[SUCS Devel] [Git][sucssite/sucs-site][sucs-site] 5 commits: Update History.txt
Imran Hussain (@imranh)
gitlab at projects.sucs.org
Thu May 4 20:53:29 BST 2023
Imran Hussain pushed to branch sucs-site at sucssite / sucs-site
Commits:
3b4df7f1 by Thomas Lake at 2021-12-31T15:55:58+00:00
Update History.txt
- - - - -
7701a447 by Thomas Lake at 2021-12-31T16:00:07+00:00
Merge branch 'master' into 'beta'
Update History.txt
See merge request sucssite/sucs-site!127
- - - - -
7c7c9c20 by Imran Hussain at 2023-05-04T20:43:52+01:00
[login] filter out everything but A-Z a-z 0-9 . - _ from username
- - - - -
6d8b6ea7 by Imran Hussain at 2023-05-04T19:49:03+00:00
Merge branch 'master' into 'beta'
[login] filter out everything but A-Z a-z 0-9 . - _ from username
See merge request sucssite/sucs-site!129
- - - - -
0ded7b1d by Imran Hussain at 2023-05-04T19:53:23+00:00
Merge branch 'beta' into 'sucs-site'
beta merge to live
See merge request sucssite/sucs-site!130
- - - - -
2 changed files:
- lib/ldap-auth.php
- lib/session.php
Changes:
=====================================
lib/ldap-auth.php
=====================================
@@ -12,7 +12,7 @@ will return "nope" if the user/pass passed is inavlid
Example usage:
-include_once("ldap-auth.php");
+require "ldap-auth.php";
isAuthd = ldapAuth("usaername", "password");
@@ -29,6 +29,8 @@ if (isAuthd == "sucs"){
// we don't care about warnings, we write our own
error_reporting(E_ERROR | E_PARSE);
+define(LDAP_OPT_DIAGNOSTIC_MESSAGE, 0x0032);
+
function ldapAuth($username, $password)
{
@@ -45,24 +47,29 @@ function ldapAuth($username, $password)
$username = implode("@", $s);
}
+ // filter out everything but A-Z a-z 0-9 . - _ from username
+ $safeusername = preg_replace("/[^A-Za-z0-9\.\-\_]/", '', $username);
+
+ // if safeusername isn't the same as username just error out
+ if ($safeusername != $username) {
+ return "nope";
+ }
+
// ldap servers
$sucsLDAPServer = 'silver.sucs.swan.ac.uk';
- $lisLDAPServer = 'ccs-suld1.swan.ac.uk';
-
- // lis auth stuffs
- $lisUsernameOu = substr($username, -1);
- $lisOtherOu = "Moved";
+ $issLDAPServer = '192.168.10.16';
// how to bind
- $sucsBindDn = "uid=$username,ou=People,dc=sucs,dc=org";
- $lisBindDn1 = "cn=$username,ou=$lisUsernameOu,ou=Students,ou=SWANSEA,o=SWANUNI";
- $lisBindDn2 = "cn=$username,ou=$lisOtherOu,ou=Students,ou=SWANSEA,o=SWANUNI";
+ $sucsBindDn = "uid=$safeusername,ou=People,dc=sucs,dc=org";
+ $issBindDn = "cn=$safeusername,ou=Students,ou=Active,ou=Resources,o=Swansea";
// Main auth
// Try and connect to silver
$ldapconnSUCS = ldap_connect($sucsLDAPServer) or die("Could not connect to SUCS LDAP server.");
+ ldap_set_option($ldapconnSUCS,LDAP_OPT_PROTOCOL_VERSION,3);
+
if ($ldapconnSUCS) {
//echo "Connected to $sucsLDAPServer <br>";
@@ -73,28 +80,28 @@ function ldapAuth($username, $password)
if ($ldapbindSUCS) {
//echo "Auth'd as $username using SUCS LDAP<br>";
return "sucs";
- // turns out they didn't give us valid sucs creds, lets try lis now
+ // turns out they didn't give us valid sucs creds, lets try iss now
} else {
- // try and connect to the lis ldap server
- $ldapconnLIS = ldap_connect($lisLDAPServer) or die("Could not connect to uni LDAP server.");
- //echo "Connected to $lisLDAPServer <br>";
+ // try and connect to the iss ldap server
+ $ldapconnISS = ldap_connect($issLDAPServer) or die("Could not connect to uni LDAP server.");
+ // echo "Connected to $issLDAPServer <br>";
+
+ ldap_set_option($ldapconnISS,LDAP_OPT_PROTOCOL_VERSION,3);
// lets try and bind to the uni ldap
- $ldapbindLIS1 = ldap_bind($ldapconnLIS, $lisBindDn1, $password);
- if ($ldapbindLIS1) {
- //echo "Auth'd as $username using uni LDAP using ou=$lisUsernameOu<br>";
+ $ldapbindiss = ldap_bind($ldapconnISS, $issBindDn, $password);
+
+ /*if (ldap_get_option($ldapconnISS, LDAP_OPT_DIAGNOSTIC_MESSAGE, $extended_error)) {
+ echo "Error Binding to LDAP: $extended_error";
+ }*/
+
+ if ($ldapbindiss) {
+ //echo "Auth'd as $username using uni LDAP using ou=$issUsernameOu<br>";
return "uni";
} else {
- $ldapbindLIS2 = ldap_bind($ldapconnLIS, $lisBindDn2, $password);
- if ($ldapbindLIS2) {
- //echo "Auth'd as $username using uni LDAP using ou=moved<br>";
- return "uni";
- // shit, couldn't bind to anything
- } else {
- //exit("Invalid Username or Password");
- return "nope";
- }
+ //exit("Invalid Username or Password");
+ return "nope";
}
}
}
=====================================
lib/session.php
=====================================
@@ -116,7 +116,15 @@ class Session
// Is this a login attempt ?
if ($submit != '' && $session_user != '' && $session_pass != '') {
- $this->session_init($session_user, $session_pass);
+ // filter out everything but A-Z a-z 0-9 . - _ from username
+ $safeusername = preg_replace("/[^A-Za-z0-9\.\-\_]/", '', $session_user);
+ if ($safeusername != $session_user) {
+ trigger_error("Invalid username", E_USER_NOTICE);
+ $this->newsession();
+ return;
+ } elseif ($safeusername == $session_user) {
+ $this->session_init($safeusername, $session_pass);
+ }
}
// Retrieve session information
View it on GitLab: https://projects.sucs.org/sucssite/sucs-site/-/compare/6374855d42bc7cc097235cbf4779c8a23b2dadcd...0ded7b1d2a1bcdaaf016bdc2e4140a83e9a2f62c
--
View it on GitLab: https://projects.sucs.org/sucssite/sucs-site/-/compare/6374855d42bc7cc097235cbf4779c8a23b2dadcd...0ded7b1d2a1bcdaaf016bdc2e4140a83e9a2f62c
You're receiving this email because of your account on projects.sucs.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sucs.org/pipermail/devel/attachments/20230504/fd450ca3/attachment-0001.html>
More information about the Devel
mailing list