tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-06-25 22:19:33 +02:00
Code Issues Projects Releases Wiki Activity

API CHANGE: Replaced BasicAuth::enable() with BasicAuth::protect_entire_site()

Browse Source 
API CHANGE: BasicAuth::requireLogin() no longer has an option to automatically log you in.  You can call logIn() on the object returned, instead.

git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/trunk@91603 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
Sam Minnee 2009-11-15 21:24:58 +00:00
parent 2cc517dd2c
commit 2db7a1d001
4 changed files with 55 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cli/CliController.php
View File

@ -11,7 +11,6 @@
*/
abstract class CliController extends Controller {
function init() {
$this->disableBasicAuth();
parent::init();
// Unless called from the command line, all CliControllers need ADMIN privileges
if(!Director::is_cli() && !Permission::check("ADMIN")) return Security::permissionFailure();

2
conf/ConfigureFromEnv.php
View File

@ -98,7 +98,7 @@ if(defined('SS_DEFAULT_ADMIN_USERNAME')) {
Security::setDefaultAdmin(SS_DEFAULT_ADMIN_USERNAME, SS_DEFAULT_ADMIN_PASSWORD);
}
if(defined('SS_USE_BASIC_AUTH') && SS_USE_BASIC_AUTH) {
BasicAuth::enable();
BasicAuth::protect_entire_site();
}
if(defined('SS_ERROR_LOG')) {

11
core/control/Controller.php
View File

@ -75,10 +75,7 @@ class Controller extends RequestHandler {
* @uses BasicAuth::requireLogin()
*/
function init() {
// Test and development sites should be secured, via basic-auth
if(Director::isTest() && $this->basicAuthEnabled && Security::database_is_ready()) {
BasicAuth::requireLogin("SilverStripe test website. Use your CMS login", "ADMIN");
}
if($this->basicAuthEnabled) BasicAuth::protect_site_if_necessary();
// Directly access the session variable just in case the Group or Member tables don't yet exist
if(Session::get('loggedInAs') && Security::database_is_ready()) {
@ -349,9 +346,9 @@ class Controller extends RequestHandler {
}
/**
* Call this to disable basic authentication on test sites.
* must be called in the init() method
* @deprecated Use BasicAuth::disable() instead? This is used in CliController - it should be updated.
* Call this to disable site-wide basic authentication for a specific contoller.
* This must be called before Controller::init(). That is, you must call it in your controller's
* init method before it calls parent::init().
*/
function disableBasicAuth() {
$this->basicAuthEnabled = false;

64
security/BasicAuth.php
View File

@ -1,17 +1,21 @@
<?php
/**
* Provides an interface to HTTP basic authentication.
*
* This utility class can be used to secure any request with basic authentication. To do so,
* {@link BasicAuth::requireLogin()} from your Controller's init() method or action handler method.
*
* It also has a function to protect your entire site. See {@link BasicAuth::protect_entire_site()}
* for more information.
*
* @package sapphire
* @subpackage security
*/
class BasicAuth extends Object {
/**
* Site-wide basic auth is disabled by default but can be enabled as needed in _config.php by calling BasicAuth::enable()
* @var boolean
* Flag set by {@link self::protect_entire_site()}
*/
static protected $enabled = false;
static protected $autologin = false;
private static $entire_site_protected = true;
/**
* Require basic authentication. Will request a username and password if none is given.
@ -23,10 +27,8 @@ class BasicAuth extends Object {
* @return Member $member
*/
static function requireLogin($realm, $permissionCode) {
if(!self::$enabled) return true;
if(!Security::database_is_ready() || Director::is_cli()) return true;
if(isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW'])) {
$member = MemberAuthenticator::authenticate(array(
'Email' => $_SERVER['PHP_AUTH_USER'],
@ -35,9 +37,6 @@ class BasicAuth extends Object {
if($member) {
$authenticated = true;
if(self::$autologin) {
$member->logIn();
}
}
}
@ -68,12 +67,49 @@ class BasicAuth extends Object {
return $member;
}
/**
* Enable protection of the entire site with basic authentication.
*
* This log-in uses the Member database for authentication, but doesn't interfere with the
* regular log-in form. This can be useful for test sites, where you want to hide the site
* away from prying eyes, but still be able to test the regular log-in features of the site.
*
* If you are including conf/ConfigureFromEnv.php in your _config.php file, you can also enable
* this feature by adding this line to your _ss_environment.php:
*
* define('SS_USE_BASIC_AUTH', true);
*
* @param $protect Set this to false to disable protection.
*/
static function protect_entire_site($protect = true) {
return self::$entire_site_protected = $protect;
}
static function enable($auto = false) {
self::$enabled = true;
self::$autologin = $auto;
/**
* @deprecated Use BasicAuth::protect_entire_site() instead.
*/
static function enable() {
user_error("BasicAuth::enable() is deprated. Use BasicAuth::protect_entire_site() instead.", E_USER_NOTICE);
return self::protect_entire_site();
}
/**
* @deprecated Use BasicAuth::protect_entire_site(false) instead.
*/
static function disable() {
self::$enabled = false;
user_error("BasicAuth::disable() is deprated. Use BasicAuth::protect_entire_site(false) instead.", E_USER_NOTICE);
return self::protect_entire_site(false);
}
/**
* Call {@link BasicAuth::requireLogin()} if {@link BasicAuth::protect_entire_site()} has been called.
* This is a helper function used by Controller.
*/
static function protect_site_if_necessary() {
if(self::$entire_site_protected) {
self::requireLogin("SilverStripe test website. Use your CMS login.", "ADMIN");
}
}
}