1 | 1 | simandl | <?php |
2 | | | // WebSVN - Subversion repository viewing via the web using PHP |
3 | | | // Copyright (C) 2004-2006 Tim Armes |
4 | | | // |
5 | | | // This program is free software; you can redistribute it and/or modify |
6 | | | // it under the terms of the GNU General Public License as published by |
7 | | | // the Free Software Foundation; either version 2 of the License, or |
8 | | | // (at your option) any later version. |
9 | | | // |
10 | | | // This program is distributed in the hope that it will be useful, |
11 | | | // but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | | | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13 | | | // GNU General Public License for more details. |
14 | | | // |
15 | | | // You should have received a copy of the GNU General Public License |
16 | | | // along with this program; if not, write to the Free Software |
17 | | | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
18 | | | // |
19 | | | // -- |
20 | | | // |
21 | | | // auth.php |
22 | | | // |
23 | | | // Handle reading and interpretation of an SVN auth file |
24 | | | |
25 | | | require_once("include/accessfile.php"); |
26 | | | |
27 | | | define("UNDEFINED", 0); |
28 | | | define("ALLOW", 1); |
29 | | | define("DENY", 2); |
30 | | | |
31 | | | class Authentication { |
32 | | | var $rights; |
33 | | | var $user; |
34 | | | var $usersGroups = array(); |
35 | | | |
36 | | | // {{{ __construct |
37 | | | |
38 | | | function Authentication($accessfile) { |
39 | | | $this->rights = new IniFile(); |
40 | | | $this->rights->readIniFile($accessfile); |
41 | | | $this->setUsername(); |
42 | | | $this->identifyGroups(); |
43 | | | } |
44 | | | |
45 | | | // }}} |
46 | | | |
47 | | | // {{{ setUsername() |
48 | | | // |
49 | | | // Set the username from the current http session |
50 | | | |
51 | | | function setUsername() { |
52 | | | if (isset($_SERVER["REMOTE_USER"])) { |
53 | | | $this->user = $_SERVER["REMOTE_USER"]; |
54 | | | } else if (isset($_SERVER["REDIRECT_REMOTE_USER"])) { |
55 | | | $this->user = $_SERVER["REDIRECT_REMOTE_USER"]; |
56 | | | } |
57 | | | } |
58 | | | |
59 | | | // }}} |
60 | | | |
61 | | | // {{{ identifyGroups() |
62 | | | // |
63 | | | // Checks to see which groups the user belongs to |
64 | | | |
65 | | | function identifyGroups() { |
66 | | | $this->usersGroups[] = "*"; |
67 | | | |
68 | | | if (is_array($this->rights->getValues("groups"))) { |
69 | | | foreach ($this->rights->getValues("groups")as $group => $names) { |
70 | | | if (in_array(strtolower($this->user), preg_split('/\s*,\s*/', $names))) { |
71 | | | $this->usersGroups[] = "@".$group; |
72 | | | } |
73 | | | |
74 | | | foreach ($this->usersGroups as $users_group) { |
75 | | | if (in_array($users_group, preg_split('/\s*,\s*/', $names))) { |
76 | | | $this->usersGroups[] = "@".$group; |
77 | | | } |
78 | | | } |
79 | | | } |
80 | | | } |
81 | | | } |
82 | | | |
83 | | | // }}} |
84 | | | |
85 | | | // {{{ inList |
86 | | | // |
87 | | | // Check if the user is in the given list and return their read status |
88 | | | // if they are (UNDEFINED, ALLOW or DENY) |
89 | | | |
90 | | | function inList($accessors, $user) { |
91 | | | $output = UNDEFINED; |
92 | | | foreach ($accessors As $key => $rights) { |
93 | | | $keymatch = false; |
94 | | | |
95 | | | if (in_array($key, $this->usersGroups) || !strcmp($key, strtolower($user))) { |
96 | | | $keymatch = true; |
97 | | | } |
98 | | | |
99 | | | if ($keymatch) { |
100 | | | if (strpos($rights, "r") !== false) { |
101 | | | return ALLOW; |
102 | | | } else { |
103 | | | $output = DENY; |
104 | | | } |
105 | | | } |
106 | | | } |
107 | | | |
108 | | | return $output; |
109 | | | } |
110 | | | |
111 | | | // }}} |
112 | | | |
113 | | | // {{{ hasReadAccess |
114 | | | // |
115 | | | // Returns true if the user has read access to the given path |
116 | | | |
117 | | | function hasReadAccess($repos, $path, $checkSubFolders = false) { |
118 | | | $access = UNDEFINED; |
119 | | | $repos = strtolower($repos); // .ini parser converts groups to lower-case |
120 | | | $path = strtolower($path); |
121 | | | if ($path == '' || $path{0} != "/") { |
122 | | | $path = "/$path"; |
123 | | | } |
124 | | | |
125 | | | // If were told to, we should check sub folders of the path to see if there's |
126 | | | // a read access below this level. This is used to display the folders needed |
127 | | | // to get to the folder to which read access is granted. |
128 | | | |
129 | | | if ($checkSubFolders) { |
130 | | | $sections = $this->rights->getSections(); |
131 | | | |
132 | | | foreach ($sections As $section => $accessers) { |
133 | | | $qualified = $repos.":".$path; |
134 | | | $len = strlen($qualified); |
135 | | | if ($len < strlen($section) && strncmp($section, $qualified, $len) == 0) { |
136 | | | $access = $this->inList($accessers, $this->user); |
137 | | | } |
138 | | | |
139 | | | if ($access != ALLOW) { |
140 | | | $len = strlen($path); |
141 | | | if ($len < strlen($section) && strncmp($section, $path, $len) == 0) { |
142 | | | $access = $this->inList($accessers, $this->user); |
143 | | | } |
144 | | | } |
145 | | | |
146 | | | if ($access == ALLOW) { |
147 | | | break; |
148 | | | } |
149 | | | } |
150 | | | } |
151 | | | |
152 | | | // If we still don't have access, check each subpath of the path until we find an |
153 | | | // access level... |
154 | | | |
155 | | | if ($access != ALLOW) { |
156 | | | $access = UNDEFINED; |
157 | | | |
158 | | | do { |
159 | | | $accessers = $this->rights->getValues($repos.":".$path); |
160 | | | if (!empty($accessers)) { |
161 | | | $access = $this->inList($accessers, $this->user); |
162 | | | } |
163 | | | |
164 | | | if ($access == UNDEFINED) { |
165 | | | $accessers = $this->rights->getValues($path); |
166 | | | if (!empty($accessers)) { |
167 | | | $access = $this->inList($accessers, $this->user); |
168 | | | } |
169 | | | } |
170 | | | |
171 | | | // If we've not got a match, remove the sub directory and start again |
172 | | | if ($access == UNDEFINED) { |
173 | | | if ($path == "/") { |
174 | | | break; |
175 | | | } |
176 | | | $path = substr($path, 0, strrpos(substr($path, 0, -1), "/") + 1); |
177 | | | } |
178 | | | |
179 | | | } while ($access == UNDEFINED && $path != ""); |
180 | | | } |
181 | | | |
182 | | | return $access == ALLOW; |
183 | | | } |
184 | | | |
185 | | | // }}} |
186 | | | |
187 | | | // {{{ hasUnrestrictedReadAccess |
188 | | | // |
189 | | | // Returns true if the user has read access to the given path and too |
190 | | | // all subfolders |
191 | | | |
192 | | | function hasUnrestrictedReadAccess($repos, $path) { |
193 | | | // First make sure that we have full read access at this level |
194 | | | |
195 | | | if (!$this->hasReadAccess($repos, $path, false)) { |
196 | | | return false; |
197 | | | } |
198 | | | |
199 | | | // Now check to see if there is a sub folder that's protected |
200 | | | $repos = strtolower($repos); // .ini parser converts groups to lower-case |
201 | | | $path = strtolower($path); |
202 | | | |
203 | | | $sections = $this->rights->getSections(); |
204 | | | |
205 | | | foreach ($sections As $section => $accessers) { |
206 | | | $qualified = $repos.":".$path; |
207 | | | $len = strlen($qualified); |
208 | | | $access = UNDEFINED; |
209 | | | |
210 | | | if ($len <= strlen($section) && strncmp($section, $qualified, $len) == 0) { |
211 | | | $access = $this->inList($accessers, $this->user); |
212 | | | } |
213 | | | |
214 | | | if ($access != DENY) { |
215 | | | $len = strlen($path); |
216 | | | if ($len <= strlen($section) && strncmp($section, $path, $len) == 0) { |
217 | | | $access = $this->inList($accessers, $this->user); |
218 | | | } |
219 | | | } |
220 | | | |
221 | | | if ($access == DENY) { |
222 | | | return false; |
223 | | | } |
224 | | | } |
225 | | | |
226 | | | return true; |
227 | | | } |
228 | | | |
229 | | | // }}} |
230 | | | |
231 | | | } |