5 use Digest::MD5 qw(md5_hex);
7 use Time::HiRes qw(gettimeofday);
8 use List::MoreUtils qw(uniq);
10 use SL::Auth::Constants qw(:all);
20 $main::lxdebug->enter_sub();
27 $self->{SESSION} = { };
29 $self->_read_auth_config();
31 $main::lxdebug->leave_sub();
37 my ($self, $login) = @_;
38 my %user = $self->read_user($login);
39 my $dbh = DBI->connect(
44 pg_enable_utf8 => $::locale->is_utf8,
47 ) or $::form->dberror;
49 if ($user{dboptions}) {
50 $dbh->do($user{dboptions}) or $::form->dberror($user{dboptions});
59 $self->{dbh}->disconnect() if ($self->{dbh});
62 sub _read_auth_config {
63 $main::lxdebug->enter_sub();
67 my $form = $main::form;
68 my $locale = $main::locale;
71 my $in = IO::File->new('config/authentication.pl', 'r');
74 $form->error($locale->text('The config file "config/authentication.pl" was not found.'));
85 $form->error($locale->text('The config file "config/authentication.pl" contained invalid Perl code:') . "\n" . $@);
88 if ($self->{module} eq 'DB') {
89 $self->{authenticator} = SL::Auth::DB->new($self);
91 } elsif ($self->{module} eq 'LDAP') {
92 $self->{authenticator} = SL::Auth::LDAP->new($self);
95 if (!$self->{authenticator}) {
96 $form->error($locale->text('No or an unknown authenticantion module specified in "config/authentication.pl".'));
99 my $cfg = $self->{DB_config};
102 $form->error($locale->text('config/authentication.pl: Key "DB_config" is missing.'));
105 if (!$cfg->{host} || !$cfg->{db} || !$cfg->{user}) {
106 $form->error($locale->text('config/authentication.pl: Missing parameters in "DB_config". Required parameters are "host", "db" and "user".'));
109 $self->{authenticator}->verify_config();
111 $self->{session_timeout} *= 1;
112 $self->{session_timeout} = 8 * 60 if (!$self->{session_timeout});
114 $main::lxdebug->leave_sub();
117 sub authenticate_root {
118 $main::lxdebug->enter_sub();
121 my $password = shift;
122 my $is_crypted = shift;
124 $password = crypt $password, 'ro' if (!$password || !$is_crypted);
125 my $admin_password = crypt "$self->{admin_password}", 'ro';
127 $main::lxdebug->leave_sub();
129 return OK if $password eq $admin_password;
135 $main::lxdebug->enter_sub();
139 $main::lxdebug->leave_sub();
141 my $result = $self->{authenticator}->authenticate(@_);
142 return OK if $result eq OK;
148 $main::lxdebug->enter_sub(2);
151 my $may_fail = shift;
154 $main::lxdebug->leave_sub(2);
158 my $cfg = $self->{DB_config};
159 my $dsn = 'dbi:Pg:dbname=' . $cfg->{db} . ';host=' . $cfg->{host};
162 $dsn .= ';port=' . $cfg->{port};
165 $main::lxdebug->message(LXDebug->DEBUG1, "Auth::dbconnect DSN: $dsn");
167 $self->{dbh} = DBI->connect($dsn, $cfg->{user}, $cfg->{password}, { pg_enable_utf8 => $::locale->is_utf8, AutoCommit => 0 });
169 if (!$may_fail && !$self->{dbh}) {
170 $main::form->error($main::locale->text('The connection to the authentication database failed:') . "\n" . $DBI::errstr);
173 $main::lxdebug->leave_sub();
179 $main::lxdebug->enter_sub();
184 $self->{dbh}->disconnect();
188 $main::lxdebug->leave_sub();
192 $main::lxdebug->enter_sub();
196 my $dbh = $self->dbconnect();
197 my $query = qq|SELECT COUNT(*) FROM pg_tables WHERE (schemaname = 'auth') AND (tablename = 'user')|;
199 my ($count) = $dbh->selectrow_array($query);
201 $main::lxdebug->leave_sub();
207 $main::lxdebug->enter_sub();
211 my $dbh = $self->dbconnect(1);
213 $main::lxdebug->leave_sub();
218 sub create_database {
219 $main::lxdebug->enter_sub();
224 my $cfg = $self->{DB_config};
226 if (!$params{superuser}) {
227 $params{superuser} = $cfg->{user};
228 $params{superuser_password} = $cfg->{password};
231 $params{template} ||= 'template0';
232 $params{template} =~ s|[^a-zA-Z0-9_\-]||g;
234 my $dsn = 'dbi:Pg:dbname=template1;host=' . $cfg->{host};
237 $dsn .= ';port=' . $cfg->{port};
240 $main::lxdebug->message(LXDebug->DEBUG1(), "Auth::create_database DSN: $dsn");
242 my $charset = $main::dbcharset;
243 $charset ||= Common::DEFAULT_CHARSET;
244 my $encoding = $Common::charset_to_db_encoding{$charset};
245 $encoding ||= 'UNICODE';
247 my $dbh = DBI->connect($dsn, $params{superuser}, $params{superuser_password}, { pg_enable_utf8 => $charset =~ m/^utf-?8$/i });
250 $main::form->error($main::locale->text('The connection to the template database failed:') . "\n" . $DBI::errstr);
253 my $query = qq|CREATE DATABASE "$cfg->{db}" OWNER "$cfg->{user}" TEMPLATE "$params{template}" ENCODING '$encoding'|;
255 $main::lxdebug->message(LXDebug->DEBUG1(), "Auth::create_database query: $query");
260 my $error = $dbh->errstr();
262 $query = qq|SELECT pg_encoding_to_char(encoding) FROM pg_database WHERE datname = 'template0'|;
263 my ($cluster_encoding) = $dbh->selectrow_array($query);
265 if ($cluster_encoding && ($cluster_encoding =~ m/^(?:UTF-?8|UNICODE)$/i) && ($encoding !~ m/^(?:UTF-?8|UNICODE)$/i)) {
266 $error = $main::locale->text('Your PostgreSQL installationen uses UTF-8 as its encoding. Therefore you have to configure Lx-Office to use UTF-8 as well.');
271 $main::form->error($main::locale->text('The creation of the authentication database failed:') . "\n" . $error);
276 $main::lxdebug->leave_sub();
280 $main::lxdebug->enter_sub();
283 my $dbh = $self->dbconnect();
285 my $charset = $main::dbcharset;
286 $charset ||= Common::DEFAULT_CHARSET;
289 User->process_query($main::form, $dbh, 'sql/auth_db.sql', undef, $charset);
291 $main::lxdebug->leave_sub();
295 $main::lxdebug->enter_sub();
301 my $form = $main::form;
303 my $dbh = $self->dbconnect();
305 my ($sth, $query, $user_id);
307 $query = qq|SELECT id FROM auth."user" WHERE login = ?|;
308 ($user_id) = selectrow_query($form, $dbh, $query, $login);
311 $query = qq|SELECT nextval('auth.user_id_seq')|;
312 ($user_id) = selectrow_query($form, $dbh, $query);
314 $query = qq|INSERT INTO auth."user" (id, login) VALUES (?, ?)|;
315 do_query($form, $dbh, $query, $user_id, $login);
318 $query = qq|DELETE FROM auth.user_config WHERE (user_id = ?)|;
319 do_query($form, $dbh, $query, $user_id);
321 $query = qq|INSERT INTO auth.user_config (user_id, cfg_key, cfg_value) VALUES (?, ?, ?)|;
322 $sth = prepare_query($form, $dbh, $query);
324 while (my ($cfg_key, $cfg_value) = each %params) {
325 next if ($cfg_key eq 'password');
327 do_statement($form, $sth, $query, $user_id, $cfg_key, $cfg_value);
332 $main::lxdebug->leave_sub();
335 sub can_change_password {
338 return $self->{authenticator}->can_change_password();
341 sub change_password {
342 $main::lxdebug->enter_sub();
345 my $result = $self->{authenticator}->change_password(@_);
347 $main::lxdebug->leave_sub();
353 $main::lxdebug->enter_sub();
357 my $dbh = $self->dbconnect();
358 my $query = qq|SELECT u.id, u.login, cfg.cfg_key, cfg.cfg_value
359 FROM auth.user_config cfg
360 LEFT JOIN auth."user" u ON (cfg.user_id = u.id)|;
361 my $sth = prepare_execute_query($main::form, $dbh, $query);
365 while (my $ref = $sth->fetchrow_hashref()) {
366 $users{$ref->{login}} ||= { 'login' => $ref->{login}, 'id' => $ref->{id} };
367 $users{$ref->{login}}->{$ref->{cfg_key}} = $ref->{cfg_value} if (($ref->{cfg_key} ne 'login') && ($ref->{cfg_key} ne 'id'));
372 $main::lxdebug->leave_sub();
378 $main::lxdebug->enter_sub();
383 my $dbh = $self->dbconnect();
384 my $query = qq|SELECT u.id, u.login, cfg.cfg_key, cfg.cfg_value
385 FROM auth.user_config cfg
386 LEFT JOIN auth."user" u ON (cfg.user_id = u.id)
387 WHERE (u.login = ?)|;
388 my $sth = prepare_execute_query($main::form, $dbh, $query, $login);
392 while (my $ref = $sth->fetchrow_hashref()) {
393 $user_data{$ref->{cfg_key}} = $ref->{cfg_value};
394 @user_data{qw(id login)} = @{$ref}{qw(id login)};
399 $main::lxdebug->leave_sub();
405 $main::lxdebug->enter_sub();
410 my $dbh = $self->dbconnect();
411 my ($id) = selectrow_query($main::form, $dbh, qq|SELECT id FROM auth."user" WHERE login = ?|, $login);
413 $main::lxdebug->leave_sub();
419 $main::lxdebug->enter_sub();
424 my $form = $main::form;
426 my $dbh = $self->dbconnect();
427 my $query = qq|SELECT id FROM auth."user" WHERE login = ?|;
429 my ($id) = selectrow_query($form, $dbh, $query, $login);
431 return $main::lxdebug->leave_sub() if (!$id);
433 do_query($form, $dbh, qq|DELETE FROM auth.user_group WHERE user_id = ?|, $id);
434 do_query($form, $dbh, qq|DELETE FROM auth.user_config WHERE user_id = ?|, $id);
438 $main::lxdebug->leave_sub();
441 # --------------------------------------
445 sub restore_session {
446 $main::lxdebug->enter_sub();
450 my $cgi = $main::cgi;
451 $cgi ||= CGI->new('');
453 $session_id = $cgi->cookie($self->get_session_cookie_name());
454 $session_id =~ s|[^0-9a-f]||g;
456 $self->{SESSION} = { };
459 $main::lxdebug->leave_sub();
463 my ($dbh, $query, $sth, $cookie, $ref, $form);
467 $dbh = $self->dbconnect();
468 $query = qq|SELECT *, (mtime < (now() - '$self->{session_timeout}m'::interval)) AS is_expired FROM auth.session WHERE id = ?|;
470 $cookie = selectfirst_hashref_query($form, $dbh, $query, $session_id);
472 if (!$cookie || $cookie->{is_expired} || ($cookie->{ip_address} ne $ENV{REMOTE_ADDR})) {
473 $self->destroy_session();
474 $main::lxdebug->leave_sub();
475 return SESSION_EXPIRED;
478 $query = qq|SELECT sess_key, sess_value FROM auth.session_content WHERE session_id = ?|;
479 $sth = prepare_execute_query($form, $dbh, $query, $session_id);
481 while (my $ref = $sth->fetchrow_hashref()) {
482 $self->{SESSION}->{$ref->{sess_key}} = $ref->{sess_value};
483 $form->{$ref->{sess_key}} = $ref->{sess_value} if (!defined $form->{$ref->{sess_key}});
488 $main::lxdebug->leave_sub();
493 sub destroy_session {
494 $main::lxdebug->enter_sub();
499 my $dbh = $self->dbconnect();
501 do_query($main::form, $dbh, qq|DELETE FROM auth.session_content WHERE session_id = ?|, $session_id);
502 do_query($main::form, $dbh, qq|DELETE FROM auth.session WHERE id = ?|, $session_id);
507 $self->{SESSION} = { };
510 $main::lxdebug->leave_sub();
513 sub expire_sessions {
514 $main::lxdebug->enter_sub();
518 my $dbh = $self->dbconnect();
520 qq|DELETE FROM auth.session_content
524 WHERE (mtime < (now() - '$self->{session_timeout}m'::interval)))|;
526 do_query($main::form, $dbh, $query);
529 qq|DELETE FROM auth.session
530 WHERE (mtime < (now() - '$self->{session_timeout}m'::interval))|;
532 do_query($main::form, $dbh, $query);
536 $main::lxdebug->leave_sub();
539 sub _create_session_id {
540 $main::lxdebug->enter_sub();
543 map { push @data, int(rand() * 255); } (1..32);
545 my $id = md5_hex(pack 'C*', @data);
547 $main::lxdebug->leave_sub();
552 sub create_or_refresh_session {
553 $main::lxdebug->enter_sub();
557 $session_id ||= $self->_create_session_id();
559 my ($form, $dbh, $query, $sth, $id);
562 $dbh = $self->dbconnect();
564 $query = qq|SELECT id FROM auth.session WHERE id = ?|;
566 ($id) = selectrow_query($form, $dbh, $query, $session_id);
569 do_query($form, $dbh, qq|UPDATE auth.session SET mtime = now() WHERE id = ?|, $session_id);
570 do_query($form, $dbh, qq|DELETE FROM auth.session_content WHERE session_id = ?|, $session_id);
573 do_query($form, $dbh, qq|INSERT INTO auth.session (id, ip_address, mtime) VALUES (?, ?, now())|, $session_id, $ENV{REMOTE_ADDR});
577 $query = qq|INSERT INTO auth.session_content (session_id, sess_key, sess_value) VALUES (?, ?, ?)|;
578 $sth = prepare_query($form, $dbh, $query);
580 foreach my $key (sort keys %{ $self->{SESSION} }) {
581 do_statement($form, $sth, $query, $session_id, $key, $self->{SESSION}->{$key});
587 $main::lxdebug->leave_sub();
590 sub set_session_value {
591 $main::lxdebug->enter_sub();
595 $self->{SESSION} ||= { };
597 while (2 <= scalar @_) {
601 $self->{SESSION}->{$key} = $value;
604 $main::lxdebug->leave_sub();
607 sub set_cookie_environment_variable {
609 $ENV{HTTP_COOKIE} = $self->get_session_cookie_name() . "=${session_id}";
612 sub get_session_cookie_name {
615 return $self->{cookie_name} || 'lx_office_erp_session_id';
622 sub session_tables_present {
623 $main::lxdebug->enter_sub();
626 my $dbh = $self->dbconnect(1);
629 $main::lxdebug->leave_sub();
636 WHERE (schemaname = 'auth')
637 AND (tablename IN ('session', 'session_content'))|;
639 my ($count) = selectrow_query($main::form, $dbh, $query);
641 $main::lxdebug->leave_sub();
646 # --------------------------------------
648 sub all_rights_full {
649 my $locale = $main::locale;
652 ["--crm", $locale->text("CRM optional software")],
653 ["crm_search", $locale->text("CRM search")],
654 ["crm_new", $locale->text("CRM create customers, vendors and contacts")],
655 ["crm_service", $locale->text("CRM services")],
656 ["crm_admin", $locale->text("CRM admin")],
657 ["crm_adminuser", $locale->text("CRM user")],
658 ["crm_adminstatus", $locale->text("CRM status")],
659 ["crm_email", $locale->text("CRM send email")],
660 ["crm_termin", $locale->text("CRM termin")],
661 ["crm_opportunity", $locale->text("CRM opportunity")],
662 ["crm_knowhow", $locale->text("CRM know how")],
663 ["crm_follow", $locale->text("CRM follow up")],
664 ["crm_notices", $locale->text("CRM notices")],
665 ["crm_other", $locale->text("CRM other")],
666 ["--master_data", $locale->text("Master Data")],
667 ["customer_vendor_edit", $locale->text("Create and edit customers and vendors")],
668 ["part_service_assembly_edit", $locale->text("Create and edit parts, services, assemblies")],
669 ["project_edit", $locale->text("Create and edit projects")],
670 ["license_edit", $locale->text("Manage license keys")],
671 ["--ar", $locale->text("AR")],
672 ["sales_quotation_edit", $locale->text("Create and edit sales quotations")],
673 ["sales_order_edit", $locale->text("Create and edit sales orders")],
674 ["sales_delivery_order_edit", $locale->text("Create and edit sales delivery orders")],
675 ["invoice_edit", $locale->text("Create and edit invoices and credit notes")],
676 ["dunning_edit", $locale->text("Create and edit dunnings")],
677 ["sales_all_edit", $locale->text("View/edit all employees sales documents")],
678 ["--ap", $locale->text("AP")],
679 ["request_quotation_edit", $locale->text("Create and edit RFQs")],
680 ["purchase_order_edit", $locale->text("Create and edit purchase orders")],
681 ["purchase_delivery_order_edit", $locale->text("Create and edit purchase delivery orders")],
682 ["vendor_invoice_edit", $locale->text("Create and edit vendor invoices")],
683 ["--warehouse_management", $locale->text("Warehouse management")],
684 ["warehouse_contents", $locale->text("View warehouse content")],
685 ["warehouse_management", $locale->text("Warehouse management")],
686 ["--general_ledger_cash", $locale->text("General ledger and cash")],
687 ["general_ledger", $locale->text("Transactions, AR transactions, AP transactions")],
688 ["datev_export", $locale->text("DATEV Export")],
689 ["cash", $locale->text("Receipt, payment, reconciliation")],
690 ["--reports", $locale->text('Reports')],
691 ["report", $locale->text('All reports')],
692 ["advance_turnover_tax_return", $locale->text('Advance turnover tax return')],
693 ["--others", $locale->text("Others")],
694 ["email_bcc", $locale->text("May set the BCC field when sending emails")],
695 ["config", $locale->text("Change Lx-Office installation settings (all menu entries beneath 'System')")],
702 return grep !/^--/, map { $_->[0] } all_rights_full();
706 $main::lxdebug->enter_sub();
710 my $form = $main::form;
712 my $dbh = $self->dbconnect();
714 my $query = 'SELECT * FROM auth."group"';
715 my $sth = prepare_execute_query($form, $dbh, $query);
719 while ($row = $sth->fetchrow_hashref()) {
720 $groups->{$row->{id}} = $row;
724 $query = 'SELECT * FROM auth.user_group WHERE group_id = ?';
725 $sth = prepare_query($form, $dbh, $query);
727 foreach $group (values %{$groups}) {
730 do_statement($form, $sth, $query, $group->{id});
732 while ($row = $sth->fetchrow_hashref()) {
733 push @members, $row->{user_id};
735 $group->{members} = [ uniq @members ];
739 $query = 'SELECT * FROM auth.group_rights WHERE group_id = ?';
740 $sth = prepare_query($form, $dbh, $query);
742 foreach $group (values %{$groups}) {
743 $group->{rights} = {};
745 do_statement($form, $sth, $query, $group->{id});
747 while ($row = $sth->fetchrow_hashref()) {
748 $group->{rights}->{$row->{right}} |= $row->{granted};
751 map { $group->{rights}->{$_} = 0 if (!defined $group->{rights}->{$_}); } all_rights();
755 $main::lxdebug->leave_sub();
761 $main::lxdebug->enter_sub();
766 my $form = $main::form;
767 my $dbh = $self->dbconnect();
769 my ($query, $sth, $row, $rights);
772 ($group->{id}) = selectrow_query($form, $dbh, qq|SELECT nextval('auth.group_id_seq')|);
774 $query = qq|INSERT INTO auth."group" (id, name, description) VALUES (?, '', '')|;
775 do_query($form, $dbh, $query, $group->{id});
778 do_query($form, $dbh, qq|UPDATE auth."group" SET name = ?, description = ? WHERE id = ?|, map { $group->{$_} } qw(name description id));
780 do_query($form, $dbh, qq|DELETE FROM auth.user_group WHERE group_id = ?|, $group->{id});
782 $query = qq|INSERT INTO auth.user_group (user_id, group_id) VALUES (?, ?)|;
783 $sth = prepare_query($form, $dbh, $query);
785 foreach my $user_id (uniq @{ $group->{members} }) {
786 do_statement($form, $sth, $query, $user_id, $group->{id});
790 do_query($form, $dbh, qq|DELETE FROM auth.group_rights WHERE group_id = ?|, $group->{id});
792 $query = qq|INSERT INTO auth.group_rights (group_id, "right", granted) VALUES (?, ?, ?)|;
793 $sth = prepare_query($form, $dbh, $query);
795 foreach my $right (keys %{ $group->{rights} }) {
796 do_statement($form, $sth, $query, $group->{id}, $right, $group->{rights}->{$right} ? 't' : 'f');
802 $main::lxdebug->leave_sub();
806 $main::lxdebug->enter_sub();
811 my $form = $main::from;
813 my $dbh = $self->dbconnect();
815 do_query($form, $dbh, qq|DELETE FROM auth.user_group WHERE group_id = ?|, $id);
816 do_query($form, $dbh, qq|DELETE FROM auth.group_rights WHERE group_id = ?|, $id);
817 do_query($form, $dbh, qq|DELETE FROM auth."group" WHERE id = ?|, $id);
821 $main::lxdebug->leave_sub();
824 sub evaluate_rights_ary {
825 $main::lxdebug->enter_sub(2);
832 foreach my $el (@{$ary}) {
833 if (ref $el eq "ARRAY") {
834 if ($action eq '|') {
835 $value |= evaluate_rights_ary($el);
837 $value &= evaluate_rights_ary($el);
840 } elsif (($el eq '&') || ($el eq '|')) {
843 } elsif ($action eq '|') {
852 $main::lxdebug->leave_sub(2);
857 sub _parse_rights_string {
858 $main::lxdebug->enter_sub(2);
868 push @stack, $cur_ary;
870 while ($access =~ m/^([a-z_0-9]+|\||\&|\(|\)|\s+)/) {
872 substr($access, 0, length $1) = "";
874 next if ($token =~ /\s/);
877 my $new_cur_ary = [];
878 push @stack, $new_cur_ary;
879 push @{$cur_ary}, $new_cur_ary;
880 $cur_ary = $new_cur_ary;
882 } elsif ($token eq ")") {
886 $main::lxdebug->leave_sub(2);
890 $cur_ary = $stack[-1];
892 } elsif (($token eq "|") || ($token eq "&")) {
893 push @{$cur_ary}, $token;
896 push @{$cur_ary}, $self->{RIGHTS}->{$login}->{$token} * 1;
900 my $result = ($access || (1 < scalar @stack)) ? 0 : evaluate_rights_ary($stack[0]);
902 $main::lxdebug->leave_sub(2);
908 $main::lxdebug->enter_sub(2);
915 $self->{FULL_RIGHTS} ||= { };
916 $self->{FULL_RIGHTS}->{$login} ||= { };
918 if (!defined $self->{FULL_RIGHTS}->{$login}->{$right}) {
919 $self->{RIGHTS} ||= { };
920 $self->{RIGHTS}->{$login} ||= $self->load_rights_for_user($login);
922 $self->{FULL_RIGHTS}->{$login}->{$right} = $self->_parse_rights_string($login, $right);
925 my $granted = $self->{FULL_RIGHTS}->{$login}->{$right};
926 $granted = $default if (!defined $granted);
928 $main::lxdebug->leave_sub(2);
934 $main::lxdebug->enter_sub(2);
938 my $dont_abort = shift;
940 my $form = $main::form;
942 if ($self->check_right($form->{login}, $right)) {
943 $main::lxdebug->leave_sub(2);
948 delete $form->{title};
949 $form->show_generic_error($main::locale->text("You do not have the permissions to access this function."));
952 $main::lxdebug->leave_sub(2);
957 sub load_rights_for_user {
958 $main::lxdebug->enter_sub();
963 my $form = $main::form;
964 my $dbh = $self->dbconnect();
966 my ($query, $sth, $row, $rights);
971 qq|SELECT gr."right", gr.granted
972 FROM auth.group_rights gr
975 FROM auth.user_group ug
976 LEFT JOIN auth."user" u ON (ug.user_id = u.id)
979 $sth = prepare_execute_query($form, $dbh, $query, $login);
981 while ($row = $sth->fetchrow_hashref()) {
982 $rights->{$row->{right}} |= $row->{granted};
986 map({ $rights->{$_} = 0 unless (defined $rights->{$_}); } SL::Auth::all_rights());
988 $main::lxdebug->leave_sub();