From fc6ef261eb4469f764d1e305a4ac617d26ca1864 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 11 Jul 2016 09:02:58 +0200 Subject: [PATCH] Remove Swekey support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It is buggy and their servers are no longer working. Signed-off-by: Michal Čihař --- .scrutinizer.yml | 2 +- build.xml | 6 +- config.sample.inc.php | 2 - doc/config.rst | 9 - doc/setup.rst | 34 -- examples/swekey.sample.conf | 44 -- libraries/config.default.php | 8 - libraries/config/messages.inc.php | 6 - libraries/config/setup.forms.php | 3 - .../plugins/auth/AuthenticationCookie.php | 15 - .../auth/swekey/authentication.inc.php | 176 ------ libraries/plugins/auth/swekey/musbe-ca.crt | 25 - .../plugins/auth/swekey/swekey.auth.lib.php | 315 ---------- libraries/plugins/auth/swekey/swekey.php | 536 ------------------ phpunit.xml.dist | 1 - .../plugin/auth/AuthenticationCookieTest.php | 25 - 16 files changed, 3 insertions(+), 1204 deletions(-) delete mode 100644 examples/swekey.sample.conf delete mode 100644 libraries/plugins/auth/swekey/authentication.inc.php delete mode 100644 libraries/plugins/auth/swekey/musbe-ca.crt delete mode 100644 libraries/plugins/auth/swekey/swekey.auth.lib.php delete mode 100644 libraries/plugins/auth/swekey/swekey.php diff --git a/.scrutinizer.yml b/.scrutinizer.yml index dd98975248..9a84f5469a 100644 --- a/.scrutinizer.yml +++ b/.scrutinizer.yml @@ -3,7 +3,7 @@ imports: - javascript - php filter: - excluded_paths: [libraries/php-gettext/*, libraries/tcpdf/*, libraries/bfShapeFiles/*, libraries/phpseclib/*, libraries/plugins/auth/recaptchalib.php, libraries/plugins/auth/swekey/swekey.php, libraries/sql-formatter/*, js/jquery/*, js/jqplot/*, js/openlayers/*, js/codemirror/*, js/canvg/*, js/tracekit/*, js/OpenStreetMap.js, js/sprintf.js, test/libraries/php-gettext/*, test/libraries/sql-formatter/*] + excluded_paths: [libraries/php-gettext/*, libraries/tcpdf/*, libraries/bfShapeFiles/*, libraries/phpseclib/*, libraries/plugins/auth/recaptchalib.php, libraries/sql-formatter/*, js/jquery/*, js/jqplot/*, js/openlayers/*, js/codemirror/*, js/canvg/*, js/tracekit/*, js/OpenStreetMap.js, js/sprintf.js, test/libraries/php-gettext/*, test/libraries/sql-formatter/*] tools: php_code_sniffer: config: diff --git a/build.xml b/build.xml index 445084cc57..53f883123c 100644 --- a/build.xml +++ b/build.xml @@ -55,7 +55,7 @@ @@ -71,7 +71,6 @@ --exclude libraries/bfShapeFiles --exclude libraries/phpseclib --exclude libraries/plugins/auth/recaptcha/recaptchalib.php - --exclude libraries/plugins/auth/swekey/swekey.php --exclude libraries/sql-parser ${source}" /> @@ -88,7 +87,6 @@ --exclude libraries/bfShapeFiles --exclude libraries/phpseclib --exclude libraries/plugins/auth/recaptcha/recaptchalib.php - --exclude libraries/plugins/auth/swekey/swekey.php --exclude libraries/sql-parser ${source}" /> @@ -103,7 +101,7 @@ `_ -since this link provides funding for phpMyAdmin. - -A self documented sample file is provided in the -file :file:`examples/swekey.sample.conf`: - -.. literalinclude:: ../examples/swekey.sample.conf - :language: sh - -.. seealso:: :config:option:`$cfg['Servers'][$i]['auth_swekey_config']` - Securing your phpMyAdmin installation +++++++++++++++++++++++++++++++++++++ diff --git a/examples/swekey.sample.conf b/examples/swekey.sample.conf deleted file mode 100644 index 49392bd94c..0000000000 --- a/examples/swekey.sample.conf +++ /dev/null @@ -1,44 +0,0 @@ -# This is a typical file used to enable Swekey hardware authentication. -# -# To activate the Swekey authentication add the following line to your config.inc.php file. -# $cfg['Servers'][$i]['auth_swekey_config'] = '/etc/swekey-pma.conf'; -# Then rename this file "swekey-pma.conf" and copy it to the /etc directory. -# Add all the Swekey ids you want to grant access to in the file. -# After each Swekey id put the corresponding user name. -# -# If you don't know the id of a Swekey just visit http://www.swekey.com?sel=support -# while your Swekey is connected. -# -# If you need to purchase a Swekey please visit https://www.phpmyadmin.net/auth_key/ -# since this link provides funding to PhpMyAdmin. -# - -0000000000000000000000000000763A:root -000000000000000000000000000089E4:steve -0000000000000000000000000000231E:scott - -# -# It is recommended to include the following lines to contact the -# authentication servers in SSL mode. -# - -SERVER_CHECK=https://auth-check-ssl.musbe.net -SERVER_RNDTOKEN=https://auth-rnd-gen-ssl.musbe.net -SERVER_STATUS=https://auth-status-ssl.musbe.net - -# -# The path of the root certificate file used to ensure a secure -# communication with the authentication servers in SSL mode. -# If not specified, will use musbe-ca.crt found in your -# phpMyAdmin/libraries/auth/swekey. -# - -#CA_FILE=/var/http-root/phpmyadmin/libraries/auth/swekey/musbe-ca.crt - -# -# If your server receives many login requests, you can enable the random -# token caching to accelerate the authentication process. -# Token caching is enabled by default. -# - -#ENABLE_TOKEN_CACHE=0 diff --git a/libraries/config.default.php b/libraries/config.default.php index 022623c5f8..0288fae742 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -236,14 +236,6 @@ $cfg['Servers'][$i]['auth_type'] = 'cookie'; */ $cfg['Servers'][$i]['auth_http_realm'] = ''; -/** - * File containing Swekey ids and login names (see /contrib); - * leave empty to deactivate Swekey hardware authentication - * - * @global string $cfg['Servers'][$i]['auth_swekey_config'] - */ -$cfg['Servers'][$i]['auth_swekey_config'] = ''; - /** * MySQL user * diff --git a/libraries/config/messages.inc.php b/libraries/config/messages.inc.php index d20822e3a7..57ec672898 100644 --- a/libraries/config/messages.inc.php +++ b/libraries/config/messages.inc.php @@ -632,12 +632,6 @@ $strConfigServers_SessionTimeZone_desc = __( $strConfigServers_auth_http_realm_desc = __('HTTP Basic Auth Realm name to display when doing HTTP Auth.'); $strConfigServers_auth_http_realm_name = __('HTTP Realm'); -$strConfigServers_auth_swekey_config_desc = __( - 'The path for the config file for SweKey hardware ' - . 'authentication (not located in your document root; suggested: ' - . '/etc/swekey.conf).' -); -$strConfigServers_auth_swekey_config_name = __('SweKey config file'); $strConfigServers_auth_type_desc = __('Authentication method to use.'); $strConfigServers_auth_type_name = __('Authentication type'); $strConfigServers_bookmarktable_desc = __( diff --git a/libraries/config/setup.forms.php b/libraries/config/setup.forms.php index 275181974a..cfffe9d5d1 100644 --- a/libraries/config/setup.forms.php +++ b/libraries/config/setup.forms.php @@ -41,9 +41,6 @@ $forms['Servers']['Server_auth'] = array('Servers' => array(1 => array( 'user', 'password', ':group:end', - ':group:' . __('Cookie authentication'), - 'auth_swekey_config' => './swekey.conf', - ':group:end', ':group:' . __('HTTP authentication'), 'auth_http_realm', ':group:end', diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php index ce5f5b93d4..eedcb0b9f4 100644 --- a/libraries/plugins/auth/AuthenticationCookie.php +++ b/libraries/plugins/auth/AuthenticationCookie.php @@ -27,11 +27,6 @@ if (! empty($_REQUEST['target'])) { $GLOBALS['target'] = basename(PMA_getenv('SCRIPT_NAME')); } -/** - * Swekey authentication functions. - */ -require './libraries/plugins/auth/swekey/swekey.auth.lib.php'; - /** * Handles the cookie authentication method * @@ -229,10 +224,6 @@ class AuthenticationCookie extends AuthenticationPlugin echo ' '; - // BEGIN Swekey Integration - Swekey_login('input_username', 'input_go'); - // END Swekey Integration - if ($GLOBALS['error_handler']->hasDisplayErrors()) { echo '
'; $GLOBALS['error_handler']->dispErrors(); @@ -279,12 +270,6 @@ class AuthenticationCookie extends AuthenticationPlugin $GLOBALS['PHP_AUTH_USER'] = $GLOBALS['PHP_AUTH_PW'] = ''; $GLOBALS['from_cookie'] = false; - // BEGIN Swekey Integration - if (! Swekey_Auth_check()) { - return false; - } - // END Swekey Integration - if (! empty($_REQUEST['pma_username'])) { // Verify Captcha if it is required. diff --git a/libraries/plugins/auth/swekey/authentication.inc.php b/libraries/plugins/auth/swekey/authentication.inc.php deleted file mode 100644 index 1d42e2c3e0..0000000000 --- a/libraries/plugins/auth/swekey/authentication.inc.php +++ /dev/null @@ -1,176 +0,0 @@ - - - diff --git a/libraries/plugins/auth/swekey/musbe-ca.crt b/libraries/plugins/auth/swekey/musbe-ca.crt deleted file mode 100644 index 2a31ad18f9..0000000000 --- a/libraries/plugins/auth/swekey/musbe-ca.crt +++ /dev/null @@ -1,25 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEKjCCAxKgAwIBAgIJAMjw7QcLWCd6MA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV -BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQKEwtNdXNiZSwgSW5j -LjESMBAGA1UEAxMJbXVzYmUuY29tMR0wGwYJKoZIhvcNAQkBFg5pbmZvQG11c2Jl -LmNvbTAeFw0wODA5MDQxNDE2MTNaFw0zNzEyMjExNDE2MTNaMGsxCzAJBgNVBAYT -AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQKEwtNdXNiZSwgSW5jLjES -MBAGA1UEAxMJbXVzYmUuY29tMR0wGwYJKoZIhvcNAQkBFg5pbmZvQG11c2JlLmNv -bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOBhOljxVzQfK4gted2I -d3BemcjW4abAUOzn3KYWXpPO5xIfVeXNDGkDbyH+X+7fo94sX25/ewuKNFDSOcvo -tXHq7uQenTHB35r+a+LY81KceUHgW90a3XsqPAkwAjyYcgo3zmM2DtLvw+5Yod8T -wAHk9m3qavnQ1uk99jBTwL7RZ9jIZHh9pFCL93uJc2obtd8O96Iycbn2q0w/AWbb -+eUVWIHzvLtfPvROeL3lJzr/Uz5LjKapxJ3qyqASflfHpnj9pU8l6g2TQ6Hg5KT5 -tLFkRe7uGhOfRtOQ/+NjaWrEuNCFnpyN4Q5Fv+5qA1Ip1IpH0200sWbAf/k2u0Qp -Sx0CAwEAAaOB0DCBzTAdBgNVHQ4EFgQUczJrQ7hCvtsnzcqiDIZ/GSn/CiwwgZ0G -A1UdIwSBlTCBkoAUczJrQ7hCvtsnzcqiDIZ/GSn/Ciyhb6RtMGsxCzAJBgNVBAYT -AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQKEwtNdXNiZSwgSW5jLjES -MBAGA1UEAxMJbXVzYmUuY29tMR0wGwYJKoZIhvcNAQkBFg5pbmZvQG11c2JlLmNv -bYIJAMjw7QcLWCd6MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAGxk -8xzIljeBDQWWVRr0NEALVSv3i09V4jAKkyEOfmZ8lKMKJi0atwbtjrXTzLnNYj+Q -pyUbyY/8ItWvV7pnVxMiF9qcer7e9X4vw358GZuMVE/da1nWxz+CwzTm5oO30RzA -antM9bISFFr9lJq69bDWOnCUi1IG8DSL3TxtlABso7S4vqiZ+sB33l6k1K4a/Njb -QkU9UejKhKkVVZTsOrumfnOJ4MCmPfX8Y/AY2o670y5HnzpxerIYziCVzApPVrW7 -sKH0tuVGturMfQOKgstYe4/m9glBTeTLMkjD+6MJC2ONBD7GAiOO95gNl5M1fzJQ -FEe5CJ7DCYl0GdmLXXw= ------END CERTIFICATE----- diff --git a/libraries/plugins/auth/swekey/swekey.auth.lib.php b/libraries/plugins/auth/swekey/swekey.auth.lib.php deleted file mode 100644 index 78d90099d6..0000000000 --- a/libraries/plugins/auth/swekey/swekey.auth.lib.php +++ /dev/null @@ -1,315 +0,0 @@ - - - \n"; - // if (file_exists($caFile)) - // echo "\n"; - } - - if (@file_exists($caFile)) { - Swekey_SetCAFile($caFile); - } elseif (! empty($caFile) - && (substr($_SESSION['SWEKEY']['CONF_SERVER_CHECK'], 0, 8) == "https://") - ) { - return "Internal Error: CA File $caFile not found"; - } - - $result = null; - $swekey_id = $_GET['swekey_id']; - $swekey_otp = $_GET['swekey_otp']; - - if (isset($swekey_id)) { - unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); - if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { - unset($swekey_id); - } else { - if (strlen($swekey_id) == 32) { - $res = Swekey_CheckOtp( - $swekey_id, $_SESSION['SWEKEY']['RND_TOKEN'], $swekey_otp - ); - unset($_SESSION['SWEKEY']['RND_TOKEN']); - if (! $res) { - $result = __('Hardware authentication failed!') . ' (' . Swekey_GetLastError() . ')'; - } else { - $_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY'] = $swekey_id; - $_SESSION['SWEKEY']['FORCE_USER'] - = $_SESSION['SWEKEY']['VALID_SWEKEYS'][$swekey_id]; - return null; - } - } else { - $result = __('No valid authentication key plugged'); - if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "
" . htmlspecialchars($swekey_id); - } - unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file - } - } - } else { - unset($_SESSION['SWEKEY']); - } - - $_SESSION['SWEKEY']['RND_TOKEN'] = Swekey_GetFastRndToken(); - if (strlen($_SESSION['SWEKEY']['RND_TOKEN']) != 64) { - $result = __('Hardware authentication failed!') . ' (' . Swekey_GetLastError() . ')'; - unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file - } - - if (! isset($swekey_id)) { - ?> - - display(); - if ($GLOBALS['error_handler']->hasDisplayErrors()) { - echo '
'; - $GLOBALS['error_handler']->dispErrors(); - echo '
'; - } - } - - if (isset($_SESSION['SWEKEY']) && $_SESSION['SWEKEY']['ENABLED']) { - echo ''; - } -} - -if (!empty($_GET['session_to_unset'])) { - session_write_close(); - session_id($_GET['session_to_unset']); - session_start(); - $_SESSION = array(); - session_write_close(); - session_destroy(); - exit; -} - -if (isset($_GET['swekey_reset'])) { - unset($_SESSION['SWEKEY']); -} - diff --git a/libraries/plugins/auth/swekey/swekey.php b/libraries/plugins/auth/swekey/swekey.php deleted file mode 100644 index baba5ee696..0000000000 --- a/libraries/plugins/auth/swekey/swekey.php +++ /dev/null @@ -1,536 +0,0 @@ -"; - -/** - * Servers addresses - * Use the Swekey_SetXxxServer($server) functions to set them - */ - -global $gSwekeyCheckServer; -if (! isset($gSwekeyCheckServer)) { - $gSwekeyCheckServer = SWEKEY_DEFAULT_CHECK_SERVER; -} - -global $gSwekeyRndTokenServer; -if (! isset($gSwekeyRndTokenServer)) { - $gSwekeyRndTokenServer = SWEKEY_DEFAULT_RND_SERVER; -} - -global $gSwekeyStatusServer; -if (! isset($gSwekeyStatusServer)) { - $gSwekeyStatusServer = SWEKEY_DEFAULT_STATUS_SERVER; -} - -global $gSwekeyCA; - -global $gSwekeyTokenCacheEnabled; -if (! isset($gSwekeyTokenCacheEnabled)) { - $gSwekeyTokenCacheEnabled = true; -} - -/** - * Change the address of the Check server. - * If $server is empty the default value 'http://auth-check.musbe.net' will be used - * - * @param int $server The protocol and hostname to use - * - * @access public - */ -function Swekey_SetCheckServer($server) -{ - global $gSwekeyCheckServer; - if (empty($server)) { - $gSwekeyCheckServer = SWEKEY_DEFAULT_CHECK_SERVER; - } else { - $gSwekeyCheckServer = $server; - } -} - -/** - * Change the address of the Random Token Generator server. - * If $server is empty the default value 'http://auth-rnd-gen.musbe.net' will be used - * - * @param int $server The protocol and hostname to use - * - * @access public - */ -function Swekey_SetRndTokenServer($server) -{ - global $gSwekeyRndTokenServer; - if (empty($server)) { - $gSwekeyRndTokenServer = SWEKEY_DEFAULT_RND_SERVER; - } else { - $gSwekeyRndTokenServer = $server; - } -} - -/** - * Change the address of the Satus server. - * If $server is empty the default value 'http://auth-status.musbe.net' will be used - * - * @param int $server The protocol and hostname to use - * - * @access public - */ -function Swekey_SetStatusServer($server) -{ - global $gSwekeyStatusServer; - if (empty($server)) { - $gSwekeyStatusServer = SWEKEY_DEFAULT_STATUS_SERVER; - } else { - $gSwekeyStatusServer = $server; - } -} - -/** - * Change the certificat file in case of the the severs use https instead of http - * - * @param string $cafile The path of the crt file to use - * - * @access public - */ -function Swekey_SetCAFile($cafile) -{ - global $gSwekeyCA; - $gSwekeyCA = $cafile; -} - -/** - * Enable or disable the random token caching - * Because everybody has full access to the cache file, it can be a DOS vulnerability - * So disable it if you are running in a non secure enviromnement - * - * @param $enable - * - * @access public - */ -function Swekey_EnableTokenCache($enable) -{ - global $gSwekeyTokenCacheEnabled; - $gSwekeyTokenCacheEnabled = ! empty($enable); -} - - -/** - * Return the last error. - * - * @return string The Last Error - * @access public - */ -function Swekey_GetLastError() -{ - global $gSwekeyLastError; - return $gSwekeyLastError; -} - -/** - * Return the last result. - * - * @return string The Last Error - * @access public - */ -function Swekey_GetLastResult() -{ - global $gSwekeyLastResult; - return $gSwekeyLastResult; -} - -/** - * Send a synchronous request to the server. - * This function manages timeout then will not block if one of the server is down - * - * @param string $url The url to get - * @param string $response_code The response code - * - * @return string The body of the response or "" in case of error - * @access private - */ -function Swekey_HttpGet($url, &$response_code) -{ - global $gSwekeyLastError; - $gSwekeyLastError = 0; - global $gSwekeyLastResult; - $gSwekeyLastResult = ""; - - // use curl if available - if (function_exists('curl_init')) { - $sess = curl_init($url); - if (substr($url, 0, 8) == "https://") { - global $gSwekeyCA; - - if (! empty($gSwekeyCA)) { - if (file_exists($gSwekeyCA)) { - if (! curl_setopt($sess, CURLOPT_CAINFO, $gSwekeyCA)) { - error_log( - "SWEKEY_ERROR:Could not set CA file : ".curl_error($sess) - ); - } else { - $caFileOk = true; - } - } else { - error_log( - "SWEKEY_ERROR:Could not find CA file $gSwekeyCA getting $url" - ); - } - } - - curl_setopt($sess, CURLOPT_SSL_VERIFYHOST, '2'); - curl_setopt($sess, CURLOPT_SSL_VERIFYPEER, '1'); - curl_setopt($sess, CURLOPT_CONNECTTIMEOUT, '20'); - curl_setopt($sess, CURLOPT_TIMEOUT, '20'); - } else { - curl_setopt($sess, CURLOPT_CONNECTTIMEOUT, '3'); - curl_setopt($sess, CURLOPT_TIMEOUT, '5'); - } - - curl_setopt($sess, CURLOPT_RETURNTRANSFER, '1'); - $res=curl_exec($sess); - $response_code = curl_getinfo($sess, CURLINFO_HTTP_CODE); - $curlerr = curl_error($sess); - curl_close($sess); - - if ($response_code == 200) { - $gSwekeyLastResult = $res; - return $res; - } - - if (! empty($response_code)) { - $gSwekeyLastError = $response_code; - error_log( - "SWEKEY_ERROR:Error $gSwekeyLastError ($curlerr) getting $url" - ); - return ""; - } - - $response_code = 408; // Request Timeout - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error $curlerr getting $url"); - return ""; - } - - // use pecl_http if available - if (class_exists('HttpRequest')) { - // retry if one of the server is down - for ($num=1; $num <= 3; $num++ ) { - $r = new HttpRequest($url); - $options = array('timeout' => '3'); - - if (substr($url, 0, 6) == "https:") { - $sslOptions = array(); - $sslOptions['verifypeer'] = true; - $sslOptions['verifyhost'] = true; - - $capath = __FILE__; - $name = strrchr($capath, '/'); - // windows - if (empty($name)) { - $name = strrchr($capath, '\\'); - } - $capath = substr($capath, 0, strlen($capath) - strlen($name) + 1) - . 'musbe-ca.crt'; - - if (! empty($gSwekeyCA)) { - $sslOptions['cainfo'] = $gSwekeyCA; - } - - $options['ssl'] = $sslOptions; - } - - $r->setOptions($options); - - /* - try - { - */ - $reply = $r->send(); - $res = $reply->getBody(); - $info = $r->getResponseInfo(); - $response_code = $info['response_code']; - if ($response_code != 200) { - $gSwekeyLastError = $response_code; - error_log( - "SWEKEY_ERROR:Error ".$gSwekeyLastError." getting ".$url - ); - return ""; - } - - - $gSwekeyLastResult = $res; - return $res; - /* - } - catch (HttpException $e) - { - error_log("SWEKEY_WARNING:HttpException ".$e." getting ".$url); - } - */ - } - - $response_code = 408; // Request Timeout - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error ".$gSwekeyLastError." getting ".$url); - return ""; - } - - global $http_response_header; - $res = @file_get_contents($url); - $response_code = substr($http_response_header[0], 9, 3); //HTTP/1.0 - if ($response_code == 200) { - $gSwekeyLastResult = $res; - return $res; - } - - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error ".$response_code." getting ".$url); - return ""; -} - -/** - * Get a Random Token from a Token Server - * The RT is a 64 vhars hexadecimal value - * You should better use Swekey_GetFastRndToken() for performance - * @access public - */ -function Swekey_GetRndToken() -{ - global $gSwekeyRndTokenServer; - return Swekey_HttpGet($gSwekeyRndTokenServer.'/FULL-RND-TOKEN', $response_code); -} - -/** - * Get a Half Random Token from a Token Server - * The RT is a 64 vhars hexadecimal value - * Use this value if you want to make your own Swekey_GetFastRndToken() - * @access public - */ -function Swekey_GetHalfRndToken() -{ - global $gSwekeyRndTokenServer; - return Swekey_HttpGet($gSwekeyRndTokenServer.'/HALF-RND-TOKEN', $response_code); -} - -/** - * Get a Half Random Token - * The RT is a 64 vhars hexadecimal value - * This function get a new random token and reuse it. - * Token are refetched from the server only once every 30 seconds. - * You should always use this function to get half random token. - * @access public - */ -function Swekey_GetFastHalfRndToken() -{ - global $gSwekeyTokenCacheEnabled; - - $res = ""; - $cachefile = ""; - - // We check if we have a valid RT is the session - if (isset($_SESSION['rnd-token-date'])) { - if (time() - $_SESSION['rnd-token-date'] < 30) { - $res = $_SESSION['rnd-token']; - } - } - - // If not we try to get it from a temp file (PHP >= 5.2.1 only) - if (strlen($res) != 32 && $gSwekeyTokenCacheEnabled) { - if (function_exists('sys_get_temp_dir')) { - $tempdir = sys_get_temp_dir(); - $cachefile = $tempdir."/swekey-rnd-token-".get_current_user(); - $modif = filemtime($cachefile); - if ($modif != false) { - if (time() - $modif < 30) { - $res = @file_get_contents($cachefile); - if (strlen($res) != 32) { - $res = ""; - } else { - $_SESSION['rnd-token'] = $res; - $_SESSION['rnd-token-date'] = $modif; - } - } - } - } - } - - // If we don't have a valid RT here we have to get it from the server - if (strlen($res) != 32) { - $res = substr(Swekey_GetHalfRndToken(), 0, 32); - $_SESSION['rnd-token'] = $res; - $_SESSION['rnd-token-date'] = time(); - if (! empty($cachefile)) { - // we unlink the file so no possible tempfile race attack - unlink($cachefile); - $file = fopen($cachefile, "x"); - if ($file != false) { - @fwrite($file, $res); - @fclose($file); - } - } - } - - return $res."00000000000000000000000000000000"; -} - -/** - * Get a Random Token - * The RT is a 64 vhars hexadecimal value - * This function generates a unique random token for each call but call the - * server only once every 30 seconds. - * You should always use this function to get random token. - * @access public - */ -function Swekey_GetFastRndToken() -{ - $res = Swekey_GetFastHalfRndToken(); - if (strlen($res) == 64) { - return substr($res, 0, 32).strtoupper(md5("Musbe Authentication Key" . mt_rand() . date(DATE_ATOM))); - } - return ""; -} - - -/** - * Checks that an OTP generated by a Swekey is valid - * - * @param mixed $id The id of the swekey - * @param mixed $rt The random token used to generate the otp - * @param mixed $otp The otp generated by the swekey - * - * @return boolean Success - * @access public - */ -function Swekey_CheckOtp($id, $rt, $otp) -{ - global $gSwekeyCheckServer; - $res = Swekey_HttpGet( - $gSwekeyCheckServer.'/CHECK-OTP/'.$id.'/'.$rt.'/'.$otp, - $response_code - ); - return $response_code == 200 && $res == "OK"; -} - -/** - * Values that are associated with a key. - * The following values can be returned by the Swekey_GetStatus() function - */ -define("SWEKEY_STATUS_OK", 0); -define("SWEKEY_STATUS_NOT_FOUND", 1); // The key does not exist in the db -define("SWEKEY_STATUS_INACTIVE", 2); // The key has never been activated -define("SWEKEY_STATUS_LOST", 3); // The user has lost his key -define("SWEKEY_STATUS_STOLEN", 4); // The key was stolen -define("SWEKEY_STATUS_FEE_DUE", 5); // The annual fee was not paid -define("SWEKEY_STATUS_OBSOLETE", 6); // The hardware is no longer supported -define("SWEKEY_STATUS_UNKOWN", 201); // We could not connect to the authentication server - -/** - * Values that are associated with a key. - * The Javascript Api can also return the following values - */ -define("SWEKEY_STATUS_REPLACED", 100); // This key has been replaced by a backup key -define("SWEKEY_STATUS_BACKUP_KEY", 101); // This key is a backup key that is not activated yet -define("SWEKEY_STATUS_NOTPLUGGED", 200); // This key is not plugged in the computer - - -/** - * Return the text corresponding to the integer status of a key - * - * @param int $status The status - * - * @return string The text corresponding to the status - * @access public - */ -function Swekey_GetStatusStr($status) -{ - switch($status) - { - case SWEKEY_STATUS_OK : - return 'OK'; - case SWEKEY_STATUS_NOT_FOUND : - return 'Key does not exist in the db'; - case SWEKEY_STATUS_INACTIVE : - return 'Key not activated'; - case SWEKEY_STATUS_LOST : - return 'Key was lost'; - case SWEKEY_STATUS_STOLEN : - return 'Key was stolen'; - case SWEKEY_STATUS_FEE_DUE : - return 'The annual fee was not paid'; - case SWEKEY_STATUS_OBSOLETE : - return 'Key no longer supported'; - case SWEKEY_STATUS_REPLACED : - return 'This key has been replaced by a backup key'; - case SWEKEY_STATUS_BACKUP_KEY : - return 'This key is a backup key that is not activated yet'; - case SWEKEY_STATUS_NOTPLUGGED : - return 'This key is not plugged in the computer'; - case SWEKEY_STATUS_UNKOWN : - return 'Unknow Status, could not connect to the authentication server'; - } - return 'unknown status '.$status; -} - -/** - * If your web site requires a key to login you should check that the key - * is still valid (has not been lost or stolen) before requiring it. - * A key can be authenticated only if its status is SWEKEY_STATUS_OK - * - * @param mixed $id The id of the swekey - * - * @return int The status of the swekey - * @access public - */ -function Swekey_GetStatus($id) -{ - global $gSwekeyStatusServer; - $res = Swekey_HttpGet($gSwekeyStatusServer.'/GET-STATUS/'.$id, $response_code); - if ($response_code == 200) { - return intval($res); - } - return SWEKEY_STATUS_UNKOWN; -} diff --git a/phpunit.xml.dist b/phpunit.xml.dist index efcc2aed56..2e2d1d226f 100644 --- a/phpunit.xml.dist +++ b/phpunit.xml.dist @@ -48,7 +48,6 @@ libraries/bfShapeFiles libraries/php-gettext libraries/phpseclib - libraries/plugins/auth/swekey/ libraries/sql-parser libraries/tcpdf diff --git a/test/classes/plugin/auth/AuthenticationCookieTest.php b/test/classes/plugin/auth/AuthenticationCookieTest.php index d999336b75..e4d2e87840 100644 --- a/test/classes/plugin/auth/AuthenticationCookieTest.php +++ b/test/classes/plugin/auth/AuthenticationCookieTest.php @@ -404,22 +404,6 @@ class AuthenticationCookieTest extends PMATestCase $attrInstance->setValue($restoreInstance); } - /** - * Test for PMA\libraries\plugins\auth\AuthenticationConfig::authCheck - * - * @return void - */ - public function testAuthCheckSwekey() - { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = 'testConfigSwekey'; - - file_put_contents('testConfigSwekey', ''); - $this->assertFalse( - $this->object->authCheck() - ); - @unlink('testConfigSwekey'); - } - /** * Test for PMA\libraries\plugins\auth\AuthenticationConfig::authCheck * @@ -427,7 +411,6 @@ class AuthenticationCookieTest extends PMATestCase */ public function testAuthCheckCaptcha() { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = ''; $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = 'testprivkey'; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = 'testpubkey'; $_POST["g-recaptcha-response"] = ''; @@ -470,7 +453,6 @@ class AuthenticationCookieTest extends PMATestCase $attrInstance->setAccessible(true); $attrInstance->setValue($mockResponse); - $GLOBALS['cfg']['Server']['auth_swekey_config'] = ''; $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $GLOBALS['cfg']['LoginCookieDeleteAll'] = true; @@ -512,7 +494,6 @@ class AuthenticationCookieTest extends PMATestCase $attrInstance = new ReflectionProperty('PMA\libraries\Response', '_instance'); $attrInstance->setAccessible(true); $attrInstance->setValue($mockResponse); - $GLOBALS['cfg']['Server']['auth_swekey_config'] = ''; $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $GLOBALS['cfg']['LoginCookieDeleteAll'] = false; @@ -536,7 +517,6 @@ class AuthenticationCookieTest extends PMATestCase */ public function testAuthCheckArbitrary() { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = ''; $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = ''; $GLOBALS['cfg']['CaptchaLoginPublicKey'] = ''; $_REQUEST['old_usr'] = ''; @@ -577,7 +557,6 @@ class AuthenticationCookieTest extends PMATestCase public function testAuthCheckIV() { $GLOBALS['cfg']['AllowArbitraryServer'] = true; - $GLOBALS['cfg']['Server']['auth_swekey_config'] = ''; $_REQUEST['pma_servername'] = 'testPMAServer'; $_REQUEST['pma_password'] = 'testPMAPSWD'; $_REQUEST['pma_username'] = ''; @@ -603,7 +582,6 @@ class AuthenticationCookieTest extends PMATestCase */ public function testAuthCheckExpires() { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = ''; $GLOBALS['server'] = 1; $_COOKIE['pmaServer-1'] = 'pmaServ1'; $_COOKIE['pmaUser-1'] = 'pmaUser1'; @@ -625,7 +603,6 @@ class AuthenticationCookieTest extends PMATestCase */ public function testAuthCheckDecryptUser() { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = 'testConfigSwekey'; $GLOBALS['server'] = 1; $_REQUEST['old_usr'] = ''; $_REQUEST['pma_username'] = ''; @@ -664,7 +641,6 @@ class AuthenticationCookieTest extends PMATestCase */ public function testAuthCheckDecryptPassword() { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = 'testConfigSwekey'; $GLOBALS['server'] = 1; $_REQUEST['old_usr'] = ''; $_REQUEST['pma_username'] = ''; @@ -710,7 +686,6 @@ class AuthenticationCookieTest extends PMATestCase */ public function testAuthCheckAuthFails() { - $GLOBALS['cfg']['Server']['auth_swekey_config'] = 'testConfigSwekey'; $GLOBALS['server'] = 1; $_REQUEST['old_usr'] = ''; $_REQUEST['pma_username'] = '';