blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-25 00:24:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Added new constants LDAP_NO_USER_DN and LDAP_TOO_MANY_USER_DN in constants.php

Browse Source 
- LDAP_Model->getUserDN now returns errors with more information
- Login redirection is performed with HTTP code 302 instead of 301
- Fixed _checkHBALDAPAuthentication behavior
- AuthLib errors have more information
This commit is contained in:
Paolo
2019-03-12 16:14:58 +01:00
parent 13db712fa7
commit d1b4024b76
4 changed files with 35 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/config/constants.php
+8
View File
@@ -74,6 +74,14 @@ define('AUTH_SUCCESS', 0);
define('AUTH_NOT_AUTHENTICATED', 1);
define('AUTH_INVALID_CREDENTIALS', 2);
/*
|--------------------------------------------------------------------------
| LDAP constants
|--------------------------------------------------------------------------
*/
define('LDAP_NO_USER_DN', 10);
define('LDAP_TOO_MANY_USER_DN', 11);
/*
|--------------------------------------------------------------------------
| File and directory modes
application/controllers/system/Login.php
+1
View File
@@ -20,6 +20,7 @@ class Login extends FHC_Controller
*/
public function usernamePassword()
{
$this->load->view('system/login/usernamePassword');
}
/**
application/core/LDAP_Model.php
+7 -3
View File
@@ -89,7 +89,7 @@ class LDAP_Model extends FHC_Model
*/
public function getUserDN($username)
{
$userDN = error('No user DN were found');
$userDN = error('No user DN were found', LDAP_NO_USER_DN);
// Tries to search for a user DN using the given username
$searchResultIdentifier = @ldap_search(
@@ -108,9 +108,13 @@ class LDAP_Model extends FHC_Model
{
$userDN = error(ldap_error($this->_connection));
}
elseif ($countEntries != 1) // 0 or > 1
elseif ($countEntries == 0)
{
$userDN = error('None or too many user DN were found');
$userDN = error('No user DN were found', LDAP_NO_USER_DN);
}
elseif ($countEntries > 1)
{
$userDN = error('Too many users DN were found', LDAP_TOO_MANY_USER_DN);
}
else // One entry was found
{
application/libraries/AuthLib.php
+19 -12
View File
@@ -227,7 +227,7 @@ class AuthLib
// Prints date and time
$this->_ci->eprintflib->printInfo('Date and time: '.date('Y.m.d H:i:s'));
$this->_ci->loglib->logError($errorMessage);
$this->_ci->loglib->logError($errorMessage); // CI log error
exit; // immediately terminate the execution
}
@@ -301,11 +301,23 @@ class AuthLib
}
elseif (isError($personResult)) // blocking error
{
$hta = $personResult; // return it!
$hta = $personResult; // to be displayed
}
}
return $hta;
// Invalid credentials
// NOTE: this is a corner case because of the HTTP basic authentication
if (getCode($hta) == AUTH_NOT_AUTHENTICATED || getCode($hta) == AUTH_INVALID_CREDENTIALS
|| getCode($hta) == LDAP_NO_USER_DN || getCode($hta) == LDAP_TOO_MANY_USER_DN)
{
$this->_showInvalidAuthentication(); // this also stop the execution
}
elseif (isError($hta)) // display error and stop execution
{
$this->_showError(getData($hta));
}
return $hta; // if success then is returned!
}
/**
@@ -330,7 +342,7 @@ class AuthLib
if (isSuccess($ldapConnection)) // connected!
{
$ldapModel->close(); // close the previous connection
$ldap = success('Authenticated'); // authenticated!
$ldap = success('Authenticated', AUTH_SUCCESS); // authenticated!
}
else // blocking error
{
@@ -354,6 +366,8 @@ class AuthLib
* Tries to find if the user is already logged via a foreign authentication method
* using a list of foreign authentication methods provided with the configurations
* If the user is logged via a foreign authentication method then an authentication object is returned
* NOTE: _checkHBALDAPAuthentication is the last to be called and it is a corner case due the HTTP basic
* authentication mechanism, and it does not return anything
*/
private function _checkForeignAuthentication()
{
@@ -374,13 +388,6 @@ class AuthLib
break;
}
// Invalid credentials
// NOTE: this is a corner case because of the HTTP basic authentication
if (getCode($auth) == AUTH_INVALID_CREDENTIALS)
{
$this->_showInvalidAuthentication(); // this also stop the execution
}
// If not authenticated with this method...
if (getCode($auth) == AUTH_NOT_AUTHENTICATED)
{
@@ -416,7 +423,7 @@ class AuthLib
// If the configuration is valid
if (!isEmptyArray($alp) && isset($alp[$al]))
{
header('HTTP/1.1 301 Moved Permanently'); // permanent redirection
header('HTTP/1.1 302 Moved temporary'); // temporary redirection
header('Location: '.site_url().$alp[$al]); // redirect to the configured login page
exit(); // stops execution!
}