Rev 94 | Blame | Compare with Previous | Last modification | View Log | RSS feed
<?php//// +----------------------------------------------------------------------+// | PHP Version 4 |// +----------------------------------------------------------------------+// | Copyright (c) 1997-2004 The PHP Group |// +----------------------------------------------------------------------+// | This source file is subject to version 2.02 of the PHP license, |// | that is bundled with this package in the file LICENSE, and is |// | available at through the world-wide-web at |// | http://www.php.net/license/2_02.txt. |// | If you did not receive a copy of the PHP license and are unable to |// | obtain it through the world-wide-web, please send a note to |// | license@php.net so we can mail you a copy immediately. |// +----------------------------------------------------------------------+// | Authors: Martin Jansen <mj@php.net> |// | Rui Hirokawa <hirokawa@php.net> |// | David Costa <gurugeek@php.net> |// +----------------------------------------------------------------------+//// $Id: Auth_HTTP.php,v 1.27 2005/04/04 12:48:33 hirokawa Exp $//require_once "Auth/Auth.php";define('AUTH_HTTP_NONCE_TIME_LEN', 16);define('AUTH_HTTP_NONCE_HASH_LEN', 32);// {{{ class Auth_HTTP/*** PEAR::Auth_HTTP** The PEAR::Auth_HTTP class provides methods for creating an* HTTP authentication system based on RFC-2617 using PHP.** Instead of generating an HTML driven form like PEAR::Auth* does, this class sends header commands to the clients which* cause them to present a login box like they are e.g. used* in Apache's .htaccess mechanism.** This class requires the PEAR::Auth package.** @notes The HTTP Digest Authentication part is based on* authentication class written by Tom Pike <tom.pike@xiven.com>** @author Martin Jansen <mj@php.net>* @author Rui Hirokawa <hirokawa@php.net>* @author David Costa <gurugeek@php.net>* @package Auth_HTTP* @extends Auth* @version $Revision: 1.27 $*/class Auth_HTTP extends Auth{// {{{ properties/*** Authorization method: 'basic' or 'digest'** @access public* @var string*/var $authType = 'basic';/*** Name of the realm for Basic Authentication** @access public* @var string* @see drawLogin()*/var $realm = "protected area";/*** Text to send if user hits cancel button** @access public* @var string* @see drawLogin()*/var $CancelText = "Error 401 - Access denied";/*** option array** @access public* @var array*/var $options = array();/*** flag to indicate the nonce was stale.** @access public* @var bool*/var $stale = false;/*** opaque string for digest authentication** @access public* @var string*/var $opaque = 'dummy';/*** digest URI** @access public* @var string*/var $uri = '';/*** authorization info returned by the client** @access public* @var array*/var $auth = array();/*** next nonce value** @access public* @var string*/var $nextNonce = '';/*** nonce value** @access public* @var string*/var $nonce = '';/*** Holds a reference to the global server variable* @var array*/var $server;/*** Holds a reference to the global post variable* @var array*/var $post;/*** Holds a reference to the global cookie variable* @var array*/var $cookie;// }}}// {{{ Constructor/*** Constructor** @param string Type of the storage driver* @param mixed Additional options for the storage driver* (example: if you are using DB as the storage* driver, you have to pass the dsn string here)** @return void*/function Auth_HTTP($storageDriver, $options = ''){/* set default values for options */$this->options = array('cryptType' => 'md5','algorithm' => 'MD5','qop' => 'auth-int,auth','opaquekey' => 'moo','noncekey' => 'moo','digestRealm' => 'protected area','forceDigestOnly' => false,'nonceLife' => 300,'sessionSharing' => true,);if (!empty($options['authType'])) {$this->authType = strtolower($options['authType']);}if (is_array($options)) {foreach($options as $key => $value) {if (array_key_exists( $key, $this->options)) {$this->options[$key] = $value;}}if (!empty($this->options['opaquekey'])) {$this->opaque = md5($this->options['opaquekey']);}}$this->Auth($storageDriver, $options);}// }}}// {{{ assignData()/*** Assign values from $PHP_AUTH_USER and $PHP_AUTH_PW or 'Authorization' header* to internal variables and sets the session id based* on them** @access public* @return void*/function assignData(){if (method_exists($this, '_importGlobalVariable')) {$this->server = &$this->_importGlobalVariable('server');}if ($this->authType == 'basic') {if (!empty($this->server['PHP_AUTH_USER'])) {$this->username = $this->server['PHP_AUTH_USER'];}if (!empty($this->server['PHP_AUTH_PW'])) {$this->password = $this->server['PHP_AUTH_PW'];}/*** Try to get authentication information from IIS*/if (empty($this->username) && empty($this->password)) {if (!empty($this->server['HTTP_AUTHORIZATION'])) {list($this->username, $this->password) =explode(':', base64_decode(substr($this->server['HTTP_AUTHORIZATION'], 6)));}}} elseif ($this->authType == 'digest') {$this->username = '';$this->password = '';$this->digest_header = null;if (!empty($this->server['PHP_AUTH_DIGEST'])) {$this->digest_header = substr($this->server['PHP_AUTH_DIGEST'],strpos($this->server['PHP_AUTH_DIGEST'],' ')+1);} else {$headers = getallheaders();if(isset($headers['Authorization']) && !empty($headers['Authorization'])) {$this->digest_header = substr($headers['Authorization'],strpos($headers['Authorization'],' ')+1);}}if($this->digest_header) {$authtemp = explode(',', $this->digest_header);$auth = array();foreach($authtemp as $key => $value) {$value = trim($value);if(strpos($value,'=') !== false) {$lhs = substr($value,0,strpos($value,'='));$rhs = substr($value,strpos($value,'=')+1);if(substr($rhs,0,1) == '"' && substr($rhs,-1,1) == '"') {$rhs = substr($rhs,1,-1);}$auth[$lhs] = $rhs;}}}if (!isset($auth['uri']) || !isset($auth['realm'])) {return;}if ($this->selfURI() == $auth['uri']) {$this->uri = $auth['uri'];if (substr($headers['Authorization'],0,7) == 'Digest ') {$this->authType = 'digest';if (!isset($auth['nonce']) || !isset($auth['username']) ||!isset($auth['response']) || !isset($auth['qop']) ||!isset($auth['nc']) || !isset($auth['cnonce'])){return;}if ($auth['qop'] != 'auth' && $auth['qop'] != 'auth-int') {return;}$this->stale = $this->_judgeStale($auth['nonce']);if ($this->nextNonce == false) {return;}$this->username = $auth['username'];$this->password = $auth['response'];$this->auth['nonce'] = $auth['nonce'];$this->auth['qop'] = $auth['qop'];$this->auth['nc'] = $auth['nc'];$this->auth['cnonce'] = $auth['cnonce'];if (isset($auth['opaque'])) {$this->auth['opaque'] = $auth['opaque'];}} elseif (substr($headers['Authorization'],0,6) == 'Basic ') {if ($this->options['forceDigestOnly']) {return; // Basic authentication is not allowed.}$this->authType = 'basic';list($username, $password) =explode(':',base64_decode(substr($headers['Authorization'],6)));$this->username = $username;$this->password = $password;}}} else {return PEAR::raiseError('authType is invalid.');}if ($this->options['sessionSharing'] &&isset($this->username) && isset($this->password)) {session_id(md5('Auth_HTTP' . $this->username . $this->password));}/*** set sessionName for AUTH, so that the sessionName is different* for distinct realms*/$this->_sessionName = "_authhttp".md5($this->realm);}// }}}// {{{ login()/*** Login function** @access private* @return void*/function login(){$login_ok = false;if (method_exists($this, '_loadStorage')) {$this->_loadStorage();}$this->storage->_auth_obj->_sessionName =& $this->_sessionName;/*** When the user has already entered a username,* we have to validate it.*/if (!empty($this->username) && !empty($this->password)) {if ($this->authType == 'basic' && !$this->options['forceDigestOnly']) {if (true === $this->storage->fetchData($this->username, $this->password)) {$login_ok = true;}} else { /* digest authentication */if (!$this->getAuth() || $this->getAuthData('a1') == null) {/** note:* - only PEAR::DB is supported as container.* - password should be stored in container as plain-text* (if $options['cryptType'] == 'none') or* A1 hashed form (md5('username:realm:password'))* (if $options['cryptType'] == 'md5')*/$dbs = $this->storage;if (!DB::isConnection($dbs->db)) {$dbs->_connect($dbs->options['dsn']);}$query = 'SELECT '.$dbs->options['passwordcol']." FROM ".$dbs->options['table'].' WHERE '.$dbs->options['usernamecol']." = '".$dbs->db->quoteString($this->username)."' ";$pwd = $dbs->db->getOne($query); // password stored in container.if (DB::isError($pwd)) {return PEAR::raiseError($pwd->getMessage(), $pwd->getCode());}if ($this->options['cryptType'] == 'none') {$a1 = md5($this->username.':'.$this->options['digestRealm'].':'.$pwd);} else {$a1 = $pwd;}$this->setAuthData('a1', $a1, true);} else {$a1 = $this->getAuthData('a1');}$login_ok = $this->validateDigest($this->password, $a1);if ($this->nextNonce == false) {$login_ok = false;}}if (!$login_ok && is_callable($this->loginFailedCallback)) {call_user_func($this->loginFailedCallback,$this->username, $this);}}if (!empty($this->username) && $login_ok) {$this->setAuth($this->username);if (is_callable($this->loginCallback)) {call_user_func($this->loginCallback,$this->username, $this);}}/*** If the login failed or the user entered no username,* output the login screen again.*/if (!empty($this->username) && !$login_ok) {$this->status = AUTH_WRONG_LOGIN;}if ((empty($this->username) || !$login_ok) && $this->showLogin) {$this->drawLogin($this->storage->activeUser);return;}if (!empty($this->username) && $login_ok && $this->authType == 'digest'&& $this->auth['qop'] == 'auth') {$this->authenticationInfo();}}// }}}// {{{ drawLogin()/*** Launch the login box** @param string $username Username* @return void* @access private*/function drawLogin($username = ""){/*** Send the header commands*/if ($this->authType == 'basic') {header("WWW-Authenticate: Basic realm=\"".$this->realm."\"");header('HTTP/1.0 401 Unauthorized');} else if ($this->authType == 'digest') {$this->nonce = $this->_getNonce();$wwwauth = 'WWW-Authenticate: Digest ';$wwwauth .= 'qop="'.$this->options['qop'].'", ';$wwwauth .= 'algorithm='.$this->options['algorithm'].', ';$wwwauth .= 'realm="'.$this->options['digestRealm'].'", ';$wwwauth .= 'nonce="'.$this->nonce.'", ';if ($this->stale) {$wwwauth .= 'stale=true, ';}if (!empty($this->opaque)) {$wwwauth .= 'opaque="'.$this->opaque.'"' ;}$wwwauth .= "\r\n";if (!$this->options['forceDigestOnly']) {$wwwauth .= 'WWW-Authenticate: Basic realm="'.$this->realm.'"';}header($wwwauth);header('HTTP/1.0 401 Unauthorized');}/*** This code is only executed if the user hits the cancel* button or if he enters wrong data 3 times.*/if ($this->stale) {echo 'Stale nonce value, please re-authenticate.';} else {echo $this->CancelText;}exit;}// }}}// {{{ setRealm()/*** Set name of the current realm** @access public* @param string $realm Name of the realm* @param string $digestRealm Name of the realm for digest authentication* @return void*/function setRealm($realm, $digestRealm = ''){$this->realm = $realm;if (!empty($digestRealm)) {$this->options['digestRealm'] = $digestRealm;}}// }}}// {{{ setCancelText()/*** Set the text to send if user hits the cancel button** @access public* @param string $text Text to send* @return void*/function setCancelText($text){$this->CancelText = $text;}// }}}// {{{ validateDigest()/*** judge if the client response is valid.** @access private* @param string $response client response* @param string $a1 password or hashed password stored in container* @return bool true if success, false otherwise*/function validateDigest($response, $a1){if (method_exists($this, '_importGlobalVariable')) {$this->server = &$this->_importGlobalVariable('server');}$a2unhashed = $this->server['REQUEST_METHOD'].":".$this->selfURI();if($this->auth['qop'] == 'auth-int') {if(isset($GLOBALS["HTTP_RAW_POST_DATA"])) {// In PHP < 4.3 get raw POST data from this variable$body = $GLOBALS["HTTP_RAW_POST_DATA"];} else if($lines = @file('php://input')) {// In PHP >= 4.3 get raw POST data from this file$body = implode("\n", $lines);} else {if (method_exists($this, '_importGlobalVariable')) {$this->post = &$this->_importGlobalVariable('post');}$body = '';foreach($this->post as $key => $value) {if($body != '') $body .= '&';$body .= rawurlencode($key) . '=' . rawurlencode($value);}}$a2unhashed .= ':'.md5($body);}$a2 = md5($a2unhashed);$combined = $a1.':'.$this->auth['nonce'].':'.$this->auth['nc'].':'.$this->auth['cnonce'].':'.$this->auth['qop'].':'.$a2;$expectedResponse = md5($combined);if(!isset($this->auth['opaque']) || $this->auth['opaque'] == $this->opaque) {if($response == $expectedResponse) { // password is validif(!$this->stale) {return true;} else {$this->drawLogin();}}}return false;}// }}}// {{{ _judgeStale()/*** judge if nonce from client is stale.** @access private* @param string $nonce nonce value from client* @return bool stale*/function _judgeStale($nonce){$stale = false;if(!$this->_decodeNonce($nonce, $time, $hash_cli)) {$this->nextNonce = false;$stale = true;return $stale;}if ($time < time() - $this->options['nonceLife']) {$this->nextNonce = $this->_getNonce();$stale = true;} else {$this->nextNonce = $nonce;}return $stale;}// }}}// {{{ _nonceDecode()/*** decode nonce string** @access private* @param string $nonce nonce value from client* @param string $time decoded time* @param string $hash decoded hash* @return bool false if nonce is invalid*/function _decodeNonce($nonce, &$time, &$hash){if (method_exists($this, '_importGlobalVariable')) {$this->server = &$this->_importGlobalVariable('server');}if (strlen($nonce) != AUTH_HTTP_NONCE_TIME_LEN + AUTH_HTTP_NONCE_HASH_LEN) {return false;}$time = base64_decode(substr($nonce, 0, AUTH_HTTP_NONCE_TIME_LEN));$hash_cli = substr($nonce, AUTH_HTTP_NONCE_TIME_LEN, AUTH_HTTP_NONCE_HASH_LEN);$hash = md5($time . $this->server['HTTP_USER_AGENT'] . $this->options['noncekey']);if ($hash_cli != $hash) {return false;}return true;}// }}}// {{{ _getNonce()/*** return nonce to detect timeout** @access private* @return string nonce value*/function _getNonce(){if (method_exists($this, '_importGlobalVariable')) {$this->server = &$this->_importGlobalVariable('server');}$time = time();$hash = md5($time . $this->server['HTTP_USER_AGENT'] . $this->options['noncekey']);return base64_encode($time) . $hash;}// }}}// {{{ authenticationInfo()/*** output HTTP Authentication-Info header** @notes md5 hash of contents is required if 'qop' is 'auth-int'** @access private* @param string MD5 hash of content*/function authenticationInfo($contentMD5 = '') {if($this->getAuth() && ($this->getAuthData('a1') != null)) {$a1 = $this->getAuthData('a1');// Work out authorisation response$a2unhashed = ":".$this->selfURI();if($this->auth['qop'] == 'auth-int') {$a2unhashed .= ':'.$contentMD5;}$a2 = md5($a2unhashed);$combined = $a1.':'.$this->nonce.':'.$this->auth['nc'].':'.$this->auth['cnonce'].':'.$this->auth['qop'].':'.$a2;// Send authentication info$wwwauth = 'Authentication-Info: ';if($this->nonce != $this->nextNonce) {$wwwauth .= 'nextnonce="'.$this->nextNonce.'", ';}$wwwauth .= 'qop='.$this->auth['qop'].', ';$wwwauth .= 'rspauth="'.md5($combined).'", ';$wwwauth .= 'cnonce="'.$this->auth['cnonce'].'", ';$wwwauth .= 'nc='.$this->auth['nc'].'';header($wwwauth);}}// }}}// {{{ setOption()/*** set authentication option** @access public* @param mixed $name key of option* @param mixed $value value of option* @return void*/function setOption($name, $value = null){if (is_array($name)) {foreach($name as $key => $value) {if (array_key_exists( $key, $this->options)) {$this->options[$key] = $value;}}} else {if (array_key_exists( $name, $this->options)) {$this->options[$name] = $value;}}}// }}}// {{{ getOption()/*** get authentication option** @access public* @param string $name key of option* @return mixed option value*/function getOption($name){if (array_key_exists( $name, $this->options)) {return $this->options[$name];}if ($name == 'CancelText') {return $this->CancelText;}if ($name == 'Realm') {return $this->realm;}return false;}// }}}// {{{ selfURI()/*** get self URI** @access public* @return string self URI*/function selfURI(){if (method_exists($this, '_importGlobalVariable')) {$this->server = &$this->_importGlobalVariable('server');}if (preg_match("/MSIE/",$this->server['HTTP_USER_AGENT'])) {// query string should be removed for MSIE$uri = preg_replace("/^(.*)\?/","\\1",$this->server['REQUEST_URI']);} else {$uri = $this->server['REQUEST_URI'];}return $uri;}// }}}}// }}}/** Local variables:* tab-width: 4* c-basic-offset: 4* End:*/?>