85 lines
2.8 KiB
Perl
85 lines
2.8 KiB
Perl
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
#
|
|
# This Source Code Form is "Incompatible With Secondary Licenses", as
|
|
# defined by the Mozilla Public License, v. 2.0.
|
|
|
|
package Bugzilla::Auth::Login::CGI;
|
|
|
|
use 5.10.1;
|
|
use strict;
|
|
|
|
use parent qw(Bugzilla::Auth::Login);
|
|
use constant user_can_create_account => 1;
|
|
|
|
use Bugzilla::Constants;
|
|
use Bugzilla::WebService::Constants;
|
|
use Bugzilla::Util;
|
|
use Bugzilla::Error;
|
|
use Bugzilla::Token;
|
|
|
|
sub get_login_info {
|
|
my ($self) = @_;
|
|
my $params = Bugzilla->input_params;
|
|
my $cgi = Bugzilla->cgi;
|
|
|
|
my $login = trim(delete $params->{'Bugzilla_login'});
|
|
my $password = delete $params->{'Bugzilla_password'};
|
|
# The token must match the cookie to authenticate the request.
|
|
my $login_token = delete $params->{'Bugzilla_login_token'};
|
|
my $login_cookie = $cgi->cookie('Bugzilla_login_request_cookie');
|
|
|
|
my $valid = 0;
|
|
# If the web browser accepts cookies, use them.
|
|
if ($login_token && $login_cookie) {
|
|
my ($time, undef) = split(/-/, $login_token);
|
|
# Regenerate the token based on the information we have.
|
|
my $expected_token = issue_hash_token(['login_request', $login_cookie], $time);
|
|
$valid = 1 if $expected_token eq $login_token;
|
|
$cgi->remove_cookie('Bugzilla_login_request_cookie');
|
|
}
|
|
# WebServices and other local scripts can bypass this check.
|
|
# This is safe because we won't store a login cookie in this case.
|
|
elsif (Bugzilla->usage_mode != USAGE_MODE_BROWSER) {
|
|
$valid = 1;
|
|
}
|
|
# Else falls back to the Referer header and accept local URLs.
|
|
# Attachments are served from a separate host (ideally), and so
|
|
# an evil attachment cannot abuse this check with a redirect.
|
|
elsif (my $referer = $cgi->referer) {
|
|
my $urlbase = correct_urlbase();
|
|
$valid = 1 if $referer =~ /^\Q$urlbase\E/;
|
|
}
|
|
# If the web browser doesn't accept cookies and the Referer header
|
|
# is missing, we have no way to make sure that the authentication
|
|
# request comes from the user.
|
|
elsif ($login && $password) {
|
|
ThrowUserError('auth_untrusted_request', { login => $login });
|
|
}
|
|
|
|
if (!defined($login) || !defined($password) || !$valid) {
|
|
return { failure => AUTH_NODATA };
|
|
}
|
|
|
|
return { username => $login, password => $password };
|
|
}
|
|
|
|
sub fail_nodata {
|
|
my ($self) = @_;
|
|
my $cgi = Bugzilla->cgi;
|
|
my $template = Bugzilla->template;
|
|
|
|
if (Bugzilla->usage_mode != USAGE_MODE_BROWSER) {
|
|
ThrowUserError('login_required');
|
|
}
|
|
|
|
print $cgi->header();
|
|
$template->process("account/auth/login.html.tmpl",
|
|
{ 'target' => $cgi->url(-relative=>1) })
|
|
|| ThrowTemplateError($template->error());
|
|
exit;
|
|
}
|
|
|
|
1;
|