From 0e3b5536e2a576c3959bf6644103c7a676684024 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Thu, 10 Aug 2017 21:58:44 +0200 Subject: create cdav principal also on client access and remove redundant pconfig check in authentication process --- Zotlabs/Module/Cdav.php | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'Zotlabs/Module/Cdav.php') diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php index bc563ab43..d0619ef0b 100644 --- a/Zotlabs/Module/Cdav.php +++ b/Zotlabs/Module/Cdav.php @@ -85,6 +85,15 @@ class Cdav extends \Zotlabs\Web\Controller { if($channel['channel_timezone']) $auth->setTimezone($channel['channel_timezone']); $auth->observer = $channel['channel_hash']; + + $principalUri = 'principals/' . $channel['channel_address']; + if(!cdav_principal($principalUri)) { + $this->activate($pdo, $channel); + if(!cdav_principal($principalUri)) { + return; + } + } + } -- cgit v1.2.3 From b413beeb365ea09ac79f57e68dbb6ac49b5ea056 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 31 Aug 2017 20:45:13 -0700 Subject: add server-to-server magic auth to dav and cdav controllers --- Zotlabs/Module/Cdav.php | 76 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 62 insertions(+), 14 deletions(-) (limited to 'Zotlabs/Module/Cdav.php') diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php index d0619ef0b..bae3fc6aa 100644 --- a/Zotlabs/Module/Cdav.php +++ b/Zotlabs/Module/Cdav.php @@ -3,31 +3,79 @@ namespace Zotlabs\Module; require_once('include/event.php'); +require_once('include/auth.php'); +require_once('include/security.php'); + class Cdav extends \Zotlabs\Web\Controller { function init() { + $record = null; + $channel_login = false; + if((argv(1) !== 'calendar') && (argv(1) !== 'addressbook')) { - // workaround for HTTP-auth in CGI mode - if (x($_SERVER, 'REDIRECT_REMOTE_USER')) { - $userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ; - if(strlen($userpass)) { - list($name, $password) = explode(':', $userpass); - $_SERVER['PHP_AUTH_USER'] = $name; - $_SERVER['PHP_AUTH_PW'] = $password; + foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) { + + /* Basic authentication */ + + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') { + $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ; + if(strlen($userpass)) { + list($name, $password) = explode(':', $userpass); + $_SERVER['PHP_AUTH_USER'] = $name; + $_SERVER['PHP_AUTH_PW'] = $password; + } + break; } - } - if (x($_SERVER, 'HTTP_AUTHORIZATION')) { - $userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ; - if(strlen($userpass)) { - list($name, $password) = explode(':', $userpass); - $_SERVER['PHP_AUTH_USER'] = $name; - $_SERVER['PHP_AUTH_PW'] = $password; + /* Signature authentication */ + + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { + $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); + if($sigblock) { + $keyId = $sigblock['keyId']; + if($keyId) { + $r = q("select * from hubloc where hubloc_addr = '%s' limit 1", + dbesc($keyId) + ); + if($r) { + $c = channelx_by_hash($r[0]['hubloc_hash']); + if($c) { + $a = q("select * from account where account_id = %d limit 1", + intval($c[0]['channel_account_id']) + ); + if($a) { + $record = [ 'channel' => $c[0], 'account' => $a[0] ]; + $channel_login = $c[0]['channel_id']; + } + } + } + if(! $record) + continue; + + if($head !== 'HTTP_AUTHORIZATION') { + $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; + } + if($record) { + $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); + if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { + $record = null; + } + if($record['account']) { + authenticate_success($record['account']); + if($channel_login) { + change_channel($channel_login); + } + } + break; + } + } + } } } + /** * This server combines both CardDAV and CalDAV functionality into a single * server. It is assumed that the server runs at the root of a HTTP domain (be -- cgit v1.2.3 From ae8cdc3b42a01bfa6a8a7baf80bad2544c3821a7 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 31 Aug 2017 21:38:03 -0700 Subject: some changes after testing server-to-server magic auth --- Zotlabs/Module/Cdav.php | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'Zotlabs/Module/Cdav.php') diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php index bae3fc6aa..abaec26a6 100644 --- a/Zotlabs/Module/Cdav.php +++ b/Zotlabs/Module/Cdav.php @@ -32,6 +32,11 @@ class Cdav extends \Zotlabs\Web\Controller { /* Signature authentication */ if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { + if($head !== 'HTTP_AUTHORIZATION') { + $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; + continue; + } + $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); if($sigblock) { $keyId = $sigblock['keyId']; @@ -43,20 +48,17 @@ class Cdav extends \Zotlabs\Web\Controller { $c = channelx_by_hash($r[0]['hubloc_hash']); if($c) { $a = q("select * from account where account_id = %d limit 1", - intval($c[0]['channel_account_id']) + intval($c['channel_account_id']) ); if($a) { - $record = [ 'channel' => $c[0], 'account' => $a[0] ]; - $channel_login = $c[0]['channel_id']; + $record = [ 'channel' => $c, 'account' => $a[0] ]; + $channel_login = $c['channel_id']; } } } if(! $record) continue; - if($head !== 'HTTP_AUTHORIZATION') { - $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; - } if($record) { $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { -- cgit v1.2.3 From 7bff60edacd68ef3dccf6f956e9c57092919950a Mon Sep 17 00:00:00 2001 From: zotlabs Date: Sat, 2 Sep 2017 14:04:37 -0700 Subject: may be exploitable in current form - awaiting review --- Zotlabs/Module/Cdav.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'Zotlabs/Module/Cdav.php') diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php index abaec26a6..ec177ae2a 100644 --- a/Zotlabs/Module/Cdav.php +++ b/Zotlabs/Module/Cdav.php @@ -64,6 +64,8 @@ class Cdav extends \Zotlabs\Web\Controller { if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { $record = null; } +// requires security review +$record = null; if($record['account']) { authenticate_success($record['account']); if($channel_login) { -- cgit v1.2.3 From 499b7de0d217e5e56819f34dea26cb5d395e2a0b Mon Sep 17 00:00:00 2001 From: zotlabs Date: Sun, 3 Sep 2017 00:59:51 -0700 Subject: Reviewed. This is OK. Revert "may be exploitable in current form - awaiting review" This reverts commit 7bff60edacd68ef3dccf6f956e9c57092919950a. --- Zotlabs/Module/Cdav.php | 2 -- 1 file changed, 2 deletions(-) (limited to 'Zotlabs/Module/Cdav.php') diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php index ec177ae2a..abaec26a6 100644 --- a/Zotlabs/Module/Cdav.php +++ b/Zotlabs/Module/Cdav.php @@ -64,8 +64,6 @@ class Cdav extends \Zotlabs\Web\Controller { if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { $record = null; } -// requires security review -$record = null; if($record['account']) { authenticate_success($record['account']); if($channel_login) { -- cgit v1.2.3 From cc1ffff7cdfe5881636b6d2de3fe16f0094b5d69 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Mon, 9 Oct 2017 21:22:57 +0200 Subject: feed untranslated appnames to nav_set_selected() and query for the active app directly to get app details --- Zotlabs/Module/Cdav.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'Zotlabs/Module/Cdav.php') diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php index abaec26a6..77052f97c 100644 --- a/Zotlabs/Module/Cdav.php +++ b/Zotlabs/Module/Cdav.php @@ -824,7 +824,7 @@ class Cdav extends \Zotlabs\Web\Controller { } if(argv(1) === 'calendar') { - nav_set_selected(t('CalDAV')); + nav_set_selected('CalDAV'); $caldavBackend = new \Sabre\CalDAV\Backend\PDO($pdo); $calendars = $caldavBackend->getCalendarsForUser($principalUri); } @@ -1025,7 +1025,7 @@ class Cdav extends \Zotlabs\Web\Controller { if(argv(1) === 'addressbook') { - nav_set_selected(t('CardDAV')); + nav_set_selected('CardDAV'); $carddavBackend = new \Sabre\CardDAV\Backend\PDO($pdo); $addressbooks = $carddavBackend->getAddressBooksForUser($principalUri); } -- cgit v1.2.3