extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2024-12-25 16:19:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix auth check on xmlrpc.php, modify sessions verify/destroy to optionally

Browse Source 
accept sessionid/kp3
This commit is contained in:
Miles Lott 2001-08-23 02:54:25 +00:00
parent 822b956b80
commit 51fd39fac2
3 changed files with 42 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
phpgwapi/inc/class.sessions.inc.php
View File

@ -73,10 +73,13 @@
}
}
function verify()
function verify($sessionid='',$kp3='')
{
$sessionid = $GLOBALS['HTTP_GET_VARS']['sessionid'] ? $GLOBALS['HTTP_GET_VARS']['sessionid'] : $GLOBALS['HTTP_COOKIE_VARS']['sessionid'];
$kp3 = $GLOBALS['HTTP_GET_VARS']['kp3'] ? $GLOBALS['HTTP_GET_VARS']['kp3'] : $GLOBALS['HTTP_COOKIE_VARS']['kp3'];
if(empty($sessionid) || !$sessionid)
{
$sessionid = $GLOBALS['HTTP_GET_VARS']['sessionid'] ? $GLOBALS['HTTP_GET_VARS']['sessionid'] : $GLOBALS['HTTP_COOKIE_VARS']['sessionid'];
$kp3 = $GLOBALS['HTTP_GET_VARS']['kp3'] ? $GLOBALS['HTTP_GET_VARS']['kp3'] : $GLOBALS['HTTP_COOKIE_VARS']['kp3'];
}
$db = $GLOBALS['phpgw']->db;
$db2 = $GLOBALS['phpgw']->db;
@ -490,39 +493,40 @@
. "where sessionid='" . $this->sessionid."'",__LINE__,__FILE__);
}
function destroy()
function destroy($sessionid='',$kp3='')
{
global $phpgw, $phpgw_info;
$sessionid = $GLOBALS['HTTP_GET_VARS']['sessionid'] ? $GLOBALS['HTTP_GET_VARS']['sessionid'] : $GLOBALS['HTTP_COOKIE_VARS']['sessionid'];
$kp3 = $GLOBALS['HTTP_GET_VARS']['kp3'] ? $GLOBALS['HTTP_GET_VARS']['kp3'] : $GLOBALS['HTTP_COOKIE_VARS']['kp3'];
if(empty($sessionid) || !$sessionid)
{
$sessionid = $GLOBALS['HTTP_GET_VARS']['sessionid'] ? $GLOBALS['HTTP_GET_VARS']['sessionid'] : $GLOBALS['HTTP_COOKIE_VARS']['sessionid'];
$kp3 = $GLOBALS['HTTP_GET_VARS']['kp3'] ? $GLOBALS['HTTP_GET_VARS']['kp3'] : $GLOBALS['HTTP_COOKIE_VARS']['kp3'];
}
if(!$sessionid && $kp3)
{
return False;
}
$phpgw_info['user']['sessionid'] = $sessionid;
$phpgw_info['user']['kp3'] = $kp3;
$GLOBALS['phpgw_info']['user']['sessionid'] = $sessionid;
$GLOBALS['phpgw_info']['user']['kp3'] = $kp3;
$phpgw->db->transaction_begin();
$phpgw->db->query("delete from phpgw_sessions where session_id='"
. $phpgw_info['user']['sessionid'] . "'",__LINE__,__FILE__);
$phpgw->db->query("delete from phpgw_app_sessions where sessionid='"
. $phpgw_info['user']['sessionid'] . "'",__LINE__,__FILE__);
$phpgw->db->query("update phpgw_access_log set lo='" . time() . "' where sessionid='"
. $phpgw_info['user']['sessionid'] . "'",__LINE__,__FILE__);
if ($phpgw_info['server']['usecookies'])
$GLOBALS['phpgw']->db->transaction_begin();
$GLOBALS['phpgw']->db->query("delete from phpgw_sessions where session_id='"
. $sessionid . "'",__LINE__,__FILE__);
$GLOBALS['phpgw']->db->query("delete from phpgw_app_sessions where sessionid='"
. $sessionid . "'",__LINE__,__FILE__);
$GLOBALS['phpgw']->db->query("update phpgw_access_log set lo='" . time() . "' where sessionid='"
. $sessionid . "'",__LINE__,__FILE__);
if ($GLOBALS['phpgw_info']['server']['usecookies'])
{
Setcookie('sessionid');
Setcookie('kp3');
if ($phpgw_info['multiable_domains'])
if ($GLOBALS['phpgw_info']['multiable_domains'])
{
Setcookie('domain');
}
}
$this->clean_sessions();
$phpgw->db->transaction_commit();
$GLOBALS['phpgw']->db->transaction_commit();
return True;
}

2
phpgwapi/inc/xml_functions.inc.php
View File

@ -728,7 +728,7 @@
$sessionid = $data['sessionid']->scalarval();
$kp3 = $data['kp3']->scalarval();
$later = $GLOBALS['phpgw']->session->destroy();
$later = $GLOBALS['phpgw']->session->destroy($sessionid,$kp3);
if($later)
{

24
xmlrpc.php
View File

@ -12,7 +12,7 @@
/* $Id$ */
$phpgw_info['flags'] = array(
$GLOBALS['phpgw_info']['flags'] = array(
'currentapp' => 'login',
'noheader' => True
);
@ -20,25 +20,35 @@
include('./header.inc.php');
$server = CreateObject('phpgwapi.xmlrpc_server');
$server->authed = False;
/* _debug_array($server);exit; */
//include(PHPGW_API_INC . '/xmlrpc.interop.php');
if($PHP_AUTH_USER && $PHP_AUTH_PW)
$headers = getallheaders();
if(ereg('Basic',$headers['Authorization']))
{
if($HTTP_X_PHPGW_SERVER)
$tmp = $headers['Authorization'];
$tmp = ereg_replace(' ','',$tmp);
$tmp = ereg_replace('Basic','',$tmp);
$auth = base64_decode(trim($tmp));
list($sessionid,$kp3) = split(':',$auth);
if($HTTP_SERVER_VARS['HTTP_X_PHPGW_SERVER'])
{
if(!@$phpgw->session->verify_server($PHP_AUTH_USER,$PHP_AUTH_PW))
if($GLOBALS['phpgw']->session->verify_server($sessionid,$kp3))
{
exit;
$server->authed = True;
}
}
else
{
if(!@$phpgw->session->verify($PHP_AUTH_USER,$PHP_AUTH_PW))
if($GLOBALS['phpgw']->session->verify($sessionid,$kp3))
{
exit;
$server->authed = True;
}
}
}
$server->service($HTTP_RAW_POST_DATA);
?>