[cfinck] 28187: Verify the login credentials with the data in the RosCMS Database instead of the data in the Bugzilla Database. This is necessary as the login data in the Bugzilla Database is not synchronized with the login data in the RosCMS Database due to our RosCMS Integration.
Author: cfinck Date: Mon Aug 6 13:17:37 2007 New Revision: 28187
URL: http://svn.reactos.org/svn/reactos?rev=28187&view=rev Log: Verify the login credentials with the data in the RosCMS Database instead of the data in the Bugzilla Database. This is necessary as the login data in the Bugzilla Database is not synchronized with the login data in the RosCMS Database due to our RosCMS Integration.
Modified: trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Verify/ROSCMS.pm
Modified: trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm URL: http://svn.reactos.org/svn/reactos/trunk/web/reactos.org/htdocs/bugzilla/Bug... ============================================================================== --- trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm (original) +++ trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm Mon Aug 6 13:17:37 2007 @@ -30,7 +30,7 @@
# Auth::Login class for RosCMS # based on the former class for Bugzilla 2.x by Gé van Geldorp and Michael Wirth and the Auth::Login::CGI class -# improved and made compatible with Bugzilla 3.x and Deskzilla by Colin Finck (2007-07-29) +# improved and made compatible with Bugzilla 3.x and Deskzilla by Colin Finck (2007-08-06)
package Bugzilla::Auth::Login::ROSCMS; use strict; @@ -66,7 +66,9 @@ # No, then check for the RosCMS Login cookie my $dbh = Bugzilla->dbh; my $user_id; + my $roscms_user_id; my $session_id = $cgi->cookie($session_cookie_name); + if ( defined $session_id ) { my $session_id_clean = $session_id; trick_taint($session_id_clean); @@ -78,7 +80,7 @@ } my $browser_agent_clean = $ENV{'HTTP_USER_AGENT'}; trick_taint($browser_agent_clean); - my $query = "SELECT m.map_subsys_userid " . + my $query = "SELECT m.map_subsys_userid, m.map_roscms_userid " . " FROM $roscms_db_name.user_sessions s, " . " $roscms_db_name.users u, " . " $roscms_db_name.subsys_mappings m " . @@ -93,7 +95,8 @@ " AND m.map_roscms_userid = s.usersession_user_id " . " AND m.map_subsys_name = 'bugzilla'"; my @params = ($session_id_clean, $remote_addr_clean, $browser_agent_clean); - ($user_id) = $dbh->selectrow_array($query, undef, @params); + ($user_id, $roscms_user_id) = $dbh->selectrow_array($query, undef, @params); + if ($user_id) { # Update time of last session use $query = "UPDATE $roscms_db_name.user_sessions " . @@ -103,14 +106,16 @@ @params = ($session_id_clean); $dbh->do($query, undef, @params); - # Get the user name and the crypted password from the database + # Get the user name and the MD5 password from the database + # We don't check the password explicitly here as we only deal with the session cookie. + # To show the Verify module that it should trust us, we pass the MD5 password hash to it. This should be secure as long as we're the only one who knows this MD5 hash. my $username = user_id_to_login($user_id); - my $crypted_password = $dbh->selectrow_array("SELECT cryptpassword FROM profiles WHERE userid = ?", undef, $user_id); + (my $md5_password) = $dbh->selectrow_array("SELECT user_roscms_password FROM $roscms_db_name.users WHERE user_id = ?", undef, $roscms_user_id); # We need to set a parameter for the Auth::Persist::ROSCMS module $cgi->param('ROSCMS_login', 1); - return { username => $username, crypted_password => $crypted_password }; + return { username => $username, md5_password => $md5_password }; } }
Modified: trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Verify/ROSCMS.pm URL: http://svn.reactos.org/svn/reactos/trunk/web/reactos.org/htdocs/bugzilla/Bug... ============================================================================== --- trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Verify/ROSCMS.pm (original) +++ trunk/web/reactos.org/htdocs/bugzilla/Bugzilla/Auth/Verify/ROSCMS.pm Mon Aug 6 13:17:37 2007 @@ -28,7 +28,7 @@ # Erik Stambaugh erik@dasbistro.com
# Auth::Verify class for RosCMS -# developed by Colin Finck based on the Auth::Verify::DB class (2007-07-29) +# developed by Colin Finck based on the Auth::Verify::DB class (2007-08-06)
package Bugzilla::Auth::Verify::ROSCMS; use strict; @@ -40,6 +40,10 @@ use Bugzilla::Util; use Bugzilla::User;
+use Digest::MD5 qw(md5_hex); + +my $roscms_db_name = "roscms"; + sub check_credentials { my ($self, $login_data) = @_; my $dbh = Bugzilla->dbh; @@ -50,20 +54,24 @@ return { failure => AUTH_NO_SUCH_USER } unless $user_id; $login_data->{bz_username} = $username; - - my ($real_password_crypted) = $dbh->selectrow_array("SELECT cryptpassword FROM profiles WHERE userid = ?", undef, $user_id); - my $entered_password_crypted = $login_data->{crypted_password}; + my $md5_password = $login_data->{md5_password}; - if( !defined $entered_password_crypted ) { + if( !defined $md5_password ) + { my $password = $login_data->{password}; - - # Using the internal crypted password as the salt, - # crypt the password the user entered. - $entered_password_crypted = crypt($password, $real_password_crypted); + $md5_password = md5_hex($password); } + my $query = "SELECT u.user_roscms_password " . + "FROM $roscms_db_name.users u, " . + " $roscms_db_name.subsys_mappings m " . + "WHERE u.user_id = m.map_roscms_userid " . + " AND m.map_subsys_name = 'bugzilla' " . + " AND m.map_subsys_userid = ?"; + (my $valid_md5_password) = $dbh->selectrow_array($query, undef, $user_id); + return { failure => AUTH_LOGINFAILED } - if $entered_password_crypted ne $real_password_crypted; + if $md5_password ne $valid_md5_password; # The user's credentials are okay, so delete any outstanding # password tokens they may have generated.
-
cfinck＠svn.reactos.org