C4/InstallAuth.pm

   1 package C4::InstallAuth;
   2
   3 # Copyright 2000-2002 Katipo Communications
   4 #
   5 # This file is part of Koha.
   6 #
   7 # Koha is free software; you can redistribute it and/or modify it
   8 # under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 3 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # Koha is distributed in the hope that it will be useful, but
  13 # WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
  19
  20 use Modern::Perl;
  21 use Digest::MD5 qw(md5_base64);
  22 use CGI::Session;
  23 use File::Spec;
  24
  25 require Exporter;
  26
  27 use C4::Context;
  28 use C4::Output;
  29 use C4::Templates;
  30 use C4::Koha;
  31
  32 use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
  33
  34 @ISA    = qw(Exporter);
  35 @EXPORT = qw(
  36   &checkauth
  37   &get_template_and_user
  38 );
  39
  40 =head1 NAME
  41
  42 InstallAuth - Authenticates Koha users for Install process
  43
  44 =head1 SYNOPSIS
  45
  46   use CGI qw ( -utf8 );
  47   use InstallAuth;
  48   use C4::Output;
  49
  50   my $query = new CGI;
  51
  52     my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
  53         {   template_name   => "opac-main.tt",
  54             query           => $query,
  55             type            => "opac",
  56             authnotrequired => 1,
  57             flagsrequired   => { acquisition => '*' },
  58         }
  59     );
  60
  61   output_html_with_http_headers $query, $cookie, $template->output;
  62
  63 =head1 DESCRIPTION
  64
  65 The main function of this module is to provide
  66 authentification. However the get_template_and_user function has
  67 been provided so that a users login information is passed along
  68 automatically. This gets loaded into the template.
  69 This package is different from C4::Auth in so far as
  70 C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
  71
  72 As in C4::Auth, Authentication is based on cookies.
  73
  74 =head1 FUNCTIONS
  75
  76 =head2 get_template_and_user
  77
  78     my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
  79         {   template_name   => "opac-main.tt",
  80             query           => $query,
  81             type            => "opac",
  82             authnotrequired => 1,
  83             flagsrequired   => { acquisition => '*' },
  84         }
  85     );
  86
  87 This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
  88 to C<&checkauth> (in this module) to perform authentification.
  89 See C<&checkauth> for an explanation of these parameters.
  90
  91 The C<template_name> is then used to find the correct template for
  92 the page. The authenticated users details are loaded onto the
  93 template in the logged_in_user variable (which is a Koha::Patron object). Also the
  94 C<sessionID> is passed to the template. This can be used in templates
  95 if cookies are disabled. It needs to be put as and input to every
  96 authenticated page.
  97
  98 More information on the C<gettemplate> sub can be found in the
  99 Templates.pm module.
 100
 101 =cut
 102
 103 sub get_template_and_user {
 104     my $in       = shift;
 105     my $query    = $in->{'query'};
 106     my $language =_get_template_language($query->cookie('KohaOpacLanguage'));
 107     my $path     = C4::Context->config('intrahtdocs'). "/prog/". $language;
 108
 109     my $tmplbase = $in->{template_name};
 110     my $filename = "$path/modules/" . $tmplbase;
 111     my $interface = 'intranet';
 112     my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query);
 113
 114     my ( $user, $cookie, $sessionID, $flags ) = checkauth(
 115         $in->{'query'},
 116         $in->{'authnotrequired'},
 117         $in->{'flagsrequired'},
 118         $in->{'type'}
 119     );
 120
 121     #     use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
 122
 123     my $borrowernumber;
 124     if ($user) {
 125         $template->param( loggedinusername => $user );
 126         $template->param( sessionID        => $sessionID );
 127
 128         # We are going to use the $flags returned by checkauth
 129         # to create the template's parameters that will indicate
 130         # which menus the user can access.
 131         if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
 132             $template->param( CAN_user_circulate        => 1 );
 133             $template->param( CAN_user_catalogue        => 1 );
 134             $template->param( CAN_user_parameters       => 1 );
 135             $template->param( CAN_user_borrowers        => 1 );
 136             $template->param( CAN_user_permission       => 1 );
 137             $template->param( CAN_user_reserveforothers => 1 );
 138             $template->param( CAN_user_editcatalogue    => 1 );
 139             $template->param( CAN_user_updatecharges    => 1 );
 140             $template->param( CAN_user_acquisition      => 1 );
 141             $template->param( CAN_user_tools            => 1 );
 142             $template->param( CAN_user_editauthorities  => 1 );
 143             $template->param( CAN_user_serials          => 1 );
 144             $template->param( CAN_user_reports          => 1 );
 145             $template->param( CAN_user_problem_reports   => 1 );
 146         }
 147
 148         my $minPasswordLength = C4::Context->preference('minPasswordLength');
 149         $minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;
 150         $template->param(minPasswordLength => $minPasswordLength,);
 151     }
 152     return ( $template, $borrowernumber, $cookie );
 153 }
 154
 155 sub _get_template_language {
 156
 157     #verify if opac language exists in staff (bug 5660)
 158     #conditions are 1) dir exists and 2) enabled in prefs
 159     my ($opaclang) = @_;
 160     return 'en' unless $opaclang;
 161     $opaclang =~ s/[^a-zA-Z_-]*//g;
 162     my $path = C4::Context->config('intrahtdocs') . "/prog/$opaclang";
 163     -d $path ? $opaclang : 'en';
 164 }
 165
 166 =head2 checkauth
 167
 168   ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
 169
 170 Verifies that the user is authorized to run this script.  If
 171 the user is authorized, a (userid, cookie, session-id, flags)
 172 quadruple is returned.  If the user is not authorized but does
 173 not have the required privilege (see $flagsrequired below), it
 174 displays an error page and exits.  Otherwise, it displays the
 175 login page and exits.
 176
 177 Note that C<&checkauth> will return if and only if the user
 178 is authorized, so it should be called early on, before any
 179 unfinished operations (e.g., if you've opened a file, then
 180 C<&checkauth> won't close it for you).
 181
 182 C<$query> is the CGI object for the script calling C<&checkauth>.
 183
 184 The C<$noauth> argument is optional. If it is set, then no
 185 authorization is required for the script.
 186
 187 C<&checkauth> fetches user and session information from C<$query> and
 188 ensures that the user is authorized to run scripts that require
 189 authorization.
 190
 191 The C<$flagsrequired> argument specifies the required privileges
 192 the user must have if the username and password are correct.
 193 It should be specified as a reference-to-hash; keys in the hash
 194 should be the "flags" for the user, as specified in the Members
 195 intranet module. Any key specified must correspond to a "flag"
 196 in the userflags table. E.g., { circulate => 1 } would specify
 197 that the user must have the "circulate" privilege in order to
 198 proceed. To make sure that access control is correct, the
 199 C<$flagsrequired> parameter must be specified correctly.
 200
 201 The C<$type> argument specifies whether the template should be
 202 retrieved from the opac or intranet directory tree.  "opac" is
 203 assumed if it is not specified; however, if C<$type> is specified,
 204 "intranet" is assumed if it is not "opac".
 205
 206 If C<$query> does not have a valid session ID associated with it
 207 (i.e., the user has not logged in) or if the session has expired,
 208 C<&checkauth> presents the user with a login page (from the point of
 209 view of the original script, C<&checkauth> does not return). Once the
 210 user has authenticated, C<&checkauth> restarts the original script
 211 (this time, C<&checkauth> returns).
 212
 213 The login page is provided using a HTML::Template, which is set in the
 214 systempreferences table or at the top of this file. The variable C<$type>
 215 selects which template to use, either the opac or the intranet
 216 authentification template.
 217
 218 C<&checkauth> returns a user ID, a cookie, and a session ID. The
 219 cookie should be sent back to the browser; it verifies that the user
 220 has authenticated.
 221
 222 =cut
 223
 224 sub checkauth {
 225     my $query = shift;
 226
 227 # $authnotrequired will be set for scripts which will run without authentication
 228     my $authnotrequired = shift;
 229     my $flagsrequired   = shift;
 230     my $type            = shift;
 231     $type = 'intranet' unless $type;
 232
 233     my $dbh = C4::Context->dbh();
 234     my $template_name;
 235     $template_name = "installer/auth.tt";
 236     my $sessdir = File::Spec->catdir( C4::Context::temporary_directory, 'cgisess_' . C4::Context->config('database') ); # same construction as in C4/Auth
 237
 238     # state variables
 239     my $loggedin = 0;
 240     my %info;
 241     my ( $userid, $cookie, $sessionID, $flags, $envcookie );
 242     my $logout = $query->param('logout.x');
 243     if ( $sessionID = $query->cookie("CGISESSID") ) {
 244         C4::Context->_new_userenv($sessionID);
 245         my $session =
 246           new CGI::Session( "driver:File;serializer:yaml", $sessionID,
 247             { Directory => $sessdir } );
 248         if ( $session->param('cardnumber') ) {
 249             C4::Context->set_userenv(
 250                 $session->param('number'),
 251                 $session->param('id'),
 252                 $session->param('cardnumber'),
 253                 $session->param('firstname'),
 254                 $session->param('surname'),
 255                 $session->param('branch'),
 256                 $session->param('branchname'),
 257                 $session->param('flags'),
 258                 $session->param('emailaddress')
 259             );
 260             $cookie = $query->cookie(
 261                 -name     => 'CGISESSID',
 262                 -value    => $session->id,
 263                 -HttpOnly => 1,
 264                 -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
 265             );
 266             $loggedin = 1;
 267             $userid   = $session->param('cardnumber');
 268         }
 269
 270         if ($logout) {
 271
 272             # voluntary logout the user
 273             C4::Context->_unset_userenv($sessionID);
 274             $sessionID = undef;
 275             $userid    = undef;
 276            # Commented out due to its lack of usefulness
 277            # open L, ">>/tmp/sessionlog";
 278            # my $time = localtime( time() );
 279            # printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
 280            #   $ip, $time;
 281            # close L;
 282         }
 283     }
 284     unless ($userid) {
 285         my $session =
 286           new CGI::Session( "driver:File;serializer:yaml", undef, { Directory => $sessdir } );
 287         $sessionID = $session->id;
 288         $userid    = $query->param('userid');
 289         C4::Context->_new_userenv($sessionID);
 290         my $password = $query->param('password');
 291         C4::Context->_new_userenv($sessionID);
 292         my ( $return, $cardnumber ) = checkpw( $userid, $password );
 293         if ($return) {
 294             $loggedin = 1;
 295             # open L, ">>/tmp/sessionlog";
 296             # my $time = localtime( time() );
 297             # printf L "%20s from %16s logged in  at %30s.\n", $userid,
 298             #  $ENV{'REMOTE_ADDR'}, $time;
 299             # close L;
 300             $cookie = $query->cookie(
 301                 -name     => 'CGISESSID',
 302                 -value    => $sessionID,
 303                 -HttpOnly => 1,
 304                 -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
 305             );
 306             if ( $return == 2 ) {
 307
 308            #Only superlibrarian should have access to this page.
 309            #Since if it is a user, it is supposed that there is a borrower table
 310            #And thus that data structure is loaded.
 311                 my $hash = C4::Context->set_userenv(
 312                     0,                           0,
 313                     C4::Context->config('user'), C4::Context->config('user'),
 314                     C4::Context->config('user'), "",
 315                     "NO_LIBRARY_SET",            1,
 316                     ""
 317                 );
 318                 $session->param( 'number',     0 );
 319                 $session->param( 'id',         C4::Context->config('user') );
 320                 $session->param( 'cardnumber', C4::Context->config('user') );
 321                 $session->param( 'firstname',  C4::Context->config('user') );
 322                 $session->param( 'surname',    C4::Context->config('user'), );
 323                 $session->param( 'branch',     'NO_LIBRARY_SET' );
 324                 $session->param( 'branchname', 'NO_LIBRARY_SET' );
 325                 $session->param( 'flags',      1 );
 326                 $session->param( 'emailaddress',
 327                     C4::Context->preference('KohaAdminEmailAddress') );
 328                 $session->param( 'ip',       $session->remote_addr() );
 329                 $session->param( 'lasttime', time() );
 330                 $userid = C4::Context->config('user');
 331             }
 332         }
 333         else {
 334             if ($userid) {
 335                 $info{'invalid_username_or_password'} = 1;
 336                 C4::Context->_unset_userenv($sessionID);
 337             }
 338         }
 339     }
 340
 341     # finished authentification, now respond
 342     if ($loggedin) {
 343
 344         # successful login
 345         unless ($cookie) {
 346             $cookie = $query->cookie(
 347                 -name    => 'CGISESSID',
 348                 -value   => '',
 349                 -HttpOnly => 1,
 350                 -expires => '',
 351                 -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
 352             );
 353         }
 354         if ($envcookie) {
 355             return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
 356         }
 357         else {
 358             return ( $userid, $cookie, $sessionID, $flags );
 359         }
 360     }
 361
 362     # else we have a problem...
 363     # get the inputs from the incoming query
 364     my @inputs = ();
 365     foreach my $name ( param $query) {
 366         (next) if ( $name eq 'userid' || $name eq 'password' );
 367         my $value = $query->param($name);
 368         push @inputs, { name => $name, value => $value };
 369     }
 370
 371     my $path =
 372       C4::Context->config('intrahtdocs') . "/prog/"
 373       . ( $query->param('language') ? $query->param('language') : "en" );
 374     my $filename = "$path/modules/$template_name";
 375     my $interface = 'intranet';
 376     my $template = C4::Templates->new( $interface, $filename, '', $query);
 377     $template->param(
 378         INPUTS => \@inputs,
 379
 380     );
 381     $template->param( login => 1 );
 382     $template->param( loginprompt => 1 ) unless $info{'nopermission'};
 383
 384     if ($info{'invalid_username_or_password'} && $info{'invalid_username_or_password'} == 1) {
 385                 $template->param( 'invalid_username_or_password' => $info{'invalid_username_or_password'});
 386     }
 387
 388     $template->param( \%info );
 389     $cookie = $query->cookie(
 390         -name    => 'CGISESSID',
 391         -value   => $sessionID,
 392         -HttpOnly => 1,
 393         -expires => '',
 394         -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
 395     );
 396     print $query->header(
 397         -type    => 'text/html; charset=utf-8',
 398         -cookie  => $cookie
 399       ),
 400       $template->output;
 401     exit;
 402 }
 403
 404 sub checkpw {
 405
 406     my ( $userid, $password ) = @_;
 407
 408     if (   $userid
 409         && $userid     eq C4::Context->config('user')
 410         && "$password" eq C4::Context->config('pass') )
 411     {
 412
 413         # Koha superuser account
 414         C4::Context->set_userenv(
 415             0, 0,
 416             C4::Context->config('user'),
 417             C4::Context->config('user'),
 418             C4::Context->config('user'),
 419             "", "NO_LIBRARY_SET", 1
 420         );
 421         return 2;
 422     }
 423     return 0;
 424 }
 425
 426 END { }    # module clean-up code here (global destructor)
 427 1;
 428 __END__
 429
 430 =head1 SEE ALSO
 431
 432 CGI(3)
 433
 434 C4::Output(3)
 435
 436 Digest::MD5(3)
 437
 438 =cut