gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-11-28 02:20:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'seeddms-5.1.x' into seeddms-6.0.x

Browse Source
This commit is contained in:
Uwe Steinmann 2025-10-24 15:02:12 +02:00
commit c00fdb7f95
3 changed files with 194 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG
View File

@ -348,6 +348,8 @@
--------------------------------------------------------------------------------
Changes in version 5.1.43
--------------------------------------------------------------------------------
- add Slim middleware for Basic authentication (can be used by extensions)
- rest api endpoint 'statstotal' returns number of groups and categories
--------------------------------------------------------------------------------
Changes in version 5.1.42

182
inc/inc.ClassAuthenticationMiddleware.php
View File

@ -35,8 +35,11 @@ class SeedDMS_Auth_Middleware_Session { /* {{{ */
private $container;
public function __construct($container) {
private $responsefactory;
public function __construct($container, $responsefactory) {
$this->container = $container;
$this->responsefactory = $responsefactory;
}
/**
@ -63,7 +66,7 @@ class SeedDMS_Auth_Middleware_Session { /* {{{ */
return $response;
}
$logger->log("Invoke middleware for method " . $request->getMethod() . " on '" . $request->getUri()->getPath() . "'", PEAR_LOG_INFO);
$logger->log("Invoke AuthSessionMiddleware for method " . $request->getMethod() . " on '" . $request->getUri()->getPath() . "'", PEAR_LOG_INFO);
require_once("inc/inc.ClassSession.php");
$session = new SeedDMS_Session($dms->getDb());
if (isset($_COOKIE["mydms_session"])) {
@ -73,6 +76,7 @@ class SeedDMS_Auth_Middleware_Session { /* {{{ */
/* Delete Cookie */
setcookie("mydms_session", $dms_session, time() - 3600, $settings->_httpRoot);
$logger->log("Session for id '" . $dms_session . "' has gone", PEAR_LOG_ERR);
$response = $this->responsefactory->createResponse();
return $response->withStatus(403);
}
@ -83,6 +87,7 @@ class SeedDMS_Auth_Middleware_Session { /* {{{ */
setcookie("mydms_session", $dms_session, time() - 3600, $settings->_httpRoot);
if ($settings->_enableGuestLogin) {
if (!($userobj = $dms->getUser($settings->_guestID))) {
$response = $this->responsefactory->createResponse();
return $response->withStatus(403);
}
} else {
@ -92,12 +97,14 @@ class SeedDMS_Auth_Middleware_Session { /* {{{ */
if ($userobj->isAdmin()) {
if ($resArr["su"]) {
if (!($userobj = $dms->getUser($resArr["su"]))) {
$response = $this->responsefactory->createResponse();
return $response->withStatus(403);
}
}
}
$dms->setUser($userobj);
} else {
$response = $this->responsefactory->createResponse();
return $response->withStatus(403);
}
$this->container->set('userobj', $userobj);
@ -106,3 +113,174 @@ class SeedDMS_Auth_Middleware_Session { /* {{{ */
return $response;
}
} /* }}} */
/**
* Middleware for authentication based on basic authentication
*
**/
class SeedDMS_Auth_Middleware_Basic { /* {{{ */
private $container;
private $responsefactory;
public function __construct($container, $responsefactory) {
$this->container = $container;
$this->responsefactory = $responsefactory;
}
/**
* Basic authentication middleware invokable class
*
* @param \Psr\Http\Message\ServerRequestInterface $request PSR7 request
* @param \Psr\Http\Message\ResponseInterface $response PSR7 response
* @param callable $next Next middleware
*
* @return \Psr\Http\Message\ResponseInterface
*/
public function __invoke($request, $handler) {
$dms = $this->container->get('dms');
$settings = $this->container->get('config');
$logger = $this->container->get('logger');
$userobj = null;
if ($this->container->has('userobj')) {
$userobj = $this->container->get('userobj');
}
if ($userobj) {
$response = $handler->handle($request);
return $response;
}
$logger->log("Invoke AuthBasicMiddleware for method " . $request->getMethod() . " on '" . $request->getUri()->getPath() . "'", PEAR_LOG_INFO);
$environment = $request->getServerParams();
if(!empty($environment['HTTP_AUTHORIZATION'])) {
$tmp = explode(' ', $environment['HTTP_AUTHORIZATION'], 2);
switch($tmp[0]) {
case 'Basic':
$logger->log("Basic authentication with ".$tmp[0]."=".$tmp[1], PEAR_LOG_INFO);
$authenticator = $this->container->get('authenticator');
$kk = explode(':', base64_decode($tmp[1]));
$userobj = $authenticator->authenticate($kk[0], $kk[1]);
if(!$userobj) {
$logger->log("Login with basic authentication for '".$kk[0]."' failed", PEAR_LOG_ERR);
$response = $this->responsefactory->createResponse();
return $response->withStatus(403);
}
$dms->setUser($userobj);
if($this->container instanceof \Slim\Container)
$this->container['userobj'] = $userobj;
else
$this->container->set('userobj', $userobj);
$logger->log("Login with basic authentication as '".$userobj->getLogin()."' successful", PEAR_LOG_INFO);
break;
}
}
$this->container->set('userobj', $userobj);
if(!$userobj)
$logger->log("Not yet authenticated. Pass on to next middleware", PEAR_LOG_INFO);
else
$logger->log("Authenticated as ".(is_object($userobj) ? $userobj->getLogin() : "annon").". Pass on to next middleware", PEAR_LOG_INFO);
/* Always pass on to the next middleware. If that middleware does
* authentication, then it should first check if 'userobj' in the container
* is already set. The authentication shipped with seeddms restapi does that
* and skips its own authentication, if userobj already exists.
*/
$response = $handler->handle($request);
return $response;
}
} /* }}} */
/**
* Middleware for authentication based on token
*
**/
class SeedDMS_Auth_Middleware_Token { /* {{{ */
private $container;
private $responsefactory;
public function __construct($container, $responsefactory) {
$this->container = $container;
$this->responsefactory = $responsefactory;
}
/**
* Basic authentication middleware invokable class
*
* @param \Psr\Http\Message\ServerRequestInterface $request PSR7 request
* @param \Psr\Http\Message\ResponseInterface $response PSR7 response
* @param callable $next Next middleware
*
* @return \Psr\Http\Message\ResponseInterface
*/
public function __invoke($request, $handler) {
$dms = $this->container->get('dms');
$settings = $this->container->get('config');
$logger = $this->container->get('logger');
$userobj = null;
if ($this->container->has('userobj')) {
$userobj = $this->container->get('userobj');
}
if ($userobj) {
$response = $handler->handle($request);
return $response;
}
$logger->log("Invoke AuthTokenMiddleware for method " . $request->getMethod() . " on '" . $request->getUri()->getPath() . "'", PEAR_LOG_INFO);
$environment = $request->getServerParams();
/* Do not even try to authenticate if HTTP_AUTHORIZATION is empty, contains
* a ' ' (in case of Basic authentication), the api key is not set, the api
* user is not set.
*/
if (!empty($environment['HTTP_AUTHORIZATION']) && strstr($environment['HTTP_AUTHORIZATION'], ' ') === false && !empty($settings->_apiKey) && !empty($settings->_apiUserId)) {
$logger->log("Authorization key: ".$environment['HTTP_AUTHORIZATION'], PEAR_LOG_DEBUG);
if($settings->_apiKey == $environment['HTTP_AUTHORIZATION']) {
if(!($userobj = $dms->getUser($settings->_apiUserId))) {
$response = $this->responsefactory->createResponse();
$response = $response->withHeader('Content-Type', 'application/json');
$response = $response->withStatus(403);
$response->getBody()->write(
(string)json_encode(
['success'=>false, 'message'=>'Invalid user associated with api key', 'data'=>''],
JSON_UNESCAPED_SLASHES | JSON_PARTIAL_OUTPUT_ON_ERROR
)
);
return $response;
}
} else {
$response = $this->responsefactory->createResponse();
$response = $response->withHeader('Content-Type', 'application/json');
$response = $response->withStatus(403);
$response->getBody()->write(
(string)json_encode(
['success'=>false, 'message'=>'Wrong api key', 'data'=>''],
JSON_UNESCAPED_SLASHES | JSON_PARTIAL_OUTPUT_ON_ERROR
)
);
return $response;
}
$logger->log("Login with apikey as '".$userobj->getLogin()."' successful", PEAR_LOG_INFO);
}
$this->container->set('userobj', $userobj);
if(!$userobj)
$logger->log("Not yet authenticated. Pass on to next middleware", PEAR_LOG_INFO);
else
$logger->log("Authenticated as ".(is_object($userobj) ? $userobj->getLogin() : "annon").". Pass on to next middleware", PEAR_LOG_INFO);
/* Always pass on to the next middleware. If that middleware does
* authentication, then it should first check if 'userobj' in the container
* is already set. The authentication shipped with seeddms restapi does that
* and skips its own authentication, if userobj already exists.
*/
$response = $handler->handle($request);
return $response;
}
} /* }}} */

14
restapi/index.php
View File

@ -3098,7 +3098,7 @@ final class SeedDMS_RestapiController { /* {{{ */
return $check;
$data = [];
foreach (array('docstotal', 'folderstotal', 'userstotal') as $type) {
foreach (array('docstotal', 'folderstotal', 'userstotal', 'groupstotal', 'categoriestotal') as $type) {
$total = $dms->getStatisticalData($type);
$data[$type] = $total;
}
@ -3167,7 +3167,12 @@ class RestapiAuthMiddleware implements MiddlewareInterface { /* {{{ */
}
/**
* Example middleware invokable class
* Auth middleware invokable class
*
* This methods checks for an api token in the Authorization header or
* a valid session in the cookie `mydms_session`.
* It does not support Basic authentication. It actually treats that
* as a wrong api token and authentication fails.
*
* @param \Psr\Http\Message\ServerRequestInterface $request PSR7 request
* @param \Psr\Http\Server\RequestHandlerInterface $handler
@ -3229,6 +3234,8 @@ class RestapiAuthMiddleware implements MiddlewareInterface { /* {{{ */
$userobj = null;
// $logger->log(var_export($environment, true), PEAR_LOG_DEBUG);
if(!empty($environment['HTTP_AUTHORIZATION']) && !empty($settings->_apiKey) && !empty($settings->_apiUserId)) {
/* We cannot handle Basic authentication, so skip it */
if (substr($environment['HTTP_AUTHORIZATION'], 0, 6) != 'Basic ') {
$logger->log("Authorization key: ".$environment['HTTP_AUTHORIZATION'], PEAR_LOG_DEBUG);
if($settings->_apiKey == $environment['HTTP_AUTHORIZATION']) {
if(!($userobj = $dms->getUser($settings->_apiUserId))) {
@ -3256,6 +3263,9 @@ class RestapiAuthMiddleware implements MiddlewareInterface { /* {{{ */
return $response;
}
$logger->log("Login with apikey as '".$userobj->getLogin()."' successful", PEAR_LOG_INFO);
} else {
$logger->log("Login with Basic auth cannot be handled by AuthMiddleware", PEAR_LOG_INFO);
}
} else {
$logger->log("Checking for valid session", PEAR_LOG_INFO);
require_once("../inc/inc.ClassSession.php");