2014-10-06 05:01:33 +02:00
|
|
|
<?php
|
|
|
|
|
|
2016-06-23 01:37:22 +02:00
|
|
|
namespace SilverStripe\Security;
|
|
|
|
|
|
2016-08-11 01:14:02 +02:00
|
|
|
use SilverStripe\Admin\AdminRootController;
|
2017-06-09 05:07:35 +02:00
|
|
|
use SilverStripe\Control\Controller;
|
|
|
|
|
use SilverStripe\Control\Director;
|
2017-05-31 07:48:16 +02:00
|
|
|
use SilverStripe\Admin\LeftAndMain;
|
2016-09-09 08:43:05 +02:00
|
|
|
use SilverStripe\Control\HTTPResponse;
|
2017-04-30 05:17:26 +02:00
|
|
|
use SilverStripe\Control\Session;
|
2016-08-19 00:51:35 +02:00
|
|
|
use SilverStripe\Core\Convert;
|
2017-05-31 07:48:16 +02:00
|
|
|
use SilverStripe\Core\Manifest\ModuleLoader;
|
2016-08-19 00:51:35 +02:00
|
|
|
use SilverStripe\ORM\FieldType\DBField;
|
2017-05-31 07:48:16 +02:00
|
|
|
use SilverStripe\ORM\FieldType\DBHTMLText;
|
2016-08-19 00:51:35 +02:00
|
|
|
use SilverStripe\View\Requirements;
|
2017-05-31 07:48:16 +02:00
|
|
|
use SilverStripe\View\SSViewer;
|
2016-08-11 01:14:02 +02:00
|
|
|
|
2014-10-06 05:01:33 +02:00
|
|
|
/**
|
|
|
|
|
* Provides a security interface functionality within the cms
|
|
|
|
|
*/
|
2016-11-29 00:31:16 +01:00
|
|
|
class CMSSecurity extends Security
|
|
|
|
|
{
|
|
|
|
|
private static $allowed_actions = array(
|
2017-04-30 05:17:26 +02:00
|
|
|
'login',
|
2016-11-29 00:31:16 +01:00
|
|
|
'LoginForm',
|
|
|
|
|
'success'
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Enable in-cms reauthentication
|
|
|
|
|
*
|
|
|
|
|
* @var boolean
|
|
|
|
|
* @config
|
|
|
|
|
*/
|
|
|
|
|
private static $reauth_enabled = true;
|
|
|
|
|
|
|
|
|
|
protected function init()
|
|
|
|
|
{
|
|
|
|
|
parent::init();
|
|
|
|
|
|
2017-05-31 07:48:16 +02:00
|
|
|
// Assign default cms theme and replace user-specified themes
|
|
|
|
|
SSViewer::set_themes(LeftAndMain::config()->uninherited('admin_themes'));
|
|
|
|
|
|
|
|
|
|
// Core styles / vendor scripts
|
|
|
|
|
$admin = ModuleLoader::getModule('silverstripe/admin');
|
|
|
|
|
Requirements::javascript($admin->getResourcePath('client/dist/js/vendor.js'));
|
|
|
|
|
Requirements::css($admin->getResourcePath('client/dist/styles/bundle.css'));
|
2016-11-29 00:31:16 +01:00
|
|
|
}
|
|
|
|
|
|
2017-05-30 09:42:00 +02:00
|
|
|
public function login($request = null, $service = Authenticator::CMS_LOGIN)
|
2017-04-30 05:17:26 +02:00
|
|
|
{
|
|
|
|
|
return parent::login($request, Authenticator::CMS_LOGIN);
|
|
|
|
|
}
|
|
|
|
|
|
2016-11-29 00:31:16 +01:00
|
|
|
public function Link($action = null)
|
|
|
|
|
{
|
|
|
|
|
/** @skipUpgrade */
|
|
|
|
|
return Controller::join_links(Director::baseURL(), "CMSSecurity", $action);
|
|
|
|
|
}
|
|
|
|
|
|
2017-04-30 05:17:26 +02:00
|
|
|
protected function getAuthenticator($name = 'cms')
|
|
|
|
|
{
|
|
|
|
|
return parent::getAuthenticator($name);
|
|
|
|
|
}
|
|
|
|
|
|
2017-05-30 09:42:00 +02:00
|
|
|
public function getApplicableAuthenticators($service = Authenticator::CMS_LOGIN)
|
2017-04-30 05:17:26 +02:00
|
|
|
{
|
2017-05-30 09:42:00 +02:00
|
|
|
return parent::getApplicableAuthenticators($service);
|
2017-04-30 05:17:26 +02:00
|
|
|
}
|
|
|
|
|
|
2016-11-29 00:31:16 +01:00
|
|
|
/**
|
|
|
|
|
* Get known logged out member
|
|
|
|
|
*
|
|
|
|
|
* @return Member
|
|
|
|
|
*/
|
|
|
|
|
public function getTargetMember()
|
|
|
|
|
{
|
2017-05-31 07:48:16 +02:00
|
|
|
$tempid = $this->getRequest()->requestVar('tempid');
|
|
|
|
|
if ($tempid) {
|
2016-11-29 00:31:16 +01:00
|
|
|
return Member::member_from_tempid($tempid);
|
|
|
|
|
}
|
2017-04-30 05:17:26 +02:00
|
|
|
|
2016-11-29 00:31:16 +01:00
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function getResponseController($title)
|
|
|
|
|
{
|
|
|
|
|
// Use $this to prevent use of Page to render underlying templates
|
|
|
|
|
return $this;
|
|
|
|
|
}
|
|
|
|
|
|
2017-06-15 12:54:41 +02:00
|
|
|
protected function getSessionMessage(&$messageType = null)
|
2016-11-29 00:31:16 +01:00
|
|
|
{
|
2017-06-15 12:54:41 +02:00
|
|
|
$message = parent::getSessionMessage($messageType);
|
2017-05-31 07:48:16 +02:00
|
|
|
if ($message) {
|
|
|
|
|
return $message;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Format
|
|
|
|
|
return _t(
|
|
|
|
|
__CLASS__.'.LOGIN_MESSAGE',
|
|
|
|
|
'<p>Your session has timed out due to inactivity</p>'
|
|
|
|
|
);
|
2016-11-29 00:31:16 +01:00
|
|
|
}
|
|
|
|
|
|
2017-05-31 07:48:16 +02:00
|
|
|
/**
|
|
|
|
|
* Check if there is a logged in member
|
|
|
|
|
*
|
|
|
|
|
* @return bool
|
|
|
|
|
*/
|
|
|
|
|
public function getIsloggedIn()
|
2016-11-29 00:31:16 +01:00
|
|
|
{
|
2017-05-31 07:48:16 +02:00
|
|
|
return !!Security::getCurrentUser();
|
2016-11-29 00:31:16 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Redirects the user to the external login page
|
|
|
|
|
*
|
|
|
|
|
* @return HTTPResponse
|
|
|
|
|
*/
|
|
|
|
|
protected function redirectToExternalLogin()
|
|
|
|
|
{
|
|
|
|
|
$loginURL = Security::create()->Link('login');
|
|
|
|
|
$loginURLATT = Convert::raw2att($loginURL);
|
|
|
|
|
$loginURLJS = Convert::raw2js($loginURL);
|
|
|
|
|
$message = _t(
|
2017-05-31 07:48:16 +02:00
|
|
|
__CLASS__.'.INVALIDUSER',
|
2016-11-29 00:31:16 +01:00
|
|
|
'<p>Invalid user. <a target="_top" href="{link}">Please re-authenticate here</a> to continue.</p>',
|
|
|
|
|
'Message displayed to user if their session cannot be restored',
|
|
|
|
|
array('link' => $loginURLATT)
|
|
|
|
|
);
|
|
|
|
|
$response = $this->getResponse();
|
|
|
|
|
$response->setStatusCode(200);
|
|
|
|
|
$response->setBody(<<<PHP
|
2014-10-06 05:01:33 +02:00
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html><body>
|
|
|
|
|
$message
|
2016-01-24 06:12:45 +01:00
|
|
|
<script type="application/javascript">
|
2014-10-06 05:01:33 +02:00
|
|
|
setTimeout(function(){top.location.href = "$loginURLJS";}, 0);
|
|
|
|
|
</script>
|
|
|
|
|
</body></html>
|
|
|
|
|
PHP
|
2016-11-29 00:31:16 +01:00
|
|
|
);
|
|
|
|
|
$this->setResponse($response);
|
2017-04-30 05:17:26 +02:00
|
|
|
|
2016-11-29 00:31:16 +01:00
|
|
|
return $response;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected function preLogin()
|
|
|
|
|
{
|
|
|
|
|
// If no member has been previously logged in for this session, force a redirect to the main login page
|
|
|
|
|
if (!$this->getTargetMember()) {
|
|
|
|
|
return $this->redirectToExternalLogin();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return parent::preLogin();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Determine if CMSSecurity is enabled
|
|
|
|
|
*
|
|
|
|
|
* @return bool
|
|
|
|
|
*/
|
2017-06-10 04:46:01 +02:00
|
|
|
public function enabled()
|
2016-11-29 00:31:16 +01:00
|
|
|
{
|
|
|
|
|
// Disable shortcut
|
2017-04-30 05:17:26 +02:00
|
|
|
if (!static::config()->get('reauth_enabled')) {
|
2016-11-29 00:31:16 +01:00
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2017-06-10 04:46:01 +02:00
|
|
|
return count($this->getApplicableAuthenticators(Authenticator::CMS_LOGIN)) > 0;
|
2016-11-29 00:31:16 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Given a successful login, tell the parent frame to close the dialog
|
|
|
|
|
*
|
|
|
|
|
* @return HTTPResponse|DBField
|
|
|
|
|
*/
|
|
|
|
|
public function success()
|
|
|
|
|
{
|
|
|
|
|
// Ensure member is properly logged in
|
2017-05-30 09:42:00 +02:00
|
|
|
if (!Security::getCurrentUser() || !class_exists(AdminRootController::class)) {
|
2016-11-29 00:31:16 +01:00
|
|
|
return $this->redirectToExternalLogin();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Get redirect url
|
2017-05-31 07:48:16 +02:00
|
|
|
$controller = $this->getResponseController(_t(__CLASS__.'.SUCCESS', 'Success'));
|
2016-11-29 00:31:16 +01:00
|
|
|
$backURLs = array(
|
|
|
|
|
$this->getRequest()->requestVar('BackURL'),
|
|
|
|
|
Session::get('BackURL'),
|
2017-06-09 05:07:35 +02:00
|
|
|
Director::absoluteURL(AdminRootController::config()->get('url_base'), true),
|
2016-11-29 00:31:16 +01:00
|
|
|
);
|
|
|
|
|
$backURL = null;
|
|
|
|
|
foreach ($backURLs as $backURL) {
|
|
|
|
|
if ($backURL && Director::is_site_url($backURL)) {
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Show login
|
|
|
|
|
$controller = $controller->customise(array(
|
2017-05-31 07:48:16 +02:00
|
|
|
'Content' => DBField::create_field(DBHTMLText::class, _t(
|
|
|
|
|
__CLASS__.'.SUCCESSCONTENT',
|
|
|
|
|
'<p>Login success. If you are not automatically redirected '.
|
2016-11-29 00:31:16 +01:00
|
|
|
'<a target="_top" href="{link}">click here</a></p>',
|
|
|
|
|
'Login message displayed in the cms popup once a user has re-authenticated themselves',
|
2016-11-29 13:45:41 +01:00
|
|
|
array('link' => Convert::raw2att($backURL))
|
2017-05-31 07:48:16 +02:00
|
|
|
))
|
2016-11-29 00:31:16 +01:00
|
|
|
));
|
|
|
|
|
|
|
|
|
|
return $controller->renderWith($this->getTemplatesFor('success'));
|
|
|
|
|
}
|
2014-10-06 05:01:33 +02:00
|
|
|
}
|
