X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fauth.php;h=65ac45bfa0e43adacabbca80f4d700b327e4ec40;hp=a051aeaf2e3d31fd9c2b3d3b2d425ff1042a5bd2;hb=0fcb12718ed2c817e8be5b0bb1eb947ffb93d423;hpb=47ccfad452e8d345542d09e59112cac317cffed8 diff --git a/functions/auth.php b/functions/auth.php index a051aeaf..65ac45bf 100644 --- a/functions/auth.php +++ b/functions/auth.php @@ -3,109 +3,86 @@ /** * auth.php * - * Contains functions used to do authentication. Library depends on - * functions from functions/global.php, functions/i18n.php and - * functions/strings.php. + * Contains functions used to do authentication. + * + * Dependencies: + * functions/global.php + * functions/strings.php. * - * @copyright © 1999-2006 The SquirrelMail Project Team + * @copyright 1999-2012 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail */ -/** Put in a safety net here, in case a naughty admin didn't run conf.pl when they upgraded */ - -if (! isset($smtp_auth_mech)) { - $smtp_auth_mech = 'none'; -} - -if (! isset($imap_auth_mech)) { - $imap_auth_mech = 'login'; -} - -if (! isset($use_imap_tls)) { - $use_imap_tls = false; -} - -if (! isset($use_smtp_tls)) { - $use_smtp_tls = false; -} /** - * Check if user has previously logged in to the SquirrelMail session. If user - * has not logged in, execution will stop inside this function. + * Detect whether user is logged in * - * @return int A positive value is returned if user has previously logged in - * successfully. - * @since 1.0 - */ -function is_logged_in() { - - if ( sqsession_is_registered('user_is_logged_in') ) { - return; - } else { - global $PHP_SELF, $session_expired_post, - $session_expired_location, $squirrelmail_language; - - // First we store some information in the new session to prevent - // information-loss. - // - $session_expired_post = $_POST; - $session_expired_location = $PHP_SELF; - if (!sqsession_is_registered('session_expired_post')) { - sqsession_register($session_expired_post,'session_expired_post'); - } - if (!sqsession_is_registered('session_expired_location')) { - sqsession_register($session_expired_location,'session_expired_location'); - } - - // signout page will deal with users who aren't logged - // in on its own; don't show error here - // - if (strpos($PHP_SELF, 'signout.php') !== FALSE) { - return; - } - - include_once( SM_PATH . 'functions/display_messages.php' ); - set_up_language($squirrelmail_language, true); - logout_error( _("You must be logged in to access this page.") ); - exit; - } -} - -/** - * Detect logged user - * - * Function is similar to is_logged_in() function. If user is logged in, function + * Function is similar to is_logged_in() function. If user is logged in, function * returns true. If user is not logged in or session is expired, function saves $_POST - * and $PHP_SELF in session and returns false. POST information is saved in - * 'session_expired_post' variable, PHP_SELF is saved in 'session_expired_location'. + * and PAGE_NAME in session and returns false. POST information is saved in + * 'session_expired_post' variable, PAGE_NAME is saved in 'session_expired_location'. + * + * This function optionally checks the referrer of this page request. If the + * administrator wants to impose a check that the referrer of this page request + * is another page on the same domain (otherwise, the page request is likely + * the result of a XSS or phishing attack), then they need to specify the + * acceptable referrer domain in a variable named $check_referrer in + * config/config.php (or the configuration tool) for which the value is + * usually the same as the $domain setting (for example: + * $check_referrer = 'example.com'; + * However, in some cases (where proxy servers are in use, etc.), the + * acceptable referrer might be different. If $check_referrer is set to + * "###DOMAIN###", then the current value of $domain is used (useful in + * situations where $domain might change at runtime (when using the Login + * Manager plugin to host multiple domains with one SquirrelMail installation, + * for example)): + * $check_referrer = '###DOMAIN###'; + * NOTE HOWEVER, that referrer checks are not foolproof - they can be spoofed + * by browsers, and some browsers intentionally don't send them, in which + * case SquirrelMail silently ignores referrer checks. * - * Script that uses this function instead of is_logged_in() function, must handle user + * Script that uses this function instead of is_logged_in() function, must handle user * level messages. * @return boolean * @since 1.5.1 */ function sqauth_is_logged_in() { - if ( sqsession_is_registered('user_is_logged_in') ) { + + global $check_referrer, $domain; + if (!sqgetGlobalVar('HTTP_REFERER', $referrer, SQ_SERVER)) $referrer = ''; + if ($check_referrer == '###DOMAIN###') $check_referrer = $domain; + if (!empty($check_referrer)) { + $ssl_check_referrer = 'https://' . $check_referrer; + $plain_check_referrer = 'http://' . $check_referrer; + } + if (sqsession_is_registered('user_is_logged_in') + && (!$check_referrer || empty($referrer) + || ($check_referrer && !empty($referrer) + && (strpos(strtolower($referrer), strtolower($plain_check_referrer)) === 0 + || strpos(strtolower($referrer), strtolower($ssl_check_referrer)) === 0)))) { return true; - } else { - global $PHP_SELF, $session_expired_post, $session_expired_location; - - // First we store some information in the new session to prevent - // information-loss. - // - $session_expired_post = $_POST; - $session_expired_location = $PHP_SELF; - if (!sqsession_is_registered('session_expired_post')) { - sqsession_register($session_expired_post,'session_expired_post'); - } - if (!sqsession_is_registered('session_expired_location')) { - sqsession_register($session_expired_location,'session_expired_location'); - } + } + + // First we store some information in the new session to prevent + // information-loss. + $session_expired_post = $_POST; + if (defined('PAGE_NAME')) + $session_expired_location = PAGE_NAME; + else + $session_expired_location = ''; + + if (!sqsession_is_registered('session_expired_post')) { + sqsession_register($session_expired_post,'session_expired_post'); + } + if (!sqsession_is_registered('session_expired_location')) { + sqsession_register($session_expired_location,'session_expired_location'); + } - return false; - } + session_write_close(); + + return false; } /** @@ -116,6 +93,9 @@ function sqauth_is_logged_in() { * @since 1.5.1 */ function sqauth_read_password() { + global $currentHookName; + if ($currentHookName == 'login_verified') global $key; + sqgetGlobalVar('key', $key, SQ_COOKIE); sqgetGlobalVar('onetimepad', $onetimepad,SQ_SESSION); @@ -124,20 +104,27 @@ function sqauth_read_password() { /** * Saves or updates user password information - * - * This function is used to update password information that SquirrelMail - * stores during existing web session. It does not modify password stored - * in authentication system used by IMAP server. * - * Function must be called before any html output started. Direct access - * to password information is deprecated. Saved password information is - * available only to next executed SquirrelMail script. If your script needs - * access to saved password after sqauth_save_password() call, use returned - * OTP encrypted key. + * This function is used to update the password information that + * SquirrelMail stores in the existing PHP session. It does NOT + * modify the password stored in the authentication system used + * by the IMAP server. + * + * This function must be called before any html output is started. + * Direct access to password information is deprecated. The saved + * password information is available only to the SquirrelMail script + * that is called/executed AFTER the current one. If your script + * needs access to the saved password after a sqauth_save_password() + * call, use the returned OTP encrypted key. + * * @param string $pass password - * @return string password encrypted with OTP. In case script wants to access - * password information before reloading page. + * + * @return string Password encrypted with OTP. In case the script + * wants to access the password information before + * the end of its execution. + * * @since 1.5.1 + * */ function sqauth_save_password($pass) { sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION); @@ -179,11 +166,13 @@ function cram_md5_response ($username,$password,$challenge) { * define the digest-uri. * @param string $host The host name, usually the server's FQDN; it is used to * define the digest-uri. + * @param string $authz Authorization ID (since 1.5.2) * @return string The response to be sent to the IMAP server * @since 1.4.0 */ -function digest_md5_response ($username,$password,$challenge,$service,$host) { +function digest_md5_response ($username,$password,$challenge,$service,$host,$authz='') { $result=digest_md5_parse_challenge($challenge); + //FIXME we should check that $result contains the expected values that we use below // verify server supports qop=auth // $qop = explode(",",$result['qop']); @@ -208,6 +197,9 @@ function digest_md5_response ($username,$password,$challenge,$service,$host) { $string_a1 .= utf8_encode($password); $string_a1 = hmac_md5($string_a1); $A1 = $string_a1 . ":" . $result['nonce'] . ":" . $cnonce; + if(!empty($authz)) { + $A1 .= ":" . utf8_encode($authz); + } $A1 = bin2hex(hmac_md5($A1)); $A2 = "AUTHENTICATE:$digest_uri_value"; // If qop is auth-int or auth-conf, A2 gets a little extra @@ -223,6 +215,9 @@ function digest_md5_response ($username,$password,$challenge,$service,$host) { $reply .= 'nonce="' . $result['nonce'] . '",nc=' . $ncount . ',cnonce="' . $cnonce . '",'; $reply .= "digest-uri=\"$digest_uri_value\",response=$response_value"; $reply .= ',qop=' . $qop_value; + if(!empty($authz)) { + $reply .= ',authzid=' . $authz; + } $reply = base64_encode($reply); return $reply . "\r\n"; @@ -239,7 +234,8 @@ function digest_md5_response ($username,$password,$challenge,$service,$host) { */ function digest_md5_parse_challenge($challenge) { $challenge=base64_decode($challenge); - while (isset($challenge)) { + $parsed = array(); + while (!empty($challenge)) { if ($challenge{0} == ',') { // First char is a comma, must not be 1st time through loop $challenge=substr($challenge,1); } @@ -274,37 +270,70 @@ function digest_md5_parse_challenge($challenge) { } /** - * Creates a HMAC digest that can be used for auth purposes - * See RFCs 2104, 2617, 2831 - * Uses mhash() extension if available - * - * @param string $data Data to apply hash function to. - * @param string $key Optional key, which, if supplied, will be used to - * calculate data's HMAC. - * @return string HMAC Digest string - * @since 1.4.0 - */ + * Creates a HMAC digest that can be used for authentication purposes + * See RFCs 2104, 2617, 2831 + * + * Uses PHP's Hash extension if available (enabled by default in PHP + * 5.1.2+ - see http://www.php.net/manual/en/hash.requirements.php + * or, if installed on earlier PHP versions, the PECL hash module - + * see http://pecl.php.net/package/hash + * + * Otherwise, will attempt to use the Mhash extension - see + * http://www.php.net/manual/en/mhash.requirements.php + * + * Finally, a fall-back custom implementation is used if none of + * the above are available. + * + * @param string $data The data to be encoded/hashed + * @param string $key The (shared) secret key that will be used + * to build the keyed hash. This argument is + * technically optional, but only for internal + * use (when the custom hash implementation is + * being used) - external callers should always + * specify a value for this argument. + * + * @return string The HMAC-MD5 digest string + * @since 1.4.0 + * + */ function hmac_md5($data, $key='') { + + // use PHP's native Hash extension if possible + // + if (function_exists('hash_hmac')) + return pack('H*', hash_hmac('md5', $data, $key)); + + + // otherwise, use (obsolete) mhash extension if available + // if (extension_loaded('mhash')) { - if ($key== '') { - $mhash=mhash(MHASH_MD5,$data); - } else { - $mhash=mhash(MHASH_MD5,$data,$key); - } + + if ($key == '') + $mhash = mhash(MHASH_MD5, $data); + else + $mhash = mhash(MHASH_MD5, $data, $key); + return $mhash; } - if (!$key) { - return pack('H*',md5($data)); - } - $key = str_pad($key,64,chr(0x00)); - if (strlen($key) > 64) { - $key = pack("H*",md5($key)); - } - $k_ipad = $key ^ str_repeat(chr(0x36), 64) ; - $k_opad = $key ^ str_repeat(chr(0x5c), 64) ; - /* Heh, let's get recursive. */ - $hmac=hmac_md5($k_opad . pack("H*",md5($k_ipad . $data)) ); + + + // or, our own implementation... + // + if (!$key) + return pack('H*', md5($data)); + + $key = str_pad($key, 64, chr(0x00)); + + if (strlen($key) > 64) + $key = pack("H*", md5($key)); + + $k_ipad = $key ^ str_repeat(chr(0x36), 64); + $k_opad = $key ^ str_repeat(chr(0x5c), 64); + + $hmac = hmac_md5($k_opad . pack('H*', md5($k_ipad . $data))); + return $hmac; + } /** @@ -312,7 +341,7 @@ function hmac_md5($data, $key='') { * * @param string $user Reference to SMTP username * @param string $pass Reference to SMTP password (unencrypted) - * @since 1.5.0 + * @since 1.4.11 */ function get_smtp_user(&$user, &$pass) { global $username, $smtp_auth_mech, @@ -321,13 +350,25 @@ function get_smtp_user(&$user, &$pass) { if ($smtp_auth_mech == 'none') { $user = ''; $pass = ''; - } elseif ( isset($smtp_sitewide_user) && isset($smtp_sitewide_pass) ) { + } elseif ( isset($smtp_sitewide_user) && isset($smtp_sitewide_pass) && + !empty($smtp_sitewide_user)) { $user = $smtp_sitewide_user; $pass = $smtp_sitewide_pass; } else { $user = $username; $pass = sqauth_read_password(); } -} -?> \ No newline at end of file + // plugin authors note: override $user or $pass by + // directly changing the arguments array contents + // in your plugin e.g., $args[0] = 'new_username'; + // + // NOTE: there is another hook in class/deliver/Deliver_SMTP.class.php + // called "smtp_authenticate" that allows a plugin to run its own + // custom authentication routine - this hook here is thus slightly + // mis-named but is too old to change. Be careful that you do not + // confuse your hook names. + // + $temp = array(&$user, &$pass); + do_hook('smtp_auth', $temp); +}