param( loginprompt => 1 ) unless $info{'nopermission'};
 374
 375     my $self_url = $query->url( -absolute => 1 );
 376     $template->param( url => $self_url, );
 377     $template->param( \%info );
 378     $cookie = $query->cookie(
 379         -name    => 'CGISESSID',
 380         -value   => $sessionID,
 381         -expires => ''
 382     );
 383     print $query->header(
 384         -type    => 'text/html; charset=utf-8',
 385         -cookie  => $cookie
 386       ),
 387       $template->output;
 388     exit;
 389 }
 390
 391 sub checkpw {
 392
 393     my ( $userid, $password ) = @_;
 394
 395     if (   $userid
 396         && $userid     eq C4::Context->config('user')
 397         && "$password" eq C4::Context->config('pass') )
 398     {
 399
 400         # Koha superuser account
 401         C4::Context->set_userenv(
 402             0, 0,
 403             C4::Context->config('user'),
 404             C4::Context->config('user'),
 405             C4::Context->config('user'),
 406             "", 1
 407         );
 408         return 2;
 409     }
 410     if (   $userid
 411         && $userid     eq 'demo'
 412         && "$password" eq 'demo'
 413         && C4::Context->config('demo') )
 414     {
 415
 416 # DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
 417 # some features won't be effective : modify systempref, modify MARC structure,
 418         return 2;
 419     }
 420     return 0;
 421 }
 422
 423 END { }    # module clean-up code here (global destructor)
 424 1;
 425 __END__
 426
 427 =back
 428
 429 =head1 SEE ALSO
 430
 431 CGI(3)
 432
 433 C4::Output(3)
 434
 435 Digest::MD5(3)
 436
 437 =cut