Peter M. Groen / knowledgetree

Commit 1a1ef17eeaa7ded062b80c5452ce670ebeb9c501

Authored by Megan Watson
1 parent 36123930

KTS-3516 

"Deleted user that has been added via the Authenticated Source can be logged in after deletion."
Fixed. Added a check to see if the user has been deleted before doing the auto-signup. Added a config option to disable the auto signup.

Committed by: Megan Watson
Reviewed by: Conrad Vermeulen



git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@8867 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 2 changed files with 60 additions and 24 deletions
lib/users/User.inc
  View file @1a1ef17
... ... @@ -8,31 +8,31 @@
8 8 * Document Management Made Simple
9 9 * Copyright (C) 2008 KnowledgeTree Inc.
10 10 * Portions copyright The Jam Warehouse Software (Pty) Limited
11   - *
  11 + *
12 12 * This program is free software; you can redistribute it and/or modify it under
13 13 * the terms of the GNU General Public License version 3 as published by the
14 14 * Free Software Foundation.
15   - *
  15 + *
16 16 * This program is distributed in the hope that it will be useful, but WITHOUT
17 17 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
18 18 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
19 19 * details.
20   - *
  20 + *
21 21 * You should have received a copy of the GNU General Public License
22 22 * along with this program. If not, see <http://www.gnu.org/licenses/>.
23   - *
24   - * You can contact KnowledgeTree Inc., PO Box 7775 #87847, San Francisco,
  23 + *
  24 + * You can contact KnowledgeTree Inc., PO Box 7775 #87847, San Francisco,
25 25 * California 94120-7775, or email info@knowledgetree.com.
26   - *
  26 + *
27 27 * The interactive user interfaces in modified source and object code versions
28 28 * of this program must display Appropriate Legal Notices, as required under
29 29 * Section 5 of the GNU General Public License version 3.
30   - *
  30 + *
31 31 * In accordance with Section 7(b) of the GNU General Public License version 3,
32 32 * these Appropriate Legal Notices must retain the display of the "Powered by
33   - * KnowledgeTree" logo and retain the original copyright notice. If the display of the
  33 + * KnowledgeTree" logo and retain the original copyright notice. If the display of the
34 34 * logo is not reasonably feasible for technical reasons, the Appropriate Legal Notices
35   - * must display the words "Powered by KnowledgeTree" and retain the original
  35 + * must display the words "Powered by KnowledgeTree" and retain the original
36 36 * copyright notice.
37 37 * Contributor( s): ______________________________________
38 38 */
... ... @@ -399,6 +399,29 @@ class User extends KTEntity {
399 399 return KTEntityUtil::getBy('User', 'username', $sUserName, $aOptions);
400 400 }
401 401  
  402 + /**
  403 + * Check whether a user has been deleted
  404 + *
  405 + * @param string $sUsername
  406 + * @return boolean
  407 + */
  408 + function checkDeletedUser($sUsername) {
  409 + $deletedUsername = "kt_deleted_{$sUsername}_";
  410 + $query = "SELECT * FROM users WHERE username LIKE '{$deletedUsername}%'";
  411 + $result = DBUtil::getOneResult($query);
  412 +
  413 + if(PEAR::isError($result) || empty($result)){
  414 + return false;
  415 + }
  416 +
  417 + // Check that the deleted username is correct
  418 + if($deletedUsername.$result['id'] != $result['username']){
  419 + return false;
  420 + }
  421 +
  422 + return true;
  423 + }
  424 +
402 425 function getByAuthenticationSource($oSource, $aOptions = null) {
403 426 $iSourceId = KTUtil::getId($oSource);
404 427 $aOptions = KTUtil::meldOptions($aOptions, array(
... ... @@ -502,8 +525,8 @@ class User extends KTEntity {
502 525  
503 526 function hasPermission($oUser, $oPermission, $oFolderOrDocument) {
504 527 return KTPermissionUtil::userHasPermissionOnItem($oUser, $oPermission, $oFolderOrDocument);
505   -
  528 +
506 529 }
507   -
  530 +
508 531 }
509 532 ?>
510 533 \ No newline at end of file
... ...
login.php
  View file @1a1ef17
... ... @@ -294,20 +294,33 @@ class LoginPageDispatcher extends KTDispatcher {
294 294 if (empty($aExtra)) {
295 295 $aExtra = array();
296 296 }
297   - $res = KTAuthenticationUtil::autoSignup($username, $password, $aExtra);
298   - if (empty($res)) {
299   - return $res;
300   - }
301   - if (is_a($res, 'User')) {
302   - $this->performLogin($res);
  297 +
  298 + // Check if the user has been deleted before allowing auto-signup
  299 + $delUser = User::checkDeletedUser($username);
  300 +
  301 + if($delUser){
  302 + return ;
303 303 }
304   - if (is_a($res, 'KTAuthenticationSource')) {
305   - $_SESSION['autosignup'] = $aExtra;
306   - $this->redirectTo('autoSignup', array(
307   - 'source_id' => $res->getId(),
308   - 'username' => $username,
309   - ));
310   - exit(0);
  304 +
  305 + $oKTConfig = KTConfig::getSingleton();
  306 + $allow = $oKTConfig->get('session/allowAutoSignup', true);
  307 +
  308 + if($allow){
  309 + $res = KTAuthenticationUtil::autoSignup($username, $password, $aExtra);
  310 + if (empty($res)) {
  311 + return $res;
  312 + }
  313 + if (is_a($res, 'User')) {
  314 + $this->performLogin($res);
  315 + }
  316 + if (is_a($res, 'KTAuthenticationSource')) {
  317 + $_SESSION['autosignup'] = $aExtra;
  318 + $this->redirectTo('autoSignup', array(
  319 + 'source_id' => $res->getId(),
  320 + 'username' => $username,
  321 + ));
  322 + exit(0);
  323 + }
311 324 }
312 325 }
313 326  
... ...