From 01759fb4c29bd3933d66671caeb8d304c475abf6 Mon Sep 17 00:00:00 2001 From: Benjamin Renard Date: Mon, 25 Apr 2022 18:42:18 +0200 Subject: [PATCH] Fix handling authentication - URL routes now defaulty required authentication if force_authentication special function is defined. - handle_request() now trigger a fatal error if user try to access to a required route and if force_authentication function is not defined. - logging() now retreive username from $auth_user['username']. --- includes/logging.php | 2 +- includes/url.php | 21 +++++++++++--- lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.mo | Bin 15837 -> 16010 bytes lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.po | 37 +++++++++++++++---------- lang/headers.pot | 4 +-- lang/messages.pot | 37 ++++++++++++++----------- lang/php-messages.pot | 33 ++++++++++++---------- 7 files changed, 82 insertions(+), 52 deletions(-) diff --git a/includes/logging.php b/includes/logging.php index 4de09ff..ed732e8 100644 --- a/includes/logging.php +++ b/includes/logging.php @@ -60,7 +60,7 @@ function logging($level, $message) { $_SERVER['REMOTE_ADDR'], ); if (isset($auth_user)) - $msg[] = ($auth_user?$auth_user:'anonymous'); + $msg[] = ($auth_user['username']?$auth_user['username']:'anonymous'); $msg[] = $level; $msg[] = $message; $msg = implode(' - ', $msg)."\n"; diff --git a/includes/url.php b/includes/url.php index 1168c16..4b4a520 100644 --- a/includes/url.php +++ b/includes/url.php @@ -29,14 +29,20 @@ $url_patterns =array(); * @param $pattern string The URL pattern (required) * @param $handler callable The URL pattern handler (must be callable, required) * @param $authenticated boolean Permit to define if this URL is accessible only for - * authenticated users (optional, default: true) + * authenticated users (optional, default: true if the special + * force_authentication function is defined, false otherwise) * @param $override boolean Allow override if a command already exists with the * same name (optional, default: false) * @param $api_mode boolean Enable API mode (optional, default: false) * @param $methods array|null HTTP method (optional, default: array('GET', 'POST')) **/ -function add_url_handler($pattern, $handler=null, $authenticated=false, $override=true, +function add_url_handler($pattern, $handler=null, $authenticated=null, $override=true, $api_mode=false, $methods=null) { + $authenticated = ( + is_null($authenticated)? + function_exists('force_authentication'): + (bool)$authenticated + ); if (is_null($methods)) $methods = array('GET', 'POST'); elseif (!is_array($methods)) @@ -322,6 +328,10 @@ function redirect($go=false) { /** * Handle the current requested URL * + * Note: if the route required that user is authenticated, this method will + * invoke the force_authentication() special function (or trigger a fatal error + * if it's not defined). + * * @param $default_url string|null The default URL if current one does not * match with any configured pattern. * @@ -343,8 +353,11 @@ function handle_request($default_url=null) { $smarty -> assign('request', $request); // Check authentication (if need) - if($request -> authenticated && function_exists('force_authentication')) - force_authentication(); + if($request -> authenticated) + if (function_exists('force_authentication')) + force_authentication(); + else + logging('FATAL', _("Authentication required but force_authentication function is not defined.")); try { return call_user_func($request -> handler, $request); diff --git a/lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.mo b/lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.mo index 8a923e5b047012d28c3ded456f0757780e213f69..0c676c87cd3bb3bc76ae50d25f9a7865a0efe019 100644 GIT binary patch delta 3536 zcmZwK3rv<(9LMpapxi~dh$!ldhJakWauKx%1p%=T)KD|!@}i(z1YSc$UsOyJui-5% zYplX*YnivzDyL1ia?LHAZj`OdvYT0KH80cZ`+MJqvaPfI-_JSE`@H8l=YP(5&}(bA zt#f`EgII z>%XA}95KL{XqNDZpLQ|QI>&3jb5xo{5E;YHLBZ{c(t5#%1wQVgT*z#QCxA$S!% z@do-~H}=K*s0?`q8&ifO&>y#;Cb$=e@qE)xMID?)4deopE^`7IlsS(~&UB$>coUWK zJ2(-iG2KLL#0=~}ZN8r{90T}Z^-MJC!IMxKPDk~ZX_+5R{Xe| zy@VS1WmE^BqXzapYEyMv-v^RU&1fKMV3DZIWZ^h;piWH(j>U_X_fYpc6FBrWR0^;j z&!JM8%u{yae9Xija4sft_-A7a>OF9U54|7$Ks`8&Y3uh{xC|?>2tPyZ{y3Za_@*LV zI*px*X1EEJnq8=w9z?aI#TaZvEzMDM-G{7>xr^#A zgwbhlgrkqne;gH#s!2knG8-d%8B>T+v>oIx77rtnFz1o4%y+2oy~(3qFo~#LJr9+c za-4&kF%P?N8bip>zl;;`Dr$y)JarYOqrN|l zlkg^Ltz%-`$9g{6Y41U0`WAYl2eWdj;!i~#hN8}OE*4@lDpi+JoAWvr;9saEDH!eE zq?M@qR-zYfLS?8G*W+8LwNHq1-$n z!%k!)o3F4h-a|k1h<7hZAo6UJf-A5D^Y9YpV?+Y^*KV##aHr@D&Z8a0R%SI!6OwJy zj!Nyvn2sLov=p3&f!$Fw$V5M z(^1E&0Ci&(_Quu7vYRH%#n*5FcB4AZV-&tP7nSlQ7=*2;0Utr#*M)lUx7bhT|7R*p z-rPk!FpeFlj#5wq%CMY+y009y)(24cA3<%lH!ur7#b^xSNN5SCU<{UE9JZqFKaGt# z|6Np?xlqW0G6r)QPoPgKe-H3OY`|e`0Bxc+R0mpc?TwL05=<_VZL=O*@EF!&GSd&l z4$Q{W$g9Bh&!8}!|EMYMluWhEM4gIRs7+LWN@*o(2K%h`S!||#1E*pYA3W2%i8j1$ z>GiO?zZe|K^#lyYndsDo#Z>%p9ri*_hwG2hT-3}t6sC#LU{vaeLRZcGJMD{&gl4Y^ zVSY2fkpYybmTI;;FV&C9^)zp;mJw#I52H#+3F14A2$_8Q!u~rSr zV4}uV`}bozRqYMUE}VFZ=qWlqJtcrjBT-KjSr@f;<`6cbj9`hKt_?)pY$de$iq)`6 zD{dn=iLN8M3kMM@TIX_Ny&9BAVlOd-VAq>cLgh)KKk+odwsRHzjo3j%E0@|RdNVF0 zRuU>YKFx%Ks35c_))4y$PeNrs@d)t(F_6$nT0p31$+e$)irx<|T8-tF+PKrx`B*|c zSfMg`?%+2xrjJOw7IUhUx7JReJ7@>E6$raY+W3MK~{Y@rd##raWhd# zaK8U3k6N{AOt$J{jwc1=^vQNKEVEZPRFoDsRMb@4>g+2W6?OJ9TZyB=R$fzAYF}LZ z-#f}3)upamE9!04H4U~hdwE5*y)5x~Q&4PJ+xFN&X|}3jzFSeu@2y+^x1;K4dwqkg Wwz%F__R;I~QDIL!{z~kmkiP+gQFUv$-HH7%sS>s3@8yN@*#YMj&2Xa=~3NOf#7Z zEo*ENX{LI zv`1k!s_6D$XRJe3%`TuGd;_&aO{n|bcKi!f1Ad*!KlNt;{937tKn7>gsNze)7C0Q0 zfeh3@3UDYML|u2q(SzMNZbB_#t1e~((S=&#Ow{$0P)nBUro&)tE^4H!Q6n!w-C#Xx zU^`JoRqcFVkDAeEsDXWj%FG=cfKlXIyCoa@W0B)qsOvA`a&+IPvx-h3n_sE?8F%3$ z%*0(hbp~F>shB|Ns(RP*q4&Ze)PoyPzrTZp*q$`Z!eUhQH=?$!2Q`tP81Dq#){Bl( zlZ2XSIw})c$Z}gY>IVhLm~105NvpwycpCd*G^5edOhWH<$SPP3>VBW1YU2#*IgRMj z{=Y^?sl1D^er6A_C&y9buNRI)25n1GGu)2){sij9av4?C{~(jMVDdX1d*ehb$I*BJ zV=#;#566L6&+}~s9o-;~J*DDEc1*`)j>qC4EJMxkBV2<`&iDC@B8}rJ)LMUwDfkEr zFy$#`aQ>!=++HS)6u^E19LErX)9GFsN&p#T8dh1g$>U4UtnvFub?vH!FA}D z;9K)@)O~g$x3(kbkLR&1UPvJS>iob7ZM$DlRevA#UhwCwB0HdpC=RJt8-yCjWDLSw zWU{sp`KeXlGOR}}L61IWQ*b$|h|i)j<4Pp|xpayXeQSCV$*TQ{N@-V0I|Fl3DXqqQ zyof_Ek;+qM3LVQ)899KIk<~coKgSgu|AhQGunGNrwJ^_3N7XDt@gUB|_c0R#2KZhy z6HrUD1+`??P{kI?+a(73VH=!+EpfJUoR2{qFGdY)C2C1aFbv(5bToik)P-lU1%87p zr(MMH_yF^843(${9l=0+7nSllbfE`_;yu)LiHuecPR4eaj?B%nk>|N>9Ua}M0yU!j zj>k|Jeu7%--%$g+hbp#zaV*AAxmx=r$VRf=sA8+f-snMHAIMfJ#zZW~qc~XmKc0m> z#fiB%AH!13Ucw?=hE1p&@boPYs5|HPeH7}ZP*_F#w-jZ9c+EeLDfnz zDkFQO_WuDo+7>m=1+}P@HlSv3(>ab9<{SA4)C=S+@(g>3F_^|lnTNVxDR#qh497Q} z`F^PMt|zEL?|z?*%2acEmCjmXBEi_b zZ3CY(2rcyl?-}n$WocmB5G~6*Vh=I6a&KU`dmO#-gjzYVnJ6LDx)3jVd;foIr>i2- zG&>XdL~|R{+(G^8hj-xa9&{lZ7QDl})v>{%9>ipo)}5&ty~Zs?p{Q10ijK@npjLMCAt!?5rc@WM01-&XDX3KP@3NVlI%vcB?Rwe zZ_DL#E>TVF^Pcg&3$vX5PE1k7YI7WPPWD8X)9;QWoc;maL_9~NI_E@&(|-YZgLqrt Uy3CMq0d-eh@g3`?C8S3D2kj3^FaQ7m diff --git a/lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.po b/lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.po index 5b9e7e2..ad867fb 100644 --- a/lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.po +++ b/lang/fr_FR.UTF8/LC_MESSAGES/DEFAULT.po @@ -1,7 +1,7 @@ msgid "" msgstr "" "Project-Id-Version: \n" -"POT-Creation-Date: 2022-04-24 19:09+0200\n" +"POT-Creation-Date: 2022-04-25 18:40+0200\n" "PO-Revision-Date: \n" "Last-Translator: Benjamin Renard \n" "Language-Team: \n" @@ -351,27 +351,27 @@ msgstr "" "\n" "Mail originalement destiné à %s." -#: /home/brenard/dev/eesyphp/includes/url.php:92 +#: /home/brenard/dev/eesyphp/includes/url.php:98 msgid "Bad request" msgstr "Mauvaise requête" -#: /home/brenard/dev/eesyphp/includes/url.php:93 +#: /home/brenard/dev/eesyphp/includes/url.php:99 msgid "Invalid request." msgstr "Requête invalide." -#: /home/brenard/dev/eesyphp/includes/url.php:96 +#: /home/brenard/dev/eesyphp/includes/url.php:102 msgid "Authentication required" msgstr "Authentification requise" -#: /home/brenard/dev/eesyphp/includes/url.php:97 +#: /home/brenard/dev/eesyphp/includes/url.php:103 msgid "You have to be authenticated to access to this page." msgstr "Vous devez être authentifié pour accéder à cette page." -#: /home/brenard/dev/eesyphp/includes/url.php:100 +#: /home/brenard/dev/eesyphp/includes/url.php:106 msgid "Access denied" msgstr "Accès interdit" -#: /home/brenard/dev/eesyphp/includes/url.php:101 +#: /home/brenard/dev/eesyphp/includes/url.php:107 msgid "" "You do not have access to this application. If you think this is an error, " "please contact support." @@ -379,25 +379,25 @@ msgstr "" "Vous n'avez pas accès à cette application. Si vous pensez qu'il s'agit d'une " "erreur, merci de prendre contact avec le support." -#: /home/brenard/dev/eesyphp/includes/url.php:104 +#: /home/brenard/dev/eesyphp/includes/url.php:110 msgid "Whoops ! Page not found" msgstr "Oups ! Page introuvable" -#: /home/brenard/dev/eesyphp/includes/url.php:105 +#: /home/brenard/dev/eesyphp/includes/url.php:111 msgid "The requested page can not be found." msgstr "La page demandée est introuvable." -#: /home/brenard/dev/eesyphp/includes/url.php:113 +#: /home/brenard/dev/eesyphp/includes/url.php:119 msgid "Error" msgstr "Erreur" -#: /home/brenard/dev/eesyphp/includes/url.php:114 +#: /home/brenard/dev/eesyphp/includes/url.php:120 msgid "An unknown error occurred. If problem persist, please contact support." msgstr "" "Une erreur inconnue est survenue. Si le problème persiste, merci de prendre " "contact avec le support." -#: /home/brenard/dev/eesyphp/includes/url.php:159 +#: /home/brenard/dev/eesyphp/includes/url.php:165 msgid "" "Unable to determine the requested page. If the problem persists, please " "contact support." @@ -405,7 +405,7 @@ msgstr "" "Impossible de déterminer la page demandée. Si le problème persiste, merci de " "prendre contact avec le support." -#: /home/brenard/dev/eesyphp/includes/url.php:312 +#: /home/brenard/dev/eesyphp/includes/url.php:318 msgid "" "Unable to determine the requested page (loop detected). If the problem " "persists, please contact support." @@ -413,11 +413,18 @@ msgstr "" "Impossible de déterminer la page demandée (boucle détectée). Si le problème " "persiste, merci de prendre contact avec le support." -#: /home/brenard/dev/eesyphp/includes/url.php:337 +#: /home/brenard/dev/eesyphp/includes/url.php:347 msgid "This request cannot be processed." msgstr "Cette requête ne peut être traitée." -#: /home/brenard/dev/eesyphp/includes/url.php:355 +#: /home/brenard/dev/eesyphp/includes/url.php:360 +msgid "" +"Authentication required but force_authentication function is not defined." +msgstr "" +"Authentification requise mais la fonction force_authentication n'est pas " +"définie." + +#: /home/brenard/dev/eesyphp/includes/url.php:368 msgid "This request could not be processed correctly." msgstr "Cette requête n'a put être traitée correctement." diff --git a/lang/headers.pot b/lang/headers.pot index 4328979..ede26b1 100644 --- a/lang/headers.pot +++ b/lang/headers.pot @@ -1,7 +1,7 @@ msgid "" msgstr "" -"POT-Creation-Date: 2022-04-24 20:13+0200\n" -"PO-Revision-Date: 2022-04-24 20:13+0200\n" +"POT-Creation-Date: 2022-04-25 18:40+0200\n" +"PO-Revision-Date: 2022-04-25 18:40+0200\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=utf-8\n" "Content-Transfer-Encoding: 8bit\n" \ No newline at end of file diff --git a/lang/messages.pot b/lang/messages.pot index 812b08e..76660ee 100644 --- a/lang/messages.pot +++ b/lang/messages.pot @@ -1,7 +1,7 @@ msgid "" msgstr "" -"POT-Creation-Date: 2022-04-24 20:13+0200\n" -"PO-Revision-Date: 2022-04-24 20:13+0200\n" +"POT-Creation-Date: 2022-04-25 18:40+0200\n" +"PO-Revision-Date: 2022-04-25 18:40+0200\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -305,65 +305,70 @@ msgid "" "Mail initialy intended for %s." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:92 +#: /home/brenard/dev/eesyphp/includes/url.php:98 msgid "Bad request" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:93 +#: /home/brenard/dev/eesyphp/includes/url.php:99 msgid "Invalid request." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:96 +#: /home/brenard/dev/eesyphp/includes/url.php:102 msgid "Authentication required" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:97 +#: /home/brenard/dev/eesyphp/includes/url.php:103 msgid "You have to be authenticated to access to this page." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:100 +#: /home/brenard/dev/eesyphp/includes/url.php:106 msgid "Access denied" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:101 +#: /home/brenard/dev/eesyphp/includes/url.php:107 msgid "" "You do not have access to this application. If you think this is an error, " "please contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:104 +#: /home/brenard/dev/eesyphp/includes/url.php:110 msgid "Whoops ! Page not found" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:105 +#: /home/brenard/dev/eesyphp/includes/url.php:111 msgid "The requested page can not be found." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:113 +#: /home/brenard/dev/eesyphp/includes/url.php:119 msgid "Error" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:114 +#: /home/brenard/dev/eesyphp/includes/url.php:120 msgid "An unknown error occurred. If problem persist, please contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:159 +#: /home/brenard/dev/eesyphp/includes/url.php:165 msgid "" "Unable to determine the requested page. If the problem persists, please " "contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:312 +#: /home/brenard/dev/eesyphp/includes/url.php:318 msgid "" "Unable to determine the requested page (loop detected). If the problem " "persists, please contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:337 +#: /home/brenard/dev/eesyphp/includes/url.php:347 msgid "This request cannot be processed." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:355 +#: /home/brenard/dev/eesyphp/includes/url.php:360 +msgid "" +"Authentication required but force_authentication function is not defined." +msgstr "" + +#: /home/brenard/dev/eesyphp/includes/url.php:368 msgid "This request could not be processed correctly." msgstr "" diff --git a/lang/php-messages.pot b/lang/php-messages.pot index 87b7471..8615dc5 100644 --- a/lang/php-messages.pot +++ b/lang/php-messages.pot @@ -297,65 +297,70 @@ msgid "" "Mail initialy intended for %s." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:92 +#: /home/brenard/dev/eesyphp/includes/url.php:98 msgid "Bad request" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:93 +#: /home/brenard/dev/eesyphp/includes/url.php:99 msgid "Invalid request." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:96 +#: /home/brenard/dev/eesyphp/includes/url.php:102 msgid "Authentication required" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:97 +#: /home/brenard/dev/eesyphp/includes/url.php:103 msgid "You have to be authenticated to access to this page." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:100 +#: /home/brenard/dev/eesyphp/includes/url.php:106 msgid "Access denied" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:101 +#: /home/brenard/dev/eesyphp/includes/url.php:107 msgid "" "You do not have access to this application. If you think this is an error, " "please contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:104 +#: /home/brenard/dev/eesyphp/includes/url.php:110 msgid "Whoops ! Page not found" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:105 +#: /home/brenard/dev/eesyphp/includes/url.php:111 msgid "The requested page can not be found." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:113 +#: /home/brenard/dev/eesyphp/includes/url.php:119 msgid "Error" msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:114 +#: /home/brenard/dev/eesyphp/includes/url.php:120 msgid "An unknown error occurred. If problem persist, please contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:159 +#: /home/brenard/dev/eesyphp/includes/url.php:165 msgid "" "Unable to determine the requested page. If the problem persists, please " "contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:312 +#: /home/brenard/dev/eesyphp/includes/url.php:318 msgid "" "Unable to determine the requested page (loop detected). If the problem " "persists, please contact support." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:337 +#: /home/brenard/dev/eesyphp/includes/url.php:347 msgid "This request cannot be processed." msgstr "" -#: /home/brenard/dev/eesyphp/includes/url.php:355 +#: /home/brenard/dev/eesyphp/includes/url.php:360 +msgid "" +"Authentication required but force_authentication function is not defined." +msgstr "" + +#: /home/brenard/dev/eesyphp/includes/url.php:368 msgid "This request could not be processed correctly." msgstr ""