Bug 18654 - Translatability: Get rid of tt directives starting with [%% in translatio...
[koha.git] / C4 / InstallAuth.pm
blob9c6795f829a6552e31e88461f8fdf185cb947371
1 package C4::InstallAuth;
3 # Copyright 2000-2002 Katipo Communications
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use strict;
21 #use warnings; FIXME - Bug 2505
22 use Digest::MD5 qw(md5_base64);
23 use File::Spec;
25 require Exporter;
26 use C4::Context;
27 use C4::Output;
28 use C4::Templates;
29 use C4::Koha;
30 use CGI::Session;
32 use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
35 =head1 NAME
37 InstallAuth - Authenticates Koha users for Install process
39 =head1 SYNOPSIS
41 use CGI qw ( -utf8 );
42 use InstallAuth;
43 use C4::Output;
45 my $query = new CGI;
47 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
48 { template_name => "opac-main.tt",
49 query => $query,
50 type => "opac",
51 authnotrequired => 1,
52 flagsrequired => { acquisition => '*' },
56 output_html_with_http_headers $query, $cookie, $template->output;
58 =head1 DESCRIPTION
60 The main function of this module is to provide
61 authentification. However the get_template_and_user function has
62 been provided so that a users login information is passed along
63 automatically. This gets loaded into the template.
64 This package is different from C4::Auth in so far as
65 C4::Auth uses many preferences which are supposed NOT to be obtainable when installing the database.
67 As in C4::Auth, Authentication is based on cookies.
69 =head1 FUNCTIONS
71 =over 2
73 =cut
75 @ISA = qw(Exporter);
76 @EXPORT = qw(
77 &checkauth
78 &get_template_and_user
81 =item get_template_and_user
83 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
84 { template_name => "opac-main.tt",
85 query => $query,
86 type => "opac",
87 authnotrequired => 1,
88 flagsrequired => { acquisition => '*' },
92 This call passes the C<query>, C<flagsrequired> and C<authnotrequired>
93 to C<&checkauth> (in this module) to perform authentification.
94 See C<&checkauth> for an explanation of these parameters.
96 The C<template_name> is then used to find the correct template for
97 the page. The authenticated users details are loaded onto the
98 template in the HTML::Template LOOP variable C<USER_INFO>. Also the
99 C<sessionID> is passed to the template. This can be used in templates
100 if cookies are disabled. It needs to be put as and input to every
101 authenticated page.
103 More information on the C<gettemplate> sub can be found in the
104 Templates.pm module.
106 =cut
108 sub get_template_and_user {
109 my $in = shift;
110 my $query = $in->{'query'};
111 my $language =_get_template_language($query->cookie('KohaOpacLanguage'));
112 my $path = C4::Context->config('intrahtdocs'). "/prog/". $language;
114 my $tmplbase = $in->{template_name};
115 my $filename = "$path/modules/" . $tmplbase;
116 my $interface = 'intranet';
117 my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query);
119 my ( $user, $cookie, $sessionID, $flags ) = checkauth(
120 $in->{'query'},
121 $in->{'authnotrequired'},
122 $in->{'flagsrequired'},
123 $in->{'type'}
126 # use Data::Dumper;warn "utilisateur $user cookie : ".Dumper($cookie);
128 my $borrowernumber;
129 if ($user) {
130 $template->param( loggedinusername => $user );
131 $template->param( sessionID => $sessionID );
133 # We are going to use the $flags returned by checkauth
134 # to create the template's parameters that will indicate
135 # which menus the user can access.
136 if ( ( $flags && $flags->{superlibrarian} == 1 ) ) {
137 $template->param( CAN_user_circulate => 1 );
138 $template->param( CAN_user_catalogue => 1 );
139 $template->param( CAN_user_parameters => 1 );
140 $template->param( CAN_user_borrowers => 1 );
141 $template->param( CAN_user_permission => 1 );
142 $template->param( CAN_user_reserveforothers => 1 );
143 $template->param( CAN_user_editcatalogue => 1 );
144 $template->param( CAN_user_updatecharges => 1 );
145 $template->param( CAN_user_acquisition => 1 );
146 $template->param( CAN_user_management => 1 );
147 $template->param( CAN_user_tools => 1 );
148 $template->param( CAN_user_editauthorities => 1 );
149 $template->param( CAN_user_serials => 1 );
150 $template->param( CAN_user_reports => 1 );
153 return ( $template, $borrowernumber, $cookie );
156 sub _get_template_language {
158 #verify if opac language exists in staff (bug 5660)
159 #conditions are 1) dir exists and 2) enabled in prefs
160 my ($opaclang) = @_;
161 return 'en' unless $opaclang;
162 $opaclang =~ s/[^a-zA-Z_-]*//g;
163 my $path = C4::Context->config('intrahtdocs') . "/prog/$opaclang";
164 -d $path ? $opaclang : 'en';
167 =item checkauth
169 ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type);
171 Verifies that the user is authorized to run this script. If
172 the user is authorized, a (userid, cookie, session-id, flags)
173 quadruple is returned. If the user is not authorized but does
174 not have the required privilege (see $flagsrequired below), it
175 displays an error page and exits. Otherwise, it displays the
176 login page and exits.
178 Note that C<&checkauth> will return if and only if the user
179 is authorized, so it should be called early on, before any
180 unfinished operations (e.g., if you've opened a file, then
181 C<&checkauth> won't close it for you).
183 C<$query> is the CGI object for the script calling C<&checkauth>.
185 The C<$noauth> argument is optional. If it is set, then no
186 authorization is required for the script.
188 C<&checkauth> fetches user and session information from C<$query> and
189 ensures that the user is authorized to run scripts that require
190 authorization.
192 The C<$flagsrequired> argument specifies the required privileges
193 the user must have if the username and password are correct.
194 It should be specified as a reference-to-hash; keys in the hash
195 should be the "flags" for the user, as specified in the Members
196 intranet module. Any key specified must correspond to a "flag"
197 in the userflags table. E.g., { circulate => 1 } would specify
198 that the user must have the "circulate" privilege in order to
199 proceed. To make sure that access control is correct, the
200 C<$flagsrequired> parameter must be specified correctly.
202 The C<$type> argument specifies whether the template should be
203 retrieved from the opac or intranet directory tree. "opac" is
204 assumed if it is not specified; however, if C<$type> is specified,
205 "intranet" is assumed if it is not "opac".
207 If C<$query> does not have a valid session ID associated with it
208 (i.e., the user has not logged in) or if the session has expired,
209 C<&checkauth> presents the user with a login page (from the point of
210 view of the original script, C<&checkauth> does not return). Once the
211 user has authenticated, C<&checkauth> restarts the original script
212 (this time, C<&checkauth> returns).
214 The login page is provided using a HTML::Template, which is set in the
215 systempreferences table or at the top of this file. The variable C<$type>
216 selects which template to use, either the opac or the intranet
217 authentification template.
219 C<&checkauth> returns a user ID, a cookie, and a session ID. The
220 cookie should be sent back to the browser; it verifies that the user
221 has authenticated.
223 =cut
225 sub checkauth {
226 my $query = shift;
228 # $authnotrequired will be set for scripts which will run without authentication
229 my $authnotrequired = shift;
230 my $flagsrequired = shift;
231 my $type = shift;
232 $type = 'intranet' unless $type;
234 my $dbh = C4::Context->dbh();
235 my $template_name;
236 $template_name = "installer/auth.tt";
237 my $sessdir = File::Spec->catdir( File::Spec->tmpdir, 'cgisess_' . C4::Context->config('database') ); # same construction as in C4/Auth
239 # state variables
240 my $loggedin = 0;
241 my %info;
242 my ( $userid, $cookie, $sessionID, $flags, $envcookie );
243 my $logout = $query->param('logout.x');
244 if ( $sessionID = $query->cookie("CGISESSID") ) {
245 C4::Context->_new_userenv($sessionID);
246 my $session =
247 new CGI::Session( "driver:File;serializer:yaml", $sessionID,
248 { Directory => $sessdir } );
249 if ( $session->param('cardnumber') ) {
250 C4::Context->set_userenv(
251 $session->param('number'),
252 $session->param('id'),
253 $session->param('cardnumber'),
254 $session->param('firstname'),
255 $session->param('surname'),
256 $session->param('branch'),
257 $session->param('branchname'),
258 $session->param('flags'),
259 $session->param('emailaddress'),
260 $session->param('branchprinter')
262 $cookie = $query->cookie(
263 -name => 'CGISESSID',
264 -value => $session->id,
265 -HttpOnly => 1,
267 $loggedin = 1;
268 $userid = $session->param('cardnumber');
270 my ( $ip, $lasttime );
272 if ($logout) {
274 # voluntary logout the user
275 C4::Context->_unset_userenv($sessionID);
276 $sessionID = undef;
277 $userid = undef;
278 # Commented out due to its lack of usefulness
279 # open L, ">>/tmp/sessionlog";
280 # my $time = localtime( time() );
281 # printf L "%20s from %16s logged out at %30s (manually).\n", $userid,
282 # $ip, $time;
283 # close L;
286 unless ($userid) {
287 my $session =
288 new CGI::Session( "driver:File;serializer:yaml", undef, { Directory => $sessdir } );
289 $sessionID = $session->id;
290 $userid = $query->param('userid');
291 C4::Context->_new_userenv($sessionID);
292 my $password = $query->param('password');
293 C4::Context->_new_userenv($sessionID);
294 my ( $return, $cardnumber ) = checkpw( $userid, $password );
295 if ($return) {
296 $loggedin = 1;
297 # open L, ">>/tmp/sessionlog";
298 # my $time = localtime( time() );
299 # printf L "%20s from %16s logged in at %30s.\n", $userid,
300 # $ENV{'REMOTE_ADDR'}, $time;
301 # close L;
302 $cookie = $query->cookie(
303 -name => 'CGISESSID',
304 -value => $sessionID,
305 -HttpOnly => 1,
307 if ( $return == 2 ) {
309 #Only superlibrarian should have access to this page.
310 #Since if it is a user, it is supposed that there is a borrower table
311 #And thus that data structure is loaded.
312 my $hash = C4::Context->set_userenv(
313 0, 0,
314 C4::Context->config('user'), C4::Context->config('user'),
315 C4::Context->config('user'), "",
316 "NO_LIBRARY_SET", 1,
319 $session->param( 'number', 0 );
320 $session->param( 'id', C4::Context->config('user') );
321 $session->param( 'cardnumber', C4::Context->config('user') );
322 $session->param( 'firstname', C4::Context->config('user') );
323 $session->param( 'surname', C4::Context->config('user'), );
324 $session->param( 'branch', 'NO_LIBRARY_SET' );
325 $session->param( 'branchname', 'NO_LIBRARY_SET' );
326 $session->param( 'flags', 1 );
327 $session->param( 'emailaddress',
328 C4::Context->preference('KohaAdminEmailAddress') );
329 $session->param( 'ip', $session->remote_addr() );
330 $session->param( 'lasttime', time() );
331 $userid = C4::Context->config('user');
334 else {
335 if ($userid) {
336 $info{'invalid_username_or_password'} = 1;
337 C4::Context->_unset_userenv($sessionID);
342 # finished authentification, now respond
343 if ($loggedin) {
345 # successful login
346 unless ($cookie) {
347 $cookie = $query->cookie(
348 -name => 'CGISESSID',
349 -value => '',
350 -HttpOnly => 1,
351 -expires => ''
354 if ($envcookie) {
355 return ( $userid, [ $cookie, $envcookie ], $sessionID, $flags );
357 else {
358 return ( $userid, $cookie, $sessionID, $flags );
362 # else we have a problem...
363 # get the inputs from the incoming query
364 my @inputs = ();
365 foreach my $name ( param $query) {
366 (next) if ( $name eq 'userid' || $name eq 'password' );
367 my $value = $query->param($name);
368 push @inputs, { name => $name, value => $value };
371 my $path =
372 C4::Context->config('intrahtdocs') . "/prog/"
373 . ( $query->param('language') ? $query->param('language') : "en" );
374 my $filename = "$path/modules/$template_name";
375 my $interface = 'intranet';
376 my $template = C4::Templates->new( $interface, $filename, '', $query);
377 $template->param(
378 INPUTS => \@inputs,
381 $template->param( login => 1 );
382 $template->param( loginprompt => 1 ) unless $info{'nopermission'};
384 if ($info{'invalid_username_or_password'} == 1) {
385 $template->param( 'invalid_username_or_password' => $info{'invalid_username_or_password'});
388 $template->param( \%info );
389 $cookie = $query->cookie(
390 -name => 'CGISESSID',
391 -value => $sessionID,
392 -HttpOnly => 1,
393 -expires => ''
395 print $query->header(
396 -type => 'text/html; charset=utf-8',
397 -cookie => $cookie
399 $template->output;
400 exit;
403 sub checkpw {
405 my ( $userid, $password ) = @_;
407 if ( $userid
408 && $userid eq C4::Context->config('user')
409 && "$password" eq C4::Context->config('pass') )
412 # Koha superuser account
413 C4::Context->set_userenv(
414 0, 0,
415 C4::Context->config('user'),
416 C4::Context->config('user'),
417 C4::Context->config('user'),
418 "", "NO_LIBRARY_SET", 1
420 return 2;
422 if ( $userid
423 && $userid eq 'demo'
424 && "$password" eq 'demo'
425 && C4::Context->config('demo') )
428 # DEMO => the demo user is allowed to do everything (if demo set to 1 in koha.conf
429 # some features won't be effective : modify systempref, modify MARC structure,
430 return 2;
432 return 0;
435 END { } # module clean-up code here (global destructor)
437 __END__
439 =back
441 =head1 SEE ALSO
443 CGI(3)
445 C4::Output(3)
447 Digest::MD5(3)
449 =cut