From 5e767144c9fad9fe84573f4c46cd74b8edf76391 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 31 Aug 2017 19:09:07 -0700 Subject: simplify api_auth --- include/api_auth.php | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) (limited to 'include/api_auth.php') diff --git a/include/api_auth.php b/include/api_auth.php index e5cd7cab3..7fc8dec3a 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -33,21 +33,15 @@ function api_login(&$a){ // workarounds for HTTP-auth in CGI mode - if(x($_SERVER,'REDIRECT_REMOTE_USER')) { - $userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"],6)) ; - if(strlen($userpass)) { - list($name, $password) = explode(':', $userpass); - $_SERVER['PHP_AUTH_USER'] = $name; - $_SERVER['PHP_AUTH_PW'] = $password; - } - } - - if(x($_SERVER,'HTTP_AUTHORIZATION')) { - $userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"],6)) ; - if(strlen($userpass)) { - list($name, $password) = explode(':', $userpass); - $_SERVER['PHP_AUTH_USER'] = $name; - $_SERVER['PHP_AUTH_PW'] = $password; + foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) { + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') { + $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ; + if(strlen($userpass)) { + list($name, $password) = explode(':', $userpass); + $_SERVER['PHP_AUTH_USER'] = $name; + $_SERVER['PHP_AUTH_PW'] = $password; + } + break; } } -- cgit v1.2.3 From 0cf5536e902aa9e74c7ca8f62bec3992f6f6a276 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 31 Aug 2017 20:08:58 -0700 Subject: server to server magic auth --- include/api_auth.php | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-) (limited to 'include/api_auth.php') diff --git a/include/api_auth.php b/include/api_auth.php index 7fc8dec3a..4b1aae642 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -7,6 +7,7 @@ function api_login(&$a){ $record = null; + $remote_auth = false; require_once('include/oauth.php'); @@ -34,6 +35,9 @@ function api_login(&$a){ // workarounds for HTTP-auth in CGI mode foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) { + + /* Basic authentication */ + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') { $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ; if(strlen($userpass)) { @@ -43,6 +47,52 @@ function api_login(&$a){ } break; } + + /* Signature authentication */ + + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Signature') { + $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); + if($sigblock) { + $keyId = $sigblock['keyId']; + if($keyId) { + $r = q("select * from hubloc where hubloc_addr = '%s' limit 1", + dbesc($keyId) + ); + if($r) { + $c = channelx_by_hash($r[0]['hubloc_hash']); + if($c) { + $a = q("select * from account where account_id = %d limit 1", + intval($c[0]['channel_account_id']) + ); + if($a) { + $record = [ 'channel' => $c[0], 'account' => $a[0] ]; + $channel_login = $c[0]['channel_id']; + } + else { + continue; + } + } + else { + continue; + } + } + else { + continue; + } + + if($head !== 'HTTP_AUTHORIZATION') { + $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; + } + if($record) { + $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); + if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { + $record = null; + } + break; + } + } + } + } } require_once('include/auth.php'); @@ -58,8 +108,6 @@ function api_login(&$a){ } } - - if($record['account']) { authenticate_success($record['account']); -- cgit v1.2.3 From b413beeb365ea09ac79f57e68dbb6ac49b5ea056 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 31 Aug 2017 20:45:13 -0700 Subject: add server-to-server magic auth to dav and cdav controllers --- include/api_auth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/api_auth.php') diff --git a/include/api_auth.php b/include/api_auth.php index 4b1aae642..01a4599aa 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -50,7 +50,7 @@ function api_login(&$a){ /* Signature authentication */ - if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Signature') { + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); if($sigblock) { $keyId = $sigblock['keyId']; -- cgit v1.2.3 From ae8cdc3b42a01bfa6a8a7baf80bad2544c3821a7 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 31 Aug 2017 21:38:03 -0700 Subject: some changes after testing server-to-server magic auth --- include/api_auth.php | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) (limited to 'include/api_auth.php') diff --git a/include/api_auth.php b/include/api_auth.php index 01a4599aa..0818fa54b 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -8,6 +8,7 @@ function api_login(&$a){ $record = null; $remote_auth = false; + $sigblock = null; require_once('include/oauth.php'); @@ -51,6 +52,11 @@ function api_login(&$a){ /* Signature authentication */ if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { + if($head !== 'HTTP_AUTHORIZATION') { + $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; + continue; + } + $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); if($sigblock) { $keyId = $sigblock['keyId']; @@ -62,11 +68,11 @@ function api_login(&$a){ $c = channelx_by_hash($r[0]['hubloc_hash']); if($c) { $a = q("select * from account where account_id = %d limit 1", - intval($c[0]['channel_account_id']) + intval($c['channel_account_id']) ); if($a) { - $record = [ 'channel' => $c[0], 'account' => $a[0] ]; - $channel_login = $c[0]['channel_id']; + $record = [ 'channel' => $c, 'account' => $a[0] ]; + $channel_login = $c['channel_id']; } else { continue; @@ -80,9 +86,6 @@ function api_login(&$a){ continue; } - if($head !== 'HTTP_AUTHORIZATION') { - $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; - } if($record) { $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { @@ -127,8 +130,8 @@ function api_login(&$a){ } -function retry_basic_auth() { - header('WWW-Authenticate: Basic realm="Hubzilla"'); +function retry_basic_auth($method = 'Basic') { + header('WWW-Authenticate: ' . $method . ' realm="Hubzilla"'); header('HTTP/1.0 401 Unauthorized'); echo('This api requires login'); killme(); -- cgit v1.2.3 From 7bff60edacd68ef3dccf6f956e9c57092919950a Mon Sep 17 00:00:00 2001 From: zotlabs Date: Sat, 2 Sep 2017 14:04:37 -0700 Subject: may be exploitable in current form - awaiting review --- include/api_auth.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include/api_auth.php') diff --git a/include/api_auth.php b/include/api_auth.php index 0818fa54b..0acd4ac68 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -85,7 +85,8 @@ function api_login(&$a){ else { continue; } - +// requires security review +$record = null; if($record) { $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { -- cgit v1.2.3 From 499b7de0d217e5e56819f34dea26cb5d395e2a0b Mon Sep 17 00:00:00 2001 From: zotlabs Date: Sun, 3 Sep 2017 00:59:51 -0700 Subject: Reviewed. This is OK. Revert "may be exploitable in current form - awaiting review" This reverts commit 7bff60edacd68ef3dccf6f956e9c57092919950a. --- include/api_auth.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include/api_auth.php') diff --git a/include/api_auth.php b/include/api_auth.php index 0acd4ac68..0818fa54b 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -85,8 +85,7 @@ function api_login(&$a){ else { continue; } -// requires security review -$record = null; + if($record) { $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { -- cgit v1.2.3