PageRenderTime 181ms CodeModel.GetById 60ms app.highlight 8ms RepoModel.GetById 72ms app.codeStats 8ms

/lib/Sabre/HTTP/DigestAuth.php

https://github.com/KOLANICH/SabreDAV
PHP | 240 lines | 81 code | 50 blank | 109 comment | 9 complexity | a3a4f29371225248d329723c8625b4bc MD5 | raw file
  1<?php
  2
  3namespace Sabre\HTTP;
  4
  5/**
  6 * HTTP Digest Authentication handler
  7 *
  8 * Use this class for easy http digest authentication.
  9 * Instructions:
 10 *
 11 *  1. Create the object
 12 *  2. Call the setRealm() method with the realm you plan to use
 13 *  3. Call the init method function.
 14 *  4. Call the getUserName() function. This function may return false if no
 15 *     authentication information was supplied. Based on the username you
 16 *     should check your internal database for either the associated password,
 17 *     or the so-called A1 hash of the digest.
 18 *  5. Call either validatePassword() or validateA1(). This will return true
 19 *     or false.
 20 *  6. To make sure an authentication prompt is displayed, call the
 21 *     requireLogin() method.
 22 *
 23 *
 24 * @copyright Copyright (C) 2007-2013 fruux GmbH (https://fruux.com/).
 25 * @author Evert Pot (http://evertpot.com/)
 26 * @license http://code.google.com/p/sabredav/wiki/License Modified BSD License
 27 */
 28class DigestAuth extends AbstractAuth {
 29
 30    /**
 31     * These constants are used in setQOP();
 32     */
 33    const QOP_AUTH = 1;
 34    const QOP_AUTHINT = 2;
 35
 36    protected $nonce;
 37    protected $opaque;
 38    protected $digestParts;
 39    protected $A1;
 40    protected $qop = self::QOP_AUTH;
 41
 42    /**
 43     * Initializes the object
 44     */
 45    public function __construct() {
 46
 47        $this->nonce = uniqid();
 48        $this->opaque = md5($this->realm);
 49        parent::__construct();
 50
 51    }
 52
 53    /**
 54     * Gathers all information from the headers
 55     *
 56     * This method needs to be called prior to anything else.
 57     *
 58     * @return void
 59     */
 60    public function init() {
 61
 62        $digest = $this->getDigest();
 63        $this->digestParts = $this->parseDigest($digest);
 64
 65    }
 66
 67    /**
 68     * Sets the quality of protection value.
 69     *
 70     * Possible values are:
 71     *   Sabre\HTTP\DigestAuth::QOP_AUTH
 72     *   Sabre\HTTP\DigestAuth::QOP_AUTHINT
 73     *
 74     * Multiple values can be specified using logical OR.
 75     *
 76     * QOP_AUTHINT ensures integrity of the request body, but this is not
 77     * supported by most HTTP clients. QOP_AUTHINT also requires the entire
 78     * request body to be md5'ed, which can put strains on CPU and memory.
 79     *
 80     * @param int $qop
 81     * @return void
 82     */
 83    public function setQOP($qop) {
 84
 85        $this->qop = $qop;
 86
 87    }
 88
 89    /**
 90     * Validates the user.
 91     *
 92     * The A1 parameter should be md5($username . ':' . $realm . ':' . $password);
 93     *
 94     * @param string $A1
 95     * @return bool
 96     */
 97    public function validateA1($A1) {
 98
 99        $this->A1 = $A1;
100        return $this->validate();
101
102    }
103
104    /**
105     * Validates authentication through a password. The actual password must be provided here.
106     * It is strongly recommended not store the password in plain-text and use validateA1 instead.
107     *
108     * @param string $password
109     * @return bool
110     */
111    public function validatePassword($password) {
112
113        $this->A1 = md5($this->digestParts['username'] . ':' . $this->realm . ':' . $password);
114        return $this->validate();
115
116    }
117
118    /**
119     * Returns the username for the request
120     *
121     * @return string
122     */
123    public function getUsername() {
124
125        return $this->digestParts['username'];
126
127    }
128
129    /**
130     * Validates the digest challenge
131     *
132     * @return bool
133     */
134    protected function validate() {
135
136        $A2 = $this->httpRequest->getMethod() . ':' . $this->digestParts['uri'];
137
138        if ($this->digestParts['qop']=='auth-int') {
139            // Making sure we support this qop value
140            if (!($this->qop & self::QOP_AUTHINT)) return false;
141            // We need to add an md5 of the entire request body to the A2 part of the hash
142            $body = $this->httpRequest->getBody(true);
143            $this->httpRequest->setBody($body,true);
144            $A2 .= ':' . md5($body);
145        } else {
146
147            // We need to make sure we support this qop value
148            if (!($this->qop & self::QOP_AUTH)) return false;
149        }
150
151        $A2 = md5($A2);
152
153        $validResponse = md5("{$this->A1}:{$this->digestParts['nonce']}:{$this->digestParts['nc']}:{$this->digestParts['cnonce']}:{$this->digestParts['qop']}:{$A2}");
154
155        return $this->digestParts['response']==$validResponse;
156
157
158    }
159
160    /**
161     * Returns an HTTP 401 header, forcing login
162     *
163     * This should be called when username and password are incorrect, or not supplied at all
164     *
165     * @return void
166     */
167    public function requireLogin() {
168
169        $qop = '';
170        switch($this->qop) {
171            case self::QOP_AUTH    : $qop = 'auth'; break;
172            case self::QOP_AUTHINT : $qop = 'auth-int'; break;
173            case self::QOP_AUTH | self::QOP_AUTHINT : $qop = 'auth,auth-int'; break;
174        }
175
176        $this->httpResponse->setHeader('WWW-Authenticate','Digest realm="' . $this->realm . '",qop="'.$qop.'",nonce="' . $this->nonce . '",opaque="' . $this->opaque . '"');
177        $this->httpResponse->sendStatus(401);
178
179    }
180
181
182    /**
183     * This method returns the full digest string.
184     *
185     * It should be compatibile with mod_php format and other webservers.
186     *
187     * If the header could not be found, null will be returned
188     *
189     * @return mixed
190     */
191    public function getDigest() {
192
193        // mod_php
194        $digest = $this->httpRequest->getRawServerValue('PHP_AUTH_DIGEST');
195        if ($digest) return $digest;
196
197        // most other servers
198        $digest = $this->httpRequest->getHeader('Authorization');
199
200        // Apache could prefix environment variables with REDIRECT_ when urls
201        // are passed through mod_rewrite
202        if (!$digest) {
203            $digest = $this->httpRequest->getRawServerValue('REDIRECT_HTTP_AUTHORIZATION');
204        }
205
206        if ($digest && strpos(strtolower($digest),'digest')===0) {
207            return substr($digest,7);
208        } else {
209            return null;
210        }
211
212    }
213
214
215    /**
216     * Parses the different pieces of the digest string into an array.
217     *
218     * This method returns false if an incomplete digest was supplied
219     *
220     * @param string $digest
221     * @return mixed
222     */
223    protected function parseDigest($digest) {
224
225        // protect against missing data
226        $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
227        $data = array();
228
229        preg_match_all('@(\w+)=(?:(?:")([^"]+)"|([^\s,$]+))@', $digest, $matches, PREG_SET_ORDER);
230
231        foreach ($matches as $m) {
232            $data[$m[1]] = $m[2] ? $m[2] : $m[3];
233            unset($needed_parts[$m[1]]);
234        }
235
236        return $needed_parts ? false : $data;
237
238    }
239
240}