From 1679334034dfcc85b9f8566b378cf9597bf65ff6 Mon Sep 17 00:00:00 2001 From: skodak Date: Tue, 20 Feb 2007 17:15:13 +0000 Subject: [PATCH] MDL-8590 auth cleanup - part 3 --- enrol/imsenterprise/enrol.php | 2 +- lang/en_utf8/auth.php | 49 ++++++++++------ lib/db/upgrade.php | 3 + lib/moodlelib.php | 105 +++++++++++++++++----------------- 4 files changed, 87 insertions(+), 72 deletions(-) diff --git a/enrol/imsenterprise/enrol.php b/enrol/imsenterprise/enrol.php index 6590f714b6..ebc4530f28 100644 --- a/enrol/imsenterprise/enrol.php +++ b/enrol/imsenterprise/enrol.php @@ -648,7 +648,7 @@ function process_person_tag($tagcontents){ }else{ // If they don't exist and they have a defined username, and $CFG->enrol_createnewusers == true, we create them. - $person->lang = $CFG->lang; + $person->lang = 'manual'; //TODO: this needs more work due tu multiauth changes $person->auth = $CFG->auth; $person->confirmed = 1; $person->timemodified = time(); diff --git a/lang/en_utf8/auth.php b/lang/en_utf8/auth.php index d798f40188..a5384ab53d 100644 --- a/lang/en_utf8/auth.php +++ b/lang/en_utf8/auth.php @@ -8,11 +8,32 @@ $string['alternateloginurl'] = 'Alternate Login URL'; $string['pluginnotenabled'] = 'Authentication plugin \'$a\' is not enabled.'; $string['pluginnotinstalled'] = 'Authentication plugin \'$a\' is not installed.'; +// syncronization +$string['auth_sync_script'] ='Cron synchronization script'; +$string['auth_dbinsertuser'] ='Inserted user $a[0] id $a[1]'; +$string['auth_dbinsertusererror'] = 'Error inserting user $a'; +$string['auth_dbdeleteuser'] ='Deleted user $a[0] id $a[1]'; +$string['auth_dbdeleteusererror'] = 'Error deleting user $a'; +$string['auth_dbreviveduser'] ='Revived user $a[0] id $a[1]'; +$string['auth_dbrevivedusererror'] = 'Error reviving user $a'; +$string['auth_dbsuspenduser'] ='Suspended user $a[0] id $a[1]'; +$string['auth_dbsuspendusererror'] = 'Error suspending user $a'; +$string['auth_dbupdatinguser'] ='Updating user $a[0] id $a[1]'; +$string['auth_remove_user_key'] ='Removed ext user'; +$string['auth_remove_user'] ='Specify what to do with internal user account during mass synchronization when user was removed from external source. Only suspended users are automatically revived if they reappear in ext source.'; +$string['auth_remove_keep'] ='Keep internal'; +$string['auth_remove_suspend'] ='Suspend internal'; +$string['auth_remove_delete'] ='Full delete internal'; + +// nologin plugin +$string['auth_nologindescription'] = 'Auxiliary plugin that prevents user to login into system and also discards any mail send to user. Can be used to suspend user accounts.'; +$string['auth_nologintitle'] = 'No login'; + // CAS plugin $string['auth_cas_logincas'] = 'Secure connection access'; $string['auth_cas_invalidcaslogin'] = 'Sorry, your login has failed - you could not be authorised'; $string['auth_cas_server_settings'] = 'CAS server configuration'; -$string['auth_castitle'] = 'Use a CAS server (SSO)'; +$string['auth_castitle'] = 'CAS server (SSO)'; $string['auth_cas_hostname'] = 'Hostname of the CAS server
eg: host.domain.fr'; $string['auth_cas_baseuri'] = 'URI of the server (nothing if no baseUri)
For example, if the CAS server responds to host.domaine.fr/CAS/ then
cas_baseuri = CAS/'; $string['auth_cas_port'] = 'Port of the CAS server'; @@ -27,7 +48,6 @@ $string['auth_cas_cantconnect'] ='LDAP part of CAS-module cannot connect to serv $string['auth_cas_use_cas'] ='Use CAS'; $string['auth_cas_broken_password'] ='You cannot proceed without changing your password, however there is no available page for changing it. Please contact your Moodle Administrator.'; - $string['auth_cas_hostname_key'] ='Hostname'; $string['auth_cas_changepasswordurl'] ='Password-change URL'; $string['auth_cas_create_user_key'] ='Create user'; @@ -37,8 +57,6 @@ $string['auth_cas_casversion'] ='Version'; $string['auth_cas_port_key'] ='Port'; $string['auth_cas_baseuri_key'] ='Base URI'; - - $string['auth_changepasswordurl'] = 'Change password URL'; $string['auth_changepasswordurl_expl'] = 'Specify the url to send users who have lost their $a password. Set Use standard Change Password page to No.'; $string['auth_changepasswordhelp'] = 'Change password help'; @@ -61,11 +79,6 @@ $string['auth_dbtype'] = 'The database type (See the auth; - } if (file_exists("{$CFG->dirroot}/auth/$auth/auth.php")) { return is_readable("{$CFG->dirroot}/auth/$auth/auth.php"); } @@ -2364,14 +2360,16 @@ function exists_auth_plugin($auth='') { * @param string $auth Authentication plugin. * @return boolean Whether the plugin is enabled. */ -function is_enabled_auth($auth='') { +function is_enabled_auth($auth) { global $CFG; - // use the global default if not specified - if ($auth == '') { - $auth = $CFG->auth; + if (empty($auth)) { + return false; + } else if ($auth == 'manual') { + return true; } - return in_array($auth, explode(',', $CFG->auth_plugins_enabled)); + + return in_array($auth, explode(',', $CFG->auth)); } /** @@ -2385,12 +2383,10 @@ function is_enabled_auth($auth='') { function get_auth_plugin($auth = '') { global $CFG; - // use the global default if not specified - if ($auth == '') { - $auth = $CFG->auth; + // use the manual if not specified + if (empty($auth)) { + $auth = 'manual'; } - - // TODO: plugin enabled? // check the plugin exists first if (! exists_auth_plugin($auth)) { @@ -2412,7 +2408,7 @@ function get_auth_plugin($auth = '') { * @return bool * @todo Outline auth types and provide code example */ -function is_internal_auth($auth='') { +function is_internal_auth($auth) { $authplugin = get_auth_plugin($auth); // throws error if bad $auth return $authplugin->is_internal(); } @@ -2456,7 +2452,7 @@ function create_user_record($username, $password, $auth='') { if ($newinfo = $authplugin->get_userinfo($username)) { $newinfo = truncate_userinfo($newinfo); foreach ($newinfo as $key => $value){ - $newuser->$key = addslashes(stripslashes($value)); // Just in case + $newuser->$key = addslashes($value); } } } @@ -2467,9 +2463,8 @@ function create_user_record($username, $password, $auth='') { } } - $newuser->auth = (empty($auth)) ? $CFG->auth : $auth; + $newuser->auth = (empty($auth)) ? 'manual' : $auth; $newuser->username = $username; - update_internal_user_password($newuser, $password, false); // fix for MDL-8480 // user CFG lang for user if $newuser->lang is empty @@ -2484,11 +2479,12 @@ function create_user_record($username, $password, $auth='') { $newuser->mnethostid = $CFG->mnet_localhost_id; if (insert_record('user', $newuser)) { - $user = get_complete_user_data('username', $newuser->username); - if($CFG->{'auth_'.$newuser->auth.'_forcechangepassword'}){ - set_user_preference('auth_forcepasswordchange', 1, $user->id); - } - return $user; + $user = get_complete_user_data('username', $newuser->username); + if($CFG->{'auth_'.$newuser->auth.'_forcechangepassword'}){ + set_user_preference('auth_forcepasswordchange', 1, $user->id); + } + update_internal_user_password($user, $password); + return $user; } return false; } @@ -2589,45 +2585,37 @@ function authenticate_user_login($username, $password) { global $CFG; - // default to manual if global auth is undefined or broken - if (empty($CFG->auth_plugins_enabled)) { - $CFG->auth_plugins_enabled = empty($CFG->auth) ? 'manual' : $CFG->auth; - } - // if blank, set default auth to first enabled auth plugin if (empty($CFG->auth)) { - $auths = explode(',', $CFG->auth_plugins_enabled); - $CFG->auth = $auths[0]; - } - - // if user not found, use site auth - if (!$user = get_complete_user_data('username', $username)) { - $user = new object(); - $user->id = 0; // Not a user - $auth = $CFG->auth_plugins_enabled; + $authsenabled = array('manual'); + } else { + $authsenabled = explode(',', 'manual,'.$CFG->auth); } - // Sort out the authentication method we are using. - if (empty($user->auth)) { // For some reason it isn't set yet - $primadmin = get_admin(); - if (!empty($user->id) && (($user->id==$primadmin->id) || isguest($user->id))) { - $auth = 'manual'; // always assume these guys are internal + if ($user = get_complete_user_data('username', $username)) { + $auth = empty($user->auth) ? 'manual' : $user->auth; // use manual if auth not set + if ($auth=='nologin' or !is_enabled_auth($auth)) { + add_to_log(0, 'login', 'error', 'index.php', $username); + error_log('[client '.$_SERVER['REMOTE_ADDR']."] $CFG->wwwroot Disabled Login: $username ".$_SERVER['HTTP_USER_AGENT']); + return false; } - else { - $auth = $CFG->auth_plugins_enabled; // default to site method + if (!empty($user->deleted)) { + add_to_log(0, 'login', 'error', 'index.php', $username); + error_log('[client '.$_SERVER['REMOTE_ADDR']."] $CFG->wwwroot Deleted Login: $username ".$_SERVER['HTTP_USER_AGENT']); + return false; } + $auths = array($auth); + } else { - $auth = $user->auth; + $auths = $authsenabled; + $user = new object(); + $user->id = 0; // User does not exist } - // walk each authentication plugin, in order - $auths = explode(',', $auth); foreach ($auths as $auth) { $authplugin = get_auth_plugin($auth); - // on auth fail, log and fall through to the next plugin + // on auth fail fall through to the next plugin if (!$authplugin->user_login($username, $password)) { - add_to_log(0, 'login', 'error', 'index.php', $username); - error_log("[client {$_SERVER['REMOTE_ADDR']}] $CFG->wwwroot Auth=$auth Failed Login: $username {$_SERVER['HTTP_USER_AGENT']}"); continue; } @@ -2635,12 +2623,16 @@ function authenticate_user_login($username, $password) { if ($user->id) { // User already exists in database if (empty($user->auth)) { // For some reason auth isn't set yet set_field('user', 'auth', $auth, 'username', $username); + $user->auth = $auth; } - update_internal_user_password($user, $password); + + update_internal_user_password($user, $password); // just in case salt or encoding were changed (magic quotes too one day) + if (!$authplugin->is_internal()) { // update user record from external DB $user = update_user_record($username, get_auth_plugin($user->auth)); } } else { + // if user not found, create him $user = create_user_record($username, $password, $auth); } // fix for MDL-6928 @@ -2745,11 +2737,11 @@ function hash_internal_user_password($password) { * @param bool store changes also in db, default true * @return true if hash changed */ -function update_internal_user_password(&$user, $password, $storeindb=true) { +function update_internal_user_password(&$user, $password) { global $CFG; $authplugin = get_auth_plugin($user->auth); - if (!empty($authplugin->config->preventpassindb) /*|| $storeindb === false */) { + if (!empty($authplugin->config->preventpassindb)) { $hashedpassword = 'not cached'; } else { $hashedpassword = hash_internal_user_password($password); @@ -3280,6 +3272,11 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml='', $a return false; } + // skip mail to suspended users + if ($user->auth=='nologin') { + return true; + } + if (!empty($user->emailstop)) { return 'emailstop'; } -- 2.39.5