Merge branch 'development' of djpbessems/lucidAuth into master

Minor edits (housekeeping)
Renamed file to reflect actual purpose
2019-06-19 10:57:55 +00:00 · 2019-06-19 10:55:01 +00:00 · 2019-06-19 10:37:20 +00:00 · 2019-06-19 10:34:31 +00:00 · 2019-06-19 10:14:04 +00:00 · 2019-06-19 10:09:46 +00:00
11 changed files with 137 additions and 66 deletions
--- a/include/lucidAuth.functions.php
+++ b/include/lucidAuth.functions.php
@ -66,11 +66,11 @@ function storeToken (string $secureToken, string $qualifiedUsername, string $htt
 			INSERT INTO SecureToken (UserId, Value)
 			SELECT User.Id, :securetoken
 			FROM User
-			WHERE User.Username = :qualifiedusername
+			WHERE LOWER(User.Username) = :qualifiedusername
 		');
 		$pdoQuery->execute([
 			':securetoken'			=>	$secureToken,
-			':qualifiedusername'	=>	$qualifiedUsername
+			':qualifiedusername'	=>	strtolower($qualifiedUsername)
 		]);
 	}
 	catch (Exception $e) {
@ -118,10 +118,10 @@ function validateToken (string $secureToken) {
 		FROM SecureToken
 		LEFT JOIN User
 			ON (User.Id=SecureToken.UserId)
-		WHERE User.Username = :username
+		WHERE LOWER(User.Username) = :username
 	');
 	$pdoQuery->execute([
-			':username'	=>	(string)$jwtPayload->sub
+			':username'	=>	(string) strtolower($jwtPayload->sub)
 		]);
 	foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) {
 		try {
--- a/include/lucidAuth.template.php
+++ b/include/lucidAuth.template.php
@ -13,8 +13,7 @@ $pageLayout['full'] = <<<'FULL'
 	<link href="misc/style.css" rel="stylesheet" />
 	<link href="misc/style.theme.css" rel="stylesheet" />
    <link href="misc/style.button.css" rel="stylesheet" />
-    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
-    <script src="misc/script.theme.js"></script>
+    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
    <script src="misc/script.translation.js"></script>
  </head>
  <body>
@ -47,7 +46,6 @@ $pageLayout['full_alt'] = <<<'FULL_ALT'
    <link href="misc/style.theme.css" rel="stylesheet" />
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
    <script src="misc/script.translation.js"></script>
-    <script src="misc/script.index.js"></script>
  </head>
  <body>
 	<div class="wrapper">
@ -74,22 +72,6 @@ $pageLayout['full_alt'] = <<<'FULL_ALT'
 </html>
 FULL_ALT;

-$pageLayout['bare'] = <<<'BARE'
-<!DOCTYPE html>
-<html lang="nl">
-  <head>
-    <meta charset="utf-8" />
-    <title>lucidAuth</title>
-	<meta name="application-name" content="lucidAuth" />
-    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
-    <script src="misc/script.iframe.js"></script>
-  </head>
-  <body>
-  	%1$s
-  </body>
-</html>
-BARE;
-
 $contentLayout['login'] = <<<'LOGIN'
 		  <script src="misc/script.index.js"></script>
          <section>
@ -121,7 +103,7 @@ LOGIN;
 $contentLayout['manage']['header'] = <<<'MANAGE_HEADER'
 		  <script src="misc/script.editable.table.js"></script>
 		  <script src="misc/script.manage.js"></script>
-          <span id="user"><span data-translation="span_loggedinas">Logged in as</span>&nbsp;%1$s&nbsp;---&nbsp;[<a id="linklanguage-en" href="#" tabindex="700">EN</a>&nbsp;<a id="linklanguage-nl" class="current" href="#" tabindex="700">NL</a>]&nbsp;[<a href="#" tabindex="800" data-translation="link_logout">Logout</a>]</span>
+          <span id="user"><span data-translation="span_loggedinas">Logged in as</span>&nbsp;%1$s&nbsp;---&nbsp;[<a id="linklanguage-en" class="current" href="#" tabindex="700">EN</a>&nbsp;<a id="linklanguage-nl" href="#" tabindex="700">NL</a>]&nbsp;[<a id="linklogout" href="#" tabindex="800" data-translation="link_logout">Logout</a>]</span>
          <ul style="clear: both; margin-top: 20px;">
            <li class="buttons">
 		      <button id="btnnewuser" class="bttn-simple bttn-xs bttn-primary" data-translation="button_new">new</button>
--- a/public/example.php
+++ b/public/example.php
@ -0,0 +1,27 @@
+<?php
+
+// Basic example of PHP script to handle with jQuery-Tabledit plug-in.
+// Note that is just an example. Should take precautions such as filtering the input data.
+
+header('Content-Type: application/json');
+
+$input = filter_input_array(INPUT_POST);
+
+$mysqli = new mysqli('localhost', 'user', 'password', 'database');
+
+if (mysqli_connect_errno()) {
+  echo json_encode(array('mysqli' => 'Failed to connect to MySQL: ' . mysqli_connect_error()));
+  exit;
+}
+
+if ($input['action'] === 'edit') {
+    $mysqli->query("UPDATE users SET username='" . $input['username'] . "', email='" . $input['email'] . "', avatar='" . $input['avatar'] . "' WHERE id='" . $input['id'] . "'");
+} else if ($input['action'] === 'delete') {
+    $mysqli->query("UPDATE users SET deleted=1 WHERE id='" . $input['id'] . "'");
+} else if ($input['action'] === 'restore') {
+    $mysqli->query("UPDATE users SET deleted=0 WHERE id='" . $input['id'] . "'");
+}
+
+mysqli_close($mysqli);
+
+echo json_encode($input);
--- a/public/lucidAuth.login.php
+++ b/public/lucidAuth.login.php
@ -14,10 +14,9 @@
 					"Result"			=>	"Failure",
 					"Reason"			=>	"Failed storing authentication token in database and/or cookie"
 				]);
-#				echo '{"Result":"Fail","Reason":"Failed storing authentication token in database and/or cookie"}' . PHP_EOL;
 				exit;
 			}
-            
+
 			// Convert base64 encoded string back from JSON;
 			//   forcing it into an associative array (instead of javascript's default StdClass object)
 			try {
@ -30,7 +29,6 @@
 					"Result"			=>	"Failure",
 					"Reason"			=>	"Original request-URI lost in transition"
 				]);
-#				echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
 				exit;
 			}
 			$originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php';
@ -40,7 +38,9 @@
 			echo json_encode([
 				"Result"			=>	"Success",
 				"Location"			=>	$originalUri,
-				"CrossDomainLogin"	=>	$settings->Session['CrossDomainLogin']
+				"CrossDomainLogin"	=>	$settings->Session['CrossDomainLogin'],
+                "CookieDomains"     =>  json_encode(array_diff($settings->Session['CookieDomains'], [$_SERVER['HTTP_HOST']])),
+                "SecureToken"       =>  $result['token']
 			]);
 		} else {
 			switch ($result['reason']) {
@ -63,8 +63,8 @@
 	} else {
 		include_once('../include/lucidAuth.template.php');

-		echo sprintf($pageLayout['full'], 
-			sprintf($contentLayout['login'], 
+		echo sprintf($pageLayout['full'],
+			sprintf($contentLayout['login'],
 				$_GET['ref']
 			)
 		);
--- a/public/lucidAuth.manage.php
+++ b/public/lucidAuth.manage.php
@ -22,12 +22,12 @@
            throw new Exception($e);
        }
    	foreach($allUsers as $row) {
-            $tableRows[] = sprintf('<tr %1$s><td data-userid="%2$s">%3$s</td><td>%4$s</td><td class="immutable">%5$s</td></tr>',
-                $validateTokenResult['uid'] === $row['Id'] ? 'class="currentuser"': null,
+            $tableRows[] = sprintf('<tr%1$s><td data-userid="%2$s">%3$s</td><td>%4$s</td><td class="immutable">%5$s</td></tr>',
+                $validateTokenResult['uid'] === $row['Id'] ? ' class="currentuser"': null,
                $row['Id'],
                explode('\\', $row['Username'])[1],
                $row['Rolename'],
-                $validateTokenResult['uid'] === $row['Id'] ? '<button class="bttn-simple bttn-xs bttn-primary" data-translation="button_sessions">Sessions</button>' : '<button class="bttn-simple bttn-xs bttn-primary" data-translation="button_sessions">Sessions</button>&nbsp;<button class="bttn-simple bttn-xs bttn-primary delete" data-translation="button_delete">Delete</button>'
+                '<button class="bttn-simple bttn-xs bttn-primary" data-translation="button_sessions">Sessions</button>' . ($validateTokenResult['uid'] === $row['Id'] ? null : '&nbsp;<button class="bttn-simple bttn-xs bttn-primary delete" data-translation="button_delete">Delete</button>')
            );
    	}

--- a/public/lucidAuth.requestCookie.php
+++ b/public/lucidAuth.requestCookie.php
@ -0,0 +1,59 @@
+<?php
+	error_reporting(E_ALL ^ E_NOTICE);
+
+	include_once('../include/lucidAuth.functions.php');
+
+    // Start with checking $_REQUEST['ref']
+	if (!empty($_REQUEST['ref'])) {
+		try {
+			$queryString = json_decode(base64_decode($_REQUEST['ref']), JSON_OBJECT_AS_ARRAY);
+		}
+		catch (Exception $e) {
+			// Silently fail, unless explicitly specified otherwise
+            header("HTTP/1.1 400 Bad Request");
+			if ($settings->Debug['Verbose']) throw new Exception($e);
+            exit;
+		}
+
+        switch ($queryString['action']) {
+            case 'login':
+                if (validateToken($queryString['token'])['status'] === "Success") {
+                    // This request appears valid; try storing a cookie
+                    $httpHost = $_SERVER['HTTP_HOST'];
+                    $httpOrigin = $_SERVER['HTTP_ORIGIN'];
+                    // Check if $_SERVER['HTTP_HOST'] and $_SERVER['HTTP_ORIGIN'] match any of the configured domains (either explicitly or as a subdomain)
+                    //   This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks
+                    $cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) {
+                        return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value)));
+                    }))[0];
+                    $originDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpOrigin) {
+                        return (strlen($value) > strlen($httpOrigin)) ? false : (0 === substr_compare($httpOrigin, $value, -strlen($value)));
+                    }))[0];
+                    if (($cookieDomain && (is_null($httpOrigin) || $originDomain)) && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) {
+                        header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
+                        header('Access-Control-Allow-Credentials: true');
+                        header('Access-Control-Max-Age: 86400');
+                        header("HTTP/1.1 202 Accepted");
+                        exit;
+                    }
+                    else {
+                        header("HTTP/1.1 400 Bad Request");
+                        exit;
+                    }
+                }
+                else {
+                    header("HTTP/1.1 401 Unauthorized");
+                    exit;
+                }
+                break;
+            default:
+                header("HTTP/1.1 400 Bad Request");
+                exit;
+                break;
+        }
+	}
+    else {
+        header("HTTP/1.1 400 Bad Request");
+        exit;
+    }
+?>
--- a/public/lucidAuth.setXDomainCookie.php
+++ b/public/lucidAuth.setXDomainCookie.php
@ -1,24 +0,0 @@
-<?php
-	error_reporting(E_ALL ^ E_NOTICE);
-
-	include_once('../include/lucidAuth.functions.php');
-
-
-	// Start with checking $_REQUEST['ref']
-	// What do we need?
-	//   token again?
-
-	// approach 1:
-	//   origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already)
-	//   this might be slower because it means one additional roundtrip between client and server
-
-	// approach 2:
-	//   let the client setup multiple iframes for all domains other than origin domains
-	//   this requires passing an array of domains to the client in asynchronous reply; which feels insecure
-
-	include_once('../include/lucidAuth.template.php');
-
-	echo sprintf($pageLayout['bare'],
-		'// iFrames go here'
-	);
-?>
--- a/public/lucidAuth.validateRequest.php
+++ b/public/lucidAuth.validateRequest.php
@ -14,7 +14,7 @@
 	$proxyHeaders = array_filter($proxyHeaders, function ($key) {
 		return substr($key, 0, 10) === 'XForwarded';
 	}, ARRAY_FILTER_USE_KEY);
-	
+
 	// For debugging purposes - enable it in ../lucidAuth.config.php
 	if ($settings->Debug['LogToFile']) {
 		file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT)) . PHP_EOL, FILE_APPEND);
@ -22,7 +22,7 @@

 	if (sizeof($proxyHeaders) === 0) {
 		// Non-proxied request; this is senseless, go fetch!
-		header("HTTP/1.1 403 Forbidden");
+		header("HTTP/1.1 400 Bad Request");
 		exit;
 	}

--- a/public/misc/script.index.js
+++ b/public/misc/script.index.js
@ -31,11 +31,34 @@ $(document).ready(function(){
 						'color':		'#FFF'
 					});
 					if (data.CrossDomainLogin) {
-						// Create iframes for other domains
-console.log('CrossDomainLogin initiated');
+                        var cookieDomains = JSON.parse(data.CookieDomains);
+                        var XHR = [];
+                        cookieDomains.forEach(function(domain) {
+                            XHR.push($.get({
+                                url: "https://auth." + domain + "/lucidAuth.requestCookie.php",
+                                crossDomain: true,
+                                xhrFields: {
+                                    withCredentials: true,
+                                },
+                                data: {
+                                    ref: btoa(JSON.stringify({
+                                        action: 'login',
+                                        token: data.SecureToken
+                                    }))
+                                }
+                            }));
+                        });
+                        $.when.apply($, XHR).then(function(){
+                            $.each(arguments, function(_index, _arg) {
+                                // Show progress somehow (maybe something like https://minicss.org/v2/progress)
+                            });
+                        });
 					}
-console.log("Navigating to :" + data.Location);
-					window.location.replace(data.Location);
+                    // Finished (either succesfully or through timeout) cross-domain logins
+// redirect once all finished loading or timeout after $X ms
+// origin domain should be exempted from timeout
+//   (because origin domain can/will be different from current domain --due to traefik design).
+					//window.location.replace(data.Location);
 				}, 2250);
 			} else {
 				$('#btnlogin').css({
--- a/public/misc/script.manage.js
+++ b/public/misc/script.manage.js
@ -22,9 +22,9 @@ $(document).ready(function(){
            .append($('<td>', {
                class: 'immutable',
                html: '<button class="bttn-simple bttn-xs bttn-primary disabled" data-translation="button_sessions" disabled="true">' +
-                    locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'nl')]['button_sessions'] + '</button>&nbsp;' +
+                    locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'en')]['button_sessions'] + '</button>&nbsp;' +
                    '<button class="bttn-simple bttn-xs bttn-primary delete" data-translation="button_delete">' +
-                    locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'nl')]['button_delete'] +
+                    locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'en')]['button_delete'] +
                    '</button>'
            }))
        );
@ -69,6 +69,10 @@ console.log({'new': newEntries, 'removed': removedEntries});
        window.location.reload();
    });

+    $('#linklogout').click(function() {
+        console.log('Logging out!');
+    });
+
   	if (localStorage.getItem('theme') !== null) {
 		$('#theme').addClass(localStorage.getItem('theme'));
 	}
--- a/public/misc/style.css
+++ b/public/misc/style.css
@ -209,4 +209,4 @@ body {
 	}
 		.main span#user nav {
 			display: inline;
-		}
+		}
Author	SHA1	Message	Date
Danny Bessems	75e8640439	Merge branch 'development' of djpbessems/lucidAuth into master	2019-06-19 10:57:55 +00:00
Danny Bessems	dca8f74f25	Minor edits (housekeeping)	2019-06-19 10:55:01 +00:00
Danny Bessems	21f272e9f0	Renamed file to reflect actual purpose	2019-06-19 10:37:20 +00:00
Danny Bessems	5a2d3313e7	Added missing CORS headers and xhrFields	2019-06-19 10:34:31 +00:00
Danny Bessems	6081e42d14	Resolved merge conflicts	2019-06-19 10:14:04 +00:00
Danny Bessems	0675ad8512	Controller for cross-domain iframes added	2019-06-19 10:09:46 +00:00
Danny Bessems	ee35696cd4	Controller for cross-domain iframes added	2019-06-18 13:21:44 +00:00
Danny Bessems	e3405369ca	Delete 'public/misc/script.theme.js'	2019-03-13 10:53:22 +00:00
Danny Bessems	f9664eab18	Periodic merge upstream Resolved merge conflicts	2019-03-13 10:44:00 +00:00
Danny Bessems	a20f13ab7c	Babysteps towards cross-domain-cookies-in-iframes	2019-03-13 09:59:12 +00:00
Danny Bessems	0a5384f6a8	Authentication failed due to case sensitive SQL-queries	2019-03-07 19:50:04 +00:00
Danny Bessems	3dbb6b9932	Implemented GUI aspect of usermanagement page TODO: add ajax-call that will update database	2019-03-06 14:21:47 +01:00
Danny Bessems	ac546633d1	Periodic merge upstream (#1 )	2019-02-28 14:31:10 +00:00