mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-18 22:08:20 +01:00
Code Issues Projects Releases Wiki Activity

Auth: Bugfix: MDL-8131

Browse Source
This commit is contained in:
donal72 2007-01-10 00:50:59 +00:00
parent f9dff2433f
commit b7b50143f3
10 changed files with 82 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
auth/cas/auth.php
View File

@ -41,8 +41,10 @@ class auth_plugin_cas {
* @returns bool Authentication success or failure. * @returns bool Authentication success or failure.
*/ */
function user_login ($username, $password) { function user_login ($username, $password) {
if (! function_exists('ldap_connect')) {
// TODO: find how to get at LDAP funcs print_error('auth_casnotinstalled','mnet');
return false;
}
global $CFG; global $CFG;
@ -82,7 +84,7 @@ class auth_plugin_cas {
ldap_close($ldap_connection); ldap_close($ldap_connection);
if ($ldap_login) { if ($ldap_login) {
if ($this->config->create_user=='0') { //cas specific if ($this->config->create_user=='0') { //cas specific
if (record_exists('user', 'username', $username)) { if (record_exists('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id)) {
return true; return true;
}else{ }else{
return false; return false;
@ -120,7 +122,7 @@ class auth_plugin_cas {
phpCAS::setLang($this->config->language); phpCAS::setLang($this->config->language);
phpCAS::forceAuthentication(); phpCAS::forceAuthentication();
if ($this->config->create_user == '0') { if ($this->config->create_user == '0') {
if (record_exists('user', 'username', phpCAS::getUser())) { if (record_exists('user', 'username', phpCAS::getUser(), 'mnethostid', $CFG->mnet_localhost_id)) {
// TODO::SOMEOTHER:: // TODO::SOMEOTHER::
$user = authenticate_user_login(phpCAS::getUser(), 'cas'); $user = authenticate_user_login(phpCAS::getUser(), 'cas');
} }
@ -169,7 +171,7 @@ class auth_plugin_cas {
} }
if ($cas_user_exist) { if ($cas_user_exist) {
if ($this->config->create_user == '0') { if ($this->config->create_user == '0') {
if (record_exists('user', 'username', phpCAS::getUser())) { if (record_exists('user', 'username', phpCAS::getUser(), 'mnethostid', $CFG->mnet_localhost_id)) {
// TODO::SOMEOTHER:: // TODO::SOMEOTHER::
$user = authenticate_user_login(phpCAS::getUser(), 'cas'); $user = authenticate_user_login(phpCAS::getUser(), 'cas');
} }

28
auth/db/auth.php
View File

@ -78,7 +78,7 @@ class auth_plugin_db {
if ( $rs->RecordCount() ) { if ( $rs->RecordCount() ) {
// user exists exterally // user exists exterally
// check username/password internally // check username/password internally
if ($user = get_record('user', 'username', $username)) { if ($user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id)) {
return validate_internal_user_password($user, $password); return validate_internal_user_password($user, $password);
} }
} else { } else {
@ -156,8 +156,9 @@ class auth_plugin_db {
function user_update_password($username, $newpassword) { function user_update_password($username, $newpassword) {
global $CFG;
if ($this->config->passtype === 'internal') { if ($this->config->passtype === 'internal') {
return set_field('user', 'password', md5($newpassword), 'username', $username); return set_field('user', 'password', md5($newpassword), 'username', $username, 'mnethostid', $CFG->mnet_localhost_id);
} else { } else {
// we should have never been called! // we should have never been called!
return false; return false;
@ -214,7 +215,7 @@ class auth_plugin_db {
foreach ($remove_users as $user) { foreach ($remove_users as $user) {
//following is copy pasted from admin/user.php //following is copy pasted from admin/user.php
//maybe this should moved to function in lib/datalib.php //maybe this should moved to function in lib/datalib.php
unset($updateuser); $updateuser = new stdClass();
$updateuser->id = $user->id; $updateuser->id = $user->id;
$updateuser->deleted = "1"; $updateuser->deleted = "1";
$updateuser->timemodified = time(); $updateuser->timemodified = time();
@ -301,17 +302,18 @@ class auth_plugin_db {
$user = $this->get_userinfo_asobj($user); $user = $this->get_userinfo_asobj($user);
// prep a few params // prep a few params
$user->username = $username; $user->username = $username;
$user->modified = time(); $user->modified = time();
$user->confirmed = 1; $user->confirmed = 1;
$user->auth = 'db'; $user->auth = 'db';
$user->mnethostid = $CFG->mnet_localhost_id;
// insert it // insert it
$old_debug=$CFG->debug; $old_debug=$CFG->debug;
$CFG->debug=10; $CFG->debug=10;
// maybe the user has been deleted before // maybe the user has been deleted before
if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1)) { if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1, 'mnethostid', $user->mnethostid)) {
$user->id = $old_user->id; $user->id = $old_user->id;
set_field('user', 'deleted', 0, 'username', $user->username); set_field('user', 'deleted', 0, 'username', $user->username);
echo "Revived user $user->username id $user->id\n"; echo "Revived user $user->username id $user->id\n";
@ -414,6 +416,7 @@ class auth_plugin_db {
* values removed from DB won't be removed from moodle. * values removed from DB won't be removed from moodle.
*/ */
function db_update_user_record($username, $updatekeys=false) { function db_update_user_record($username, $updatekeys=false) {
global $CFG;
$pcfg = get_config('auth/db'); $pcfg = get_config('auth/db');
@ -421,12 +424,15 @@ class auth_plugin_db {
$username = trim(moodle_strtolower($username)); $username = trim(moodle_strtolower($username));
// get the current user record // get the current user record
$user = get_record('user', 'username', $username); $user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id);
if (empty($user)) { // trouble if (empty($user)) { // trouble
error_log("Cannot update non-existent user: $username"); error_log("Cannot update non-existent user: $username");
die; die;
} }
// Ensure userid is not overwritten
$userid = $user->id;
// TODO: this had a function_exists() - now we have a $this // TODO: this had a function_exists() - now we have a $this
if ($newinfo = $this->get_userinfo($username)) { if ($newinfo = $this->get_userinfo($username)) {
$newinfo = truncate_userinfo($newinfo); $newinfo = truncate_userinfo($newinfo);
@ -445,12 +451,12 @@ class auth_plugin_db {
} }
if (!empty($this->config->{'field_updatelocal_' . $key})) { if (!empty($this->config->{'field_updatelocal_' . $key})) {
if ($user->{$key} != $value) { // only update if it's changed if ($user->{$key} != $value) { // only update if it's changed
set_field('user', $key, $value, 'username', $username); set_field('user', $key, $value, 'id', $userid);
} }
} }
} }
} }
return get_record_select("user", "username = '$username' AND deleted <> '1'"); return get_record_select("user", "id = '$userid' AND deleted <> '1'");
} }
// A chance to validate form data, and last chance to // A chance to validate form data, and last chance to

3
auth/email/auth.php
View File

@ -51,7 +51,8 @@ class auth_plugin_email {
* @returns bool Authentication success or failure. * @returns bool Authentication success or failure.
*/ */
function user_login ($username, $password) { function user_login ($username, $password) {
if ($user = get_record('user', 'username', $username)) { global $CFG;
if ($user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id)) {
return validate_internal_user_password($user, $password); return validate_internal_user_password($user, $password);
} }
return false; return false;

3
auth/imap/auth.php
View File

@ -42,7 +42,8 @@ class auth_plugin_imap {
*/ */
function user_login ($username, $password) { function user_login ($username, $password) {
if (! function_exists('imap_open')) { if (! function_exists('imap_open')) {
error("Cannot use IMAP authentication. The PHP IMAP module is not installed."); print_error('auth_imapnotinstalled','mnet');
return false;
} }
global $CFG; global $CFG;

41
auth/ldap/auth.php
View File

@ -46,6 +46,10 @@ class auth_plugin_ldap {
* @returns bool Authentication success or failure. * @returns bool Authentication success or failure.
*/ */
function user_login($username, $password) { function user_login($username, $password) {
if (! function_exists('ldap_bind')) {
print_error('auth_ldapnotinstalled','mnet');
return false;
}
global $CFG; global $CFG;
@ -329,6 +333,8 @@ class auth_plugin_ldap {
$user->guid=bin2hex($user->guid); $user->guid=bin2hex($user->guid);
//add authentication source stamp //add authentication source stamp
$user->auth = AUTH_LDAP_NAME; $user->auth = AUTH_LDAP_NAME;
//add MNET host id
$user->mnethostid = $CFG->mnet_localhost_id;
$fresult[$user->username]=$user; $fresult[$user->username]=$user;
} }
@ -517,7 +523,7 @@ class auth_plugin_ldap {
foreach ($remove_users as $user) { foreach ($remove_users as $user) {
//following is copy pasted from admin/user.php //following is copy pasted from admin/user.php
//maybe this should moved to function in lib/datalib.php //maybe this should moved to function in lib/datalib.php
unset($updateuser); $updateuser = new stdClass();
$updateuser->id = $user->id; $updateuser->id = $user->id;
$updateuser->deleted = '1'; $updateuser->deleted = '1';
//$updateuser->username = "$user->username".time(); // Remember it just in case //$updateuser->username = "$user->username".time(); // Remember it just in case
@ -617,7 +623,7 @@ class auth_plugin_ldap {
if (!empty($add_users)) { if (!empty($add_users)) {
print "User entries to add: ". count($add_users). "\n"; print "User entries to add: ". count($add_users). "\n";
if ($creatorroles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) { if ($roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {
$creatorrole = array_shift($roles); // We can only use one, let's use the first one $creatorrole = array_shift($roles); // We can only use one, let's use the first one
} }
@ -627,18 +633,19 @@ class auth_plugin_ldap {
//print $user->username . "\n"; //print $user->username . "\n";
// prep a few params // prep a few params
$user->modified = time(); $user->modified = time();
$user->confirmed = 1; $user->confirmed = 1;
$user->auth = AUTH_LDAP_NAME; $user->auth = AUTH_LDAP_NAME;
$user->mnethostid = $CFG->mnet_localhost_id;
// insert it // insert it
$old_debug=$CFG->debug; $old_debug=$CFG->debug;
$CFG->debug=10; $CFG->debug=10;
// maybe the user has been deleted before // maybe the user has been deleted before
if ($old_user = get_record('user', 'idnumber', $user->idnumber, 'deleted', 1)) { if ($old_user = get_record('user', 'idnumber', $user->idnumber, 'deleted', 1, 'mnethostid', $CFG->mnet_localhost_id)) {
$user->id = $old_user->id; $user->id = $old_user->id;
set_field('user', 'deleted', 0, 'idnumber', $user->idnumber); set_field('user', 'deleted', 0, 'id', $user->id);
echo "Revived user $user->username with idnumber $user->idnumber id $user->id\n"; echo "Revived user $user->username with idnumber $user->idnumber id $user->id\n";
} }
elseif ($id = insert_record('user',$user)) { // it is truly a new user elseif ($id = insert_record('user',$user)) { // it is truly a new user
@ -687,12 +694,15 @@ class auth_plugin_ldap {
$username = trim(moodle_strtolower($username)); $username = trim(moodle_strtolower($username));
// get the current user record // get the current user record
$user = get_record('user', 'username', $username); $user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id);
if (empty($user)) { // trouble if (empty($user)) { // trouble
error_log("Cannot update non-existent user: $username"); error_log("Cannot update non-existent user: $username");
die; die;
} }
// Protect the userid from being overwritten
$userid = $user->id;
if (function_exists('auth_get_userinfo')) { if (function_exists('auth_get_userinfo')) {
if ($newinfo = auth_get_userinfo($username)) { if ($newinfo = auth_get_userinfo($username)) {
$newinfo = truncate_userinfo($newinfo); $newinfo = truncate_userinfo($newinfo);
@ -702,23 +712,21 @@ class auth_plugin_ldap {
} }
foreach ($updatekeys as $key) { foreach ($updatekeys as $key) {
unset($value);
if (isset($newinfo[$key])) { if (isset($newinfo[$key])) {
$value = $newinfo[$key]; $value = addslashes(stripslashes($newinfo[$key]));
$value = addslashes(stripslashes($value)); // Just in case
} }
else { else {
$value = ''; $value = '';
} }
if (!empty($this->config->{'field_updatelocal_' . $key})) { if (!empty($this->config->{'field_updatelocal_' . $key})) {
if ($user->{$key} != $value) { // only update if it's changed if ($user->{$key} != $value) { // only update if it's changed
set_field('user', $key, $value, 'username', $username); set_field('user', $key, $value, 'id', $userid);
} }
} }
} }
} }
} }
return get_record_select("user", "username = '$username' AND deleted <> '1'"); return get_record_select("user", "id = '$userid' AND deleted <> '1'");
} }
function ldap_bulk_insert($users) { function ldap_bulk_insert($users) {
@ -952,13 +960,12 @@ class auth_plugin_ldap {
* called when the user password is updated. * called when the user password is updated.
* changes userpassword in external db * changes userpassword in external db
* *
* @param mixed $username Username * @param object $user User table object
* @param mixed $newpassword Plaintext password * @param mixed $newpassword Plaintext password
* @param mixed $oldpassword Plaintext old password to bind ldap with * @param mixed $oldpassword Plaintext old password to bind ldap with
* @return boolean result * @return boolean result
* *
*/ */
// function user_update_password($username, $newpassword) {
function user_update_password($user, $newpassword) { function user_update_password($user, $newpassword) {
/// called when the user password is updated -- it assumes it is called by an admin /// called when the user password is updated -- it assumes it is called by an admin
/// or that you've otherwise checked the user's credentials /// or that you've otherwise checked the user's credentials

9
auth/manual/auth.php
View File

@ -43,14 +43,11 @@ class auth_plugin_manual
* @returns bool Authentication success or failure. * @returns bool Authentication success or failure.
*/ */
function user_login ($username, $password) { function user_login ($username, $password) {
if ($user = get_record('user', 'username', $username)) { global $CFG;
if (validate_internal_user_password($user, $password)) { if ($user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id)) {
return true; return validate_internal_user_password($user, $password);
// return AUTH_OK;
}
} }
return false; return false;
// return AUTH_FAIL;
} }
/* /*

2
auth/mnet/land.php
View File

@ -26,7 +26,7 @@ $localuser = $mnetauth->confirm_mnet_session($token, $remotewwwroot);
// log in // log in
$CFG->auth = 'mnet'; $CFG->auth = 'mnet';
$USER = get_complete_user_data('id', $localuser->id); $USER = get_complete_user_data('id', $localuser->id, $localuser->mnethostid);
load_all_capabilities(); load_all_capabilities();
// redirect // redirect

5
auth/none/auth.php
View File

@ -44,10 +44,11 @@ class auth_plugin_none {
* @returns bool Authentication success or failure. * @returns bool Authentication success or failure.
*/ */
function user_login ($username, $password) { function user_login ($username, $password) {
if ($user = get_record('user', 'username', $username)) { global $CFG;
if ($user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id)) {
return validate_internal_user_password($user, $password); return validate_internal_user_password($user, $password);
} }
return true; return false;
} }
/* /*

20
lib/moodlelib.php
View File

@ -2686,7 +2686,7 @@ function update_internal_user_password(&$user, $password, $storeindb=true) {
$hashedpassword = hash_internal_user_password($password); $hashedpassword = hash_internal_user_password($password);
} }
return set_field('user', 'password', $hashedpassword, 'username', $user->username); return set_field('user', 'password', $hashedpassword, 'id', $user->id);
} }
/** /**
@ -2700,7 +2700,7 @@ function update_internal_user_password(&$user, $password, $storeindb=true) {
* @param string $value The value to match for $field. * @param string $value The value to match for $field.
* @return user A {@link $USER} object. * @return user A {@link $USER} object.
*/ */
function get_complete_user_data($field, $value) { function get_complete_user_data($field, $value, $mnethostid=null) {
global $CFG; global $CFG;
@ -2708,9 +2708,23 @@ function get_complete_user_data($field, $value) {
return false; return false;
} }
/// Build the WHERE clause for an SQL query
$constraints = $field .' = \''. $value .'\' AND deleted <> \'1\'';
if (null === $mnethostid) {
$constraints .= ' AND auth != \'mnet\'';
} elseif (is_numeric($mnethostid)) {
$constraints .= ' AND mnethostid = \''.$mnethostid.'\'';
} else {
error_log('Call to get_complete_user_data for $field='.$field.', $value = '.$value.', with invalid $mnethostid: '. $mnethostid);
print_error('invalidhostlogin','mnet', $CFG->wwwroot.'/login/index.php');
exit;
}
/// Get all the basic user data /// Get all the basic user data
if (! $user = get_record_select('user', $field .' = \''. $value .'\' AND deleted <> \'1\'')) { if (! $user = get_record_select('user', $constraints)) {
return false; return false;
} }

9
mnet/xmlrpc/client.php
View File

@ -137,7 +137,10 @@ class mnet_xmlrpc_client {
// Executing any system method is permitted. // Executing any system method is permitted.
} else { } else {
$id_list = $mnet_peer->id;
if (!empty($CFG->mnet_all_hosts_id)) {
$id_list .= ', '.$CFG->mnet_all_hosts_id;
}
// Find methods that we subscribe to on this host // Find methods that we subscribe to on this host
$sql = " $sql = "
SELECT SELECT
@ -150,12 +153,12 @@ class mnet_xmlrpc_client {
r.xmlrpc_path = '{$this->method}' AND r.xmlrpc_path = '{$this->method}' AND
s2r.rpcid = r.id AND s2r.rpcid = r.id AND
s2r.serviceid = h2s.serviceid AND s2r.serviceid = h2s.serviceid AND
h2s.subscribe = '1'"; h2s.subscribe = '1' AND
h2s.hostid in ({$id_list})";
$permission = get_record_sql($sql); $permission = get_record_sql($sql);
if ($permission == false) { if ($permission == false) {
// TODO: Handle attempt to call not-permitted method // TODO: Handle attempt to call not-permitted method
echo '<pre>'.$sql.'</pre>';
return false; return false;
} }