1
|
<?php
|
2
|
/* $Id$ */
|
3
|
/*
|
4
|
Copyright (C) 2008 Shrew Soft Inc
|
5
|
All rights reserved.
|
6
|
|
7
|
Copyright (C) 2007, 2008 Scott Ullrich <sullrich@gmail.com>
|
8
|
All rights reserved.
|
9
|
|
10
|
Copyright (C) 2005-2006 Bill Marquette <bill.marquette@gmail.com>
|
11
|
All rights reserved.
|
12
|
|
13
|
Copyright (C) 2006 Paul Taylor <paultaylor@winn-dixie.com>.
|
14
|
All rights reserved.
|
15
|
|
16
|
Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
|
17
|
All rights reserved.
|
18
|
|
19
|
Redistribution and use in source and binary forms, with or without
|
20
|
modification, are permitted provided that the following conditions are met:
|
21
|
|
22
|
1. Redistributions of source code must retain the above copyright notice,
|
23
|
this list of conditions and the following disclaimer.
|
24
|
|
25
|
2. Redistributions in binary form must reproduce the above copyright
|
26
|
notice, this list of conditions and the following disclaimer in the
|
27
|
documentation and/or other materials provided with the distribution.
|
28
|
|
29
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
30
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
31
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
32
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
33
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
34
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
35
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
36
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
37
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
38
|
POSSIBILITY OF SUCH DAMAGE.
|
39
|
|
40
|
DISABLE_PHP_LINT_CHECKING
|
41
|
*/
|
42
|
|
43
|
/*
|
44
|
pfSense_MODULE: auth
|
45
|
*/
|
46
|
|
47
|
require_once("priv.defs.inc");
|
48
|
|
49
|
/* Load and process custom privs. */
|
50
|
function get_priv_files($directory) {
|
51
|
$dir_array = array();
|
52
|
if(!is_dir($directory))
|
53
|
return;
|
54
|
if ($dh = opendir($directory)) {
|
55
|
while (($file = readdir($dh)) !== false) {
|
56
|
$canadd = 0;
|
57
|
if($file == ".")
|
58
|
$canadd = 1;
|
59
|
if($file == "..")
|
60
|
$canadd = 1;
|
61
|
if($canadd == 0)
|
62
|
array_push($dir_array, $file);
|
63
|
}
|
64
|
closedir($dh);
|
65
|
}
|
66
|
if(!is_array($dir_array))
|
67
|
return;
|
68
|
return $dir_array;
|
69
|
}
|
70
|
|
71
|
// Load and sort privs
|
72
|
$dir_array = get_priv_files("/etc/inc/priv");
|
73
|
foreach ($dir_array as $file)
|
74
|
if (!is_dir("/etc/inc/priv/{$file}") && stristr($file,".inc"))
|
75
|
include("/etc/inc/priv/{$file}");
|
76
|
if(is_dir("/usr/local/pkg/priv")) {
|
77
|
$dir_array = get_priv_files("/usr/local/pkg/priv");
|
78
|
foreach ($dir_array as $file)
|
79
|
if (!is_dir("/usr/local/pkg/priv/{$file}") && stristr($file,".inc"))
|
80
|
include("/usr/local/pkg/priv/{$file}");
|
81
|
}
|
82
|
|
83
|
if(is_array($priv_list))
|
84
|
sort_privs($priv_list);
|
85
|
|
86
|
function cmp_privkeys($a, $b) {
|
87
|
/* user privs at the top */
|
88
|
$auser = strncmp("user-", $a, 5);
|
89
|
$buser = strncmp("user-", $b, 5);
|
90
|
if($auser != $buser)
|
91
|
return $auser - $buser;
|
92
|
|
93
|
/* name compare others */
|
94
|
return strcasecmp($a, $b);
|
95
|
}
|
96
|
|
97
|
function sort_privs(& $privs) {
|
98
|
uksort($privs, "cmp_privkeys");
|
99
|
}
|
100
|
|
101
|
function cmp_page_matches($page, & $matches, $fullwc = true) {
|
102
|
|
103
|
// $dbg_matches = implode(",", $matches);
|
104
|
// log_error("debug: checking page {$page} match with {$dbg_matches}");
|
105
|
|
106
|
if (!is_array($matches))
|
107
|
return false;
|
108
|
|
109
|
/* skip any leading fwdslash */
|
110
|
$test = strpos($page, "/");
|
111
|
if ($test !== false && $test == 0)
|
112
|
$page = substr($page, 1);
|
113
|
|
114
|
/* look for a match */
|
115
|
foreach ($matches as $match) {
|
116
|
|
117
|
/* possibly ignore full wildcard match */
|
118
|
if (!$fullwc && !strcmp($match ,"*"))
|
119
|
continue;
|
120
|
|
121
|
/* compare exact or wildcard match */
|
122
|
$match = str_replace(array(".", "*","?"), array("\.", ".*","\?"), $match);
|
123
|
$result = preg_match("@^/{$match}$@", "/{$page}");
|
124
|
|
125
|
if ($result)
|
126
|
return true;
|
127
|
}
|
128
|
|
129
|
return false;
|
130
|
}
|
131
|
|
132
|
function map_page_privname($page) {
|
133
|
global $priv_list;
|
134
|
|
135
|
foreach ($priv_list as $pname => $pdata) {
|
136
|
if (strncmp($pname, "page-", 5))
|
137
|
continue;
|
138
|
$fullwc = false;
|
139
|
if (!strcasecmp($page,"any")||!strcmp($page,"*"))
|
140
|
$fullwc = true;
|
141
|
if (cmp_page_matches($page, $pdata['match'], $fullwc))
|
142
|
return $pname;
|
143
|
}
|
144
|
|
145
|
return false;
|
146
|
}
|
147
|
|
148
|
function get_user_privdesc(& $user) {
|
149
|
global $priv_list;
|
150
|
|
151
|
$privs = array();
|
152
|
|
153
|
$user_privs = $user['priv'];
|
154
|
if (!is_array($user_privs))
|
155
|
$user_privs = array();
|
156
|
|
157
|
$names = local_user_get_groups($user, true);
|
158
|
|
159
|
foreach ($names as $name) {
|
160
|
$group = getGroupEntry($name);
|
161
|
$group_privs = $group['priv'];
|
162
|
if (!is_array($group_privs))
|
163
|
continue;
|
164
|
foreach ($group_privs as $pname) {
|
165
|
if (in_array($pname,$user_privs))
|
166
|
continue;
|
167
|
if (!$priv_list[$pname])
|
168
|
continue;
|
169
|
$priv = $priv_list[$pname];
|
170
|
$priv['group'] = $group['name'];
|
171
|
$privs[] = $priv;
|
172
|
}
|
173
|
}
|
174
|
|
175
|
foreach ($user_privs as $pname)
|
176
|
if($priv_list[$pname])
|
177
|
$privs[] = $priv_list[$pname];
|
178
|
|
179
|
return $privs;
|
180
|
}
|
181
|
|
182
|
function isAllowed($username, $page) {
|
183
|
global $_SESSION;
|
184
|
|
185
|
if (!isset($username))
|
186
|
return false;
|
187
|
|
188
|
/* admin/root access check */
|
189
|
$user = getUserEntry($username);
|
190
|
if (isset($user))
|
191
|
if (isset($user['uid']))
|
192
|
if ($user['uid']==0)
|
193
|
return true;
|
194
|
|
195
|
/* user privelege access check */
|
196
|
if (cmp_page_matches($page, $_SESSION['page-match']))
|
197
|
return true;
|
198
|
|
199
|
return false;
|
200
|
}
|
201
|
|
202
|
|
203
|
function isAllowedPage($page) {
|
204
|
global $_SESSION;
|
205
|
|
206
|
|
207
|
$username = $_SESSION['Username'];
|
208
|
|
209
|
if (!isset($username))
|
210
|
return false;
|
211
|
|
212
|
/* admin/root access check */
|
213
|
$user = getUserEntry($username);
|
214
|
if (isset($user))
|
215
|
if (isset($user['uid']))
|
216
|
if ($user['uid']==0)
|
217
|
return true;
|
218
|
|
219
|
/* user privelege access check */
|
220
|
return cmp_page_matches($page, $_SESSION['page-match']);
|
221
|
}
|
222
|
|
223
|
function getPrivPages(& $entry, & $allowed_pages) {
|
224
|
global $priv_list;
|
225
|
|
226
|
if (!is_array($entry['priv']))
|
227
|
return;
|
228
|
|
229
|
foreach ($entry['priv'] as $pname) {
|
230
|
if (strncmp($pname, "page-", 5))
|
231
|
continue;
|
232
|
$priv = &$priv_list[$pname];
|
233
|
if (!is_array($priv))
|
234
|
continue;
|
235
|
$matches = &$priv['match'];
|
236
|
if (!is_array($matches))
|
237
|
continue;
|
238
|
foreach ($matches as $match)
|
239
|
$allowed_pages[] = $match;
|
240
|
}
|
241
|
}
|
242
|
|
243
|
function getAllowedPages($username) {
|
244
|
global $config, $_SESSION;
|
245
|
|
246
|
if (!function_exists("ldap_connect"))
|
247
|
return;
|
248
|
|
249
|
$allowed_pages = array();
|
250
|
$allowed_groups = array();
|
251
|
|
252
|
$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
|
253
|
// obtain ldap groups if we are in ldap mode
|
254
|
if ($authcfg['type'] == "ldap")
|
255
|
$allowed_groups = @ldap_get_groups($username, $authcfg);
|
256
|
else {
|
257
|
// search for a local user by name
|
258
|
$local_user = getUserEntry($username);
|
259
|
getPrivPages($local_user, $allowed_pages);
|
260
|
|
261
|
// obtain local groups if we have a local user
|
262
|
if ($local_user)
|
263
|
$allowed_groups = local_user_get_groups($local_user);
|
264
|
}
|
265
|
|
266
|
// build a list of allowed pages
|
267
|
if (is_array($config['system']['group']) && is_array($allowed_groups))
|
268
|
foreach ($config['system']['group'] as $group)
|
269
|
if (in_array($group['name'], $allowed_groups))
|
270
|
getPrivPages($group, $allowed_pages);
|
271
|
|
272
|
// $dbg_pages = implode(",", $allowed_pages);
|
273
|
// $dbg_groups = implode(",", $allowed_groups);
|
274
|
// log_error("debug: user {$username} groups = {$dbg_groups}");
|
275
|
// log_error("debug: user {$username} pages = {$dbg_pages}");
|
276
|
|
277
|
$_SESSION['page-match'] = $allowed_pages;
|
278
|
|
279
|
return $allowed_pages;
|
280
|
}
|
281
|
|
282
|
function sort_user_privs($privs) {
|
283
|
// Privileges to place first, to redirect properly.
|
284
|
$priority_privs = array("page-dashboard-all", "page-system-login/logout");
|
285
|
|
286
|
$fprivs = array_intersect($privs, $priority_privs);
|
287
|
$sprivs = array_diff($privs, $priority_privs);
|
288
|
|
289
|
return array_merge($fprivs, $sprivs);
|
290
|
}
|
291
|
?>
|