X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fauth.php;h=72a7b75eca5c6f6b38479f5eb168ac2672e98799;hb=19d01c6b200dfd6317e4a933325d903ba2901726;hp=0de160c91499c646c2a6927eefc7de09c9b64b37;hpb=47a2932647c61c732b649a27b5dc7853bb6388ff;p=squirrelmail.git diff --git a/functions/auth.php b/functions/auth.php index 0de160c9..72a7b75e 100644 --- a/functions/auth.php +++ b/functions/auth.php @@ -3,22 +3,23 @@ /** * auth.php * - * Copyright (c) 1999-2002 The SquirrelMail Project Team + * Copyright (c) 1999-2004 The SquirrelMail Project Team * Licensed under the GNU GPL. For full terms see the file COPYING. * * Contains functions used to do authentication. * - * $Id$ + * @version $Id$ + * @package squirrelmail */ -/* Put in a safety net here, in case a naughty admin didn't run conf.pl when they upgraded */ +/** Put in a safety net here, in case a naughty admin didn't run conf.pl when they upgraded */ if (! isset($smtp_auth_mech)) { $smtp_auth_mech = 'none'; } if (! isset($imap_auth_mech)) { - $imap_auth_mech = 'plain'; + $imap_auth_mech = 'login'; } if (! isset($use_imap_tls)) { @@ -29,13 +30,20 @@ if (! isset($use_smtp_tls)) { $use_smtp_tls = false; } +/** + * Check if user has previously logged in to the Squirrelmail session. If user + * has not logged in, execution will stop inside this function. + * + * @return int A positive value is returned if user has previously logged in + * successfully. + */ function is_logged_in() { if ( sqsession_is_registered('user_is_logged_in') ) { return; } else { global $PHP_SELF, $session_expired_post, - $session_expired_location; + $session_expired_location, $squirrelmail_language; /* First we store some information in the new session to prevent * information-loss. @@ -49,36 +57,55 @@ function is_logged_in() { if (!sqsession_is_registered('session_expired_location')) { sqsession_register($session_expired_location,'session_expired_location'); } - include_once( '../functions/display_messages.php' ); + include_once( SM_PATH . 'functions/display_messages.php' ); + set_up_language($squirrelmail_language, true); logout_error( _("You must be logged in to access this page.") ); exit; } } +/** + * Given the challenge from the server, supply the response using cram-md5 (See + * RFC 2195 for details) + * + * @param string $username User ID + * @param string $password User password supplied by User + * @param string $challenge The challenge supplied by the server + * @return string The response to be sent to the IMAP server + * + */ function cram_md5_response ($username,$password,$challenge) { - -/* Given the challenge from the server, supply the response using - cram-md5 (See RFC 2195 for details) - NOTE: Requires mhash extension to PHP -*/ -$challenge=base64_decode($challenge); -$hash=bin2hex(mhash(MHASH_MD5,$challenge,$password)); -$response=base64_encode($username . " " . $hash) . "\r\n"; -return $response; + $challenge=base64_decode($challenge); + $hash=bin2hex(hmac_md5($challenge,$password)); + $response=base64_encode($username . " " . $hash) . "\r\n"; + return $response; } +/** + * Return Digest-MD5 response. + * Given the challenge from the server, calculate and return the + * response-string for digest-md5 authentication. (See RFC 2831 for more + * details) + * + * @param string $username User ID + * @param string $password User password supplied by User + * @param string $challenge The challenge supplied by the server + * @param string $service The service name, usually 'imap'; it is used to + * define the digest-uri. + * @param string $host The host name, usually the server's FQDN; it is used to + * define the digest-uri. + * @return string The response to be sent to the IMAP server + */ function digest_md5_response ($username,$password,$challenge,$service,$host) { -/* Given the challenge from the server, calculate and return the response-string - for digest-md5 authentication. (See RFC 2831 for more details) */ $result=digest_md5_parse_challenge($challenge); // verify server supports qop=auth - $qop = explode(",",$result['qop']); + // $qop = explode(",",$result['qop']); //if (!in_array("auth",$qop)) { // rfc2831: client MUST fail if no qop methods supported // return false; //} - $cnonce = base64_encode(bin2hex(mhash(MHASH_MD5, microtime()))); + $cnonce = base64_encode(bin2hex(hmac_md5(microtime()))); $ncount = "00000001"; /* This can be auth (authentication only), auth-int (integrity protection), or @@ -93,18 +120,18 @@ function digest_md5_response ($username,$password,$challenge,$service,$host) { $string_a1 = utf8_encode($username).":"; $string_a1 .= utf8_encode($result['realm']).":"; $string_a1 .= utf8_encode($password); - $string_a1 = mhash(MHASH_MD5, $string_a1); + $string_a1 = hmac_md5($string_a1); $A1 = $string_a1 . ":" . $result['nonce'] . ":" . $cnonce; - $A1 = bin2hex(mhash(MHASH_MD5, $A1)); + $A1 = bin2hex(hmac_md5($A1)); $A2 = "AUTHENTICATE:$digest_uri_value"; // If qop is auth-int or auth-conf, A2 gets a little extra if ($qop_value != 'auth') { $A2 .= ':00000000000000000000000000000000'; } - $A2 = bin2hex(mhash(MHASH_MD5, $A2)); + $A2 = bin2hex(hmac_md5($A2)); $string_response = $result['nonce'] . ':' . $ncount . ':' . $cnonce . ':' . $qop_value; - $response_value = bin2hex(mhash(MHASH_MD5, $A1.":".$string_response.":".$A2)); + $response_value = bin2hex(hmac_md5($A1.":".$string_response.":".$A2)); $reply = 'charset=utf-8,username="' . $username . '",realm="' . $result["realm"] . '",'; $reply .= 'nonce="' . $result['nonce'] . '",nc=' . $ncount . ',cnonce="' . $cnonce . '",'; @@ -115,12 +142,17 @@ function digest_md5_response ($username,$password,$challenge,$service,$host) { } +/** + * Parse Digest-MD5 challenge. + * This function parses the challenge sent during DIGEST-MD5 authentication and + * returns an array. See the RFC for details on what's in the challenge string. + * + * @param string $challenge Digest-MD5 Challenge + * @return array Digest-MD5 challenge decoded data + */ function digest_md5_parse_challenge($challenge) { -/* This function parses the challenge sent during DIGEST-MD5 authentication and - returns an array. See the RFC for details on what's in the challenge string. -*/ $challenge=base64_decode($challenge); - while (strlen($challenge)) { + while (isset($challenge)) { if ($challenge{0} == ',') { // First char is a comma, must not be 1st time through loop $challenge=substr($challenge,1); } @@ -142,7 +174,11 @@ function digest_md5_parse_challenge($challenge) { } else { // We're in a "simple" value - explode to next comma $val=explode(',',$challenge,2); - $challenge=$val[1]; + if (isset($val[1])) { + $challenge=$val[1]; + } else { + unset($challenge); + } $value=$val[0]; } $parsed["$key"]=$value; @@ -150,4 +186,60 @@ function digest_md5_parse_challenge($challenge) { return $parsed; } +/** + * Creates a HMAC digest that can be used for auth purposes + * See RFCs 2104, 2617, 2831 + * Uses mhash() extension if available + * + * @param string $data Data to apply hash function to. + * @param string $key Optional key, which, if supplied, will be used to + * calculate data's HMAC. + * @return string HMAC Digest string + */ +function hmac_md5($data, $key='') { + if (extension_loaded('mhash')) { + if ($key== '') { + $mhash=mhash(MHASH_MD5,$data); + } else { + $mhash=mhash(MHASH_MD5,$data,$key); + } + return $mhash; + } + if (!$key) { + return pack('H*',md5($data)); + } + $key = str_pad($key,64,chr(0x00)); + if (strlen($key) > 64) { + $key = pack("H*",md5($key)); + } + $k_ipad = $key ^ str_repeat(chr(0x36), 64) ; + $k_opad = $key ^ str_repeat(chr(0x5c), 64) ; + /* Heh, let's get recursive. */ + $hmac=hmac_md5($k_opad . pack("H*",md5($k_ipad . $data)) ); + return $hmac; +} + +/** + * Fillin user and password based on SMTP auth settings. + * + * @param string $user Reference to SMTP username + * @param string $pass Reference to SMTP password (unencrypted) + */ +function get_smtp_user(&$user, &$pass) { + global $username, $smtp_auth_mech, + $smtp_sitewide_user, $smtp_sitewide_pass; + + if ($smtp_auth_mech == 'none') { + $user = ''; + $pass = ''; + } elseif ( isset($smtp_sitewide_user) && isset($smtp_sitewide_pass) ) { + $user = $smtp_sitewide_user; + $pass = $smtp_sitewide_pass; + } else { + global $key, $onetimepad; + $user = $username; + $pass = OneTimePadDecrypt($key, $onetimepad); + } +} + ?>