tyler.durden/icingaweb2
1
0
Fork 0
mirror of https://github.com/Icinga/icingaweb2.git synced 2025-07-28 16:24:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

autologin: Fix externally-authenticated users still being authenticated after external authentication is disabled

Browse Source 
The if condition for revoking authentication if the username changed relied on having the `$_SERVER' variable set which was used for authentication.
Authentication is now revoked if the username changed or external authentication is no longer in effect.

refs #6462
This commit is contained in:
Eric Lippmann 2014-09-18 15:20:46 +02:00
parent 854e284d42
commit f1d3b72f05
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
library/Icinga/Authentication/Manager.php
View File

@ -113,24 +113,26 @@ class Manager
} }
/** /**
* Tries to authenticate the user with the current session * Try to authenticate the user with the current session
*
* Authentication for externally-authenticated users will be revoked if the username changed or external
* authentication is no longer in effect
*/ */
public function authenticateFromSession() public function authenticateFromSession()
{ {
$this->user = Session::getSession()->get('user'); $this->user = Session::getSession()->get('user');
if ($this->user !== null && $this->user->isRemoteUser() === true) { if ($this->user !== null && $this->user->isRemoteUser() === true) {
list($originUsername, $field) = $this->user->getRemoteUserInformation(); list($originUsername, $field) = $this->user->getRemoteUserInformation();
if (array_key_exists($field, $_SERVER) && $_SERVER[$field] !== $originUsername) { if (! array_key_exists($field, $_SERVER) || $_SERVER[$field] !== $originUsername) {
$this->removeAuthorization(); $this->removeAuthorization();
} }
} }
} }
/** /**
* Returns true when the user is currently authenticated * Whether the user is authenticated
* *
* @param Boolean $ignoreSession Set to true to prevent authentication by session * @param bool $ignoreSession True to prevent session authentication
* *
* @return bool * @return bool
*/ */