composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-05-26 02:32:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°9448 - Fix external auth variable value

Browse Source
This commit is contained in:
Stephen Abello
2026-04-07 11:53:43 +02:00
parent e467ca83cf
commit 050e269921
3 changed files with 171 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
application/loginexternal.class.inc.php
View File

@@ -75,13 +75,10 @@ class LoginExternal extends AbstractLoginFSMExtension
}
/**
* @return bool
* @return bool|mixed
*/
private function GetAuthUser()
{
$sExtAuthVar = MetaModel::GetConfig()->GetExternalAuthenticationVariable(); // In which variable is the info passed ?
eval('$sAuthUser = isset('.$sExtAuthVar.') ? '.$sExtAuthVar.' : false;'); // Retrieve the value
/** @var string $sAuthUser */
return $sAuthUser; // Retrieve the value
return MetaModel::GetConfig()->GetExternalAuthenticationVariable();
}
}

75
core/config.class.inc.php
View File

@@ -75,6 +75,7 @@ define('DEFAULT_EXT_AUTH_VARIABLE', '$_SERVER[\'REMOTE_USER\']');
define('DEFAULT_ENCRYPTION_KEY', '@iT0pEncr1pti0n!'); // We'll use a random generated key later (if possible)
define('DEFAULT_ENCRYPTION_LIB', 'Mcrypt'); // We'll define the best encryption available later
define('DEFAULT_HASH_ALGO', PASSWORD_DEFAULT);
/**
* Config
* configuration data (this class cannot not be localized, because it is responsible for loading the dictionaries)
@@ -869,6 +870,14 @@ class Config
'source_of_value' => '',
'show_in_conf_sample' => false,
],
'ext_auth_variable' => [
'type' => 'string',
'description' => 'External authentication expression (allowed: $_SERVER[\'key\'], $_COOKIE[\'key\'], $_REQUEST[\'key\'], getallheaders()[\'Header-Name\'])',
'default' => '',
'value' => '',
'source_of_value' => '',
'show_in_conf_sample' => false,
],
'login_debug' => [
'type' => 'bool',
'description' => 'Activate the login FSM debug',
@@ -2350,9 +2359,73 @@ class Config
return explode('|', $this->m_sAllowedLoginTypes);
}
/**
* @return bool|mixed
* @since 3.2.3 return the parsed value instead of an unsecured variable name
*/
public function GetExternalAuthenticationVariable()
{
return $this->m_sExtAuthVariable;
$sExpression = $this->Get('ext_auth_variable');
$aParsed = $this->ParseExternalAuthVariableExpression($sExpression);
if ($aParsed === null) {
return false;
}
$sKey = $aParsed['key'];
switch ($aParsed['type']) {
case 'server':
return $_SERVER[$sKey] ?? false;
case 'cookie':
return $_COOKIE[$sKey] ?? false;
case 'request':
return $_REQUEST[$sKey] ?? false;
case 'header':
if (!function_exists('getallheaders')) {
return false;
}
$aHeaders = getallheaders();
if (!is_array($aHeaders)) {
return false;
}
return $aHeaders[$sKey] ?? false;
}
return false;
}
/**
* @param $sExpression
* @return array|null
*/
private function ParseExternalAuthVariableExpression($sExpression)
{
// If it's a configuration parameter it's probably already trimmed, but just in case
$sExpression = trim((string) $sExpression);
if ($sExpression === '') {
return null;
}
// Match $_SERVER/$_COOKIE/$_REQUEST['key'] with optional whitespace and single/double quotes.
if (preg_match('/^\$_(SERVER|COOKIE|REQUEST)\s*\[\s*(["\'])\s*([^"\']+)\2\s*\]\s*$/', $sExpression, $aMatches) === 1) {
$sContext = strtoupper($aMatches[1]);
$sKey = $aMatches[3];
return [
'type' => strtolower($sContext),
'key' => $sKey,
'normalized' => '$_'.$sContext.'[\''.$sKey.'\']',
];
}
// Match getallheaders()['Header-Name'] in a case-insensitive way.
if (preg_match('/^getallheaders\(\)\s*\[\s*(["\'])\s*([^"\']+)\1\s*\]\s*$/i', $sExpression, $aMatches) === 1) {
$sKey = $aMatches[2];
return [
'type' => 'header',
'key' => $sKey,
'normalized' => 'getallheaders()[\''.$sKey.'\']',
];
}
return null;
}
public function GetCSVImportCharsets()

95
tests/php-unit-tests/unitary-tests/application/LoginExternalTest.php Normal file
View File

@@ -0,0 +1,95 @@
<?php
/**
* Copyright (C) 2010-2024 Combodo SAS
*
* This file is part of iTop.
*
* iTop is free software; you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* iTop is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with iTop. If not, see <http://www.gnu.org/licenses/>
*/
namespace Combodo\iTop\Test\UnitTest\Application;
use Combodo\iTop\Test\UnitTest\ItopDataTestCase;
use utils;
class LoginExternalTest extends ItopDataTestCase
{
private $oConfig;
private $sOriginalExtAuthVariable;
protected function setUp(): void
{
parent::setUp();
require_once APPROOT.'application/loginexternal.class.inc.php';
$this->oConfig = utils::GetConfig();
$this->sOriginalExtAuthVariable = $this->oConfig->Get('ext_auth_variable');
}
protected function tearDown(): void
{
$this->oConfig->Set('ext_auth_variable', $this->sOriginalExtAuthVariable, 'unit_test');
parent::tearDown();
}
private function CallGetAuthUser()
{
$oLoginExternal = new \LoginExternal();
$oMethod = new \ReflectionMethod(\LoginExternal::class, 'GetAuthUser');
$oMethod->setAccessible(true);
return $oMethod->invoke($oLoginExternal);
}
public function testGetAuthUserFromServerVariable()
{
$_SERVER['REMOTE_USER'] = 'alice';
$this->oConfig->Set('ext_auth_variable', '$_SERVER[\'REMOTE_USER\']', 'unit_test');
$this->assertSame('alice', $this->CallGetAuthUser());
}
public function testGetAuthUserFromCookie()
{
$_COOKIE['auth_user'] = 'bob';
$this->oConfig->Set('ext_auth_variable', '$_COOKIE[\'auth_user\']', 'unit_test');
$this->assertSame('bob', $this->CallGetAuthUser());
}
public function testGetAuthUserFromRequest()
{
$_REQUEST['auth_user'] = 'carol';
$this->oConfig->Set('ext_auth_variable', '$_REQUEST[\'auth_user\']', 'unit_test');
$this->assertSame('carol', $this->CallGetAuthUser());
}
public function testInvalidExpressionReturnsFalse()
{
$this->oConfig->Set('ext_auth_variable', '$_SERVER[\'HTTP_X_CMD\']) ? print(\'x\') : false; //', 'unit_test');
$this->assertFalse($this->CallGetAuthUser());
}
public function testGetAuthUserFromHeaderWithoutAllowlist()
{
if (!function_exists('getallheaders')) {
$this->markTestSkipped('getallheaders() not available');
}
$_SERVER['HTTP_X_REMOTE_USER'] = 'CN=header-test';
$this->oConfig->Set('ext_auth_variable', 'getallheaders()[\'X-Remote-User\']', 'unit_test');
$this->assertSame('CN=header-test', $this->CallGetAuthUser());
}
}