diff --git a/webui/config.php b/webui/config.php index d8fe2f19..27ea607d 100644 --- a/webui/config.php +++ b/webui/config.php @@ -236,6 +236,7 @@ $config['CGI_INPUT_FIELD_WIDTH'] = 50; $config['CGI_INPUT_FIELD_HEIGHT'] = 7; $config['ADMIN_CAN_POWER_SEARCH'] = 0; +$config['FOUR_EYES_LOGIN_FOR_AUDITOR'] = 0; $config['MEMCACHED_PREFIX'] = '_piler:'; $config['MEMCACHED_TTL'] = 900; diff --git a/webui/controller/login/foureyes.php b/webui/controller/login/foureyes.php new file mode 100644 index 00000000..77f3ab9d --- /dev/null +++ b/webui/controller/login/foureyes.php @@ -0,0 +1,123 @@ +id = "content"; + $this->template = "login/foureyes.tpl"; + $this->layout = "common/layout-empty"; + + + if(Registry::get('username')) { + header("Location: search.php"); + exit; + } + + + $request = Registry::get('request'); + $session = Registry::get('session'); + + $db = Registry::get('db'); + + $this->load->model('user/auth'); + $this->load->model('user/user'); + $this->load->model('user/prefs'); + $this->load->model('domain/domain'); + $this->load->model('folder/folder'); + + if(ENABLE_SAAS == 1) { + $this->load->model('saas/ldap'); + $this->load->model('saas/customer'); + } + + $this->data['title'] = $this->data['text_login']; + $this->data['title_prefix'] = TITLE_PREFIX; + + $this->data['failed_login_count'] = $this->model_user_auth->get_failed_login_count(); + + $data = $session->get("auth_data"); + + if($this->request->server['REQUEST_METHOD'] == 'POST' && $this->validate() == true) { + + if($this->model_user_auth->checkLogin($this->request->post['username'], $_POST['password']) == 1) { + $session->remove("four_eyes"); + + $this->model_user_auth->apply_user_auth_session($data); + $session->remove("auth_data"); + + $this->model_user_prefs->get_user_preferences($session->get('username')); + + if(ENABLE_SAAS == 1) { + $this->model_saas_customer->online($session->get('email')); + } + + LOGGER('logged in'); + + if(isAdminUser() == 1) { + header("Location: " . SITE_URL . "index.php?route=health/health"); + exit; + } + + header("Location: " . SITE_URL . "search.php"); + exit; + } + else { + $this->model_user_auth->increment_failed_login_count($this->data['failed_login_count']); + $this->data['failed_login_count']++; + } + + $this->data['x'] = $this->data['text_invalid_email_or_password']; + + } + + + $this->render(); + } + + + private function check_admin_account() { + + if($this->model_user_auth->checkLogin($this->request->post['username2'], $_POST['password2']) != 1 || isAdminUser() != 1) { + $this->error['username'] = 'failed admin login'; + return 0; + } + else { + $this->model_user_auth->reset_user_auth_session(); + return 1; + } + + } + + + private function validate() { + + if(strlen($this->request->post['username']) < 2){ + $this->error['username'] = $this->data['text_invalid_username']; + } + + + if(CAPTCHA_FAILED_LOGIN_COUNT > 0 && $this->data['failed_login_count'] > CAPTCHA_FAILED_LOGIN_COUNT) { + require_once $_SERVER['DOCUMENT_ROOT'] . '/securimage/securimage.php'; + $image = new Securimage(); + + if($image->check($this->request->post['captcha']) != true) { + $this->error['captcha'] = 'captcha error'; + } + } + + + if (!$this->error) { + return true; + } else { + return false; + } + + } + + +} + +?> diff --git a/webui/controller/login/ga.php b/webui/controller/login/ga.php index e7812a3b..d76ba669 100644 --- a/webui/controller/login/ga.php +++ b/webui/controller/login/ga.php @@ -52,6 +52,11 @@ class ControllerLoginGA extends Controller { $session->set("ga_block", ""); + if($session->get("four_eyes") == 1) { + header("Location: " . SITE_URL . "index.php?route=login/foureyes"); + exit; + } + $this->model_user_auth->apply_user_auth_session($data); $session->remove("auth_data"); diff --git a/webui/controller/login/login.php b/webui/controller/login/login.php index 620427ef..8ef8ebd0 100644 --- a/webui/controller/login/login.php +++ b/webui/controller/login/login.php @@ -47,6 +47,12 @@ class ControllerLoginLogin extends Controller { header("Location: " . SITE_URL . "index.php?route=login/ga"); exit; } + + else if($session->get("four_eyes") == 1) { + header("Location: " . SITE_URL . "index.php?route=login/foureyes"); + exit; + } + else { $data = $session->get("auth_data"); $this->model_user_auth->apply_user_auth_session($data); diff --git a/webui/index.php b/webui/index.php index cef8dbcf..152c76e3 100644 --- a/webui/index.php +++ b/webui/index.php @@ -69,6 +69,9 @@ Registry::set('import_status', $import_status); if($session->get("ga_block") == 1 && $request->get['route'] != 'login/logout' ) { $action = new Router('login/ga'); } +else if($session->get("four_eyes") == 1 && $request->get['route'] != 'login/logout' ) { + $action = new Router('login/foureyes'); +} else if(Registry::get('username')) { if(isset($request->get['route'])){ diff --git a/webui/model/user/auth.php b/webui/model/user/auth.php index bdebae00..c55063b9 100644 --- a/webui/model/user/auth.php +++ b/webui/model/user/auth.php @@ -44,10 +44,6 @@ class ModelUserAuth extends Model { if($ok == 1) { return $ok; } } -/* - * TODO: test the CUSTOM_EMAIL_QUERY_FUNCTION feature! - */ - if(ENABLE_IMAP_AUTH == 1) { require 'Zend/Mail/Protocol/Imap.php'; $ok = $this->checkLoginAgainstIMAP($username, $password, $data); @@ -116,6 +112,8 @@ class ModelUserAuth extends Model { $this->is_ga_code_needed($username); + $this->is_four_eye_auth_needed($data['admin_user']); + return 1; } @@ -213,6 +211,8 @@ class ModelUserAuth extends Model { $session->set("auth_data", $data); + $this->is_four_eye_auth_needed($role); + AUDIT(ACTION_LOGIN, $username, '', '', 'successful auth against LDAP'); return 1; @@ -494,10 +494,10 @@ class ModelUserAuth extends Model { } - public function is_four_eye_auth_needed() { + public function is_four_eye_auth_needed($admin_user = 0) { $session = Registry::get('session'); - if(1 == FOUR_EYES_LOGIN_FOR_AUDITOR && 2 == $session->get("admin_user")) { + if(1 == FOUR_EYES_LOGIN_FOR_AUDITOR && 2 == $admin_user) { $session->set("four_eyes", 1); } diff --git a/webui/view/theme/default/templates/login/foureyes.tpl b/webui/view/theme/default/templates/login/foureyes.tpl new file mode 100644 index 00000000..ac66af45 --- /dev/null +++ b/webui/view/theme/default/templates/login/foureyes.tpl @@ -0,0 +1,67 @@ + + + + + <?php if($title_prefix) { print $title_prefix; ?> | <?php } ?><?php print $title; ?> + + + + + + + + + + + + + + + + + + + + + + + +
+
Archive Logo Image
+ +
+ + + +

+ " /> + + + + + 0 && $failed_login_count > CAPTCHA_FAILED_LOGIN_COUNT) { ?> + captcha image + + + + + +
+ + +
+

+
+ +
+ + + + + + + + + diff --git a/webui/view/theme/mobile/templates/login/foureyes.tpl b/webui/view/theme/mobile/templates/login/foureyes.tpl new file mode 100644 index 00000000..4816f657 --- /dev/null +++ b/webui/view/theme/mobile/templates/login/foureyes.tpl @@ -0,0 +1,76 @@ + + + + + <?php if($title_prefix) { print $title_prefix; ?> | <?php } ?><?php print $title; ?> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Archive Logo Image
+ +
+ + + +

+ " /> + + + + + 0 && $failed_login_count > CAPTCHA_FAILED_LOGIN_COUNT) { ?> + captcha image + + + + + +
+ +
+ + +

+ + +

+
+ +
+ + + + + + + + + +