1
|
<?php
|
2
|
/* $Id$ */
|
3
|
/*
|
4
|
Copyright (C) 2008 Shrew Soft Inc
|
5
|
All rights reserved.
|
6
|
|
7
|
Copyright (C) 2007, 2008 Scott Ullrich <sullrich@gmail.com>
|
8
|
All rights reserved.
|
9
|
|
10
|
Copyright (C) 2005-2006 Bill Marquette <bill.marquette@gmail.com>
|
11
|
All rights reserved.
|
12
|
|
13
|
Copyright (C) 2006 Paul Taylor <paultaylor@winn-dixie.com>.
|
14
|
All rights reserved.
|
15
|
|
16
|
Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
|
17
|
All rights reserved.
|
18
|
|
19
|
Redistribution and use in source and binary forms, with or without
|
20
|
modification, are permitted provided that the following conditions are met:
|
21
|
|
22
|
1. Redistributions of source code must retain the above copyright notice,
|
23
|
this list of conditions and the following disclaimer.
|
24
|
|
25
|
2. Redistributions in binary form must reproduce the above copyright
|
26
|
notice, this list of conditions and the following disclaimer in the
|
27
|
documentation and/or other materials provided with the distribution.
|
28
|
|
29
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
30
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
31
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
32
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
33
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
34
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
35
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
36
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
37
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
38
|
POSSIBILITY OF SUCH DAMAGE.
|
39
|
|
40
|
*/
|
41
|
|
42
|
/*
|
43
|
pfSense_MODULE: auth
|
44
|
*/
|
45
|
|
46
|
require_once("priv.defs.inc");
|
47
|
|
48
|
/* Load and process custom privs. */
|
49
|
function get_priv_files($directory) {
|
50
|
$dir_array = array();
|
51
|
if(!is_dir($directory))
|
52
|
return;
|
53
|
if ($dh = opendir($directory)) {
|
54
|
while (($file = readdir($dh)) !== false) {
|
55
|
$canadd = 0;
|
56
|
if($file == ".")
|
57
|
$canadd = 1;
|
58
|
if($file == "..")
|
59
|
$canadd = 1;
|
60
|
if($canadd == 0)
|
61
|
array_push($dir_array, $file);
|
62
|
}
|
63
|
closedir($dh);
|
64
|
}
|
65
|
if(!is_array($dir_array))
|
66
|
return;
|
67
|
return $dir_array;
|
68
|
}
|
69
|
|
70
|
// Load and sort privs
|
71
|
$dir_array = get_priv_files("/etc/inc/priv");
|
72
|
foreach ($dir_array as $file)
|
73
|
if (!is_dir("/etc/inc/priv/{$file}") && stristr($file,".inc"))
|
74
|
include("/etc/inc/priv/{$file}");
|
75
|
if(is_dir("/usr/local/pkg/priv")) {
|
76
|
$dir_array = get_priv_files("/usr/local/pkg/priv");
|
77
|
foreach ($dir_array as $file)
|
78
|
if (!is_dir("/usr/local/pkg/priv/{$file}") && stristr($file,".inc"))
|
79
|
include("/usr/local/pkg/priv/{$file}");
|
80
|
}
|
81
|
|
82
|
if(is_array($priv_list))
|
83
|
sort_privs($priv_list);
|
84
|
|
85
|
function cmp_privkeys($a, $b) {
|
86
|
/* user privs at the top */
|
87
|
$auser = strncmp("user-", $a, 5);
|
88
|
$buser = strncmp("user-", $b, 5);
|
89
|
if($auser != $buser)
|
90
|
return $auser - $buser;
|
91
|
|
92
|
/* name compare others */
|
93
|
return strcasecmp($a, $b);
|
94
|
}
|
95
|
|
96
|
function sort_privs(& $privs) {
|
97
|
uksort($privs, "cmp_privkeys");
|
98
|
}
|
99
|
|
100
|
function cmp_page_matches($page, & $matches, $fullwc = true) {
|
101
|
|
102
|
// $dbg_matches = implode(",", $matches);
|
103
|
// log_error("debug: checking page {$page} match with {$dbg_matches}");
|
104
|
|
105
|
if (!is_array($matches))
|
106
|
return false;
|
107
|
|
108
|
/* skip any leading fwdslash */
|
109
|
$test = strpos($page, "/");
|
110
|
if ($test !== false && $test == 0)
|
111
|
$page = substr($page, 1);
|
112
|
|
113
|
/* look for a match */
|
114
|
foreach ($matches as $match) {
|
115
|
|
116
|
/* possibly ignore full wildcard match */
|
117
|
if (!$fullwc && !strcmp($match ,"*"))
|
118
|
continue;
|
119
|
|
120
|
/* compare exact or wildcard match */
|
121
|
$match = str_replace(array(".", "*","?"), array("\.", ".*","\?"), $match);
|
122
|
$result = preg_match("@^/{$match}$@", "/{$page}");
|
123
|
|
124
|
if ($result)
|
125
|
return true;
|
126
|
}
|
127
|
|
128
|
return false;
|
129
|
}
|
130
|
|
131
|
function map_page_privname($page) {
|
132
|
global $priv_list;
|
133
|
|
134
|
foreach ($priv_list as $pname => $pdata) {
|
135
|
if (strncmp($pname, "page-", 5))
|
136
|
continue;
|
137
|
$fullwc = false;
|
138
|
if (!strcasecmp($page,"any")||!strcmp($page,"*"))
|
139
|
$fullwc = true;
|
140
|
if (cmp_page_matches($page, $pdata['match'], $fullwc))
|
141
|
return $pname;
|
142
|
}
|
143
|
|
144
|
return false;
|
145
|
}
|
146
|
|
147
|
function get_user_privdesc(& $user) {
|
148
|
global $priv_list;
|
149
|
|
150
|
$privs = array();
|
151
|
|
152
|
$user_privs = $user['priv'];
|
153
|
if (!is_array($user_privs))
|
154
|
$user_privs = array();
|
155
|
|
156
|
$names = local_user_get_groups($user, true);
|
157
|
|
158
|
foreach ($names as $name) {
|
159
|
$group = getGroupEntry($name);
|
160
|
$group_privs = $group['priv'];
|
161
|
if (!is_array($group_privs))
|
162
|
continue;
|
163
|
foreach ($group_privs as $pname) {
|
164
|
if (in_array($pname,$user_privs))
|
165
|
continue;
|
166
|
if (!$priv_list[$pname])
|
167
|
continue;
|
168
|
$priv = $priv_list[$pname];
|
169
|
$priv['group'] = $group['name'];
|
170
|
$privs[] = $priv;
|
171
|
}
|
172
|
}
|
173
|
|
174
|
foreach ($user_privs as $pname)
|
175
|
if($priv_list[$pname])
|
176
|
$privs[] = $priv_list[$pname];
|
177
|
|
178
|
return $privs;
|
179
|
}
|
180
|
|
181
|
function isAllowed($username, $page) {
|
182
|
global $_SESSION;
|
183
|
|
184
|
if (!isset($username))
|
185
|
return false;
|
186
|
|
187
|
/* admin/root access check */
|
188
|
$user = getUserEntry($username);
|
189
|
if (isset($user))
|
190
|
if (isset($user['uid']))
|
191
|
if ($user['uid']==0)
|
192
|
return true;
|
193
|
|
194
|
/* user privelege access check */
|
195
|
if (cmp_page_matches($page, $_SESSION['page-match']))
|
196
|
return true;
|
197
|
|
198
|
return false;
|
199
|
}
|
200
|
|
201
|
|
202
|
function isAllowedPage($page) {
|
203
|
global $_SESSION;
|
204
|
|
205
|
|
206
|
$username = $_SESSION['Username'];
|
207
|
|
208
|
if (!isset($username))
|
209
|
return false;
|
210
|
|
211
|
/* admin/root access check */
|
212
|
$user = getUserEntry($username);
|
213
|
if (isset($user))
|
214
|
if (isset($user['uid']))
|
215
|
if ($user['uid']==0)
|
216
|
return true;
|
217
|
|
218
|
/* user privelege access check */
|
219
|
return cmp_page_matches($page, $_SESSION['page-match']);
|
220
|
}
|
221
|
|
222
|
function getPrivPages(& $entry, & $allowed_pages) {
|
223
|
global $priv_list;
|
224
|
|
225
|
if (!is_array($entry['priv']))
|
226
|
return;
|
227
|
|
228
|
foreach ($entry['priv'] as $pname) {
|
229
|
if (strncmp($pname, "page-", 5))
|
230
|
continue;
|
231
|
$priv = &$priv_list[$pname];
|
232
|
if (!is_array($priv))
|
233
|
continue;
|
234
|
$matches = &$priv['match'];
|
235
|
if (!is_array($matches))
|
236
|
continue;
|
237
|
foreach ($matches as $match)
|
238
|
$allowed_pages[] = $match;
|
239
|
}
|
240
|
}
|
241
|
|
242
|
function getAllowedPages($username) {
|
243
|
global $config, $_SESSION;
|
244
|
|
245
|
if (!function_exists("ldap_connect"))
|
246
|
return;
|
247
|
|
248
|
$allowed_pages = array();
|
249
|
$allowed_groups = array();
|
250
|
|
251
|
$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
|
252
|
// obtain ldap groups if we are in ldap mode
|
253
|
if ($authcfg['type'] == "ldap")
|
254
|
$allowed_groups = @ldap_get_groups($username, $authcfg);
|
255
|
else {
|
256
|
// search for a local user by name
|
257
|
$local_user = getUserEntry($username);
|
258
|
getPrivPages($local_user, $allowed_pages);
|
259
|
|
260
|
// obtain local groups if we have a local user
|
261
|
if ($local_user)
|
262
|
$allowed_groups = local_user_get_groups($local_user);
|
263
|
}
|
264
|
|
265
|
// build a list of allowed pages
|
266
|
if (is_array($config['system']['group']) && is_array($allowed_groups))
|
267
|
foreach ($config['system']['group'] as $group)
|
268
|
if (in_array($group['name'], $allowed_groups))
|
269
|
getPrivPages($group, $allowed_pages);
|
270
|
|
271
|
// $dbg_pages = implode(",", $allowed_pages);
|
272
|
// $dbg_groups = implode(",", $allowed_groups);
|
273
|
// log_error("debug: user {$username} groups = {$dbg_groups}");
|
274
|
// log_error("debug: user {$username} pages = {$dbg_pages}");
|
275
|
|
276
|
$_SESSION['page-match'] = $allowed_pages;
|
277
|
|
278
|
return $allowed_pages;
|
279
|
}
|
280
|
|
281
|
function sort_user_privs($privs) {
|
282
|
// Privileges to place first, to redirect properly.
|
283
|
$priority_privs = array("page-dashboard-all", "page-system-login/logout");
|
284
|
|
285
|
$fprivs = array_intersect($privs, $priority_privs);
|
286
|
$sprivs = array_diff($privs, $priority_privs);
|
287
|
|
288
|
return array_merge($fprivs, $sprivs);
|
289
|
}
|
290
|
?>
|