--- /dev/null
+<?php # vim:ts=2:sw=2:et:
+/* For licensing and copyright terms, see the file named LICENSE */
+include '../../inc/common.php';
+
+MTrackACL::requireAnyRights('User', 'modify');
+$plugins = MTrackConfig::getSection('plugins');
+
+function get_openid_admins()
+{
+ $admins = array();
+ $regadmins = array();
+ foreach (MTrackConfig::getSection('user_classes') as $id => $role) {
+ if ($role == 'admin') {
+ if (preg_match('@^https?://@', $id)) {
+ $admins[] = $id;
+ } else {
+ $regadmins[$id] = $id;
+ }
+ }
+ }
+ if (count($regadmins)) {
+ /* look at aliases to see if there are any that look like OpenIDs */
+ foreach (MTrackDB::q('select alias, userid from useraliases')->fetchAll()
+ as $row) {
+ if (!preg_match('@^https?://@', $row[0])) {
+ continue;
+ }
+ if (isset($regadmins[$row[1]])) {
+ $admins[] = $row[0];
+ }
+ }
+ }
+ return $admins;
+}
+
+function get_admins()
+{
+ $admins = array();
+ foreach (MTrackConfig::getSection('user_classes') as $id => $role) {
+ if ($role == 'admin' && !preg_match('@^https?://@', $id)) {
+ $admins[] = $id;
+ }
+ }
+ return $admins;
+}
+
+$message = null;
+
+if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+ if (isset($_POST['setuppublic'])) {
+ $admins = get_openid_admins();
+ $add_admin = isset($_POST['adminopenid']) ?
+ trim($_POST['adminopenid']) : '';
+ $localid = isset($_POST['adminuserid']) ?
+ trim($_POST['adminuserid']) : '';
+ if (count($admins) == 0 && (!strlen($add_admin) || !strlen($localid))) {
+ $message = "You MUST add an OpenID for the administrator";
+ } else {
+ if (strlen($localid)) {
+ MTrackConfig::set('user_classes', $localid, 'admin');
+ }
+ $new = true;
+ foreach (MTrackDB::q('select userid from userinfo where userid = ?',
+ $localid)->fetchAll() as $row) {
+ $new = false;
+ break;
+ }
+ if ($new) {
+ MTrackDB::q('insert into userinfo (userid, active) values (?, 1)', $localid);
+ }
+ $new = true;
+ foreach (MTrackDB::q('select userid from useraliases where alias = ?', $add_admin)->fetchAll() as $row) {
+ if ($row[0] != $localid) {
+ throw new Exception("$add_admin is already associated with $row[0]");
+ }
+ $new = false;
+ }
+ if ($new) {
+ MTrackDB::q('insert into useraliases (userid, alias) values (?,?)',
+ $localid, $add_admin);
+ }
+
+ MTrackConfig::set('plugins', 'MTrackAuth_OpenID', '');
+ if (isset($plugins['MTrackAuth_HTTP'])) {
+ MTrackConfig::remove('plugins', 'MTrackAuth_HTTP');
+ // Reset anonymous for public access
+ MTrackConfig::remove('user_class_roles', 'anonymous');
+ }
+
+ MTrackConfig::save();
+ header("Location: {$ABSWEB}admin/auth.php");
+ exit;
+ }
+ } elseif (isset($_POST['setupprivate'])) {
+ $admins = get_admins();
+ $add_admin = isset($_POST['adminuser']) ?
+ trim($_POST['adminuser']) : '';
+ if (count($admins) == 0 && !strlen($add_admin)) {
+ $message = "You MUST add a user with admin rights";
+ } else {
+ $vardir = MTrackConfig::get('core', 'vardir');
+ $pfile = "$vardir/http.user";
+
+ if (strlen($add_admin)) {
+ if (!isset($_SERVER['REMOTE_USER'])) {
+ // validate the password
+ if ($_POST['adminpass1'] != $_POST['adminpass2']) {
+ $message = "Passwords don't match";
+ } else {
+ $http_auth = new MTrackAuth_HTTP(null, "digest:$pfile");
+ $http_auth->setUserPassword($add_admin, $_POST['adminpass1']);
+ }
+ }
+ MTrackConfig::set('user_classes', $add_admin, 'admin');
+ }
+ if ($message == null) {
+ if (!isset($plugins['MTrackAuth_HTTP'])) {
+ MTrackConfig::set('plugins', 'MTrackAuth_HTTP',
+ "$vardir/http.group, digest:$pfile");
+ }
+ if (isset($plugins['MTrackAuth_OpenID'])) {
+ MTrackConfig::remove('plugins', 'MTrackAuth_OpenID');
+ // Set up the roles for private access
+ // Use default authenticated permissions
+ MTrackConfig::remove('user_class_roles', 'authenticated');
+ // Make anonymous have no rights
+ MTrackConfig::set('user_class_roles', 'anonymous', '');
+ }
+ MTrackConfig::save();
+ header("Location: {$ABSWEB}admin/auth.php");
+ exit;
+ }
+ }
+ }
+}
+
+mtrack_head("Administration - Authentication");
+
+$plugins = MTrackConfig::getSection('plugins');
+$http_configd = isset($plugins['MTrackAuth_HTTP']) ? " (Active)" : '';
+$openid_configd = isset($plugins['MTrackAuth_OpenID']) ? " (Active)" : '';
+
+
+?>
+<h1>Authentication</h1>
+<?php
+if ($message) {
+ $message = htmlentities($message, ENT_QUOTES, 'utf-8');
+ echo <<<HTML
+<div class='ui-state-error ui-corner-all'>
+ <span class='ui-icon ui-icon-alert'></span>
+ $message
+</div>
+HTML;
+}
+
+
+?>
+<p>
+Select one of the following, depending
+on which one best matches your intended mtrack deployment:
+</p>
+
+<form method='post'>
+<div id="authaccordion">
+<h2><a href='#'>Private (HTTP authentication)<?php echo $http_configd ?></a></h2>
+<div>
+<p>
+ I want to strictly control who has access to mtrack, and prevent
+ anonymous users from having any rights.
+</p>
+<?php
+if (isset($_SERVER['REMOTE_USER'])) {
+?>
+<p>
+ It looks like your web server is configured to use HTTP authentication
+ (you're authenticated as <?php
+ echo htmlentities($_SERVER['REMOTE_USER'], ENT_QUOTES, 'utf-8') ?>)
+ mtrack will defer to your web server configuration for authentication.
+ Contact your system administrator to add or remove users, or to change
+ their passwords. You may still use the mtrack user management screens
+ to change rights assignments for the users.
+</p>
+<?php
+} else {
+?>
+<p>
+ mtrack will use HTTP authentication and store the password and group
+ files in the <em>vardir</em>.
+</p>
+<?php
+}
+echo "<h3>Administrators</h3>";
+$admins = get_admins();
+if (count($admins)) {
+ echo "<p>The following users are configured with admin rights:</p>";
+ echo "<p>";
+ foreach ($admins as $id) {
+ echo mtrack_username($id) . " ";
+ }
+ echo "</p>";
+} else {
+ echo <<<HTML
+<p>You <em>MUST</em> add at least one user as an administrator,
+otherwise no one will be able to administer the system without editing
+the config.ini file.
+</p>
+HTML;
+
+ echo <<<HTML
+<table>
+<tr>
+<td><b>Add Admin User</b>:</td>
+<td><input type="text" name="adminuser"></td>
+</tr>
+HTML;
+
+ if (!isset($_SERVER['REMOTE_USER'])) {
+ echo <<<HTML
+<tr>
+ <td><b>Set Password</b>:</td>
+ <td><input type="password" name="adminpass1"></td>
+</tr>
+<tr>
+ <td><b>Confirm Password</b>:</td>
+ <td><input type="password" name="adminpass2"></td>
+</tr>
+</table>
+HTML;
+ } else {
+ echo <<<HTML
+</table>
+<p>
+<em>You can't set the password here, because mtrack has no way to automatically
+find out how to do that. Contact your system administrator to ensure that
+you have a username and password configured for mtrack</em></p>
+HTML;
+ }
+}
+?>
+ <input type='submit' name='setupprivate'
+ value='Configure Private Authentication'>
+
+</div>
+<h2><a href='#'>Public (OpenID)<?php echo $openid_configd ?></a></h2>
+<div>
+<p>
+ I want to allow the public access to mtrack, but only allow people that
+ I trust to make certain kinds of changes.
+</p>
+<p>
+ mtrack will use OpenID to manage authentication.
+</p>
+<h3>Administrators</h3>
+<?php
+$admins = get_openid_admins();
+if (count($admins)) {
+ echo "<p>The following OpenID users are configured with admin rights:</p>";
+ echo "<p>";
+ foreach ($admins as $id) {
+ echo mtrack_username($id) . " ($id) ";
+ }
+ echo "</p>";
+} else {
+ echo <<<HTML
+<p>You <em>MUST</em> add at least one OpenID as an administrator,
+otherwise no one will be able to administer the system without editing
+the config.ini file.
+</p>
+HTML;
+}
+?>
+<b>Add Admin OpenID</b>: <input type="text" name="adminopenid"><br>
+<b>Local Username</b>: <input type="text" name="adminuserid"><br>
+ <input type='submit' name='setuppublic'
+ value='Configure Public Authentication'>
+</div>
+</div>
+</form>
+<script>
+$(document).ready(function () {
+ $('#authaccordion').accordion({
+ active: <?php
+ if (isset($plugins['MTrackAuth_OpenID'])) {
+ echo "1";
+ } else {
+ echo "0";
+ }
+?>});
+});
+</script>
+<?php
+mtrack_foot();
+
projects / web.mtrack / blobdiff