]> git.wh0rd.org Git - tt-rss.git/commitdiff
move authentication modules to plugins/
authorAndrew Dolgov <fox@madoka.volgo-balt.ru>
Thu, 27 Dec 2012 11:14:44 +0000 (15:14 +0400)
committerAndrew Dolgov <fox@madoka.volgo-balt.ru>
Thu, 27 Dec 2012 11:14:44 +0000 (15:14 +0400)
12 files changed:
classes/auth/imap.php [deleted file]
classes/auth/internal.php [deleted file]
classes/auth/remote.php [deleted file]
classes/iauthmodule.php [new file with mode: 0644]
classes/pluginhost.php
classes/pref/prefs.php
config.php-dist
include/functions.php
include/sanity_config.php
plugins/auth_imap/auth_imap.php [new file with mode: 0644]
plugins/auth_internal/auth_internal.php [new file with mode: 0644]
plugins/auth_remote/auth_remote.php [new file with mode: 0644]

diff --git a/classes/auth/imap.php b/classes/auth/imap.php
deleted file mode 100644 (file)
index 52664eb..0000000
+++ /dev/null
@@ -1,32 +0,0 @@
-<?php
-/* Requires php-imap
-       Put the following options in config.php:
-
-       define('IMAP_AUTH_SERVER', 'your.imap.server:port');
-       define('IMAP_AUTH_OPTIONS', '/tls/novalidate-cert/norsh');
-       // More about options: http://php.net/manual/ru/function.imap-open.php
-
- */
-
-class Auth_Imap extends Auth_Base {
-
-       function authenticate($login, $password) {
-
-               if ($login && $password) {
-                       $imap = imap_open(
-                               "{".IMAP_AUTH_SERVER.IMAP_AUTH_OPTIONS."}INBOX",
-                               $login,
-                               $password);
-
-                       if ($imap) {
-                               imap_close($imap);
-
-                               return $this->auto_create_user($login);
-                       }
-               }
-
-               return false;
-       }
-
-}
-?>
diff --git a/classes/auth/internal.php b/classes/auth/internal.php
deleted file mode 100644 (file)
index 37014ce..0000000
+++ /dev/null
@@ -1,174 +0,0 @@
-<?php
-class Auth_Internal extends Auth_Base {
-
-       function authenticate($login, $password) {
-
-               $pwd_hash1 = encrypt_password($password);
-               $pwd_hash2 = encrypt_password($password, $login);
-               $login = db_escape_string($login);
-               $otp = db_escape_string($_REQUEST["otp"]);
-
-               if (get_schema_version($this->link) > 96) {
-                       if (!defined('AUTH_DISABLE_OTP') || !AUTH_DISABLE_OTP) {
-                               $result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
-                                       login = '$login'");
-
-                               if (db_num_rows($result) > 0) {
-                                       require_once "lib/otphp/vendor/base32.php";
-                                       require_once "lib/otphp/lib/otp.php";
-                                       require_once "lib/otphp/lib/totp.php";
-
-                                       $base32 = new Base32();
-
-                                       $otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
-                                       $secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
-
-                                       $topt = new \OTPHP\TOTP($secret);
-                                       $otp_check = $topt->now();
-
-                                       if ($otp_enabled) {
-                                               if ($otp) {
-                                                       if ($otp != $otp_check) {
-                                                               return false;
-                                                       }
-                                               } else {
-                                                       $return = urlencode($_REQUEST["return"]);
-                                                       ?><html>
-                                                               <head><title>Tiny Tiny RSS</title></head>
-                                                       <body>
-                                                       <form action="public.php?return=<?php echo $return ?>"
-                                                                       method="POST">
-                                                               <input type="hidden" name="op" value="login">
-                                                               <input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
-                                                               <input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
-
-                                                               <label><?php echo __("Please enter your one time password:") ?></label>
-                                                               <input type="password" size="6" name="otp"/>
-                                                               <input type="submit" value="Continue"/>
-                                                       </form>
-                                                       <script type="text/javascript">
-                                                               document.forms[0].otp.focus();
-                                                       </script>
-                                                       <?php
-                                                       exit;
-                                               }
-                                       }
-                               }
-                       }
-               }
-
-               if (get_schema_version($this->link) > 87) {
-
-                       $result = db_query($this->link, "SELECT salt FROM ttrss_users WHERE
-                               login = '$login'");
-
-                       if (db_num_rows($result) != 1) {
-                               return false;
-                       }
-
-                       $salt = db_fetch_result($result, 0, "salt");
-
-                       if ($salt == "") {
-
-                               $query = "SELECT id
-                   FROM ttrss_users WHERE
-                                       login = '$login' AND (pwd_hash = '$pwd_hash1' OR
-                                       pwd_hash = '$pwd_hash2')";
-
-                               // verify and upgrade password to new salt base
-
-                               $result = db_query($this->link, $query);
-
-                               if (db_num_rows($result) == 1) {
-                                       // upgrade password to MODE2
-
-                                       $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
-                                       $pwd_hash = encrypt_password($password, $salt, true);
-
-                                       db_query($this->link, "UPDATE ttrss_users SET
-                                               pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
-
-                                       $query = "SELECT id
-                           FROM ttrss_users WHERE
-                                               login = '$login' AND pwd_hash = '$pwd_hash'";
-
-                               } else {
-                                       return false;
-                               }
-
-                       } else {
-
-                               $pwd_hash = encrypt_password($password, $salt, true);
-
-                               $query = "SELECT id
-                        FROM ttrss_users WHERE
-                                       login = '$login' AND pwd_hash = '$pwd_hash'";
-
-                       }
-
-               } else {
-                       $query = "SELECT id
-                FROM ttrss_users WHERE
-                               login = '$login' AND (pwd_hash = '$pwd_hash1' OR
-                                       pwd_hash = '$pwd_hash2')";
-               }
-
-               $result = db_query($this->link, $query);
-
-               if (db_num_rows($result) == 1) {
-                       return db_fetch_result($result, 0, "id");
-               }
-
-               return false;
-       }
-
-       function check_password($owner_uid, $password) {
-               $owner_uid = db_escape_string($owner_uid);
-
-               $result = db_query($this->link, "SELECT salt,login FROM ttrss_users WHERE
-                       id = '$owner_uid'");
-
-               $salt = db_fetch_result($result, 0, "salt");
-               $login = db_fetch_result($result, 0, "login");
-
-               if (!$salt) {
-                       $password_hash1 = encrypt_password($password);
-                       $password_hash2 = encrypt_password($password, $login);
-
-                       $query = "SELECT id FROM ttrss_users WHERE
-                               id = '$owner_uid' AND (pwd_hash = '$password_hash1' OR
-                               pwd_hash = '$password_hash2')";
-
-               } else {
-                       $password_hash = encrypt_password($password, $salt, true);
-
-                       $query = "SELECT id FROM ttrss_users WHERE
-                               id = '$owner_uid' AND pwd_hash = '$password_hash'";
-               }
-
-               $result = db_query($this->link, $query);
-
-               return db_num_rows($result) != 0;
-       }
-
-       function change_password($owner_uid, $old_password, $new_password) {
-               $owner_uid = db_escape_string($owner_uid);
-
-               if ($this->check_password($owner_uid, $old_password)) {
-
-                       $new_salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
-                       $new_password_hash = encrypt_password($new_password, $new_salt, true);
-
-                       db_query($this->link, "UPDATE ttrss_users SET
-                               pwd_hash = '$new_password_hash', salt = '$new_salt', otp_enabled = false
-                                       WHERE id = '$owner_uid'");
-
-                       $_SESSION["pwd_hash"] = $new_password_hash;
-
-                       return __("Password has been changed.");
-               } else {
-                       return "ERROR: ".__('Old password is incorrect.');
-               }
-       }
-}
-?>
diff --git a/classes/auth/remote.php b/classes/auth/remote.php
deleted file mode 100644 (file)
index 6892a35..0000000
+++ /dev/null
@@ -1,61 +0,0 @@
-<?php
-class Auth_Remote extends Auth_Base {
-       function get_login_by_ssl_certificate() {
-               $cert_serial = db_escape_string(get_ssl_certificate_id());
-
-               if ($cert_serial) {
-                       $result = db_query($this->link, "SELECT login FROM ttrss_user_prefs, ttrss_users
-                               WHERE pref_name = 'SSL_CERT_SERIAL' AND value = '$cert_serial' AND
-                               owner_uid = ttrss_users.id");
-
-                       if (db_num_rows($result) != 0) {
-                               return db_escape_string(db_fetch_result($result, 0, "login"));
-                       }
-               }
-
-               return "";
-       }
-
-
-       function authenticate($login, $password) {
-               $try_login = db_escape_string($_SERVER["REMOTE_USER"]);
-
-               if (!$try_login) $try_login = $this->get_login_by_ssl_certificate();
-#              if (!$try_login) $try_login = "test_qqq";
-
-               if ($try_login) {
-                       $user_id = $this->auto_create_user($try_login);
-
-                       if ($user_id) {
-                               $_SESSION["fake_login"] = $try_login;
-                               $_SESSION["fake_password"] = "******";
-                               $_SESSION["hide_hello"] = true;
-                               $_SESSION["hide_logout"] = true;
-
-                               // LemonLDAP can send user informations via HTTP HEADER
-                               if (defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE){
-                                       // update user name
-                                       $fullname = $_SERVER['HTTP_USER_NAME'] ? $_SERVER['HTTP_USER_NAME'] : $_SERVER['AUTHENTICATE_CN'];
-                                       if ($fullname){
-                                               $fullname = db_escape_string($fullname);
-                                               db_query($this->link, "UPDATE ttrss_users SET full_name = '$fullname' WHERE id = " .
-                                                       $user_id);
-                                       }
-                                       // update user mail
-                                       $email = $_SERVER['HTTP_USER_MAIL'] ? $_SERVER['HTTP_USER_MAIL'] : $_SERVER['AUTHENTICATE_MAIL'];
-                                       if ($email){
-                                               $email = db_escape_string($email);
-                                               db_query($this->link, "UPDATE ttrss_users SET email = '$email' WHERE id = " .
-                                                       $user_id);
-                                       }
-                               }
-
-                               return $user_id;
-                       }
-               }
-
-               return false;
-       }
-}
-
-?>
diff --git a/classes/iauthmodule.php b/classes/iauthmodule.php
new file mode 100644 (file)
index 0000000..d47dbac
--- /dev/null
@@ -0,0 +1,5 @@
+<?php
+interface IAuthModule {
+       function authenticate($login, $password);
+}
+?>
index 545e62e01b2468a8c284b384b02656375d8829aa..d97dfa66660a4f36568885d1295088e179b1d58d 100644 (file)
@@ -13,6 +13,7 @@ class PluginHost {
        const HOOK_PREFS_TABS = 5;
        const HOOK_FEED_PARSED = 6;
        const HOOK_UPDATE_TASK = 7;
+       const HOOK_AUTH_USER = 8;
 
        const KIND_ALL = 1;
        const KIND_SYSTEM = 2;
index e8926194e6ebf767b8a6ea9761d70cb670e1f0d0..0922e43a8068fcaa86bc6894699684e67ee28453 100644 (file)
@@ -28,8 +28,8 @@ class Pref_Prefs extends Handler_Protected {
                        return;
                }
 
-               $module_class = "auth_" . $_SESSION["auth_module"];
-               $authenticator = new $module_class($this->link);
+               global $pluginhost;
+               $authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
 
                if (method_exists($authenticator, "change_password")) {
                        print $authenticator->change_password($_SESSION["uid"], $old_pw, $new_pw);
@@ -188,9 +188,11 @@ class Pref_Prefs extends Handler_Protected {
 
                print "</form>";
 
-               if  ($_SESSION["auth_module"]) {
-                       $module_class = "auth_" . $_SESSION["auth_module"];
-                       $authenticator = new $module_class($this->link);
+               if ($_SESSION["auth_module"]) {
+                       global $pluginhost;
+
+                       $authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
+
                } else {
                        $authenticator = false;
                }
@@ -258,7 +260,7 @@ class Pref_Prefs extends Handler_Protected {
 
                        print "</form>";
 
-                       if ($_SESSION["auth_module"] == "internal") {
+                       if ($_SESSION["auth_module"] == "auth_internal") {
 
                                print "<h2>" . __("One time passwords / Authenticator") . "</h2>";
 
@@ -802,11 +804,11 @@ class Pref_Prefs extends Handler_Protected {
 
        function otpenable() {
                $password = db_escape_string($_REQUEST["password"]);
-
-               $module_class = "auth_" . $_SESSION["auth_module"];
-               $authenticator = new $module_class($this->link);
                $enable_otp = $_REQUEST["enable_otp"] == "on";
 
+               global $pluginhost;
+               $authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
+
                if ($authenticator->check_password($_SESSION["uid"], $password)) {
 
                        if ($enable_otp) {
@@ -824,8 +826,8 @@ class Pref_Prefs extends Handler_Protected {
        function otpdisable() {
                $password = db_escape_string($_REQUEST["password"]);
 
-               $module_class = "auth_" . $_SESSION["auth_module"];
-               $authenticator = new $module_class($this->link);
+               global $pluginhost;
+               $authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
 
                if ($authenticator->check_password($_SESSION["uid"], $password)) {
 
index cd7a29be6ed2e73656aa3aaaec53d0d9689d217f..e0949c61e089bc8b514e03bccd4f860da8b4da06 100644 (file)
        // *** Authentication ***
        // **********************
 
-       define('AUTH_MODULES', 'internal');
-       // Comma-separated list of authentication modules to use. 
-       // Available modules are:
-       // internal - tt-rss internal user DB
-       // remote - use server REMOTE_USER variable or client SSL certificate if enabled
-       // imap - authenticates using an IMAP server (check classes/auth/imap.php for some
-       // stuff you need to put into config.php)
-       // in preferences
-       //
+       // Please see PLUGINS below to configure various authentication modules.
 
        define('AUTH_AUTO_CREATE', true);
        // Allow authentication modules to auto-create users in tt-rss internal
        // if you experience weird errors and tt-rss failing to start, blank pages
        // after login, or content encoding errors, disable it.
 
-       define('PLUGINS', 'note');
-       // Comma-separated list of plugins to load automatically for all users. 
-       // System plugins have to be specified here.
+       define('PLUGINS', 'auth_remote, auth_internal, note');
+       // Comma-separated list of plugins to load automatically for all users.
+       // System plugins have to be specified here. Please enable at least one
+       // authentication plugin here (auth_*).
        // Users may enable other user plugins from Preferences/Plugins but may not
        // disable plugins specified in this list.
-       
+
        define('FEEDBACK_URL', '');
        // Displays an URL for users to provide feedback or comments regarding
        // this instance of tt-rss. Can lead to a forum, contact email, etc.
index d03fcfb15f0c4efaead5e3a33be17300919894e0..f6ef7c2b370ca02ac9cf302f9824d968c36d305c 100644 (file)
                if (!SINGLE_USER_MODE) {
 
                        $user_id = false;
-                       $modules = explode(",", AUTH_MODULES);
+                       /* $modules = explode(",", AUTH_MODULES);
 
                        foreach ($modules as $module) {
                                $module_class = "auth_$module";
                                        print T_sprintf("Fatal: authentication module %s not found.", $module);
                                        die;
                                }
+                       } */
+
+                       global $pluginhost;
+                       foreach ($pluginhost->get_hooks($pluginhost::HOOK_AUTH_USER) as $plugin) {
+
+                               $user_id = (int) $plugin->authenticate($login, $password);
+
+                               if ($user_id) {
+                                       $_SESSION["auth_module"] = strtolower(get_class($plugin));
+                                       break;
+                               }
                        }
 
                        if ($user_id && !$check_only) {
index f5436b6b0bf3cc3996e8f10a180be11e19ecbe2a..04058560f7b65f0add25cdd85de1d27233be94f1 100644 (file)
@@ -1,3 +1,3 @@
-<?php # This file has been generated at:  Mon Dec 24 13:27:42 MSK 2012
+<?php # This file has been generated at:  Thu Dec 27 15:13:04 MSK 2012
 define('GENERATED_CONFIG_CHECK', 26);
-$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'AUTH_MODULES', 'AUTH_AUTO_CREATE', 'AUTH_AUTO_LOGIN', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_EXPIRE_TIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'PLUGINS', 'FEEDBACK_URL', 'CONFIG_VERSION'); ?>
+$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'AUTH_AUTO_CREATE', 'AUTH_AUTO_LOGIN', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_EXPIRE_TIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'PLUGINS', 'FEEDBACK_URL', 'CONFIG_VERSION'); ?>
diff --git a/plugins/auth_imap/auth_imap.php b/plugins/auth_imap/auth_imap.php
new file mode 100644 (file)
index 0000000..cca279c
--- /dev/null
@@ -0,0 +1,51 @@
+<?php
+/* Requires php-imap
+       Put the following options in config.php:
+
+       define('IMAP_AUTH_SERVER', 'your.imap.server:port');
+       define('IMAP_AUTH_OPTIONS', '/tls/novalidate-cert/norsh');
+       // More about options: http://php.net/manual/ru/function.imap-open.php
+
+*/
+class Auth_Imap extends Plugin implements IAuthModule {
+
+       private $link;
+       private $host;
+       private $base;
+
+       function about() {
+               return array(1.0,
+                       "Authenticates against an IMAP server (configured in config.php)",
+                       "fox",
+                       true);
+       }
+
+       function init($host) {
+               $this->link = $host->get_link();
+               $this->host = $host;
+               $this->base = new Auth_Base($this->link);
+
+               $host->add_hook($host::HOOK_AUTH_USER, $this);
+       }
+
+       function authenticate($login, $password) {
+
+               if ($login && $password) {
+                       $imap = imap_open(
+                               "{".IMAP_AUTH_SERVER.IMAP_AUTH_OPTIONS."}INBOX",
+                               $login,
+                               $password);
+
+                       if ($imap) {
+                               imap_close($imap);
+
+                               return $this->base->auto_create_user($login);
+                       }
+               }
+
+               return false;
+       }
+
+}
+
+?>
diff --git a/plugins/auth_internal/auth_internal.php b/plugins/auth_internal/auth_internal.php
new file mode 100644 (file)
index 0000000..cf6c137
--- /dev/null
@@ -0,0 +1,191 @@
+<?php
+class Auth_Internal extends Plugin implements IAuthModule {
+
+       private $link;
+       private $host;
+
+       function about() {
+               return array(1.0,
+                       "Authenticates against internal tt-rss database",
+                       "fox",
+                       true);
+       }
+
+       function init($host) {
+               $this->link = $host->get_link();
+               $this->host = $host;
+
+               $host->add_hook($host::HOOK_AUTH_USER, $this);
+       }
+
+       function authenticate($login, $password) {
+
+               $pwd_hash1 = encrypt_password($password);
+               $pwd_hash2 = encrypt_password($password, $login);
+               $login = db_escape_string($login);
+               $otp = db_escape_string($_REQUEST["otp"]);
+
+               if (get_schema_version($this->link) > 96) {
+                       if (!defined('AUTH_DISABLE_OTP') || !AUTH_DISABLE_OTP) {
+                               $result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
+                                       login = '$login'");
+
+                               if (db_num_rows($result) > 0) {
+                                       require_once "lib/otphp/vendor/base32.php";
+                                       require_once "lib/otphp/lib/otp.php";
+                                       require_once "lib/otphp/lib/totp.php";
+
+                                       $base32 = new Base32();
+
+                                       $otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
+                                       $secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
+
+                                       $topt = new \OTPHP\TOTP($secret);
+                                       $otp_check = $topt->now();
+
+                                       if ($otp_enabled) {
+                                               if ($otp) {
+                                                       if ($otp != $otp_check) {
+                                                               return false;
+                                                       }
+                                               } else {
+                                                       $return = urlencode($_REQUEST["return"]);
+                                                       ?><html>
+                                                               <head><title>Tiny Tiny RSS</title></head>
+                                                       <body>
+                                                       <form action="public.php?return=<?php echo $return ?>"
+                                                                       method="POST">
+                                                               <input type="hidden" name="op" value="login">
+                                                               <input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
+                                                               <input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
+
+                                                               <label><?php echo __("Please enter your one time password:") ?></label>
+                                                               <input type="password" size="6" name="otp"/>
+                                                               <input type="submit" value="Continue"/>
+                                                       </form>
+                                                       <script type="text/javascript">
+                                                               document.forms[0].otp.focus();
+                                                       </script>
+                                                       <?php
+                                                       exit;
+                                               }
+                                       }
+                               }
+                       }
+               }
+
+               if (get_schema_version($this->link) > 87) {
+
+                       $result = db_query($this->link, "SELECT salt FROM ttrss_users WHERE
+                               login = '$login'");
+
+                       if (db_num_rows($result) != 1) {
+                               return false;
+                       }
+
+                       $salt = db_fetch_result($result, 0, "salt");
+
+                       if ($salt == "") {
+
+                               $query = "SELECT id
+                   FROM ttrss_users WHERE
+                                       login = '$login' AND (pwd_hash = '$pwd_hash1' OR
+                                       pwd_hash = '$pwd_hash2')";
+
+                               // verify and upgrade password to new salt base
+
+                               $result = db_query($this->link, $query);
+
+                               if (db_num_rows($result) == 1) {
+                                       // upgrade password to MODE2
+
+                                       $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
+                                       $pwd_hash = encrypt_password($password, $salt, true);
+
+                                       db_query($this->link, "UPDATE ttrss_users SET
+                                               pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
+
+                                       $query = "SELECT id
+                           FROM ttrss_users WHERE
+                                               login = '$login' AND pwd_hash = '$pwd_hash'";
+
+                               } else {
+                                       return false;
+                               }
+
+                       } else {
+
+                               $pwd_hash = encrypt_password($password, $salt, true);
+
+                               $query = "SELECT id
+                        FROM ttrss_users WHERE
+                                       login = '$login' AND pwd_hash = '$pwd_hash'";
+
+                       }
+
+               } else {
+                       $query = "SELECT id
+                FROM ttrss_users WHERE
+                               login = '$login' AND (pwd_hash = '$pwd_hash1' OR
+                                       pwd_hash = '$pwd_hash2')";
+               }
+
+               $result = db_query($this->link, $query);
+
+               if (db_num_rows($result) == 1) {
+                       return db_fetch_result($result, 0, "id");
+               }
+
+               return false;
+       }
+
+       function check_password($owner_uid, $password) {
+               $owner_uid = db_escape_string($owner_uid);
+
+               $result = db_query($this->link, "SELECT salt,login FROM ttrss_users WHERE
+                       id = '$owner_uid'");
+
+               $salt = db_fetch_result($result, 0, "salt");
+               $login = db_fetch_result($result, 0, "login");
+
+               if (!$salt) {
+                       $password_hash1 = encrypt_password($password);
+                       $password_hash2 = encrypt_password($password, $login);
+
+                       $query = "SELECT id FROM ttrss_users WHERE
+                               id = '$owner_uid' AND (pwd_hash = '$password_hash1' OR
+                               pwd_hash = '$password_hash2')";
+
+               } else {
+                       $password_hash = encrypt_password($password, $salt, true);
+
+                       $query = "SELECT id FROM ttrss_users WHERE
+                               id = '$owner_uid' AND pwd_hash = '$password_hash'";
+               }
+
+               $result = db_query($this->link, $query);
+
+               return db_num_rows($result) != 0;
+       }
+
+       function change_password($owner_uid, $old_password, $new_password) {
+               $owner_uid = db_escape_string($owner_uid);
+
+               if ($this->check_password($owner_uid, $old_password)) {
+
+                       $new_salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
+                       $new_password_hash = encrypt_password($new_password, $new_salt, true);
+
+                       db_query($this->link, "UPDATE ttrss_users SET
+                               pwd_hash = '$new_password_hash', salt = '$new_salt', otp_enabled = false
+                                       WHERE id = '$owner_uid'");
+
+                       $_SESSION["pwd_hash"] = $new_password_hash;
+
+                       return __("Password has been changed.");
+               } else {
+                       return "ERROR: ".__('Old password is incorrect.');
+               }
+       }
+}
+?>
diff --git a/plugins/auth_remote/auth_remote.php b/plugins/auth_remote/auth_remote.php
new file mode 100644 (file)
index 0000000..65f188b
--- /dev/null
@@ -0,0 +1,81 @@
+<?php
+class Auth_Remote extends Plugin implements IAuthModule {
+
+       private $link;
+       private $host;
+       private $base;
+
+       function about() {
+               return array(1.0,
+                       "Authenticates against remote password (e.g. supplied by Apache)",
+                       "fox",
+                       true);
+       }
+
+       function init($host) {
+               $this->link = $host->get_link();
+               $this->host = $host;
+               $this->base = new Auth_Base($this->link);
+
+               $host->add_hook($host::HOOK_AUTH_USER, $this);
+       }
+
+       function get_login_by_ssl_certificate() {
+               $cert_serial = db_escape_string(get_ssl_certificate_id());
+
+               if ($cert_serial) {
+                       $result = db_query($this->link, "SELECT login FROM ttrss_user_prefs, ttrss_users
+                               WHERE pref_name = 'SSL_CERT_SERIAL' AND value = '$cert_serial' AND
+                               owner_uid = ttrss_users.id");
+
+                       if (db_num_rows($result) != 0) {
+                               return db_escape_string(db_fetch_result($result, 0, "login"));
+                       }
+               }
+
+               return "";
+       }
+
+
+       function authenticate($login, $password) {
+               $try_login = db_escape_string($_SERVER["REMOTE_USER"]);
+
+               if (!$try_login) $try_login = $this->get_login_by_ssl_certificate();
+#              if (!$try_login) $try_login = "test_qqq";
+
+               if ($try_login) {
+                       $user_id = $this->base->auto_create_user($try_login);
+
+                       if ($user_id) {
+                               $_SESSION["fake_login"] = $try_login;
+                               $_SESSION["fake_password"] = "******";
+                               $_SESSION["hide_hello"] = true;
+                               $_SESSION["hide_logout"] = true;
+
+                               // LemonLDAP can send user informations via HTTP HEADER
+                               if (defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE){
+                                       // update user name
+                                       $fullname = $_SERVER['HTTP_USER_NAME'] ? $_SERVER['HTTP_USER_NAME'] : $_SERVER['AUTHENTICATE_CN'];
+                                       if ($fullname){
+                                               $fullname = db_escape_string($fullname);
+                                               db_query($this->link, "UPDATE ttrss_users SET full_name = '$fullname' WHERE id = " .
+                                                       $user_id);
+                                       }
+                                       // update user mail
+                                       $email = $_SERVER['HTTP_USER_MAIL'] ? $_SERVER['HTTP_USER_MAIL'] : $_SERVER['AUTHENTICATE_MAIL'];
+                                       if ($email){
+                                               $email = db_escape_string($email);
+                                               db_query($this->link, "UPDATE ttrss_users SET email = '$email' WHERE id = " .
+                                                       $user_id);
+                                       }
+                               }
+
+                               return $user_id;
+                       }
+               }
+
+               return false;
+       }
+}
+
+?>