split authentication to separate modules

backend.php

@@ -131,13 +131,6 @@
 	#	return;
 	#}
 
-	function __autoload($class) {
-		$file = "classes/".strtolower(basename($class)).".php";
-		if (file_exists($file)) {
-			require $file;
-		}
-	}
-
 	$op = str_replace("-", "_", $op);
 
 	if (class_exists($op)) {

classes/auth_base.php

@@ -0,0 +1,55 @@
+<?php
+class Auth_Base {
+	protected $link;
+
+	function __construct($link) {
+		$this->link = $link;
+	}
+
+	function authenticate($login, $password) {
+		return false;
+	}
+
+	// Auto-creates specified user if allowed by system configuration
+	// Can be used instead of find_user_by_login() by external auth modules
+	function auto_create_user($login) {
+		if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
+			$user_id = $this->find_user_by_login($login);
+
+			if (!$user_id) {
+				$login = db_escape_string($login);
+				$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
+				$pwd_hash = encrypt_password($password, $salt, true);
+
+				$query = "INSERT INTO ttrss_users
+						(login,access_level,last_login,created,pwd_hash,salt)
+						VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
+
+				db_query($this->link, $query);
+
+				return $this->find_user_by_login($login);
+
+			} else {
+				return $user_id;
+			}
+		}
+
+		return false;
+	}
+
+	function find_user_by_login($login) {
+		$login = db_escape_string($login);
+
+		$result = db_query($this->link, "SELECT id FROM ttrss_users WHERE
+			login = '$login'");
+
+		if (db_num_rows($result) > 0) {
+			return db_fetch_result($result, 0, "id");
+		} else {
+			return false;
+		}
+
+	}
+}
+
+?>

classes/auth_internal.php

@@ -0,0 +1,75 @@
+<?php
+class Auth_Internal extends Auth_Base {
+
+	function authenticate($login, $password) {
+
+		$pwd_hash1 = encrypt_password($password);
+		$pwd_hash2 = encrypt_password($password, $login);
+		$login = db_escape_string($login);
+
+		if (get_schema_version($this->link) > 87) {
+
+			$result = db_query($this->link, "SELECT salt FROM ttrss_users WHERE
+				login = '$login'");
+
+			if (db_num_rows($result) != 1) {
+				return false;
+			}
+
+			$salt = db_fetch_result($result, 0, "salt");
+
+			if ($salt == "") {
+
+				$query = "SELECT id
+	            FROM ttrss_users WHERE
+					login = '$login' AND (pwd_hash = '$pwd_hash1' OR
+					pwd_hash = '$pwd_hash2')";
+
+				// verify and upgrade password to new salt base
+
+				$result = db_query($this->link, $query);
+
+				if (db_num_rows($result) == 1) {
+					// upgrade password to MODE2
+
+					$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
+					$pwd_hash = encrypt_password($password, $salt, true);
+
+					db_query($this->link, "UPDATE ttrss_users SET
+						pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
+
+					$query = "SELECT id
+		            FROM ttrss_users WHERE
+						login = '$login' AND pwd_hash = '$pwd_hash'";
+
+				} else {
+					return false;
+				}
+
+			} else {
+
+				$pwd_hash = encrypt_password($password, $salt, true);
+
+				$query = "SELECT id
+		         FROM ttrss_users WHERE
+					login = '$login' AND pwd_hash = '$pwd_hash'";
+
+			}
+
+		} else {
+			$query = "SELECT id
+	         FROM ttrss_users WHERE
+				login = '$login' AND (pwd_hash = '$pwd_hash1' OR
+					pwd_hash = '$pwd_hash2')";
+		}
+
+		$result = db_query($this->link, $query);
+
+		if (db_num_rows($result) == 1) {
+			return db_fetch_result($result, 0, "id");
+		}
+
+		return false;
+	}
+}
+?>

classes/auth_remote.php

@@ -0,0 +1,61 @@
+<?php
+class Auth_Remote extends Auth_Base {
+	function get_login_by_ssl_certificate() {
+		$cert_serial = db_escape_string(get_ssl_certificate_id());
+
+		if ($cert_serial) {
+			$result = db_query($this->link, "SELECT login FROM ttrss_user_prefs, ttrss_users
+				WHERE pref_name = 'SSL_CERT_SERIAL' AND value = '$cert_serial' AND
+				owner_uid = ttrss_users.id");
+
+			if (db_num_rows($result) != 0) {
+				return db_escape_string(db_fetch_result($result, 0, "login"));
+			}
+		}
+
+		return "";
+	}
+
+
+	function authenticate($login, $password) {
+		$try_login = db_escape_string($_SERVER["REMOTE_USER"]);
+
+		if (!$try_login) $try_login = $this->get_login_by_ssl_certificate();
+#	  	if (!$try_login) $try_login = "test_qqq";
+
+		if ($try_login) {
+			$user_id = $this->auto_create_user($try_login);
+
+			if ($user_id) {
+				$_SESSION["fake_login"] = $try_login;
+				$_SESSION["fake_password"] = "******";
+				$_SESSION["hide_hello"] = true;
+				$_SESSION["hide_logout"] = true;
+
+				// LemonLDAP can send user informations via HTTP HEADER
+				if (defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE){
+					// update user name
+					$fullname = $_SERVER['HTTP_USER_NAME'] ? $_SERVER['HTTP_USER_NAME'] : $_SERVER['AUTHENTICATE_CN'];
+					if ($fullname){
+						$fullname = db_escape_string($fullname);
+						db_query($this->link, "UPDATE ttrss_users SET full_name = '$fullname' WHERE id = " .
+							$user_id);
+					}
+					// update user mail
+					$email = $_SERVER['HTTP_USER_MAIL'] ? $_SERVER['HTTP_USER_MAIL'] : $_SERVER['AUTHENTICATE_MAIL'];
+					if ($email){
+						$email = db_escape_string($email);
+						db_query($this->link, "UPDATE ttrss_users SET email = '$email' WHERE id = " .
+							$user_id);
+					}
+				}
+
+				return $user_id;
+			}
+		}
+
+		return false;
+	}
+}
+
+?>

classes/pref_prefs.php

@@ -197,7 +197,7 @@ class Pref_Prefs extends Protected_Handler {
 		print "<tr><td width=\"40%\">".__('E-mail')."</td>";
 		print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" name=\"email\" required=\"1\" value=\"$email\"></td></tr>";
 
-		if (!SINGLE_USER_MODE && !(ALLOW_REMOTE_USER_AUTH && AUTO_LOGIN)) {
+		if (!SINGLE_USER_MODE && !$_SESSION["hide_hello"]) {
 
 			$access_level = db_fetch_result($result, 0, "access_level");
 			print "<tr><td width=\"40%\">".__('Access level')."</td>";
@@ -214,7 +214,7 @@ class Pref_Prefs extends Protected_Handler {
 
 		print "</form>";
 
-		if (!SINGLE_USER_MODE && !(ALLOW_REMOTE_USER_AUTH && AUTO_LOGIN)) {
+		if (!SINGLE_USER_MODE && !$_SESSION["hide_logout"]) {
 
 			$result = db_query($this->link, "SELECT id FROM ttrss_users
 				WHERE id = ".$_SESSION["uid"]." AND pwd_hash

config.php-dist

@@ -48,6 +48,28 @@
 	// Unless you really know what you're doing, please keep those relative
 	// to tt-rss main directory.
 
+	// **********************
+	// *** Authentication ***
+	// **********************
+
+	define('AUTH_MODULES', 'internal');
+	// Comma-separated list of authentication modules to use. 
+	// Available modules are:
+	// 1. internal - tt-rss internal user DB
+	// 2. remote - use server REMOTE_USER variable or client SSL certificate if enabled
+	// in preferences
+	//
+
+	define('AUTH_AUTO_CREATE', true);
+	// Allow authentication modules to auto-create users in tt-rss internal
+	// database when authenticated successfully.
+
+	define('AUTH_AUTO_LOGIN', true);
+	// Automatically login user on remote or other kind of externally supplied
+	// authentication, otherwise redirect to login form as normal.
+	// If set to true, users won't be able to set application language
+	// and settings profile.
+
 	// *********************
 	// *** Feed settings ***
 	// *********************
@@ -84,28 +106,6 @@
 	// Index name in Sphinx configuration. You can specify multiple indexes
 	// as a comma-separated string.
 
-	// **********************
-	// *** Authentication ***
-	// **********************
-
-	define('ALLOW_REMOTE_USER_AUTH', false);
-	// Set to 'true' if you trust your web server's REMOTE_USER 
-	// environment variable that the user is logged in. This option can be 
-	// used to integrate tt-rss with Apache's external authentication modules.
-
-	define('AUTO_LOGIN', false);
-	// Set this to true if you use ALLOW_REMOTE_USER_AUTH or client SSL
-	// certificate authentication and you want to skip the login form. 
-	// If set to true, users won't be able to set application language 
-	// and settings profile.
-	// Otherwise users will be redirected to login form with their login
-	// information pre-filled.
-
-	define('AUTO_CREATE_USER', false);
-	// If users are authenticated by your web server, set this to true if
-	// You want new users to be automaticaly created in tt-rss database
-	// on first login
-
 	// ***********************************
 	// *** Self-registrations by users ***
 	// ***********************************

include/functions.php

@@ -2,6 +2,13 @@
 	define('EXPECTED_CONFIG_VERSION', 25);
 	define('SCHEMA_VERSION', 94);
 
+	function __autoload($class) {
+		$file = "classes/".strtolower(basename($class)).".php";
+		if (file_exists($file)) {
+			require $file;
+		}
+	}
+
 	mb_internal_encoding("UTF-8");
 	date_default_timezone_set('UTC');
 	if (defined('E_DEPRECATED')) {
@@ -672,131 +679,34 @@
 		return "";
 	}
 
-	function get_login_by_ssl_certificate($link) {
+	function authenticate_user($link, $login, $password, $check_only = false) {
-
-		$cert_serial = db_escape_string(get_ssl_certificate_id());
-
-		if ($cert_serial) {
-			$result = db_query($link, "SELECT login FROM ttrss_user_prefs, ttrss_users
-				WHERE pref_name = 'SSL_CERT_SERIAL' AND value = '$cert_serial' AND
-				owner_uid = ttrss_users.id");
-
-			if (db_num_rows($result) != 0) {
-				return db_escape_string(db_fetch_result($result, 0, "login"));
-			}
-		}
-
-		return "";
-	}
-
-	function get_remote_user($link) {
-
-		if (defined('ALLOW_REMOTE_USER_AUTH') && ALLOW_REMOTE_USER_AUTH) {
-			return db_escape_string($_SERVER["REMOTE_USER"]);
-		}
-
-		return db_escape_string(get_login_by_ssl_certificate($link));
-	}
-
-	function get_remote_fakepass($link) {
-		if (get_remote_user($link))
-			return "******";
-		else
-			return "";
-	}
-
-	function authenticate_user($link, $login, $password, $force_auth = false) {
 
 		if (!SINGLE_USER_MODE) {
 
-			$pwd_hash1 = encrypt_password($password);
+			$user_id = false;
-			$pwd_hash2 = encrypt_password($password, $login);
+			$modules = explode(",", AUTH_MODULES);
-			$login = db_escape_string($login);
 
-			$remote_user = get_remote_user($link);
+			foreach ($modules as $module) {
+				$module_class = "auth_$module";
+				if (class_exists($module_class)) {
+					$authenticator = new $module_class($link);
 
-			if ($remote_user && $remote_user == $login && $login != "admin") {
+					$user_id = (int) $authenticator->authenticate($login, $password);
 
-				$login = $remote_user;
+					if ($user_id) break;
-
-				$query = "SELECT id,login,access_level,pwd_hash
-	            FROM ttrss_users WHERE
-					login = '$login'";
-
-				if (defined('AUTO_CREATE_USER') && AUTO_CREATE_USER
-						&& $_SERVER["REMOTE_USER"]) {
-					$result = db_query($link, $query);
-
-					// First login ?
-					if (db_num_rows($result) == 0) {
-						$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
-						$pwd_hash = encrypt_password($password, $salt, true);
-
-						$query2 = "INSERT INTO ttrss_users
-								(login,access_level,last_login,created,pwd_hash,salt)
-								VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
-						db_query($link, $query2);
-					}
-				}
-
-			} else if (get_schema_version($link) > 87) {
-				$result = db_query($link, "SELECT salt FROM ttrss_users WHERE
-					login = '$login'");
-
-				if (db_num_rows($result) != 1) {
-					return false;
-				}
-
-				$salt = db_fetch_result($result, 0, "salt");
-
-				if ($salt == "") {
-
-					$query = "SELECT id,login,access_level,pwd_hash
-		            FROM ttrss_users WHERE
-						login = '$login' AND (pwd_hash = '$pwd_hash1' OR
-						pwd_hash = '$pwd_hash2')";
-
-					// verify and upgrade password to new salt base
-
-					$result = db_query($link, $query);
-
-					if (db_num_rows($result) == 1) {
-						// upgrade password to MODE2
-
-						$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
-						$pwd_hash = encrypt_password($password, $salt, true);
-
-						db_query($link, "UPDATE ttrss_users SET
-							pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
-
-						$query = "SELECT id,login,access_level,pwd_hash
-			            FROM ttrss_users WHERE
-							login = '$login' AND pwd_hash = '$pwd_hash'";
-
-					} else {
-						return false;
-					}
 
 				} else {
-
+					print T_sprintf("Fatal: authentication module %s not found.", $module);
-					$pwd_hash = encrypt_password($password, $salt, true);
+					die;
-
-					$query = "SELECT id,login,access_level,pwd_hash
-			         FROM ttrss_users WHERE
-						login = '$login' AND pwd_hash = '$pwd_hash'";
-
 				}
-			} else {
-				$query = "SELECT id,login,access_level,pwd_hash
-		         FROM ttrss_users WHERE
-					login = '$login' AND (pwd_hash = '$pwd_hash1' OR
-						pwd_hash = '$pwd_hash2')";
 			}
 
-			$result = db_query($link, $query);
+			if ($user_id && !$check_only) {
+				$_SESSION["uid"] = $user_id;
+
+				$result = db_query($link, "SELECT login,access_level,pwd_hash FROM ttrss_users
+					WHERE id = '$user_id'");
 
-			if (db_num_rows($result) == 1) {
-				$_SESSION["uid"] = db_fetch_result($result, 0, "id");
 				$_SESSION["name"] = db_fetch_result($result, 0, "login");
 				$_SESSION["access_level"] = db_fetch_result($result, 0, "access_level");
 				$_SESSION["csrf_token"] = sha1(uniqid(rand(), true));
@@ -804,25 +714,6 @@
 				db_query($link, "UPDATE ttrss_users SET last_login = NOW() WHERE id = " .
 					$_SESSION["uid"]);
 
-
-				// LemonLDAP can send user informations via HTTP HEADER
-				if (defined('AUTO_CREATE_USER') && AUTO_CREATE_USER){
-					// update user name
-					$fullname = $_SERVER['HTTP_USER_NAME'] ? $_SERVER['HTTP_USER_NAME'] : $_SERVER['AUTHENTICATE_CN'];
-					if ($fullname){
-						$fullname = db_escape_string($fullname);
-						db_query($link, "UPDATE ttrss_users SET full_name = '$fullname' WHERE id = " .
-							$_SESSION["uid"]);
-					}
-					// update user mail
-					$email = $_SERVER['HTTP_USER_MAIL'] ? $_SERVER['HTTP_USER_MAIL'] : $_SERVER['AUTHENTICATE_MAIL'];
-					if ($email){
-						$email = db_escape_string($email);
-						db_query($link, "UPDATE ttrss_users SET email = '$email' WHERE id = " .
-							$_SESSION["uid"]);
-					}
-				}
-
 				$_SESSION["ip_address"] = $_SERVER["REMOTE_ADDR"];
 				$_SESSION["pwd_hash"] = db_fetch_result($result, 0, "pwd_hash");
 
@@ -841,6 +732,9 @@
 			$_SESSION["name"] = "admin";
 			$_SESSION["access_level"] = 10;
 
+			$_SESSION["hide_hello"] = true;
+			$_SESSION["hide_logout"] = true;
+
 			if (!$_SESSION["csrf_token"]) {
 				$_SESSION["csrf_token"] = sha1(uniqid(rand(), true));
 			}
@@ -998,12 +892,11 @@
 
 			if (!$_SESSION["uid"] || !validate_session($link)) {
 
-				if (get_remote_user($link) && AUTO_LOGIN) {
+				if (AUTH_AUTO_LOGIN && authenticate_user($link, null, null)) {
-				    authenticate_user($link, get_remote_user($link), null);
 				    $_SESSION["ref_schema_version"] = get_schema_version($link, true);
 				} else {
+					 authenticate_user($link, null, null, true);
 				    render_login_form($link, $mobile);
-				    //header("Location: login.php");
 				    exit;
 				}
 			} else {

include/login_form.php

@@ -131,11 +131,11 @@ function validateLoginForm(f) {
 			<tr><td align="right"><?php echo __("Login:") ?></td>
 			<td align="right"><input name="login"
 				onchange="fetchProfiles()" onfocus="fetchProfiles()"
-				value="<?php echo get_remote_user($link) ?>"></td></tr>
+				value="<? echo $_SESSION["fake_login"] ?>"></td></tr>
 			<tr><td align="right"><?php echo __("Password:") ?></td>
 			<td align="right"><input type="password" name="password"
 				onchange="fetchProfiles()" onfocus="fetchProfiles()"
-				value="<?php echo get_remote_fakepass($link) ?>"></td></tr>
+				value="<? echo $_SESSION["fake_password"] ?>"></td></tr>
 			<tr><td align="right"><?php echo __("Language:") ?></td>
 			<td align="right">
 			<?php

include/sanity_config.php

@@ -1,3 +1,3 @@
-<?php # This file has been generated at:  Mon Jul 9 12:33:19 MSK 2012
+<?php # This file has been generated at:  Thu Aug 16 14:47:22 MSK 2012
 define('GENERATED_CONFIG_CHECK', 25);
-$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'DEFAULT_UPDATE_METHOD', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ALLOW_REMOTE_USER_AUTH', 'AUTO_LOGIN', 'AUTO_CREATE_USER', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_EXPIRE_TIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CONSUMER_KEY', 'CONSUMER_SECRET', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'FEEDBACK_URL', 'ARTICLE_BUTTON_PLUGINS', 'CONFIG_VERSION'); ?>
+$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'AUTH_MODULES', 'AUTH_AUTO_CREATE', 'AUTH_AUTO_LOGIN', 'DEFAULT_UPDATE_METHOD', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_EXPIRE_TIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CONSUMER_KEY', 'CONSUMER_SECRET', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'FEEDBACK_URL', 'ARTICLE_BUTTON_PLUGINS', 'CONFIG_VERSION'); ?>

index.php

@@ -110,7 +110,7 @@
 </div>
 
 <div id="header">
-	<?php if (!SINGLE_USER_MODE && !(ALLOW_REMOTE_USER_AUTH && AUTO_LOGIN)) { ?>
+	<?php if (!$_SESSION["hide_hello"]) { ?>
 			<?php echo __('Hello,') ?> <b><?php echo $_SESSION["name"] ?></b> |
 	<?php } ?>
 	<a href="prefs.php"><?php echo __('Preferences') ?></a>
@@ -120,7 +120,7 @@
 				<?php echo __('Comments?') ?></a>
 	<?php } ?>
 
-	<?php if (!SINGLE_USER_MODE && !(ALLOW_REMOTE_USER_AUTH && AUTO_LOGIN)) { ?>
+	<?php if (!$_SESSION["hide_logout"]) { ?>
 			| <a href="backend.php?op=logout"><?php echo __('Logout') ?></a>
 	<?php } ?>
 

public.php

@@ -38,13 +38,6 @@
 		ob_start("ob_gzhandler");
 	}
 
-	function __autoload($class) {
-		$file = "classes/".strtolower(basename($class)).".php";
-		if (file_exists($file)) {
-			require $file;
-		}
-	}
-
 	$method = $_REQUEST["op"];
 
 	$handler = new Public_Handler($link, $_REQUEST);