source: alternc/trunk/bureau/class/m_hta.php @ 3151

Revision 3151, 11.4 KB checked in by squidly, 13 months ago (diff)

Correction classe de gestion des htaccess
Line 
1<?php
2/*
3 $Id: m_hta.php,v 1.5 2004/11/29 17:15:37 anonymous Exp $
4 ----------------------------------------------------------------------
5 AlternC - Web Hosting System
6 Copyright (C) 2002 by the AlternC Development Team.
7 http://alternc.org/
8 ----------------------------------------------------------------------
9 Based on:
10 Valentin Lacambre's web hosting softwares: http://altern.org/
11 ----------------------------------------------------------------------
12 LICENSE
13
14 This program is free software; you can redistribute it and/or
15 modify it under the terms of the GNU General Public License (GPL)
16 as published by the Free Software Foundation; either version 2
17 of the License, or (at your option) any later version.
18
19 This program is distributed in the hope that it will be useful,
20 but WITHOUT ANY WARRANTY; without even the implied warranty of
21 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22 GNU General Public License for more details.
23
24 To read the license please visit http://www.gnu.org/copyleft/gpl.html
25 ----------------------------------------------------------------------
26 Original Author of file:
27 Purpose of file:
28 ----------------------------------------------------------------------
29*/
30
31/**
32* This class handle folder web restricted access through .htaccess/.htpassword
33* files.
34*
35* Copyleft {@link http://alternc.net/ AlternC Team}
36*
37* @copyright    AlternC-Team 2002-11-01 http://alternc.org/
38*
39*/
40class m_hta {
41
42
43  /*---------------------------------------------------------------------------*/
44  /**
45   * Constructor
46   */
47  function m_webaccess() {
48  }
49
50
51  /**
52   * Password kind used in this class (hook for admin class)
53   */
54  function alternc_password_policy() {
55    return array("hta"=>"Protected folders passwords");
56  }
57
58
59  /*---------------------------------------------------------------------------*/
60  /**
61   * Create a protected folder (.htaccess et .htpasswd)
62   * @param string $dir Folder to protect (relative to user root)
63   * @return boolean TRUE if the folder has been protected, or FALSE if an error occurred
64   */
65  function CreateDir($dir) {
66    global $mem,$bro,$err,$L_ALTERNC_LOC;
67    $err->log("hta","createdir",$dir);
68    $absolute=$bro->convertabsolute($dir,0);
69    if (!$absolute) {
70      $err->raise("hta",8,$dir);
71      return false;
72    }
73    if (!file_exists($absolute)) {
74      @mkdir($absolute,00777);
75    }
76    if (!file_exists("$absolute/.htaccess")) {
77      if (!@touch("$absolute/.htaccess")) {
78        $err->raise("hta",12);
79        return false;
80      }
81      $file = @fopen("$absolute/.htaccess","r+");
82      if (!$file) {
83        $err->raise("hta",12);
84        return false;
85      }
86      fseek($file,0);
87      $param="AuthUserFile $absolute/.htpasswd\nAuthName \"Zone Protégée\"\nAuthType Basic\nrequire valid-user\n";
88      fwrite($file, $param);
89      fclose($file);
90    }
91    if (!file_exists("$absolute/.htpasswd")) {
92      if (!touch("$absolute/.htpasswd")) {
93        $err->raise("hta",12);
94        return false;
95      }
96      return true;
97    }
98    return true;
99  }
100
101
102  /*---------------------------------------------------------------------------*/
103  /**
104   * Returns the list of all user folder currently protected by a .htpasswd file
105   * @return array Array containing user folder list
106   */
107
108  function ListDir(){
109          global$err,$mem,$L_ALTERNC_LOC;
110          $err->log("hta","listdir");
111          $sortie=array();
112          $absolute="$L_ALTERNC_LOC/html/".substr($mem->user["login"],0,1)."/".$mem->user["login"];
113          exec("find $absolute -name .htpasswd|sort",$sortie);
114          if(!count($sortie)){
115                  $err->raise("hta",4);
116                  return false;
117          }
118          $pattern="/^".preg_quote($L_ALTERNC_LOC,"/")."\/html\/.\/[^\/]*\/(.*)\/\.htpasswd/";
119                  for($i=0;$i<count($sortie);$i++){
120                  preg_match($pattern,$sortie[$i],$matches);
121                  $r[$i]=$matches[1]."/";
122          }
123          return $r;
124  }
125
126  /*---------------------------------------------------------------------------*/
127  /**
128   * Tells if a folder is protected.
129   * @param string $dir Folder to check
130   * @return TRUE if the folder is protected, or FALSE if it is not
131   */
132  function is_protected($dir){
133    global $mem,$err,$L_ALTERNC_LOC;
134    $err->log("hta","is_protected",$dir);
135    $absolute="$L_ALTERNC_LOC/html/".substr($mem->user["login"],0,1)."/".$mem->user["login"]."/$dir";
136    $sortie=array();
137    if (file_exists("$absolute/.htpasswd")){
138      return true;
139    }
140    else {
141      return false;
142    }
143  }
144
145
146  /*---------------------------------------------------------------------------*/
147  /**
148   * Returns the list of login for a protected folder.
149   * @param string $dir The folder to lookup (relative to user root)
150   * @return array An array containing the list of logins from the .htpasswd file, or FALSE
151   */
152  function get_hta_detail($dir) {
153    global $mem,$err,$L_ALTERNC_LOC;
154    $err->log("hta","get_hta_detail");
155    $absolute="$L_ALTERNC_LOC/html/".substr($mem->user["login"],0,1)."/".$mem->user["login"]."/$dir";
156    if (file_exists("$absolute/.htaccess")) {
157      /*                if (!_reading_htaccess($absolute)) {
158                        return false;
159                        }
160      */        }
161    $file = @fopen("$absolute/.htpasswd","r");
162    $i=0;
163    $res=array();
164    if (!$file) {
165      return false;
166    }
167    // TODO: Tester la validité du .htpasswd
168    while (!feof($file)) {
169      $s=fgets($file,1024);
170      $t=explode(":",$s);
171      if ($t[0]!=$s) {
172        $res[$i]=$t[0];
173        $i=$i+1;
174      }
175    }
176    fclose($file);
177    return $res;
178  }
179
180
181  /*---------------------------------------------------------------------------*/
182  /**
183   * Unprotect a folder
184   * @param string $dir Folder to unprotect, relative to user root
185   * @return boolean TRUE if the folder has been unprotected, or FALSE if an error occurred
186   */
187  function DelDir($dir) {
188    global $mem,$bro,$err;
189    $err->log("hta","deldir",$dir);
190    $dir=$bro->convertabsolute($dir,0);
191    if (!$dir) {
192      $err->raise("hta",8,$dir);
193      return false;
194    }
195    if (!@unlink("$dir/.htaccess")) {
196      $err->raise("hta",5,$dir);
197      return false;
198    }
199    if (!@unlink("$dir/.htpasswd")) {
200      $err->raise("hta",6,$dir);
201      return false;
202    }
203    return true;
204  }
205
206
207  /*---------------------------------------------------------------------------*/
208  /**
209   * Add a user to a protected folder
210   * @param string $login The user login to add
211   * @param string $password The password to add (cleartext)
212   * @param string $dir The folder we add it to (relative to user root).
213   * @return boolean TRUE if the user has been added, or FALSE if an error occurred
214   */
215  function add_user($user,$password,$dir) {
216    global $err, $bro, $admin;
217    $err->log("hta","add_user",$user."/".$dir);
218    $absolute=$bro->convertabsolute($dir,0);
219    if (!file_exists($absolute)) {
220      $err->raise("hta",8,$dir);
221      return false;
222    }
223    if (checkloginmail($user)){
224      // Check this password against the password policy using common API :
225      if (is_callable(array($admin,"checkPolicy"))) {
226        if (!$admin->checkPolicy("hta",$user,$password)) {
227          return false; // The error has been raised by checkPolicy()
228        }
229      }
230
231      $file = @fopen("$absolute/.htpasswd","a+");
232      if (!$file) {
233        $err->raise("hta",12);
234        return false;
235      }
236      fseek($file,0);
237      while (!feof($file)) {
238        $s=fgets($file,1024);
239        $t=explode(":",$s);
240        if ($t[0]==$user) {
241          $err->raise("hta",10,$user);
242          return false;
243        }
244      }
245      fseek($file,SEEK_END);
246      if (substr($t[1],-1)!="\n") {
247        fwrite($file,"\n");
248      }
249      fwrite($file, "$user:"._md5cr($password)."\n");
250      fclose($file);
251      return true;
252    } else {
253      $err->raise("hta",11);
254      return false;
255    }
256  }
257
258
259  /*---------------------------------------------------------------------------*/
260  /**
261   * Delete a user from a protected folder.
262   * @param array $lst An array with login to delete.
263   * @param string $dir The folder, relative to user root, where we want to delete users.
264   * @return boolean TRUE if users has been deleted, or FALSE if an error occurred.
265   */
266  function del_user($lst,$dir) {
267    global $bro,$err;
268    $err->log("hta","del_user",$lst."/".$dir);
269    $absolute=$bro->convertabsolute($dir,0);
270    if (!file_exists($absolute)) {
271      $err->raise("hta",8,$dir);
272      return false;
273    }
274    touch("$absolute/.htpasswd.new");
275    $file = fopen("$absolute/.htpasswd","r");
276    $newf = fopen("$absolute/.htpasswd.new","a");
277    if (!$file || !$newf) {
278      $err->raise("hta",12);
279      return false;
280    }
281    reset($lst);
282    fseek($file,0);
283    while (!feof($file)) {
284      $s=fgets($file,1024);
285      $t=explode(":",$s);
286      if (!in_array($t[0],$lst) && ($t[0]!="\n")) {
287        fseek($newf,0);
288        fwrite($newf, "$s");
289      }
290    }
291    fclose($file);
292    fclose($newf);
293    unlink("$absolute/.htpasswd");
294    rename("$absolute/.htpasswd.new", "$absolute/.htpasswd");
295    return true;
296  }
297
298
299  /*---------------------------------------------------------------------------*/
300  /**
301   * Change the password of a user in a protected folder
302   * @param string $user The users whose password should be changed
303   * @param string $newpass The new password of this user
304   * @param string $dir The folder, relative to user root, in which we will change a password
305   * @return boolean TRUE if the password has been changed, or FALSE if an error occurred
306   */
307  function change_pass($user,$newpass,$dir) {
308    global $bro,$err,$admin;
309    $err->log("hta","change_pass",$user."/".$dir);
310    $absolute=$bro->convertabsolute($dir,0);
311    if (!file_exists($absolute)) {
312      $err->raise("hta",8,$dir);
313      return false;
314    }
315
316    // Check this password against the password policy using common API :
317    if (is_callable(array($admin,"checkPolicy"))) {
318      if (!$admin->checkPolicy("hta",$user,$newpass)) {
319        return false; // The error has been raised by checkPolicy()
320      }
321    }
322
323    touch("$absolute/.htpasswd.new");
324    $file = fopen("$absolute/.htpasswd","r");
325    $newf = fopen("$absolute/.htpasswd.new","a");
326    if (!$file || !$newf) {
327      $err->raise("hta",12);
328      return false;
329    }
330    while (!feof($file)) {
331      $s=fgets($file,1024);
332      $t=explode(":",$s);
333      if ($t[0]!=$user) {
334        fwrite($newf, "$s");
335      }
336    }
337    fwrite($newf, "$user:"._md5cr($newpass)."\n");
338    fclose($file);
339    fclose($newf);
340    unlink("$absolute/.htpasswd");
341    rename("$absolute/.htpasswd.new", "$absolute/.htpasswd");
342    return true;
343  }
344
345
346  /*---------------------------------------------------------------------------*/
347  /**
348   * Check that a .htaccess file is valid (for authentication)
349   * @param string $absolute Folder we want to check (relative to user root)
350   * @return boolean TRUE is the .htaccess is protecting this folder, or FALSE else
351   * @access private
352   */
353  function _reading_htaccess($absolute) {
354    global $err;
355    $err->log("hta","_reading_htaccess",$absolute);
356    $file = fopen("$absolute/.htaccess","r+");
357    $lignes=array(1,1,1);
358    $errr=0;
359    if (!$file) {
360      return false;
361    }
362    while (!feof($file) && !$errr) {
363      $s=fgets($file,1024);
364      if (substr($s,0,12)!="RewriteCond " && substr($s,0,14)!="ErrorDocument " && substr($s,0,12)!="RewriteRule " && substr($s,0,14)!="RewriteEngine " && trim($s)!="") {
365        $errr=1;
366      }
367      if (strtolower(trim($s))==strtolower("authuserfile $absolute/.htpasswd")) {
368        $lignes[0]=0;
369        $errr=0;
370      } // authuserfile
371      if (strtolower(trim($s))=="require valid-user") {
372        $lignes[1]=0;
373        $errr=0;
374      } //require
375      if (strtolower(trim($s))=="authtype basic") {
376        $lignes[2]=0;
377        $errr=0;
378      } //authtype
379    } // Reading config file
380    fclose($file);
381    if ($errr ||  in_array(0,$lignes)) {
382      $err->raise("hta",1);
383      return false;
384    }
385    return true;
386  } 
387
388} /* CLASS m_hta */
389
390
391
392?>
Note: See TracBrowser for help on using the repository browser.