Changeset 1304 for trunk/wifidog-auth/wifidog/classes/Authenticators/AuthenticatorLDAP.php

Timestamp:

10/22/07 15:06:20 (5 years ago)

Author:

benoitg

Message:

• Major security fix: Fix the authenticator for a security breach where a user could get Internet access using an empty username. LocalUser? and LDAP were definitely vulnerable, RADIUS may have been.

Files:

• trunk/wifidog-auth/wifidog/classes/Authenticators/AuthenticatorLDAP.php (modified) (3 diffs)

trunk/wifidog-auth/wifidog/classes/Authenticators/AuthenticatorLDAP.php

@@ -125 +125 @@
      * @return void
      */
-        public function __construct($account_orgin, $host, $rdn, $pass, $o, $filter)
+    public function __construct($account_orgin, $host, $rdn, $pass, $o, $filter)
     {
         // Call parent constructor
         parent::__construct($account_orgin);
 
-                $this->mldap_hostname = $host;
-                $this->mldap_filter = $filter;
-                $this->mldap_o = $o;
-                $this->mldap_rdn = trim($rdn);
-                $this->mldap_pass = trim($pass);
+        $this->mldap_hostname = $host;
+        $this->mldap_filter = $filter;
+        $this->mldap_o = $o;
+        $this->mldap_rdn = trim($rdn);
+        $this->mldap_pass = trim($pass);
     }
 
@@ -151 +151 @@
 
      */
-        private function checkLdapUser($username, $password, $ldap_server, $o, $f, &$errmsg = null )
-        {
-            // Init values
-                $rtval = true;
-
-                // Check if php-ldap extension is loaded
-                if (Dependency::check("ldap", $errmsg)) {
-                if ($connect = @ldap_connect($ldap_server)) {
-                    // if connected to ldap server
-                        ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
-
-                        // bind to ldap connection
+    private function checkLdapUser($username, $password, $ldap_server, $o, $f, &$errmsg = null )
+    {
+        // Init values
+        $rtval = true;
+
+        // Check if php-ldap extension is loaded
+        if (Dependency::check("ldap", $errmsg)) {
+            if ($connect = @ldap_connect($ldap_server)) {
+                // if connected to ldap server
+                ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
+
+                // bind to ldap connection
                 if (strlen(trim($this->mldap_rdn)) == 0) {
-                                if (($bind = @ldap_bind($connect)) == false) {
-                                        $errmsg = _("Error while connecting to the LDAP server.");
-                                        return false;
-                                }
-                        } else {
-                                if (($bind = @ldap_bind($connect, $this->mldap_rdn, $this->mldap_pass )) == false) {
-                                        $errmsg = _("Error while connecting to the LDAP server.");
-                                        return false;
-                                }
-                        }
-
-                        // search for user
-                        if (($res_id = ldap_search($connect, "o=$o", "$f=$username")) == false)  {
-                                $errmsg = _("Error while obtaining your LDAP information.");
-
-                                return false;
-                        }
-
-                        if (ldap_count_entries($connect, $res_id) != 1) {
-                                $errmsg = _("Error while obtaining your username or password from the LDAP server.");
-
-                                return false;
-                        }
-
-                        if (($entry_id = ldap_first_entry($connect, $res_id)) == false) {
-                                $errmsg = _("Error while obtaining your username or password from the LDAP server.");
-
-                                return false;
-                        }
-
-                        if (($user_dn = ldap_get_dn($connect, $entry_id)) == false) {
-                                $errmsg = _("Error while obtaining your username or password from the LDAP server.");
-
-                                return false;
-                        }
-
-                        //Authenticate the User
-                        if (($link_id = ldap_bind($connect, $user_dn, $password)) == false) {
-                                $errmsg = _("Error in username or password.");
-
-                                return false;
-                        }
-
-                        return true;
-                } else {
-                        $errmsg = _("Error connecting to the LDAP Server.");
-                }
-
-                ldap_close($connect);
-                } else {
-                    $rtval = false;
-                }
-        }
+                    if (($bind = @ldap_bind($connect)) == false) {
+                        $errmsg = _("Error while connecting to the LDAP server.");
+                        return false;
+                    }
+                } else {
+                    if (($bind = @ldap_bind($connect, $this->mldap_rdn, $this->mldap_pass )) == false) {
+                        $errmsg = _("Error while connecting to the LDAP server.");
+                        return false;
+                    }
+                }
+
+                // search for user
+                if (($res_id = ldap_search($connect, "o=$o", "$f=$username")) == false)  {
+                    $errmsg = _("Error while obtaining your LDAP information.");
+
+                    return false;
+                }
+
+                if (ldap_count_entries($connect, $res_id) != 1) {
+                    $errmsg = _("Error while obtaining your username or password from the LDAP server.");
+
+                    return false;
+                }
+
+                if (($entry_id = ldap_first_entry($connect, $res_id)) == false) {
+                    $errmsg = _("Error while obtaining your username or password from the LDAP server.");
+
+                    return false;
+                }
+
+                if (($user_dn = ldap_get_dn($connect, $entry_id)) == false) {
+                    $errmsg = _("Error while obtaining your username or password from the LDAP server.");
+
+                    return false;
+                }
+
+                //Authenticate the User
+                if (($link_id = ldap_bind($connect, $user_dn, $password)) == false) {
+                    $errmsg = _("Error in username or password.");
+
+                    return false;
+                }
+
+                return true;
+            } else {
+                $errmsg = _("Error connecting to the LDAP Server.");
+            }
+
+            ldap_close($connect);
+        } else {
+            $rtval = false;
+        }
+    }
 
     /**
@@ -231 +231 @@
      *                otherwise.
      */
-        public function login($username, $password, &$errmsg = null)
-        {
-            
-                $db = AbstractDb::getObject();
-
-                // Init values
-                $retval = false;
-                $username = $db->EscapeString($username);
-                $password = $db->EscapeString($password);
-
-                // Check if php-ldap extension is loaded
-                if (Dependency::check("ldap", $errmsg)) {
-                if ($this->checkLdapUser($username, $password, $this->mldap_hostname, $this->mldap_o, $this->mldap_filter, $errmsg)) {
-                        //LDAP Authentication Successful
-                        $sql = "SELECT user_id, pass FROM users WHERE (username='$username') AND account_origin='".$this->getNetwork()->getId()."'";
-
-                        $db->ExecSqlUniqueRes($sql, $user_info, false);
-
-                        if ($user_info != null) {
-                                $user = User::getObject($user_info['user_id']);
-
-                                if ($user->isUserValid($errmsg)) {
-                                        $retval = $user;
-                                        User::setCurrentUser($user);
-                                        $errmsg = _("Login successfull");
-                                } else {
-                                        $retval = false;
-                                //Error already been set
-                                }
-                        } else {
-                                $user = User::createUser(get_guid(), $username, $this->getNetwork(), "", "");
-                                $retval = &$user;
-                                $user->setAccountStatus(ACCOUNT_STATUS_ALLOWED);
-                                User::setCurrentUser($user);
-                                $errmsg = _("Login successfull");
-                        }
-                } else {
-                        return false;
-                        //Error already been set
-                }
-                }
-
-                return $retval;
-        }
+    public function login($username, $password, &$errmsg = null)
+    {
+         
+        $db = AbstractDb::getObject();
+
+        // Init values
+        $retval = false;
+        $username = $db->EscapeString($username);
+        $password = $db->EscapeString($password);
+
+        // Check if php-ldap extension is loaded
+        if (Dependency::check("ldap", $errmsg)) {
+            if ($this->checkLdapUser($username, $password, $this->mldap_hostname, $this->mldap_o, $this->mldap_filter, $errmsg)) {
+                //LDAP Authentication Successful
+                $sql = "SELECT user_id, pass FROM users WHERE (username='$username') AND account_origin='".$this->getNetwork()->getId()."'";
+
+                $db->ExecSqlUniqueRes($sql, $user_info, false);
+
+                if ($user_info != null) {
+                    $user = User::getObject($user_info['user_id']);
+
+                    if ($user->isUserValid($errmsg)) {
+                        $retval = $user;
+                        User::setCurrentUser($user);
+                        $errmsg = _("Login successfull");
+                    } else {
+                        $retval = false;
+                        //Error already been set
+                    }
+                } else {
+                    $user = User::createUser(get_guid(), $username, $this->getNetwork(), "", "");
+                    $retval = &$user;
+                    $user->setAccountStatus(ACCOUNT_STATUS_ALLOWED);
+
+                    $errmsg = _("Login successfull");
+                }
+            } else {
+                $retval = false;
+                //Error already been set
+            }
+        }
+        User::setCurrentUser($retval);
+        return $retval;
+    }
 
     /**