libraries/auth/http.auth.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Set of functions used to run http authentication.
   5  * NOTE: Requires PHP loaded as a Apache module.
   6  *
   7  * @package phpMyAdmin-Auth-HTTP
   8  * @version $Id$
   9  */
  10
  11
  12 /**
  13  * Displays authentication form
  14  *
  15  * @global  string    the font face to use in case of failure
  16  * @global  string    the default font size to use in case of failure
  17  * @global  string    the big font size to use in case of failure
  18  *
  19  * @return  boolean   always true (no return indeed)
  20  *
  21  * @access  public
  22  */
  23 function PMA_auth()
  24 {
  25     /* Perform logout to custom URL */
  26     if (!empty($_REQUEST['old_usr']) && !empty($GLOBALS['cfg']['Server']['LogoutURL'])) {
  27         PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['LogoutURL']);
  28         exit;
  29     }
  30
  31     if (empty($GLOBALS['cfg']['Server']['auth_http_realm'])) {
  32         if (empty($GLOBALS['cfg']['Server']['verbose'])) {
  33             $server_message = $GLOBALS['cfg']['Server']['host'];
  34         } else {
  35             $server_message = $GLOBALS['cfg']['Server']['verbose'];
  36         }
  37         $realm_message = 'phpMyAdmin ' . $server_message;
  38     } else {
  39         $realm_message = $GLOBALS['cfg']['Server']['auth_http_realm'];
  40     }
  41     // remove non US-ASCII to respect RFC2616
  42     $realm_message = preg_replace('/[^\x20-\x7e]/i', '', $realm_message);
  43     header('WWW-Authenticate: Basic realm="' . $realm_message .  '"');
  44     header('HTTP/1.0 401 Unauthorized');
  45     if (php_sapi_name() !== 'cgi-fcgi') {
  46         header('status: 401 Unauthorized');
  47     }
  48
  49     // Defines the charset to be used
  50     header('Content-Type: text/html; charset=' . $GLOBALS['charset']);
  51     /* HTML header */
  52     $page_title = __('Access denied');
  53     require './libraries/header_meta_style.inc.php';
  54     ?>
  55 </head>
  56 <body>
  57     <?php
  58     if (file_exists(CUSTOM_HEADER_FILE)) {
  59         require CUSTOM_HEADER_FILE;
  60     }
  61     ?>
  62
  63 <br /><br />
  64 <center>
  65     <h1><?php echo sprintf(__('Welcome to %s'), ' phpMyAdmin'); ?></h1>
  66 </center>
  67 <br />
  68
  69     <?php
  70     PMA_Message::error(__('Wrong username/password. Access denied.'))->display();
  71
  72     if (file_exists(CUSTOM_FOOTER_FILE)) {
  73         require CUSTOM_FOOTER_FILE;
  74     }
  75     ?>
  76
  77 </body>
  78 </html>
  79     <?php
  80     exit();
  81 } // end of the 'PMA_auth()' function
  82
  83
  84 /**
  85  * Gets advanced authentication settings
  86  *
  87  * @global  string    the username if register_globals is on
  88  * @global  string    the password if register_globals is on
  89  * @global  array     the array of server variables if register_globals is
  90  *                    off
  91  * @global  array     the array of environment variables if register_globals
  92  *                    is off
  93  * @global  string    the username for the ? server
  94  * @global  string    the password for the ? server
  95  * @global  string    the username for the WebSite Professional server
  96  * @global  string    the password for the WebSite Professional server
  97  * @global  string    the username of the user who logs out
  98  *
  99  * @return  boolean   whether we get authentication settings or not
 100  *
 101  * @access  public
 102  */
 103 function PMA_auth_check()
 104 {
 105     global $PHP_AUTH_USER, $PHP_AUTH_PW;
 106     global $old_usr;
 107
 108     // Grabs the $PHP_AUTH_USER variable whatever are the values of the
 109     // 'register_globals' and the 'variables_order' directives
 110     if (empty($PHP_AUTH_USER)) {
 111         if (PMA_getenv('PHP_AUTH_USER')) {
 112             $PHP_AUTH_USER = PMA_getenv('PHP_AUTH_USER');
 113         } elseif (PMA_getenv('REMOTE_USER')) {
 114             // CGI, might be encoded, see below
 115             $PHP_AUTH_USER = PMA_getenv('REMOTE_USER');
 116         } elseif (PMA_getenv('REDIRECT_REMOTE_USER')) {
 117             // CGI, might be encoded, see below
 118             $PHP_AUTH_USER = PMA_getenv('REDIRECT_REMOTE_USER');
 119         } elseif (PMA_getenv('AUTH_USER')) {
 120             // WebSite Professional
 121             $PHP_AUTH_USER = PMA_getenv('AUTH_USER');
 122         } elseif (PMA_getenv('HTTP_AUTHORIZATION')) {
 123             // IIS, might be encoded, see below
 124             $PHP_AUTH_USER = PMA_getenv('HTTP_AUTHORIZATION');
 125         } elseif (PMA_getenv('Authorization')) {
 126             // FastCGI, might be encoded, see below
 127             $PHP_AUTH_USER = PMA_getenv('Authorization');
 128         }
 129     }
 130     // Grabs the $PHP_AUTH_PW variable whatever are the values of the
 131     // 'register_globals' and the 'variables_order' directives
 132     if (empty($PHP_AUTH_PW)) {
 133         if (PMA_getenv('PHP_AUTH_PW')) {
 134             $PHP_AUTH_PW = PMA_getenv('PHP_AUTH_PW');
 135         } elseif (PMA_getenv('REMOTE_PASSWORD')) {
 136             // Apache/CGI
 137             $PHP_AUTH_PW = PMA_getenv('REMOTE_PASSWORD');
 138         } elseif (PMA_getenv('AUTH_PASSWORD')) {
 139             // WebSite Professional
 140             $PHP_AUTH_PW = PMA_getenv('AUTH_PASSWORD');
 141         }
 142     }
 143
 144     // Decode possibly encoded information (used by IIS/CGI/FastCGI)
 145     // (do not use explode() because a user might have a colon in his password
 146     if (strcmp(substr($PHP_AUTH_USER, 0, 6), 'Basic ') == 0) {
 147         $usr_pass = base64_decode(substr($PHP_AUTH_USER, 6));
 148         if (! empty($usr_pass)) {
 149             $colon = strpos($usr_pass, ':');
 150             if ($colon) {
 151                 $PHP_AUTH_USER = substr($usr_pass, 0, $colon);
 152                 $PHP_AUTH_PW = substr($usr_pass, $colon + 1);
 153             }
 154             unset($colon);
 155         }
 156         unset($usr_pass);
 157     }
 158
 159     // User logged out -> ensure the new username is not the same
 160     if (!empty($old_usr)
 161         && (isset($PHP_AUTH_USER) && $old_usr == $PHP_AUTH_USER)) {
 162         $PHP_AUTH_USER = '';
 163         // -> delete user's choices that were stored in session
 164         session_destroy();
 165     }
 166
 167     // Returns whether we get authentication settings or not
 168     if (empty($PHP_AUTH_USER)) {
 169         return false;
 170     } else {
 171         return true;
 172     }
 173 } // end of the 'PMA_auth_check()' function
 174
 175
 176 /**
 177  * Set the user and password after last checkings if required
 178  *
 179  * @global  array     the valid servers settings
 180  * @global  integer   the id of the current server
 181  * @global  array     the current server settings
 182  * @global  string    the current username
 183  * @global  string    the current password
 184  *
 185  * @return  boolean   always true
 186  *
 187  * @access  public
 188  */
 189 function PMA_auth_set_user()
 190 {
 191     global $cfg, $server;
 192     global $PHP_AUTH_USER, $PHP_AUTH_PW;
 193
 194     // Ensures valid authentication mode, 'only_db', bookmark database and
 195     // table names and relation table name are used
 196     if ($cfg['Server']['user'] != $PHP_AUTH_USER) {
 197         $servers_cnt = count($cfg['Servers']);
 198         for ($i = 1; $i <= $servers_cnt; $i++) {
 199             if (isset($cfg['Servers'][$i])
 200                 && ($cfg['Servers'][$i]['host'] == $cfg['Server']['host'] && $cfg['Servers'][$i]['user'] == $PHP_AUTH_USER)) {
 201                 $server        = $i;
 202                 $cfg['Server'] = $cfg['Servers'][$i];
 203                 break;
 204             }
 205         } // end for
 206     } // end if
 207
 208     $cfg['Server']['user']     = $PHP_AUTH_USER;
 209     $cfg['Server']['password'] = $PHP_AUTH_PW;
 210
 211     return true;
 212 } // end of the 'PMA_auth_set_user()' function
 213
 214
 215 /**
 216  * User is not allowed to login to MySQL -> authentication failed
 217  *
 218  * @return  boolean   always true (no return indeed)
 219  *
 220  * @access  public
 221  */
 222 function PMA_auth_fails()
 223 {
 224     $error = PMA_DBI_getError();
 225     if ($error && $GLOBALS['errno'] != 1045) {
 226         PMA_fatalError($error);
 227     } else {
 228         PMA_auth();
 229         return true;
 230     }
 231
 232 } // end of the 'PMA_auth_fails()' function
 233
 234 ?>