accessMeth_t umGetAccessMethodForURL(char_t *url) { accessMeth_t amRet; char_t *urlHavingLimit, *group; urlHavingLimit = umGetAccessLimit(url); if (urlHavingLimit) { group = umGetAccessLimitGroup(urlHavingLimit); if (group && *group) { amRet = umGetGroupAccessMethod(group); } else { amRet = umGetAccessLimitMethod(urlHavingLimit); } bfree(B_L, urlHavingLimit); } else { amRet = AM_FULL; } return amRet; }
bool_t umUserCanAccessURL(char_t *user, char_t *url) { accessMeth_t amURL; char_t *group, *usergroup, *urlHavingLimit; short priv; a_assert(user && *user); a_assert(url && *url); /* * Make sure user exists */ if (!umUserExists(user)) { return FALSE; } /* * Make sure user is enabled */ if (!umGetUserEnabled(user)) { return FALSE; } /* * Make sure user has sufficient privileges (any will do) */ usergroup = umGetUserGroup(user); priv = umGetGroupPrivilege(usergroup); if (priv == 0) { return FALSE; } /* * Make sure user's group is enabled */ if (!umGetGroupEnabled(usergroup)) { return FALSE; } /* * The access method of the user group must not be AM_NONE */ if (umGetGroupAccessMethod(usergroup) == AM_NONE) { return FALSE; } /* * Check to see if there is an Access Limit for this URL */ urlHavingLimit = umGetAccessLimit(url); if (urlHavingLimit) { amURL = umGetAccessLimitMethod(urlHavingLimit); group = umGetAccessLimitGroup(urlHavingLimit); bfree(B_L, urlHavingLimit); } else { /* * If there isn't an access limit for the URL, user has full access */ return TRUE; } /* * If the access method for the URL is AM_NONE then * the file "doesn't exist". */ if (amURL == AM_NONE) { return FALSE; } /* * If Access Limit has a group specified, then the user must be a * member of that group */ if (group && *group) { if (usergroup && (gstrcmp(group, usergroup) != 0)) { return FALSE; } } /* * Otherwise, user can access the URL */ return TRUE; }
bool_t umUserCanAccessURL(char_t *user, char_t *url) { accessMeth_t amURL; char_t *group, *usergroup, *urlHavingLimit; short priv; a_assert(user && *user); a_assert(url && *url); /* * Make sure user exists */ if (!umUserExists(user)) { return FALSE; } /* * Make sure user is enabled */ if (!umGetUserEnabled(user)) { return FALSE; } /* * Make sure user has sufficient privileges (any will do) */ usergroup = umGetUserGroup(user); priv = umGetGroupPrivilege(usergroup); if (priv == 0) { return FALSE; } /* * Make sure user's group is enabled */ if (!umGetGroupEnabled(usergroup)) { return FALSE; } /* * The access method of the user group must not be AM_NONE */ if (umGetGroupAccessMethod(usergroup) == AM_NONE) { return FALSE; } /* * Check to see if there is an Access Limit for this URL */ urlHavingLimit = umGetAccessLimit(url); if (urlHavingLimit) { amURL = umGetAccessLimitMethod(urlHavingLimit); group = umGetAccessLimitGroup(urlHavingLimit); bfree(B_L, urlHavingLimit); } else { /* * If there isn't an access limit for the URL, user has full access */ return TRUE; } /* * If the access method for the URL is AM_NONE then * the file "doesn't exist". */ if (amURL == AM_NONE) { return FALSE; } /* * If Access Limit has a group specified, then the user must be a * member of that group */ if (group && *group) { #ifdef qHierarchicalAccess /* * If we are compiling with the hierarchical access extensions, we * instead call the user-provided function that checks to see whether * the current user's access level is greater than or equal to the * access level required for this URL. */ return dmfCanAccess(usergroup, group); #else if (usergroup && (gstrcmp(group, usergroup) != 0)) { return FALSE; } #endif } /* * Otherwise, user can access the URL */ return TRUE; }
int websSecurityHandler(webs_t wp, char_t *urlPrefix, char_t *webDir, int arg, char_t *url, char_t *path, char_t *query) { char_t *type, *userid, *password, *accessLimit; int flags, nRet; accessMeth_t am; a_assert(websValid(wp)); a_assert(url && *url); a_assert(path && *path); /* * Get the critical request details */ type = websGetRequestType(wp); password = websGetRequestPassword(wp); userid = websGetRequestUserName(wp); flags = websGetRequestFlags(wp); /* * Get the access limit for the URL. Exit if none found. */ accessLimit = umGetAccessLimit(path); if (accessLimit == NULL) { return 0; } /* * Check to see if URL must be encrypted */ #ifdef WEBS_SSL_SUPPORT nRet = umGetAccessLimitSecure(accessLimit); if (nRet && ((flags & WEBS_SECURE) == 0)) { websStats.access++; websError(wp, 405, T("Access Denied\nSecure access is required.")); trace(3, T("SEC: Non-secure access attempted on <%s>\n"), path); /* bugfix 5/24/02 -- we were leaking the memory pointed to by * 'accessLimit'. Thanks to Simon Byholm. */ bfree(B_L, accessLimit); return 1; } #endif /* * Get the access limit for the URL */ am = umGetAccessMethodForURL(accessLimit); nRet = 0; if ((flags & WEBS_LOCAL_REQUEST) && (debugSecurity == 0)) { /* * Local access is always allowed (defeat when debugging) */ } else if (am == AM_NONE) { /* * URL is supposed to be hidden! Make like it wasn't found. */ websStats.access++; websError(wp, 404, T("Page Not Found")); nRet = 1; } else if (userid && *userid) { if (!umUserExists(userid)) { websStats.access++; websError(wp, 401, T("Access Denied\nUnknown User")); trace(3, T("SEC: Unknown user <%s> attempted to access <%s>\n"), userid, path); nRet = 1; } else if (!umUserCanAccessURL(userid, accessLimit)) { websStats.access++; websError(wp, 403, T("Access Denied\nProhibited User")); nRet = 1; } else if (password && * password) { char_t * userpass = umGetUserPassword(userid); if (userpass) { if (gstrcmp(password, userpass) != 0) { websStats.access++; websError(wp, 401, T("Access Denied\nWrong Password")); trace(3, T("SEC: Password fail for user <%s>") T("attempt to access <%s>\n"), userid, path); nRet = 1; } else { /* * User and password check out. */ } bfree (B_L, userpass); } #ifdef DIGEST_ACCESS_SUPPORT } else if (flags & WEBS_AUTH_DIGEST) { char_t *digestCalc; /* * Check digest for equivalence */ wp->password = umGetUserPassword(userid); a_assert(wp->digest); a_assert(wp->nonce); a_assert(wp->password); digestCalc = websCalcDigest(wp); a_assert(digestCalc); if (gstrcmp(wp->digest, digestCalc) != 0) { bfree (B_L, digestCalc); digestCalc = websCalcUrlDigest(wp); a_assert(digestCalc); if (gstrcmp(wp->digest, digestCalc) != 0) { websStats.access++; websError(wp, 401, T("Access Denied\nWrong Password")); nRet = 1; } } bfree (B_L, digestCalc); #endif } else { /* * No password has been specified */ #ifdef DIGEST_ACCESS_SUPPORT if (am == AM_DIGEST) { wp->flags |= WEBS_AUTH_DIGEST; } #endif websStats.errors++; websError(wp, 401, T("Access to this document requires a password")); nRet = 1; } } else if (am != AM_FULL) { /* * This will cause the browser to display a password / username * dialog */ #ifdef DIGEST_ACCESS_SUPPORT if (am == AM_DIGEST) { wp->flags |= WEBS_AUTH_DIGEST; } #endif websStats.errors++; websError(wp, 401, T("Access to this document requires a User ID")); nRet = 1; } bfree(B_L, accessLimit); return nRet; }