Prechádzať zdrojové kódy

Improve the SSO login check by allowing several possible referers (BT#4158)

Yannick Warnier 12 rokov pred
rodič
commit
e56ef06dc2
1 zmenil súbory, kde vykonal 31 pridanie a 10 odobranie
  1. 31 10
      main/inc/local.inc.php

+ 31 - 10
main/inc/local.inc.php

@@ -444,15 +444,36 @@ if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout)) {
 				// Redirect to master server
 				$osso->ask_master();
 			} elseif (isset($_GET['sso_cookie'])) {
-				$protocol = api_get_setting('sso_authentication_protocol');
-				$master_url = api_get_setting('sso_authentication_domain').api_get_setting('sso_authentication_auth_uri');
-                //error_log($_GET['sso_referer']);error_log($protocol.$master_url);
-				if (isset($_GET['sso_referer']) ? $_GET['sso_referer'] === $protocol.$master_url  : FALSE) {
-					//make all the process of checking
-					//if the user exists (delegated to the sso class)
-					$osso->check_user();
+				// Here we are going to check the origin of
+				// what the call says should be used for
+				// authentication, and ensure  we know it
+				$matches_domain = false;
+				if (isset($_GET['sso_referer'])) {
+					$protocol = api_get_setting('sso_authentication_protocol');
+					// sso_authentication_domain can list
+					// several, comma-separated, domains
+					$master_urls = split(',',api_get_setting('sso_authentication_domain'));
+					if (!empty($master_urls)) {
+					    $master_auth_uri = api_get_setting('sso_authentication_auth_uri');
+					    foreach ($master_urls as $mu) {
+						if (empty($mu)) { continue; }
+						// for each URL, check until we find *one* that matches the $_GET['sso_referer'], then skip the rest
+						if ($protocol.trim($mu).$master_auth_uri === $_GET['sso_referer']) {
+					            $matches_domain = true;
+					            break;
+					        }
+					    }
+                                	} else {
+					    error_log('Your sso_authentication_master param is empty. Check the platform configuration, security section. It can be a list of comma-separated domains');
+					}
+				}
+				if ($matches_domain) { 
+                                        //make all the process of checking
+                                        //if the user exists (delegated to the sso class)
+                                        $osso->check_user();
+
 				} else {
-                    error_log('Check the sso_referer URL in your script');
+					error_log('Check the sso_referer URL in your script, it doesn\'t match any of the possibilities');
 					//Request comes from unknown source
 					$loginFailed = true;
 					Session::erase('_uid');
@@ -460,7 +481,7 @@ if (!empty($_SESSION['_user']['user_id']) && ! ($login || $logout)) {
 					exit;
 				}
 			}
-		}//end logout
+		}//end logout ... else ... login
 	} elseif (api_get_setting('openid_authentication')=='true') {
 		if (!empty($_POST['openid_url'])) {
 			include 'main/auth/openid/login.php';
@@ -1097,4 +1118,4 @@ if (!$no_redirection && (isset($_SESSION['request_uri']) && !empty($_SESSION['re
     header('Location: '.$req);
     exit;
 }
-*/
+*/