summaryrefslogtreecommitdiffstats
path: root/glpi-security2.patch
diff options
context:
space:
mode:
Diffstat (limited to 'glpi-security2.patch')
-rw-r--r--glpi-security2.patch292
1 files changed, 292 insertions, 0 deletions
diff --git a/glpi-security2.patch b/glpi-security2.patch
new file mode 100644
index 0000000..254c47a
--- /dev/null
+++ b/glpi-security2.patch
@@ -0,0 +1,292 @@
+From 9cd45a1ec1932189fc5295e0f9978b36ab5eecaa Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Wed, 27 Mar 2019 14:55:25 +0100
+Subject: [PATCH] Fix/cookie auth (#5562) * prevent timed attack * add new
+ field for storing cookie token and reverse the verification (we store the
+ hash on our side and not client side)
+
+Backported from 9.4 26900a5e53a5ad347d20a947eb5f7e2b447fef9f
+
+Check cookie validity on glpi side
+
+Backported from 9.4 a3ab29c77c6fc7a45a7b0ef71c4442aee62acda6
+
+Hack for DB Schema
+
+As 9.3.3 use dbschema 9.3.2, we can switch to 9.3.3
+Migration detection use dbversion, so will be raised
+Script execution use version, which allow to keep it unchanged
+More 9.4 is aware of 9.3.3 (not of 9.4)
+---
+ inc/auth.class.php | 19 ++++-------
+ inc/define.php | 2 +-
+ inc/update.class.php | 7 +++-
+ inc/user.class.php | 64 ++++++++++++++++++++++++++++++------
+ install/mysql/glpi-empty.sql | 10 +++---
+ install/update_932_933.php | 63 +++++++++++++++++++++++++++++++++++
+ 6 files changed, 136 insertions(+), 29 deletions(-)
+ create mode 100644 install/update_932_933.php
+
+diff --git a/inc/auth.class.php b/inc/auth.class.php
+index 707d7ab31..67d361653 100644
+--- a/inc/auth.class.php
++++ b/inc/auth.class.php
+@@ -500,11 +500,11 @@ class Auth extends CommonGLPI {
+ if (count($data) === 2) {
+ list ($cookie_id, $cookie_token) = $data;
+
+- $token = User::getToken($cookie_id, 'personal_token');
++ $user = new User();
++ $user->getFromDB($cookie_id);
++ $hash = $user->getAuthToken('cookie_token');
+
+- if ($token !== false && Auth::checkPassword($token, $cookie_token)) {
+- $user = new User();
+- $user->getFromDB($cookie_id); //true if $token is not false
++ if (Auth::checkPassword($cookie_token, $hash)) {
+ $this->user->fields['name'] = $user->fields['name'];
+ return true;
+ } else {
+@@ -848,12 +848,7 @@ class Auth extends CommonGLPI {
+ }
+
+ if ($this->auth_succeded && $CFG_GLPI['login_remember_time'] > 0 && $remember_me) {
+- $token = false;
+- if (!empty($this->user->fields['personal_token'])) {
+- $token = $this->user->fields['personal_token'];
+- } else {
+- $token = User::getToken($this->user->fields['id'], 'personal_token');
+- }
++ $token = $this->user->getAuthToken('cookie_token', true);
+
+ if ($token) {
+ //Cookie name (Allow multiple GLPI)
+@@ -861,11 +856,9 @@ class Auth extends CommonGLPI {
+ //Cookie session path
+ $cookie_path = ini_get('session.cookie_path');
+
+- $hash = Auth::getPasswordHash($token);
+-
+ $data = json_encode([
+ $this->user->fields['id'],
+- $hash,
++ $token,
+ ]);
+
+ //Send cookie to browser
+diff --git a/inc/define.php b/inc/define.php
+index 78125529e..22830bc05 100644
+--- a/inc/define.php
++++ b/inc/define.php
+@@ -41,7 +41,7 @@ if (substr(GLPI_VERSION, -4) === '-dev') {
+ );
+ } else {
+ //for stable version
+- define("GLPI_SCHEMA_VERSION", '9.3.2');
++ define("GLPI_SCHEMA_VERSION", '9.3.3');
+ }
+ define('GLPI_MIN_PHP', '5.6.0'); // Must also be changed in top of index.php
+ define('GLPI_YEAR', '2018');
+diff --git a/inc/update.class.php b/inc/update.class.php
+index fec2271c0..e3da3c9f0 100644
+--- a/inc/update.class.php
++++ b/inc/update.class.php
+@@ -431,7 +431,12 @@ class Update extends CommonGLPI {
+ case "9.3.1":
+ include_once "{$updir}update_931_932.php";
+ update931to932();
+- break;
++
++ case "9.3.2":
++ case "9.3.3":
++ // post 9.3.3
++ include_once "{$updir}update_932_933.php";
++ update932to933();
+
+ case GLPI_VERSION:
+ case GLPI_SCHEMA_VERSION:
+diff --git a/inc/user.class.php b/inc/user.class.php
+index 67bfc7149..d4139edfa 100644
+--- a/inc/user.class.php
++++ b/inc/user.class.php
+@@ -4595,26 +4595,70 @@ class User extends CommonDBTM {
+ }
+
+
+- /**
++ /**
++ * Get token of a user. If it does not exists then generate it.
++ *
++ * @since 9.4
++ *
++ * @param string $field the field storing the token
++ * @param boolean $force_new force generation of a new token
++ *
++ * @return string|false token or false in case of error
++ */
++ public function getAuthToken($field = 'personal_token', $force_new = false) {
++ global $CFG_GLPI;
++
++ if ($this->isNewItem()) {
++ return false;
++ }
++
++ // check date validity for cookie token
++ $outdated = false;
++ if ($field === 'cookie_token') {
++ $date_create = new DateTime($this->fields[$field."_date"]);
++ $date_expir = $date_create->add(new DateInterval('PT'.$CFG_GLPI["login_remember_time"].'S'));
++
++ if ($date_expir < new DateTime()) {
++ $outdated = true;
++ }
++ }
++
++ // token exists, is not oudated, and we may use it
++ if (!empty($this->fields[$field]) && !$force_new && !$outdated) {
++ return $this->fields[$field];
++ }
++
++ // else get a new token
++ $token = self::getUniqueToken($field);
++
++ // for cookie token, we need to store it hashed
++ $hash = $token;
++ if ($field === 'cookie_token') {
++ $hash = Auth::getPasswordHash($token);
++ }
++
++ // save this token in db
++ $this->update(['id' => $this->getID(),
++ $field => $hash,
++ $field . "_date" => $_SESSION['glpi_currenttime']]);
++
++ return $token;
++ }
++
++/**
+ * Get token of a user. If not exists generate it.
+ *
+ * @param integer $ID User ID
+ * @param string $field Field storing the token
++ * @param boolean $force_new force generation of a new token
+ *
+ * @return string|boolean User token, false if user does not exist
+ */
+- static function getToken($ID, $field = 'personal_token') {
++ static function getToken($ID, $field = 'personal_token', $force_new = false) {
+
+ $user = new self();
+ if ($user->getFromDB($ID)) {
+- if (!empty($user->fields[$field])) {
+- return $user->fields[$field];
+- }
+- $token = self::getUniqueToken($field);
+- $user->update(['id' => $user->getID(),
+- $field => $token,
+- $field . "_date" => $_SESSION['glpi_currenttime']]);
+- return $user->fields[$field];
++ return $user->getAuthToken($field, $force_new);
+ }
+
+ return false;
+diff --git a/install/mysql/glpi-empty.sql b/install/mysql/glpi-empty.sql
+index abfe14600..14d6976c9 100644
+--- a/install/mysql/glpi-empty.sql
++++ b/install/mysql/glpi-empty.sql
+@@ -8850,6 +8850,8 @@ CREATE TABLE `glpi_users` (
+ `personal_token_date` datetime DEFAULT NULL,
+ `api_token` varchar(255) COLLATE utf8_unicode_ci DEFAULT NULL,
+ `api_token_date` datetime DEFAULT NULL,
++ `cookie_token` varchar(255) COLLATE utf8_unicode_ci DEFAULT NULL,
++ `cookie_token_date` datetime DEFAULT NULL,
+ `display_count_on_home` int(11) DEFAULT NULL,
+ `notification_to_myself` tinyint(1) DEFAULT NULL,
+ `duedateok_color` varchar(255) COLLATE utf8_unicode_ci DEFAULT NULL,
+@@ -8900,10 +8902,10 @@ CREATE TABLE `glpi_users` (
+ KEY `sync_field` (`sync_field`)
+ ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
+
+-INSERT INTO `glpi_users` VALUES ('2','glpi','$2y$10$rXXzbc2ShaiCldwkw4AZL.n.9QSH7c0c9XJAyyjrbL9BwmWditAYm','','','','',NULL,'0',NULL,'0','20','1',NULL,'0','1','2014-06-18 08:02:24','2014-06-18 08:02:24',NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
+-INSERT INTO `glpi_users` VALUES ('3','post-only','$2y$10$dTMar1F3ef5X/H1IjX9gYOjQWBR1K4bERGf4/oTPxFtJE/c3vXILm','','','','',NULL,'0','en_GB','0','20','1',NULL,'0','1',NULL,NULL,NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
+-INSERT INTO `glpi_users` VALUES ('4','tech','$2y$10$.xEgErizkp6Az0z.DHyoeOoenuh0RcsX4JapBk2JMD6VI17KtB1lO','','','','',NULL,'0','en_GB','0','20','1',NULL,'0','1',NULL,NULL,NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
+-INSERT INTO `glpi_users` VALUES ('5','normal','$2y$10$Z6doq4zVHkSPZFbPeXTCluN1Q/r0ryZ3ZsSJncJqkN3.8cRiN0NV.','','','','',NULL,'0','en_GB','0','20','1',NULL,'0','1',NULL,NULL,NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
++INSERT INTO `glpi_users` VALUES ('2','glpi','$2y$10$rXXzbc2ShaiCldwkw4AZL.n.9QSH7c0c9XJAyyjrbL9BwmWditAYm','','','','',NULL,'0',NULL,'0','20','1',NULL,'0','1','2014-06-18 08:02:24','2014-06-18 08:02:24',NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
++INSERT INTO `glpi_users` VALUES ('3','post-only','$2y$10$dTMar1F3ef5X/H1IjX9gYOjQWBR1K4bERGf4/oTPxFtJE/c3vXILm','','','','',NULL,'0','en_GB','0','20','1',NULL,'0','1',NULL,NULL,NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
++INSERT INTO `glpi_users` VALUES ('4','tech','$2y$10$.xEgErizkp6Az0z.DHyoeOoenuh0RcsX4JapBk2JMD6VI17KtB1lO','','','','',NULL,'0','en_GB','0','20','1',NULL,'0','1',NULL,NULL,NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
++INSERT INTO `glpi_users` VALUES ('5','normal','$2y$10$Z6doq4zVHkSPZFbPeXTCluN1Q/r0ryZ3ZsSJncJqkN3.8cRiN0NV.','','','','',NULL,'0','en_GB','0','20','1',NULL,'0','1',NULL,NULL,NULL,'0','0','0','0','0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,'0',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,0,'',NULL);
+
+ ### Dump table glpi_usertitles
+
+diff --git a/install/update_932_933.php b/install/update_932_933.php
+new file mode 100644
+index 000000000..240c5cb00
+--- /dev/null
++++ b/install/update_932_933.php
+@@ -0,0 +1,63 @@
++<?php
++/**
++ * ---------------------------------------------------------------------
++ * GLPI - Gestionnaire Libre de Parc Informatique
++ * Copyright (C) 2015-2017 Teclib' and contributors.
++ *
++ * http://glpi-project.org
++ *
++ * based on GLPI - Gestionnaire Libre de Parc Informatique
++ * Copyright (C) 2003-2014 by the INDEPNET Development Team.
++ *
++ * ---------------------------------------------------------------------
++ *
++ * LICENSE
++ *
++ * This file is part of GLPI.
++ *
++ * GLPI is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * GLPI is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with GLPI. If not, see <http://www.gnu.org/licenses/>.
++ * ---------------------------------------------------------------------
++ */
++
++/** @file
++* @brief
++*/
++
++/**
++ * Update from 9.3.2 to 9.3.3 (DB schema version, introduced post 9.3.3)
++ *
++ * @return bool for success (will die for most error)
++**/
++function update932to933() {
++ global $DB, $migration, $CFG_GLPI;
++
++ $current_config = Config::getConfigurationValues('core');
++ $updateresult = true;
++ $ADDTODISPLAYPREF = [];
++
++ //TRANS: %s is the number of new version
++ $migration->displayTitle(sprintf(__('Update to %s'), '9.3.3'));
++ $migration->setVersion('9.3.3');
++
++ // Create a dedicated token for rememberme process
++ if (!$DB->fieldExists('glpi_users', 'cookie_token')) {
++ $migration->addField('glpi_users', 'cookie_token', 'string', ['after' => 'api_token_date']);
++ $migration->addField('glpi_users', 'cookie_token_date', 'datetime', ['after' => 'cookie_token']);
++ }
++
++ // ************ Keep it at the end **************
++ $migration->executeMigration();
++
++ return $updateresult;
++}
+--
+2.20.1
+