view release on metacpan or  search on metacpan

lib/Apache2_4/AuthCookieMultiDBI.pm  view on Meta::CPAN

# get_client_database_info -- Get a clients database details.
# 
sub get_client_database_info {
    my ($self, $r, $client) = @_;

    my %c;

    $c{'dbhost'}  = '';
    $c{'dbname'}  = '';
    $c{'dblogin'} = '';
    $c{'dbpass'}  = '';

    return %c;
}

#-------------------------------------------------------------------------------
# user_is_active -- check user active or not
# 
sub user_is_active {
    my $self = shift;
    my $r = shift;
    my $user = shift;

    my %c                 = $self->_dbi_config_vars($r);
    my $active_field_name = $c{'DBI_UserActiveField'};

    if ( !$active_field_name ) {
        return TRUE;    # Default is that users are active
    }

    my $dbh = $self->_dbi_connect($r) || return;
    my $sql_query = <<"SQL";
      SELECT `$active_field_name`
      FROM `$c{'DBI_UsersTable'}`
      WHERE `$c{'DBI_UserField'}` = ?
SQL

    my $sth = $dbh->prepare_cached($sql_query);
    $sth->execute($user);
    my ($user_active_setting) = $sth->fetchrow_array;
    $sth->finish();

    return $user_active_setting;
}

#-------------------------------------------------------------------------------
# decrypt_session_key -- decrypt session key
# 
sub decrypt_session_key {
    my ( $self, $r, $encryptiontype, $encrypted_session_key, $secret_key )
        = @_;

    if ( $encryptiontype eq 'none' ) {
        return $encrypted_session_key;
    }

    my $auth_name = $r->auth_name;

    my $session_key;

    # Check that this looks like an encrypted hex-encoded string.
    if ( $encrypted_session_key !~ HEX_STRING_REGEX ) {
        my $message = "${self}\tencrypted session key '$encrypted_session_key' doesn't look like it's properly hex-encoded for auth realm $auth_name";
        $r->server->log_error( $message );
        return;
    }

    my $cipher = $self->_get_cipher_for_type( $encryptiontype, $auth_name,
        $secret_key );
    if ( !$cipher ) {
        my $message = "${self}\tunknown encryption type '$encryptiontype' for auth realm $auth_name";
        $r->server->log_error( $message );
        return;
    }
    $session_key = $cipher->decrypt_hex($encrypted_session_key);
    return $session_key;
}


#===============================================================================
# O V E R R I D   F U N C T I O N S
#===============================================================================

#-------------------------------------------------------------------------------
# authen_ses_key -- Overrid authen_ses_key method from Apache2_4::AuthCookie
# 
sub authen_ses_key ($$$) {
    my ( $self, $r, $encrypted_session_key ) = @_;

    my $auth_name = $r->auth_name;

    # Get the configuration information.
    my %c = $self->_dbi_config_vars($r);

    # Get the secret key.
    my $secret_key = $c{'DBI_SecretKey'};
    if ( !defined $secret_key ) {
        my $message = "${self} -> didn't have the secret key from for auth realm $auth_name";
        $r->server->log_error( $message );
        return;
    }

    my $session_key = $self->decrypt_session_key( $r, $c{'DBI_EncryptionType'}, $encrypted_session_key, $secret_key ) || return;

    # Break up the session key.
    my ( $enc_user, $issue_time, $expire_time, $session_id, @rest ) = split COLON_REGEX, $session_key;
    my $hashed_string = pop @rest;

    # Let's check that we got passed sensible values in the cookie.
    ($enc_user) = _defined_or_empty($enc_user);
    if ( $enc_user !~ PERCENT_ENCODED_STRING_REGEX ) {
        my $message = "${self} -> bad percent-encoded user '$enc_user' recovered from session ticket for auth_realm '$auth_name'";
        $r->server->log_error( $message );
        return;
    }

    # decode the user
    my $user = _percent_decode($enc_user);

    ($issue_time) = _defined_or_empty($issue_time);
    if ( $issue_time !~ DATE_TIME_STRING_REGEX ) {