[Sommaire] [Imprimer]

   1  <?php
   2      /**************************************************************************\
   3      * eGroupWare API - Auth from SQL                                           *
   4      * This file written by Dan Kuykendall <seek3r@phpgroupware.org>            *
   5      * and Joseph Engo <jengo@phpgroupware.org>                                 *
   6      * Encryption types other than md5() added by                               *
   7      *  Miles Lott <milos@groupwhere.org> based on code from                    *
   8      *  http://www.thomas-alfeld.de/frank/                                      *
   9      * massive code cleanup and                                                 *
  10      * added password migration by                                              *
  11      *  Cornelius Weiss <egw@von-und-zu-weiss.de                                *
  12      * Authentication based on SQL table                                        *
  13      * Copyright (C) 2000, 2001 Dan Kuykendall                                  *
  14      * ------------------------------------------------------------------------ *
  15      * This library is free software; you can redistribute it and/or modify it  *
  16      * under the terms of the GNU Lesser General Public License as published by *
  17      * the Free Software Foundation; either version 2.1 of the License,         *
  18      * or any later version.                                                    *
  19      * This library is distributed in the hope that it will be useful, but      *
  20      * WITHOUT ANY WARRANTY; without even the implied warranty of               *
  21      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.                     *
  22      * See the GNU Lesser General Public License for more details.              *
  23      * You should have received a copy of the GNU Lesser General Public License *
  24      * along with this library; if not, write to the Free Software Foundation,  *
  25      * Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA            *
  26      \**************************************************************************/
  27      
  28      /* $Id: class.auth_sql.inc.php 20295 2006-02-15 12:31:25Z  $ */
  29  
  30      class auth_
  31      {
  32          var $db = '';
  33          var $previous_login = -1;
  34  
  35  		function auth_()
  36          {
  37              $this->db = clone($GLOBALS['egw']->db);
  38              $this->db->set_app('phpgwapi');
  39              $this->table = 'egw_accounts';
  40  
  41              $this->type = @$GLOBALS['egw_info']['server']['sql_encryption_type'] ?
  42                  strtolower($GLOBALS['egw_info']['server']['sql_encryption_type']) : 'md5';
  43          }
  44  
  45          /**
  46           * password authentication against password stored in sql datababse
  47           *
  48           * @param string $username username of account to authenticate
  49           * @param string $passwd corresponding password
  50           * @param string $passwd_type='text' 'text' for cleartext passwords (default) 
  51           * @return boolean true if successful authenticated, false otherwise
  52           */
  53  		function authenticate($username, $passwd, $passwd_type='text')
  54          {
  55              /* normal web form login */
  56              if($passwd_type == 'text')
  57              {
  58                  $this->db->select($this->table,'account_lid,account_pwd,account_lastlogin',array(
  59                      'account_lid'    => $username,
  60                      'account_type'   => 'u',
  61                      'account_status' => 'A'
  62                  ),__LINE__,__FILE__);
  63                  
  64                  if(!$this->db->next_record() || !$this->db->f('account_pwd') ||
  65                      $GLOBALS['egw_info']['server']['case_sensitive_username'] && $this->db->f('account_lid') != $username)
  66                  {
  67                      return false;
  68                  }
  69                  if(!$this->compare_password($passwd,$this->db->f('account_pwd'),$this->type,strtolower($username)))
  70                  {
  71                      $match = false;
  72                      // do we have to migrate an old password ?
  73                      if($GLOBALS['egw_info']['server']['pwd_migration_allowed'] && !empty($GLOBALS['egw_info']['server']['pwd_migration_types']))
  74                      {
  75                          foreach(explode(',', $GLOBALS['egw_info']['server']['pwd_migration_types']) as $type)
  76                          {
  77                              if($this->compare_password($passwd,$this->db->f('account_pwd'),$type,strtolower($username)))
  78                              {
  79                                  $account_id = $GLOBALS['egw_info']['user']['account_id'];
  80                                  $encrypted_passwd = $this->encrypt_sql($passwd);
  81                                  $this->_update_passwd($encrypted_passwd,$passwd,$account_id);
  82                                  $match = true;
  83                                  break;
  84                              }
  85                          }
  86                      }
  87                      if (!$match) return false;
  88                  }
  89              }
  90              /* Auth via crypted password. NOTE: mail needs cleartext password to authenticate against mailserver! */
  91              else
  92              {
  93                  $this->db->select($this->table,'account_lid,account_lastlogin',array(
  94                      'account_lid' => $username,
  95                      'account_type'   => 'u',
  96                      'account_status' => 'A',
  97                      'account_pwd' => $passwd,
  98                  ),__LINE__,__FILE__);
  99                  
 100                  if(!$this->db->next_record() ||
 101                      $GLOBALS['egw_info']['server']['case_sensitive_username'] && $this->db->f('account_lid') != $username)
 102                  {
 103                      return false;
 104                  }
 105              }
 106              // if this point is reached, auth was successfull
 107              $this->previous_login = $this->db->f('account_lastlogin');
 108  
 109              return true;
 110          }
 111  
 112          /**
 113           * changes password in sql datababse
 114           *
 115           * @param string $old_passwd must be cleartext
 116           * @param string $new_passwd must be cleartext
 117           * @param int $account_id account id of user whose passwd should be changed
 118           * @return boolean true if password successful changed, false otherwise
 119           */
 120  		function change_password($old_passwd, $new_passwd, $account_id=0)
 121          {
 122              $admin = True;
 123              // Don't allow password changes for other accounts when using XML-RPC
 124              if(!$account_id || $GLOBALS['egw_info']['flags']['currentapp'] == 'login')
 125              {
 126                  $admin = False;
 127                  $account_id = $GLOBALS['egw_info']['user']['account_id'];
 128              }
 129                      
 130              $this->db->select($this->table,'account_pwd',array(
 131                  'account_id'     => $account_id,
 132                  'account_type'   => 'u',
 133                  'account_status' => 'A',
 134              ),__LINE__,__FILE__);
 135  
 136              if(!$this->db->next_record()) return false;    // account not found
 137  
 138              /* Check the old_passwd to make sure this is legal */
 139              if(!$admin && !$this->compare_password($old_passwd,$this->db->f('account_pwd'),$this->type,strtolower($username)))
 140              {
 141                  return false;
 142              }
 143  
 144              /* old password ok, or admin called the function from the admin application (no old passwd available).*/
 145              return $this->_update_passwd($this->encrypt_sql($new_passwd),$new_passwd,$account_id,$admin);
 146          }
 147  
 148          /**
 149           * changes password in sql datababse
 150           *
 151           * @internal 
 152           * @param string $encrypted_passwd
 153           * @param string $new_passwd cleartext
 154           * @param int $account_id account id of user whose passwd should be changed
 155           * @param boolean $admin=false called by admin, if not update password in the session
 156           * @return boolean true if password successful changed, false otherwise
 157           */
 158  		function _update_passwd($encrypted_passwd,$new_passwd,$account_id,$admin=false)
 159          {
 160              $this->db->update($this->table,array(
 161                  'account_pwd' => $encrypted_passwd,
 162                  'account_lastpwd_change' => time(),
 163              ),array(
 164                  'account_id' => $account_id,
 165              ),__LINE__,__FILE__);
 166  
 167              if(!$this->db->affected_rows()) return false;
 168              
 169              if(!$admin)
 170              {
 171                  $GLOBALS['egw']->session->appsession('password','phpgwapi',$new_passwd);
 172              }
 173              return $encrypted_passwd;
 174          }
 175      }