silverstripe-framework/src/Security/CMSSecurity.php

214 lines
5.9 KiB
PHP
Raw Normal View History

<?php
2016-06-23 01:37:22 +02:00
namespace SilverStripe\Security;
2016-08-11 01:14:02 +02:00
use SilverStripe\Admin\AdminRootController;
2017-06-09 05:07:35 +02:00
use SilverStripe\Control\Controller;
use SilverStripe\Control\Director;
use SilverStripe\Admin\LeftAndMain;
2016-09-09 08:43:05 +02:00
use SilverStripe\Control\HTTPResponse;
use SilverStripe\Control\Session;
use SilverStripe\Core\Convert;
use SilverStripe\Core\Manifest\ModuleLoader;
use SilverStripe\ORM\FieldType\DBField;
use SilverStripe\ORM\FieldType\DBHTMLText;
use SilverStripe\View\Requirements;
use SilverStripe\View\SSViewer;
2016-08-11 01:14:02 +02:00
/**
* Provides a security interface functionality within the cms
*/
2016-11-29 00:31:16 +01:00
class CMSSecurity extends Security
{
private static $allowed_actions = array(
'login',
2016-11-29 00:31:16 +01:00
'LoginForm',
'success'
);
/**
* Enable in-cms reauthentication
*
* @var boolean
* @config
*/
private static $reauth_enabled = true;
protected function init()
{
parent::init();
// Assign default cms theme and replace user-specified themes
SSViewer::set_themes(LeftAndMain::config()->uninherited('admin_themes'));
// Core styles / vendor scripts
$admin = ModuleLoader::getModule('silverstripe/admin');
Requirements::javascript($admin->getResourcePath('client/dist/js/vendor.js'));
Requirements::css($admin->getResourcePath('client/dist/styles/bundle.css'));
2016-11-29 00:31:16 +01:00
}
public function login($request = null, $service = Authenticator::CMS_LOGIN)
{
return parent::login($request, Authenticator::CMS_LOGIN);
}
2016-11-29 00:31:16 +01:00
public function Link($action = null)
{
/** @skipUpgrade */
return Controller::join_links(Director::baseURL(), "CMSSecurity", $action);
}
protected function getAuthenticator($name = 'cms')
{
return parent::getAuthenticator($name);
}
public function getApplicableAuthenticators($service = Authenticator::CMS_LOGIN)
{
return parent::getApplicableAuthenticators($service);
}
2016-11-29 00:31:16 +01:00
/**
* Get known logged out member
*
* @return Member
*/
public function getTargetMember()
{
$tempid = $this->getRequest()->requestVar('tempid');
if ($tempid) {
2016-11-29 00:31:16 +01:00
return Member::member_from_tempid($tempid);
}
2016-11-29 00:31:16 +01:00
return null;
}
public function getResponseController($title)
{
// Use $this to prevent use of Page to render underlying templates
return $this;
}
protected function getLoginMessage(&$messageType = null)
{
$message = parent::getLoginMessage($messageType);
if ($message) {
return $message;
}
// Format
return _t(
__CLASS__.'.LOGIN_MESSAGE',
'<p>Your session has timed out due to inactivity</p>'
);
2016-11-29 00:31:16 +01:00
}
/**
* Check if there is a logged in member
*
* @return bool
*/
public function getIsloggedIn()
2016-11-29 00:31:16 +01:00
{
return !!Security::getCurrentUser();
2016-11-29 00:31:16 +01:00
}
/**
* Redirects the user to the external login page
*
* @return HTTPResponse
*/
protected function redirectToExternalLogin()
{
$loginURL = Security::create()->Link('login');
$loginURLATT = Convert::raw2att($loginURL);
$loginURLJS = Convert::raw2js($loginURL);
$message = _t(
__CLASS__.'.INVALIDUSER',
2016-11-29 00:31:16 +01:00
'<p>Invalid user. <a target="_top" href="{link}">Please re-authenticate here</a> to continue.</p>',
'Message displayed to user if their session cannot be restored',
array('link' => $loginURLATT)
);
$response = $this->getResponse();
$response->setStatusCode(200);
$response->setBody(<<<PHP
<!DOCTYPE html>
<html><body>
$message
2016-01-24 06:12:45 +01:00
<script type="application/javascript">
setTimeout(function(){top.location.href = "$loginURLJS";}, 0);
</script>
</body></html>
PHP
2016-11-29 00:31:16 +01:00
);
$this->setResponse($response);
2016-11-29 00:31:16 +01:00
return $response;
}
protected function preLogin()
{
// If no member has been previously logged in for this session, force a redirect to the main login page
if (!$this->getTargetMember()) {
return $this->redirectToExternalLogin();
}
return parent::preLogin();
}
/**
* Determine if CMSSecurity is enabled
*
* @return bool
*/
public function enabled()
2016-11-29 00:31:16 +01:00
{
// Disable shortcut
if (!static::config()->get('reauth_enabled')) {
2016-11-29 00:31:16 +01:00
return false;
}
return count($this->getApplicableAuthenticators(Authenticator::CMS_LOGIN)) > 0;
2016-11-29 00:31:16 +01:00
}
/**
* Given a successful login, tell the parent frame to close the dialog
*
* @return HTTPResponse|DBField
*/
public function success()
{
// Ensure member is properly logged in
if (!Security::getCurrentUser() || !class_exists(AdminRootController::class)) {
2016-11-29 00:31:16 +01:00
return $this->redirectToExternalLogin();
}
// Get redirect url
$controller = $this->getResponseController(_t(__CLASS__.'.SUCCESS', 'Success'));
2016-11-29 00:31:16 +01:00
$backURLs = array(
$this->getRequest()->requestVar('BackURL'),
Session::get('BackURL'),
2017-06-09 05:07:35 +02:00
Director::absoluteURL(AdminRootController::config()->get('url_base'), true),
2016-11-29 00:31:16 +01:00
);
$backURL = null;
foreach ($backURLs as $backURL) {
if ($backURL && Director::is_site_url($backURL)) {
break;
}
}
// Show login
$controller = $controller->customise(array(
'Content' => DBField::create_field(DBHTMLText::class, _t(
__CLASS__.'.SUCCESSCONTENT',
'<p>Login success. If you are not automatically redirected '.
2016-11-29 00:31:16 +01:00
'<a target="_top" href="{link}">click here</a></p>',
'Login message displayed in the cms popup once a user has re-authenticated themselves',
2016-11-29 13:45:41 +01:00
array('link' => Convert::raw2att($backURL))
))
2016-11-29 00:31:16 +01:00
));
return $controller->renderWith($this->getTemplatesFor('success'));
}
}