use deny-by-default security

diff --git a/data/templates/forbidden.htm b/data/templates/forbidden.htm
index d7d3b6185e79e19a804a23dfd3baf1e7fb6bd003..04b8fb6f91794cc7ce977498eef6586e45c8aff8 100644 (file)
--- a/data/templates/forbidden.htm
+++ b/data/templates/forbidden.htm
@@ -3,23 +3,13 @@
 
 {% block content %}
 
 
 {% block content %}
 

-<fieldset>
-  <legend>Access Denied</legend>
-  <img src="/images/access_denied.png" align='left'>
-  <p>We're sorry, your identity is not authorized:</p>
-  <p><code>{{ identity }}</code></p>
-  <p>If you feel this message is in error, please notify the site admin
-    and include your identity.</p>
-</fieldset>
+<img src="/images/access_denied.png" align='left' alt="acces denied"/>
+<h2>Access Denied</h2>
+<p>
+ We're sorry; but you are not allowed to access this page.
+</p>
+<p>
+ You may <a href="/login">log in</a> if you want.
+</p>

 {% endblock %}
 
 {% endblock %}
 

-{% block sidebar %}
- {% if recents.results %}
- <h3>Recently created</h3>
- <ul>
- {% for repo in recents.repos %}
-   {% include 'repo-sidebar-list.htm' %}
- {% endfor %}
- </ul>
- {% endif %}
-{% endblock %}

diff --git a/www/delete.php b/www/delete.php
index 85f62582e9b6daca8c93f4201bca32a7b8d20274..6d68ae4486d4ce365fd0e31c7289bb17bd46ee89 100644 (file)
--- a/www/delete.php
+++ b/www/delete.php
@@ -4,9 +4,6 @@ namespace phorkie;
  * Delete paste or ask for deletion
  */
 require_once 'www-header.php';
  * Delete paste or ask for deletion
  */
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] > 0) {
-    include_once 'secure.php';
-}

 
 $repo = new Repository();
 $repo->loadFromRequest();
 
 $repo = new Repository();
 $repo->loadFromRequest();

diff --git a/www/display.php b/www/display.php
index 6f754d9ec4c01d4ee0e7d4e36996ac6e4c5e49ac..534a11959b9c1f0cc8b3fd5148e24a19dcd61c46 100644 (file)
--- a/www/display.php
+++ b/www/display.php
@@ -3,10 +3,8 @@ namespace phorkie;
 /**
  * Display paste contents
  */
 /**
  * Display paste contents
  */

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] == 2) {
-    include_once 'secure.php';
-}

 
 $repo = new Repository();
 $repo->loadFromRequest();
 
 $repo = new Repository();
 $repo->loadFromRequest();

diff --git a/www/doap.php b/www/doap.php
index db00df4d3dec8d891444450b80c1f7e2b15d41f4..f374dba0464244c163431321727f4aa9f5f69833 100644 (file)
--- a/www/doap.php
+++ b/www/doap.php
@@ -4,6 +4,7 @@ namespace phorkie;
  * Display DOAP of the paste.
  * Contains a machine-readable project description with Git URL.
  */
  * Display DOAP of the paste.
  * Contains a machine-readable project description with Git URL.
  */

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 
 $repo = new Repository();
 require_once 'www-header.php';
 
 $repo = new Repository();

diff --git a/www/edit.php b/www/edit.php
index 20e779386a422494db506fcd4b144ab45641f7a4..897aada2b36bf67a2478f4440a91451bf88a107a 100644 (file)
--- a/www/edit.php
+++ b/www/edit.php
@@ -4,9 +4,6 @@ namespace phorkie;
  * Edit paste contents
  */
 require_once 'www-header.php';
  * Edit paste contents
  */
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] > 0) {
-    include_once 'secure.php';
-}

 
 $repo = new Repository();
 $repo->loadFromRequest();
 
 $repo = new Repository();
 $repo->loadFromRequest();

diff --git a/www/forbidden.php b/www/forbidden.php
new file mode 100644 (file)
index 0000000..fc166eb
--- /dev/null
+++ b/www/forbidden.php
@@ -0,0 +1,11 @@
+<?php
+namespace phorkie;
+/**
+ * Show an access denied error
+ */
+
+render(
+    'forbidden'
+);
+exit();
+?>

diff --git a/www/fork.php b/www/fork.php
index 64dceb92a860ea9ce869d1012722fb8c53c8d784..3d1c4b73d1979d2bb8b8e9813d58579b47261715 100644 (file)
--- a/www/fork.php
+++ b/www/fork.php
@@ -4,9 +4,6 @@
  */
 namespace phorkie;
 require_once 'www-header.php';
  */
 namespace phorkie;
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] > 0) {
-    include_once 'secure.php';
-}

 
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     throw new Exception_Input('Forking only possible via POST');
 
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     throw new Exception_Input('Forking only possible via POST');

diff --git a/www/index.php b/www/index.php
index 7ac6fcfbc868cefd485775280c4a3cec1e04e081..18018313aa3ce76b2770bbbd575b5367ff28fa09 100644 (file)
--- a/www/index.php
+++ b/www/index.php
@@ -3,6 +3,11 @@
  * Jump to the index as per the configuration
  */
 namespace phorkie;
  * Jump to the index as per the configuration
  */
 namespace phorkie;

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 require_once 'www-header.php';

-require_once $GLOBALS['phorkie']['cfg']['index'].".php";
+
+header(
+    'Location: '
+    . Tools::fullUrl('/' . $GLOBALS['phorkie']['cfg']['index'])
+);

 ?>
 ?>

diff --git a/www/list.php b/www/list.php
index 5a394ebac52aad2037a91b7503f2ac0343199cfa..721d20c547370e541d8ff3c6f5528d73d2b176f6 100644 (file)
--- a/www/list.php
+++ b/www/list.php
@@ -3,10 +3,8 @@
  * List a repository
  */
 namespace phorkie;
  * List a repository
  */
 namespace phorkie;

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] == 2) {
-    include_once 'secure.php';
-}

 $rs = new Repositories();
 
 $page = 0;
 $rs = new Repositories();
 
 $page = 0;

diff --git a/www/login.php b/www/login.php
index f05f98014e0cf679b1099c849294ed32c66d632b..b8cb5124f4ed738b0ac40d34ad9ebe42be5f62c6 100644 (file)
--- a/www/login.php
+++ b/www/login.php
@@ -18,6 +18,7 @@ set_include_path(
     . PATH_SEPARATOR . get_include_path()
 );
 
     . PATH_SEPARATOR . get_include_path()
 );
 

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 require_once 'openid/config.php';
 
 require_once 'www-header.php';
 require_once 'openid/config.php';
 

diff --git a/www/new.php b/www/new.php
index 0675b4d3b0d1d8c78edff6b228f895da3d144935..5d370f524344adeafd0d32a0fbc7a6a52d6a68a6 100644 (file)
--- a/www/new.php
+++ b/www/new.php
@@ -10,10 +10,8 @@ namespace phorkie;
  *
  * Creates and redirects to display page
  */
  *
  * Creates and redirects to display page
  */

+$pageRequiresLogin = true;

 require_once 'www-header.php';
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] > 0) {
-    include_once 'secure.php';
-}

 
 $repopo = new Repository_Post();
 if ($repopo->process($_POST, $_SESSION)) {
 
 $repopo = new Repository_Post();
 if ($repopo->process($_POST, $_SESSION)) {

diff --git a/www/raw.php b/www/raw.php
index 6b20633920da1c7217e408212931a04477203ad2..634576db1dcceccca35e47ee98fd5bbb2a543a5a 100644 (file)
--- a/www/raw.php
+++ b/www/raw.php
@@ -1,12 +1,11 @@
 <?php
 <?php

+namespace phorkie;

 /**
  * Displays a file
  */
 /**
  * Displays a file
  */

-namespace phorkie;
+$pageRequiresLogin = false;

 require_once 'www-header.php';
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] == 2) {
-    include_once 'secure.php';
-}
+

 $repo = new Repository();
 $repo->loadFromRequest();
 
 $repo = new Repository();
 $repo->loadFromRequest();
 

diff --git a/www/revision.php b/www/revision.php
index 06462afa72f9e6af525241a65e2c4700ce212074..c4ce9e8eb2b98a3893c9c10dd28919293138c63e 100644 (file)
--- a/www/revision.php
+++ b/www/revision.php
@@ -1,12 +1,10 @@
 <?php
 namespace phorkie;
 /**
 <?php
 namespace phorkie;
 /**

- * Display paste contents
+ * Display historic paste contents

  */
  */

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 require_once 'www-header.php';

-if ($GLOBALS['phorkie']['auth']['secure'] == 2) {
-    require_once 'secure.php';
-}

 
 $repo = new Repository();
 $repo->loadFromRequest();
 
 $repo = new Repository();
 $repo->loadFromRequest();

diff --git a/www/search.php b/www/search.php
index cb72c6aa8c64cfacd1980b7354127a61d1631ce9..87019112ad7eee235c880bad31dab9ef58bf43d3 100644 (file)
--- a/www/search.php
+++ b/www/search.php
@@ -3,6 +3,7 @@ namespace phorkie;
 /**
  * Search for a search term
  */
 /**
  * Search for a search term
  */

+$pageRequiresLogin = false;

 require_once 'www-header.php';
 
 if (!isset($_GET['q']) || $_GET['q'] == '') {
 require_once 'www-header.php';
 
 if (!isset($_GET['q']) || $_GET['q'] == '') {

diff --git a/www/user.php b/www/user.php
index fd851c4ebfd627270ba0019c9cec51d18ef6b655..8f305da7ab38c4d321aa02cf9482c30c257e5a25 100644 (file)
--- a/www/user.php
+++ b/www/user.php
@@ -4,9 +4,6 @@
  */
 namespace phorkie;
 require_once 'www-header.php';
  */
 namespace phorkie;
 require_once 'www-header.php';

-if (!isset($_SESSION['identity'])) {
-    include_once 'secure.php';
-}

 
 if (isset($_POST['name'])) {
     $_SESSION['name'] = substr(filter_var($_POST['name'], FILTER_SANITIZE_STRING), 0, 35);
 
 if (isset($_POST['name'])) {
     $_SESSION['name'] = substr(filter_var($_POST['name'], FILTER_SANITIZE_STRING), 0, 35);

diff --git a/www/www-header.php b/www/www-header.php
index c8403152105d86e350f123340af274a4ad2c2f0d..290e680015900ca445bb25ad599e0d3779837f6f 100644 (file)
--- a/www/www-header.php
+++ b/www/www-header.php
@@ -72,6 +72,8 @@ $twig = new \Twig_Environment(
 );
 //$twig->addExtension(new \Twig_Extension_Debug());
 
 );
 //$twig->addExtension(new \Twig_Extension_Debug());
 

+require __DIR__ . '/www-security.php';
+

 function render($tplname, $vars = array())
 {
     $vars['css'] = $GLOBALS['phorkie']['cfg']['css'];
 function render($tplname, $vars = array())
 {
     $vars['css'] = $GLOBALS['phorkie']['cfg']['css'];

diff --git a/www/www-security.php b/www/www-security.php
new file mode 100644 (file)
index 0000000..241f866
--- /dev/null
+++ b/www/www-security.php
@@ -0,0 +1,40 @@
+<?php
+namespace phorkie;
+/**
+ * security levels + login requirement:
+ */
+
+if (!isset($GLOBALS['phorkie']['auth']['secure'])) {
+    //not set? highest level of security
+    $GLOBALS['phorkie']['auth']['secure'] = 2;
+}
+
+if ($GLOBALS['phorkie']['auth']['secure'] == 0) {
+    //everyone may do everything
+    return;
+}
+
+$logged_in = false;
+if (!isset($_SESSION['identity'])) {
+    //not logged in 
+} else if ($GLOBALS['phorkie']['auth']['userlist']) {
+    if (in_array($_SESSION['identity'], $GLOBALS['phorkie']['users'])) {
+        $logged_in = true;
+    }
+} else {
+    //session identity exists, no special checks required
+    $logged_in = true;
+}
+
+if ($logged_in) {
+    //logged in? all fine
+    return;
+} else if ($GLOBALS['phorkie']['auth']['secure'] == 2) {
+    //not logged in and security level 2 => error
+    require 'forbidden.php';
+} else if (isset($pageRequiresLogin) && !$pageRequiresLogin) {
+    return;
+}
+
+require 'forbidden.php';
+?>
\ No newline at end of file