libraries/auth/http.auth.lib.php3

   1 <?php
   2 /* $Id$ */
   3
   4 // +--------------------------------------------------------------------------+
   5 // | Set of functions used to run http authentication.                        |
   6 // | NOTE: Requires PHP loaded as a Apache module.                            |
   7 // +--------------------------------------------------------------------------+
   8
   9
  10 if (!defined('PMA_HTTP_AUTH_INCLUDED')) {
  11     define('PMA_HTTP_AUTH_INCLUDED', 1);
  12
  13     /**
  14      * Displays authentication form
  15      *
  16      * @global  string    the font face to use in case of failure
  17      * @global  string    the default font size to use in case of failure
  18      * @global  string    the big font size to use in case of failure
  19      *
  20      * @return  boolean   always true (no return indeed)
  21      *
  22      * @access  public
  23      */
  24     function PMA_auth()
  25     {
  26         global $right_font_family, $font_size, $font_bigger;
  27
  28         header('WWW-Authenticate: Basic realm="phpMyAdmin ' . sprintf($GLOBALS['strRunning'], (empty($GLOBALS['cfgServer']['verbose']) ? str_replace('\'', '\\\'',$GLOBALS['cfgServer']['host']) : str_replace('\'', '\\\'', $GLOBALS['cfgServer']['verbose']))) .  '"');
  29         header('HTTP/1.0 401 Unauthorized');
  30         header('status: 401 Unauthorized');
  31         ?>
  32 <!DOCTYPE html
  33     PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  34     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  35 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<?php echo $GLOBALS['available_languages'][$GLOBALS['lang']][2]; ?>" lang="<?php echo $GLOBALS['available_languages'][$GLOBALS['lang']][2]; ?>" dir="<?php echo $GLOBALS['text_dir']; ?>">
  36
  37 <head>
  38 <title><?php echo $GLOBALS['strAccessDenied']; ?></title>
  39 <style type="text/css">
  40 <!--
  41 body     {font-family: <?php echo $right_font_family; ?>; font-size: <?php echo $font_size; ?>; color: #000000}
  42 h1       {font-family: <?php echo $right_font_family; ?>; font-size: <?php echo $font_bigger; ?>; font-weight: bold}
  43 //-->
  44 </style>
  45 </head>
  46
  47 <body bgcolor="<?php echo $GLOBALS['cfgRightBgColor']; ?>">
  48 <br /><br />
  49 <center>
  50     <h1><?php echo sprintf($GLOBALS['strWelcome'], ' phpMyAdmin ' . PMA_VERSION); ?></h1>
  51 </center>
  52 <br />
  53 <p><?php echo $GLOBALS['strWrongUser']; ?></p>
  54 </body>
  55
  56 </html>
  57         <?php
  58         echo "\n";
  59         exit();
  60
  61         return TRUE;
  62     } // end of the 'PMA_auth()' function
  63
  64
  65     /**
  66      * Gets advanced authentication settings
  67      *
  68      * @global  string    the username if register_globals is on
  69      * @global  string    the password if register_globals is on
  70      * @global  array     the array of server variables if register_globals is
  71      *                    off
  72      * @global  array     the array of environment variables if register_globals
  73      *                    is off
  74      * @global  string    the username for the ? server
  75      * @global  string    the password for the ? server
  76      * @global  string    the username for the WebSite Professional server
  77      * @global  string    the password for the WebSite Professional server
  78      * @global  string    the username of the user who logs out
  79      *
  80      * @return  boolean   whether we get authentication settings or not
  81      *
  82      * @access  public
  83      */
  84     function PMA_auth_check()
  85     {
  86         global $PHP_AUTH_USER, $PHP_AUTH_PW;
  87         global $HTTP_SERVER_VARS, $HTTP_ENV_VARS;
  88         global $REMOTE_USER, $AUTH_USER, $REMOTE_PASSWORD, $AUTH_PASSWORD;
  89         global $old_usr;
  90
  91         // Grabs the $PHP_AUTH_USER variable whatever are the values of the
  92         // 'register_globals' and the 'variables_order' directives
  93         // loic1 - 2001/25/11: use the new globals arrays defined with php 4.1+
  94         if (empty($PHP_AUTH_USER)) {
  95             if (!empty($_SERVER) && isset($_SERVER['PHP_AUTH_USER'])) {
  96                 $PHP_AUTH_USER = $_SERVER['PHP_AUTH_USER'];
  97             }
  98             else if (!empty($HTTP_SERVER_VARS) && isset($HTTP_SERVER_VARS['PHP_AUTH_USER'])) {
  99                 $PHP_AUTH_USER = $HTTP_SERVER_VARS['PHP_AUTH_USER'];
 100             }
 101             else if (isset($REMOTE_USER)) {
 102                 $PHP_AUTH_USER = $REMOTE_USER;
 103             }
 104             else if (!empty($_ENV) && isset($_ENV['REMOTE_USER'])) {
 105                 $PHP_AUTH_USER = $_ENV['REMOTE_USER'];
 106             }
 107             else if (!empty($HTTP_ENV_VARS) && isset($HTTP_ENV_VARS['REMOTE_USER'])) {
 108                 $PHP_AUTH_USER = $HTTP_ENV_VARS['REMOTE_USER'];
 109             }
 110             else if (@getenv('REMOTE_USER')) {
 111                 $PHP_AUTH_USER = getenv('REMOTE_USER');
 112             }
 113             // Fix from Matthias Fichtner for WebSite Professional - Part 1
 114             else if (isset($AUTH_USER)) {
 115                 $PHP_AUTH_USER = $AUTH_USER;
 116             }
 117             else if (!empty($_ENV) && isset($_ENV['AUTH_USER'])) {
 118                 $PHP_AUTH_USER = $_ENV['AUTH_USER'];
 119             }
 120             else if (!empty($HTTP_ENV_VARS) && isset($HTTP_ENV_VARS['AUTH_USER'])) {
 121                 $PHP_AUTH_USER = $HTTP_ENV_VARS['AUTH_USER'];
 122             }
 123             else if (@getenv('AUTH_USER')) {
 124                 $PHP_AUTH_USER = getenv('AUTH_USER');
 125             }
 126         }
 127         // Grabs the $PHP_AUTH_PW variable whatever are the values of the
 128         // 'register_globals' and the 'variables_order' directives
 129         // loic1 - 2001/25/11: use the new globals arrays defined with php 4.1+
 130         if (empty($PHP_AUTH_PW)) {
 131             if (!empty($_SERVER) && isset($_SERVER['PHP_AUTH_PW'])) {
 132                 $PHP_AUTH_PW = $_SERVER['PHP_AUTH_PW'];
 133             }
 134             else if (!empty($HTTP_SERVER_VARS) && isset($HTTP_SERVER_VARS['PHP_AUTH_PW'])) {
 135                 $PHP_AUTH_PW = $HTTP_SERVER_VARS['PHP_AUTH_PW'];
 136             }
 137             else if (isset($REMOTE_PASSWORD)) {
 138                 $PHP_AUTH_PW = $REMOTE_PASSWORD;
 139             }
 140             else if (!empty($_ENV) && isset($_ENV['REMOTE_PASSWORD'])) {
 141                 $PHP_AUTH_PW = $_ENV['REMOTE_PASSWORD'];
 142             }
 143             else if (!empty($HTTP_ENV_VARS) && isset($HTTP_ENV_VARS['REMOTE_PASSWORD'])) {
 144                 $PHP_AUTH_PW = $HTTP_ENV_VARS['REMOTE_PASSWORD'];
 145             }
 146             else if (@getenv('REMOTE_PASSWORD')) {
 147                 $PHP_AUTH_PW = getenv('REMOTE_PASSWORD');
 148             }
 149             // Fix from Matthias Fichtner for WebSite Professional - Part 2
 150             else if (isset($AUTH_PASSWORD)) {
 151                 $PHP_AUTH_PW = $AUTH_PASSWORD;
 152             }
 153             else if (!empty($_ENV) && isset($_ENV['AUTH_PASSWORD'])) {
 154                 $PHP_AUTH_PW = $_ENV['AUTH_PASSWORD'];
 155             }
 156             else if (!empty($HTTP_ENV_VARS) && isset($HTTP_ENV_VARS['AUTH_PASSWORD'])) {
 157                 $PHP_AUTH_PW = $HTTP_ENV_VARS['AUTH_PASSWORD'];
 158             }
 159             else if (@getenv('AUTH_PASSWORD')) {
 160                 $PHP_AUTH_PW = getenv('AUTH_PASSWORD');
 161             }
 162         }
 163
 164         // User logged out -> ensure the new username is not the same
 165         if (!empty($old_usr)
 166             && (isset($PHP_AUTH_USER) && $old_usr == $PHP_AUTH_USER)) {
 167             $PHP_AUTH_USER = '';
 168         }
 169
 170         // Returns whether we get authentication settings or not
 171         if (empty($PHP_AUTH_USER)) {
 172             return FALSE;
 173         } else {
 174             if (get_magic_quotes_gpc()) {
 175                 $PHP_AUTH_USER = stripslashes($PHP_AUTH_USER);
 176                 $PHP_AUTH_PW   = stripslashes($PHP_AUTH_PW);
 177             }
 178             return TRUE;
 179         }
 180     } // end of the 'PMA_auth_check()' function
 181
 182
 183     /**
 184      * Set the user and password after last checkings if required
 185      *
 186      * @global  array     the valid servers settings
 187      * @global  integer   the id of the current server
 188      * @global  array     the current server settings
 189      * @global  string    the current username
 190      * @global  string    the current password
 191      *
 192      * @return  boolean   always true
 193      *
 194      * @access  public
 195      */
 196     function PMA_auth_set_user()
 197     {
 198         global $cfgServers, $server, $cfgServer;
 199         global $PHP_AUTH_USER, $PHP_AUTH_PW;
 200
 201         // Ensures the valid 'only_db' setting is used
 202         if ($cfgServer['user'] != $PHP_AUTH_USER) {
 203             $servers_cnt = count($cfgServers);
 204             for ($i = 1; $i <= $servers_cnt; $i++) {
 205                 if (isset($cfgServers[$i])
 206                     && ($cfgServers[$i]['host'] == $cfgServer['host'] && $cfgServers[$i]['user'] == $PHP_AUTH_USER)) {
 207                     $server    = $i;
 208                     $cfgServer = $cfgServers[$i];
 209                     break;
 210                 }
 211             } // end for
 212         } // end if
 213
 214         $cfgServer['user']     = $PHP_AUTH_USER;
 215         $cfgServer['password'] = $PHP_AUTH_PW;
 216
 217         return TRUE;
 218     } // end of the 'PMA_auth_set_user()' function
 219
 220
 221     /**
 222      * User is not allowed to login to MySQL -> authentication failed
 223      *
 224      * @return  boolean   always true (no return indeed)
 225      *
 226      * @access  public
 227      */
 228     function PMA_auth_fails()
 229     {
 230         PMA_auth();
 231
 232         return TRUE;
 233     } // end of the 'PMA_auth()' function
 234
 235 } // $__PMA_HTTP_AUTH_LIB__
 236 ?>