add server-to-server magic auth to dav and cdav controllers

1 files changed, 62 insertions, 14 deletions

diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php
index d0619ef0b..bae3fc6aa 100644
--- a/Zotlabs/Module/Cdav.php
+++ b/Zotlabs/Module/Cdav.php
@@ -3,31 +3,79 @@ namespace Zotlabs\Module;
 
 require_once('include/event.php');
 
+require_once('include/auth.php');
+require_once('include/security.php');
+
 class Cdav extends \Zotlabs\Web\Controller {
 
 	function init() {
 
+		$record = null;
+		$channel_login = false;
+
 		if((argv(1) !== 'calendar') && (argv(1) !== 'addressbook')) {
 
-			// workaround for HTTP-auth in CGI mode
-			if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
-				$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
-				if(strlen($userpass)) {
-					list($name, $password) = explode(':', $userpass);
-					$_SERVER['PHP_AUTH_USER'] = $name;
-					$_SERVER['PHP_AUTH_PW'] = $password;
+			foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
+
+				/* Basic authentication */
+
+				if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
+					$userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
+					if(strlen($userpass)) {
+						list($name, $password) = explode(':', $userpass);
+						$_SERVER['PHP_AUTH_USER'] = $name;
+						$_SERVER['PHP_AUTH_PW']   = $password;
+					}
+					break;
 				}
-			}
 
-			if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
-				$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
-				if(strlen($userpass)) {
-					list($name, $password) = explode(':', $userpass);
-					$_SERVER['PHP_AUTH_USER'] = $name;
-					$_SERVER['PHP_AUTH_PW'] = $password;
+				/* Signature authentication */
+
+				if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
+					$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
+					if($sigblock) {
+						$keyId = $sigblock['keyId'];
+						if($keyId) {
+							$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
+								dbesc($keyId)
+							);
+							if($r) {
+								$c = channelx_by_hash($r[0]['hubloc_hash']);
+								if($c) {
+									$a = q("select * from account where account_id = %d limit 1",
+										intval($c[0]['channel_account_id'])
+									);
+									if($a) {
+										$record = [ 'channel' => $c[0], 'account' => $a[0] ];
+										$channel_login = $c[0]['channel_id'];
+									}
+								}
+							}
+							if(! $record)
+								continue;
+
+							if($head !== 'HTTP_AUTHORIZATION') {
+								$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
+							}
+							if($record) {
+								$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
+								if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
+									$record = null;
+								}
+								if($record['account']) {
+							        authenticate_success($record['account']);
+							        if($channel_login) {
+							            change_channel($channel_login);
+									}
+								}
+								break;
+							}
+						}
+					}
 				}
 			}
 
+
 			/**
 			 * This server combines both CardDAV and CalDAV functionality into a single
 			 * server. It is assumed that the server runs at the root of a HTTP domain (be