1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
# -*- Mode: perl; indent-tabs-mode: nil -*-
#
# The contents of this file are subject to the Mozilla Public
# License Version 1.1 (the "License"); you may not use this file
# except in compliance with the License. You may obtain a copy of
# the License at http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS
# IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
# implied. See the License for the specific language governing
# rights and limitations under the License.
#
# The Original Code is the Bugzilla Bug Tracking System.
#
# The Initial Developer of the Original Code is Netscape Communications
# Corporation. Portions created by Netscape are
# Copyright (C) 1998 Netscape Communications Corporation. All
# Rights Reserved.
#
# Contributor(s): Erik Stambaugh <erik@dasbistro.com>
package Bugzilla::Auth::Login::WWW::Env;
use strict;
use Bugzilla::Config;
use Bugzilla::Error;
use Bugzilla::Util;
sub login {
my ($class, $type) = @_;
# XXX This does not currently work correctly with Param('requirelogin').
# Bug 253636 will hopefully see that param's needs taken care of in a
# parent module, but for the time being, this module does not honor
# the param in the way that CGI.pm does.
my $matched_userid = '';
my $matched_extern_id = '';
my $disabledtext = '';
my $dbh = Bugzilla->dbh;
my $sth;
# Gather the environment variables
my $env_id = $ENV{Param("auth_env_id")};
my $env_email = $ENV{Param("auth_env_email")};
my $env_realname = $ENV{Param("auth_env_realname")};
# allow undefined values to work with trick_taint
for ($env_id, $env_email, $env_realname) { $_ ||= '' };
# make sure the email field contains only a valid email address
my $emailregexp = Param("emailregexp");
$env_email =~ /($emailregexp)/;
$env_email = $1;
# untaint the remaining values
trick_taint($env_id);
trick_taint($env_realname);
if ($env_id | $env_email) {
# Look in the DB for the extern_id
if ($env_id) {
# Not having the email address defined but having an ID isn't
# allowed.
return undef unless $env_email;
$sth = $dbh->prepare("SELECT userid, disabledtext " .
"FROM profiles WHERE extern_id=?");
$sth->execute($env_id);
my $fetched = $sth->fetch;
if ($fetched) {
$matched_userid = $fetched->[0];
$disabledtext = $fetched->[1];
}
}
unless ($matched_userid) {
# There was either no match for the external ID given, or one was
# not present.
#
# Check to see if the email address is in there and has no
# external id assigned. We test for both the login name (which we
# also sent), and the id, so that we have a way of telling that we
# got something instead of a bunch of NULLs
$sth = $dbh->prepare("SELECT extern_id, userid, disabledtext " .
"FROM profiles WHERE login_name=?");
$sth->execute($env_email);
$sth->execute();
my $fetched = $sth->fetch();
if ($fetched) {
($matched_extern_id, $matched_userid, $disabledtext) = @{$fetched};
}
if ($matched_userid) {
if ($matched_extern_id) {
# someone with a different external ID has that address!
ThrowUserError("extern_id_conflict");
}
else
{
# someone with no external ID used that address, time to
# add the ID!
$sth = $dbh->prepare("UPDATE profiles " .
"SET extern_id=? WHERE userid=?");
$sth->execute($env_id, $matched_userid);
}
}
else
{
# Need to create a new user with that email address. Note
# that cryptpassword has been filled in with '*', since the
# user has no DB password.
$sth = $dbh->prepare("INSERT INTO profiles ( " .
"login_name, cryptpassword, " .
"realname, disabledtext " .
") VALUES ( ?, ?, ?, '' )");
$sth->execute($env_email, '*', $env_realname);
$matched_userid = $dbh->bz_last_key('profiles', 'userid');
}
}
}
# now that we hopefully have a username, we need to see if the data
# has to be updated
if ($matched_userid) {
$sth = $dbh->prepare("SELECT login_name, realname " .
"FROM profiles " .
"WHERE userid=?");
$sth->execute($matched_userid);
my $fetched = $sth->fetch;
my $username = $fetched->[0];
my $this_realname = $fetched->[1];
if ( ($username ne $env_email) ||
($this_realname ne $env_realname) ) {
$sth = $dbh->prepare("UPDATE profiles " .
"SET login_name=?, " .
"realname=? " .
"WHERE userid=?");
$sth->execute($env_email,
($env_realname || $this_realname),
$matched_userid);
$sth->execute;
}
}
# Now we throw an error if the user has been disabled
if ($disabledtext) {
ThrowUserError("account_disabled",
{'disabled_reason' => $disabledtext});
}
return $matched_userid;
}
# This auth style does not allow the user to log out.
sub can_logout { return 0; }
1;
__END__
=head1 NAME
Bugzilla::Auth::Env - Environment Variable Authentication
=head1 DESCRIPTION
Many external user authentication systems supply login information to CGI
programs via environment variables. This module checks to see if those
variables are populated and, if so, assumes authentication was successful and
returns the user's ID, having automatically created a new profile if
necessary.
=head1 SEE ALSO
L<Bugzilla::Auth>
|
