lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sec: Fix security login mutualized function.

Browse Source
This commit is contained in:
Laurent Destailleur 2011-09-23 11:53:22 +00:00
parent 540ccab025
commit d90a1ad56b
1 changed files with 12 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
htdocs/main.inc.php
View File

@ -304,7 +304,6 @@ if (! defined('NOLOGIN'))
if (empty($dolibarr_main_authentication)) $dolibarr_main_authentication='http,dolibarr'; if (empty($dolibarr_main_authentication)) $dolibarr_main_authentication='http,dolibarr';
// Authentication mode: forceuser // Authentication mode: forceuser
if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) $dolibarr_auto_user='auto'; if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) $dolibarr_auto_user='auto';
// Set authmode // Set authmode
$authmode=explode(',',$dolibarr_main_authentication); $authmode=explode(',',$dolibarr_main_authentication);
@ -365,15 +364,12 @@ if (! defined('NOLOGIN'))
} }
} }
// Validation of login with a third party login module method $usertotest=$_POST["username"];
if (is_array($conf->login_method_modules) && !empty($conf->login_method_modules)) $passwordtotest=$_POST["password"];
{ $entitytotest=$_POST["entity"];
$login = getLoginMethod($_POST["username"],$_POST["password"],$_POST["entity"]);
if ($login) $test=false;
}
// Validation tests user / password // Validation of login/pass/entity
// If ok, the variable will be initialized login // If ok, the variable login will be returned
// If error, we will put error message in session under the name dol_loginmesg // If error, we will put error message in session under the name dol_loginmesg
$goontestloop=false; $goontestloop=false;
if (isset($_SERVER["REMOTE_USER"]) && in_array('http',$authmode)) $goontestloop=true; if (isset($_SERVER["REMOTE_USER"]) && in_array('http',$authmode)) $goontestloop=true;
@ -381,39 +377,14 @@ if (! defined('NOLOGIN'))
if ($test && $goontestloop) if ($test && $goontestloop)
{ {
foreach($authmode as $mode) $login = checkLoginPassEntity($usertotest,$passwordtotest,$entitytotest,$authmode);
if ($login)
{ {
if ($test && $mode && ! $login) $dol_authmode=$conf->authmode; // This properties is defined only when logged to say what mode was successfully used
{ $dol_tz=$_POST["tz"];
$authfile=DOL_DOCUMENT_ROOT.'/includes/login/functions_'.$mode.'.php'; $dol_dst=$_POST["dst"];
$result=include_once($authfile); $dol_screenwidth=$_POST["screenwidth"];
if ($result) $dol_screenheight=$_POST["screenheight"];
{
// Call function to check user/password
$usertotest=$_POST["username"];
$passwordtotest=$_POST["password"];
$entitytotest=$_POST["entity"];
$function='check_user_password_'.$mode;
$login=$function($usertotest,$passwordtotest,$entitytotest);
if ($login) // Login is successfull
{
$test=false;
$dol_authmode=$mode; // This properties is defined only when logged to say what mode was successfully used
$dol_tz=$_POST["tz"];
$dol_dst=$_POST["dst"];
$dol_screenwidth=$_POST["screenwidth"];
$dol_screenheight=$_POST["screenheight"];
}
}
else
{
dol_syslog("Authentification ko - failed to load file '".$authfile."'",LOG_ERR);
sleep(1);
$langs->load('main');
$langs->load('other');
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorFailedToLoadLoginFileForMode",$mode);
}
}
} }
if (! $login) if (! $login)