2014-10-06 05:01:33 +02:00
|
|
|
<?php
|
|
|
|
|
|
2016-06-23 01:37:22 +02:00
|
|
|
namespace SilverStripe\Security;
|
|
|
|
|
|
|
|
|
|
use Requirements;
|
|
|
|
|
use Controller;
|
|
|
|
|
use Director;
|
|
|
|
|
use Convert;
|
|
|
|
|
use Session;
|
2016-08-11 01:14:02 +02:00
|
|
|
|
2016-06-23 01:37:22 +02:00
|
|
|
use SS_HTTPResponse;
|
2016-08-11 01:14:02 +02:00
|
|
|
use SilverStripe\Admin\AdminRootController;
|
|
|
|
|
|
2016-06-23 01:37:22 +02:00
|
|
|
|
|
|
|
|
|
2014-10-06 05:01:33 +02:00
|
|
|
/**
|
|
|
|
|
* Provides a security interface functionality within the cms
|
2015-08-24 06:15:38 +02:00
|
|
|
* @package framework
|
|
|
|
|
* @subpackage security
|
2014-10-06 05:01:33 +02:00
|
|
|
*/
|
|
|
|
|
class CMSSecurity extends Security {
|
|
|
|
|
|
|
|
|
|
private static $casting = array(
|
2016-06-03 10:51:02 +02:00
|
|
|
'Title' => 'HTMLFragment'
|
2014-10-06 05:01:33 +02:00
|
|
|
);
|
|
|
|
|
|
|
|
|
|
private static $allowed_actions = array(
|
2016-06-23 01:37:22 +02:00
|
|
|
'SilverStripe\\Security\\LoginForm',
|
2014-10-06 05:01:33 +02:00
|
|
|
'success'
|
|
|
|
|
);
|
|
|
|
|
|
2014-11-21 05:40:39 +01:00
|
|
|
/**
|
|
|
|
|
* Enable in-cms reauthentication
|
|
|
|
|
*
|
|
|
|
|
* @var boolean
|
|
|
|
|
* @config
|
|
|
|
|
*/
|
|
|
|
|
private static $reauth_enabled = true;
|
|
|
|
|
|
2015-02-23 14:46:00 +01:00
|
|
|
protected function init() {
|
2014-10-06 05:01:33 +02:00
|
|
|
parent::init();
|
|
|
|
|
|
|
|
|
|
// Include CMS styles and js
|
|
|
|
|
Requirements::css(THIRDPARTY_DIR . '/jquery-ui-themes/smoothness/jquery-ui.css');
|
2016-04-19 11:04:43 +02:00
|
|
|
Requirements::css(FRAMEWORK_ADMIN_DIR . '/client/dist/styles/bundle.css');
|
2014-10-06 05:01:33 +02:00
|
|
|
Requirements::combine_files(
|
|
|
|
|
'cmssecurity.js',
|
|
|
|
|
array(
|
|
|
|
|
THIRDPARTY_DIR . '/jquery/jquery.js',
|
|
|
|
|
THIRDPARTY_DIR . '/jquery-ui/jquery-ui.js',
|
|
|
|
|
THIRDPARTY_DIR . '/jquery-entwine/dist/jquery.entwine-dist.js',
|
2016-04-19 11:04:43 +02:00
|
|
|
FRAMEWORK_ADMIN_DIR . '/client/dist/js/sspath.js',
|
|
|
|
|
FRAMEWORK_ADMIN_DIR . '/client/dist/js/CMSSecurity.js'
|
2014-10-06 05:01:33 +02:00
|
|
|
)
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function Link($action = null) {
|
2016-06-23 01:37:22 +02:00
|
|
|
/** @skipUpgrade */
|
2014-10-06 05:01:33 +02:00
|
|
|
return Controller::join_links(Director::baseURL(), "CMSSecurity", $action);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Get known logged out member
|
|
|
|
|
*
|
|
|
|
|
* @return Member
|
|
|
|
|
*/
|
|
|
|
|
public function getTargetMember() {
|
2015-04-30 01:04:08 +02:00
|
|
|
if($tempid = $this->getRequest()->requestVar('tempid')) {
|
2014-10-06 05:01:33 +02:00
|
|
|
return Member::member_from_tempid($tempid);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function getResponseController($title) {
|
|
|
|
|
// Use $this to prevent use of Page to render underlying templates
|
|
|
|
|
return $this;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-18 23:05:07 +01:00
|
|
|
protected function getLoginMessage(&$messageType = null) {
|
|
|
|
|
return parent::getLoginMessage($messageType)
|
2014-10-06 05:01:33 +02:00
|
|
|
?: _t(
|
|
|
|
|
'CMSSecurity.LoginMessage',
|
|
|
|
|
'<p>If you have any unsaved work you can return to where you left off by logging back in below.</p>'
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function getTitle() {
|
|
|
|
|
// Check if logged in already
|
|
|
|
|
if(Member::currentUserID()) {
|
|
|
|
|
return _t('CMSSecurity.SUCCESS', 'Success');
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Display logged-out message
|
|
|
|
|
$member = $this->getTargetMember();
|
|
|
|
|
if($member) {
|
|
|
|
|
return _t(
|
|
|
|
|
'CMSSecurity.TimedOutTitleMember',
|
|
|
|
|
'Hey {name}!<br />Your session has timed out.',
|
|
|
|
|
'Title for CMS popup login form for a known user',
|
|
|
|
|
array('name' => $member->FirstName)
|
|
|
|
|
);
|
|
|
|
|
} else {
|
|
|
|
|
return _t(
|
|
|
|
|
'CMSSecurity.TimedOutTitleAnonymous',
|
|
|
|
|
'Your session has timed out.',
|
|
|
|
|
'Title for CMS popup login form without a known user'
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Redirects the user to the external login page
|
|
|
|
|
*
|
|
|
|
|
* @return SS_HTTPResponse
|
|
|
|
|
*/
|
|
|
|
|
protected function redirectToExternalLogin() {
|
|
|
|
|
$loginURL = Security::create()->Link('login');
|
|
|
|
|
$loginURLATT = Convert::raw2att($loginURL);
|
|
|
|
|
$loginURLJS = Convert::raw2js($loginURL);
|
|
|
|
|
$message = _t(
|
|
|
|
|
'CMSSecurity.INVALIDUSER',
|
|
|
|
|
'<p>Invalid user. <a target="_top" href="{link}">Please re-authenticate here</a> to continue.</p>',
|
|
|
|
|
'Message displayed to user if their session cannot be restored',
|
|
|
|
|
array('link' => $loginURLATT)
|
|
|
|
|
);
|
2015-08-14 02:39:33 +02:00
|
|
|
$response = $this->getResponse();
|
|
|
|
|
$response->setStatusCode(200);
|
|
|
|
|
$response->setBody(<<<PHP
|
2014-10-06 05:01:33 +02:00
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html><body>
|
|
|
|
|
$message
|
2016-01-24 06:12:45 +01:00
|
|
|
<script type="application/javascript">
|
2014-10-06 05:01:33 +02:00
|
|
|
setTimeout(function(){top.location.href = "$loginURLJS";}, 0);
|
|
|
|
|
</script>
|
|
|
|
|
</body></html>
|
|
|
|
|
PHP
|
|
|
|
|
);
|
2015-08-14 02:39:33 +02:00
|
|
|
$this->setResponse($response);
|
|
|
|
|
return $response;
|
2014-10-06 05:01:33 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected function preLogin() {
|
|
|
|
|
// If no member has been previously logged in for this session, force a redirect to the main login page
|
|
|
|
|
if(!$this->getTargetMember()) {
|
|
|
|
|
return $this->redirectToExternalLogin();
|
|
|
|
|
}
|
2015-08-14 02:39:33 +02:00
|
|
|
|
2014-10-06 05:01:33 +02:00
|
|
|
return parent::preLogin();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function GetLoginForms() {
|
|
|
|
|
$forms = array();
|
|
|
|
|
$authenticators = Authenticator::get_authenticators();
|
|
|
|
|
foreach($authenticators as $authenticator) {
|
|
|
|
|
// Get only CMS-supporting authenticators
|
|
|
|
|
if($authenticator::supports_cms()) {
|
|
|
|
|
$forms[] = $authenticator::get_cms_login_form($this);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return $forms;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Determine if CMSSecurity is enabled
|
|
|
|
|
*
|
|
|
|
|
* @return bool
|
|
|
|
|
*/
|
|
|
|
|
public static function enabled() {
|
2014-11-21 05:40:39 +01:00
|
|
|
// Disable shortcut
|
|
|
|
|
if(!static::config()->reauth_enabled) return false;
|
2015-08-14 02:39:33 +02:00
|
|
|
|
2014-10-06 05:01:33 +02:00
|
|
|
// Count all cms-supported methods
|
|
|
|
|
$authenticators = Authenticator::get_authenticators();
|
|
|
|
|
foreach($authenticators as $authenticator) {
|
|
|
|
|
// Supported if at least one authenticator is supported
|
|
|
|
|
if($authenticator::supports_cms()) return true;
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function LoginForm() {
|
|
|
|
|
$authenticator = $this->getAuthenticator();
|
|
|
|
|
if($authenticator && $authenticator::supports_cms()) {
|
|
|
|
|
return $authenticator::get_cms_login_form($this);
|
|
|
|
|
}
|
|
|
|
|
user_error('Passed invalid authentication method', E_USER_ERROR);
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-18 23:05:07 +01:00
|
|
|
public function getTemplatesFor($action) {
|
2016-06-23 01:37:22 +02:00
|
|
|
return array("CMSSecurity_{$action}", "SilverStripe\\Security\\CMSSecurity")
|
2014-10-06 05:01:33 +02:00
|
|
|
+ parent::getTemplatesFor($action);
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-18 23:05:07 +01:00
|
|
|
public function getIncludeTemplate($name) {
|
2014-11-18 00:45:54 +01:00
|
|
|
return array("CMSSecurity_{$name}")
|
|
|
|
|
+ parent::getIncludeTemplate($name);
|
|
|
|
|
}
|
|
|
|
|
|
2014-10-06 05:01:33 +02:00
|
|
|
/**
|
|
|
|
|
* Given a successful login, tell the parent frame to close the dialog
|
|
|
|
|
*
|
|
|
|
|
* @return SS_HTTPResponse
|
|
|
|
|
*/
|
|
|
|
|
public function success() {
|
|
|
|
|
// Ensure member is properly logged in
|
|
|
|
|
if(!Member::currentUserID()) {
|
|
|
|
|
return $this->redirectToExternalLogin();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Get redirect url
|
|
|
|
|
$controller = $this->getResponseController(_t('CMSSecurity.SUCCESS', 'Success'));
|
2016-04-18 23:02:35 +02:00
|
|
|
$backURLs = array(
|
|
|
|
|
$this->getRequest()->requestVar('BackURL'),
|
|
|
|
|
Session::get('BackURL'),
|
|
|
|
|
Director::absoluteURL(AdminRootController::config()->url_base, true),
|
|
|
|
|
);
|
|
|
|
|
foreach ($backURLs as $backURL) {
|
|
|
|
|
if ($backURL && Director::is_site_url($backURL)) {
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
2014-10-06 05:01:33 +02:00
|
|
|
|
|
|
|
|
// Show login
|
|
|
|
|
$controller = $controller->customise(array(
|
|
|
|
|
'Content' => _t(
|
|
|
|
|
'CMSSecurity.SUCCESSCONTENT',
|
|
|
|
|
'<p>Login success. If you are not automatically redirected '.
|
|
|
|
|
'<a target="_top" href="{link}">click here</a></p>',
|
|
|
|
|
'Login message displayed in the cms popup once a user has re-authenticated themselves',
|
|
|
|
|
array('link' => $backURL)
|
|
|
|
|
)
|
|
|
|
|
));
|
2015-08-14 02:39:33 +02:00
|
|
|
|
2014-10-06 05:01:33 +02:00
|
|
|
return $controller->renderWith($this->getTemplatesFor('success'));
|
|
|
|
|
}
|
|
|
|
|
}
|
