diff --git a/ecrire/action/cookie.php b/ecrire/action/cookie.php
index a1a44260aab3ed80e40df496664458b4b282f381..0b47999a5544d80490e094f9974d1e6e6118843f 100644
--- a/ecrire/action/cookie.php
+++ b/ecrire/action/cookie.php
@@ -40,8 +40,17 @@ function action_cookie_dist() {
// tentative de connexion en auth_http
if (_request('essai_auth_http') AND !$GLOBALS['ignore_auth_http']) {
- auth_http($redirect);
- return;
+ include_spip('inc/auth');
+ if (@$_SERVER['PHP_AUTH_USER']
+ AND @$_SERVER['PHP_AUTH_PW']
+ AND lire_php_auth($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']))
+ redirige_par_entete($redirect);
+ else ask_php_auth(_T('info_connexion_refusee'),
+ _T('login_login_pass_incorrect'),
+ _T('login_retour_site'),
+ "url=".rawurlencode($redirect),
+ _T('login_nouvelle_tentative'),
+ (strpos($url,_DIR_RESTREINT_ABS)!==false));
}
// en cas de login sur bonjour=oui, on tente de poser un cookie
diff --git a/ecrire/action/logout.php b/ecrire/action/logout.php
index ca813c3cb0b0d90b259c19dc1f4e75dd765979df..82c36ff1fc2025061319dcafd3d6f5cd95192d6d 100644
--- a/ecrire/action/logout.php
+++ b/ecrire/action/logout.php
@@ -37,7 +37,6 @@ function action_logout_dist()
// si authentification http, et que la personne est loge,
// pour se deconnecter, il faut proposer un nouveau formulaire de connexion http
if (isset($_SERVER['PHP_AUTH_USER']) AND !$ignore_auth_http AND $GLOBALS['auth_can_disconnect']) {
- include_spip('inc/actions');
ask_php_auth(_T('login_deconnexion_ok'),
_T('login_verifiez_navigateur'),
_T('login_retour_public'),
diff --git a/ecrire/base/connect_sql.php b/ecrire/base/connect_sql.php
index 49a320b35f1699a987c4010bf1c979d13e15c4c8..89d4ca4140d9fece5559d2aaa83fbdefcefb3163 100644
--- a/ecrire/base/connect_sql.php
+++ b/ecrire/base/connect_sql.php
@@ -218,7 +218,7 @@ function spip_connect_main($connexion)
function spip_connect_ldap($serveur='') {
$connexion = spip_connect($serveur);
if (!is_array($connexion['ldap'])) {
- if (isset($connexion['authentification']['ldap'])) {
+ if ($connexion['authentification']['ldap']) {
$f = _DIR_CONNECT . $connexion['authentification']['ldap'];
unset($GLOBALS['ldap_link']);
if (is_readable($f)) include_once($f);
diff --git a/ecrire/inc/actions.php b/ecrire/inc/actions.php
index 043856d4f1320d291bf0b7157886181677b9cfee..7e657fa9515ed64174ac825993a3ad00cadc1f13 100644
--- a/ecrire/inc/actions.php
+++ b/ecrire/inc/actions.php
@@ -235,57 +235,4 @@ function determine_upload($type='') {
else
return sous_repertoire($repertoire, $GLOBALS['visiteur_session']['login']);
}
-
-//
-// Verif d'un utilisateur authentifie en php_auth
-//
-
-// http://doc.spip.org/@verifier_php_auth
-function verifier_php_auth() {
-
- if (@$_SERVER['PHP_AUTH_USER'] && $_SERVER['PHP_AUTH_PW']
- && !@$GLOBALS['ignore_auth_http']) {
- include_spip('inc/auth');
- if ($r = auth_identifier_login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) {
- $GLOBALS['visiteur_session'] = $r;
- return $GLOBALS['visiteur_session']['statut'];
- }
- }
- return false;
-}
-
-//
-// entete php_auth (est-encore utilise ?)
-//
-// http://doc.spip.org/@ask_php_auth
-function ask_php_auth($pb, $raison, $retour, $url='', $re='', $lien='') {
- @Header("WWW-Authenticate: Basic realm=\"espace prive\"");
- @Header("HTTP/1.0 401 Unauthorized");
- $ici = generer_url_ecrire();
- echo "<b>$pb</b><p>$raison</p>[<a href='$ici'>$retour</a>] ";
- if ($url) {
- echo "[<a href='", generer_url_action('cookie',"essai_auth_http=oui&$url"), "'>$re</a>]";
- }
-
- if ($lien)
- echo " [<a href='$ici'>"._T('login_espace_prive')."</a>]";
- exit;
-}
-
-// Verifie si le visiteur est authentifie en http,
-// sinon lui renvoie une demande (status 401)
-// http://doc.spip.org/@auth_http
-function auth_http($url) {
-
- if (verifier_php_auth())
- redirige_par_entete($url);
- else {
- ask_php_auth(_T('info_connexion_refusee'),
- _T('login_login_pass_incorrect'),
- _T('login_retour_site'),
- "url=".rawurlencode($url),
- _T('login_nouvelle_tentative'),
- (strpos($url,_DIR_RESTREINT_ABS)!==false));
- }
-}
?>
diff --git a/ecrire/inc/auth.php b/ecrire/inc/auth.php
index aacc568198a76705361003a3f732d33beae2635c..7ff438258d794e63d4d856e41da7679e37d61eda 100644
--- a/ecrire/inc/auth.php
+++ b/ecrire/inc/auth.php
@@ -157,8 +157,7 @@ function auth_mode()
if (!$ignore_auth_http) {
if (isset($_SERVER['PHP_AUTH_USER'])
AND isset($_SERVER['PHP_AUTH_PW'])) {
- include_spip('inc/actions');
- if ($r = auth_identifier_login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) {
+ if ($r = lire_php_auth($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) {
if (!$id_auteur) {
$_SERVER['PHP_AUTH_PW'] = '';
$auth_can_disconnect = true;
@@ -497,4 +496,33 @@ function auth_synchroniser_distant($auth_methode, $id_auteur, $champs){
return auth_administrer('synchroniser_distant',$args);
}
+
+function lire_php_auth($login, $pw)
+{
+ $row = sql_fetsel('*', 'spip_auteurs', 'login=' . sql_quote($login));
+ if (!$row) return false;
+ if (!$row['source'])
+ return ($row['pass'] == md5($row['alea_actuel'] . $pw)) ? $row : false;
+ $auth = charger_fonction($row['source'], 'auth', true);
+ if ($auth) return $auth($login, $pw);
+ return false;
+}
+
+//
+// entete php_auth (est-encore utilise ?)
+//
+// http://doc.spip.org/@ask_php_auth
+function ask_php_auth($pb, $raison, $retour, $url='', $re='', $lien='') {
+ @Header("WWW-Authenticate: Basic realm=\"espace prive\"");
+ @Header("HTTP/1.0 401 Unauthorized");
+ $ici = generer_url_ecrire();
+ echo "<b>$pb</b><p>$raison</p>[<a href='$ici'>$retour</a>] ";
+ if ($url) {
+ echo "[<a href='", generer_url_action('cookie',"essai_auth_http=oui&$url"), "'>$re</a>]";
+ }
+
+ if ($lien)
+ echo " [<a href='$ici'>"._T('login_espace_prive')."</a>]";
+ exit;
+}
?>
\ No newline at end of file
diff --git a/ecrire/inc/utils.php b/ecrire/inc/utils.php
index 9f2ca945b5342078475da7de6df6ea3ab1b65394..b8efb49d63e9c778755f293a830386baaa2adc57 100644
--- a/ecrire/inc/utils.php
+++ b/ecrire/inc/utils.php
@@ -1513,8 +1513,8 @@ function verifier_visiteur() {
return 0;
}
- if (isset($_COOKIE['spip_session']) OR isset($_COOKIE[$GLOBALS['cookie_prefix'].'_session']) OR
- (isset($_SERVER['PHP_AUTH_USER']) AND !$GLOBALS['ignore_auth_http'])) {
+ $h = (isset($_SERVER['PHP_AUTH_USER']) AND !$GLOBALS['ignore_auth_http']);
+ if ($h OR isset($_COOKIE['spip_session']) OR isset($_COOKIE[$GLOBALS['cookie_prefix'].'_session'])) {
// Rq: pour que cette fonction marche depuis mes_options
// il faut forcer l'init si ce n'est fait
@@ -1532,8 +1532,14 @@ function verifier_visiteur() {
if ($session()) {
return $GLOBALS['visiteur_session']['statut'];
}
- include_spip('inc/actions');
- return verifier_php_auth();
+ if ($h AND isset($_SERVER['PHP_AUTH_PW'])) {
+ include_spip('inc/auth');
+ $h = lire_php_auth($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
+ }
+ if ($h) {
+ $GLOBALS['visiteur_session'] = $h;
+ return $GLOBALS['visiteur_session']['statut'];
+ }
}
// au moins son navigateur nous dit la langue preferee de cet inconnu
include_spip('inc/lang');