dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove session from provisioning (#7014)

Browse Source 
* use single database object, use settings class

* add common domain functions

* use settings class
This commit is contained in:
frytimo
2024-06-22 19:28:04 -06:00
committed by GitHub
parent 81af0fefd1
commit fcd64fcce6
4 changed files with 54 additions and 943 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/devices/device_edit.php
+15 -20
View File
@@ -44,8 +44,14 @@
$device_firmware_version = '';
$device_template ='';
//include the device class
require_once "app/devices/resources/classes/device.php";
//get the domain uuid
$domain_uuid = $_SESSION['domain_uuid'] ?? '';
//initialize the database object
$database = database::new();
//initialize the settigns object
$settings = new settings(['database' => $database, 'domain_uuid' => $domain_uuid]);
//action add or update
if (!empty($_REQUEST["id"]) && is_uuid($_REQUEST["id"])) {
@@ -56,12 +62,11 @@
$action = "add";
}
//get total device count from the database, check limit, if defined
//get the total device count from the database, check the limit, if defined
if ($action == 'add') {
if (!empty($_SESSION['limit']['devices']['numeric']) && $_SESSION['limit']['devices']['numeric']) {
$sql = "select count(*) from v_devices where domain_uuid = :domain_uuid ";
$parameters['domain_uuid'] = $_SESSION['domain_uuid'];
$database = new database;
$total_devices = $database->select($sql, $parameters, 'column');
if ($total_devices >= $_SESSION['limit']['devices']['numeric']) {
message::add($text['message-maximum_devices'].' '.$_SESSION['limit']['devices']['numeric'], 'negative');
@@ -101,7 +106,6 @@
$sql = "select device_address from v_devices ";
$sql .= "where device_uuid = :device_uuid ";
$parameters['device_uuid'] = $device_uuid;
$database = new database;
$row = $database->select($sql, $parameters, 'row');
if (is_array($row) && @sizeof($row) != 0) {
$device_address = $row["device_address"];
@@ -224,7 +228,6 @@
$sql .= " and d1.device_uuid <> :device_uuid ";
}
$parameters['device_address'] = $device_address;
$database = new database;
$domain_name = $database->select($sql, $parameters, 'column');
if ($domain_name != '') {
$message = $text['message-duplicate'].(if_group("superadmin") && $_SESSION["domain_name"] != $domain_name ? ": ".$domain_name : null);
@@ -436,7 +439,6 @@
}
//save the device
$database = new database;
$database->app_name = 'devices';
$database->app_uuid = '4efa1a1a-32e7-bf83-534b-6c8299958a8e';
$database->save($array);
@@ -479,7 +481,7 @@
//write the provision files
if (!empty($_SESSION['provision']['path']['text'])) {
$prov = new provision;
$prov = new provision(['settings' => $settings]);
$prov->domain_uuid = $domain_uuid;
$response = $prov->write();
}
@@ -507,7 +509,7 @@
$sql = "select * from v_devices ";
$sql .= "where device_uuid = :device_uuid ";
$parameters['device_uuid'] = $device_uuid;
$database = new database;
$row = $database->select($sql, $parameters, 'row');
if (is_array($row) && @sizeof($row) != 0) {
$device_address = $row["device_address"];
@@ -556,7 +558,6 @@
$sql .= "and device_uuid = :device_uuid ";
$parameters['domain_uuid'] = $domain_uuid;
$parameters['device_uuid'] = $device_uuid_alternate;
$database = new database;
$device_alternate = $database->select($sql, $parameters, 'all');
unset($sql, $parameters);
}
@@ -566,7 +567,7 @@
$sql .= "where device_uuid = :device_uuid ";
$sql .= "order by cast(line_number as int) asc ";
$parameters['device_uuid'] = $device_uuid ?? null;
$database = new database;
$device_lines = $database->select($sql, $parameters, 'all');
unset($sql, $parameters);
@@ -606,7 +607,6 @@
$sql .= "else 100 end, ";
$sql .= $db_type == "mysql" ? "device_key_id asc " : "cast(device_key_id as numeric) asc ";
$parameters['device_uuid'] = $device_uuid ?? null;
$database = new database;
$device_keys = $database->select($sql, $parameters, 'all');
unset($sql, $parameters);
@@ -638,7 +638,7 @@
$sql .= "from v_device_vendors ";
$sql .= "where enabled = 'true' ";
$sql .= "order by name asc ";
$database = new database;
$device_vendors = $database->select($sql, null, 'all');
unset($sql);
@@ -649,7 +649,6 @@
$sql .= "and v.enabled = 'true' ";
$sql .= "and f.enabled = 'true' ";
$sql .= "order by v.name asc, f.type asc ";
$database = new database;
$vendor_functions = $database->select($sql, null, 'all');
unset($sql);
@@ -658,7 +657,6 @@
$sql .= "where device_uuid = :device_uuid ";
$sql .= "order by device_setting_subcategory asc ";
$parameters['device_uuid'] = $device_uuid ?? null;
$database = new database;
$device_settings = $database->select($sql, $parameters, 'all');
unset($sql, $parameters);
@@ -686,7 +684,6 @@
$sql .= "and user_enabled = 'true' ";
$sql .= "order by username asc ";
$parameters['domain_uuid'] = $domain_uuid;
$database = new database;
$users = $database->select($sql, $parameters, 'all');
unset($sql, $parameters);
@@ -1007,7 +1004,7 @@
}
if (permission_exists("device_files")) {
//get the template directory
$prov = new provision;
$prov = new provision(['settings' => $settings]);
$prov->domain_uuid = $domain_uuid;
$template_dir = $prov->template_dir;
$files = glob($template_dir.'/'.$device_template.'/*');
@@ -1017,8 +1014,7 @@
echo " <option value=''>".$text['label-download']."</option>\n";
foreach ($files as $file) {
//format the device address
$format = new provision();
$address = $format->format_address($device_address, $device_vendor);
$address = $prov->format_address($device_address, $device_vendor);
//render the file name
$file_name = str_replace("{\$address}", $address, basename($file));
$file_name = str_replace("{\$mac}", $address, basename($file_name));
@@ -1458,7 +1454,6 @@
$sql .= "where (domain_uuid = :domain_uuid or domain_uuid is null) ";
$sql .= "order by device_profile_name asc ";
$parameters['domain_uuid'] = $domain_uuid;
$database = new database;
$device_profiles = $database->select($sql, $parameters, 'all');
if (is_array($device_profiles) && @sizeof($device_profiles) != 0) {
echo " <tr>";
app/provision/app_defaults.php
+5 -10
View File
@@ -31,9 +31,9 @@ if ($domains_processed == 1) {
$sql = "select device_uuid, device_address ";
$sql .= "from v_devices ";
$sql .= "where (device_address like '%-%' or device_address like '%:%') ";
$database = new database;
$database = database::new();
$result = $database->select($sql, null, 'all');
if (is_array($result) && @sizeof($result) != 0) {
if (!empty($result)) {
foreach ($result as $row) {
//define update values
$device_uuid = $row["device_uuid"];
@@ -47,7 +47,6 @@ if ($domains_processed == 1) {
$p = new permissions;
$p->add('device_add', 'temp');
//execute update
$database = new database;
$database->app_name = 'provision';
$database->app_uuid = 'abf28ead-92ef-3de6-ebbb-023fbc2b6dd3';
$database->save($array, false);
@@ -56,7 +55,7 @@ if ($domains_processed == 1) {
$p->delete('device_add', 'temp');
}
}
unset($sql, $result, $row);
unset($sql, $result, $row, $p);
//update http_auth_enabled set to true
$sql = "select count(*) from v_default_settings ";
@@ -73,15 +72,14 @@ if ($domains_processed == 1) {
$p->add('default_setting_edit', 'temp');
//execute update
$database = new database;
$database->app_name = 'provision';
$database->app_uuid = 'abf28ead-92ef-3de6-ebbb-023fbc2b6dd3';
$database->save($array, false);
unset($array);
//grant temporary permissions
$p = new permissions;
//revoke temporary permissions
$p->delete('default_setting_edit', 'temp');
unset($p);
}
unset($sql);
@@ -95,7 +93,6 @@ if ($domains_processed == 1) {
$sql .= "and default_setting_name = 'text' ";
$sql .= "and default_setting_value = 'false' ";
$sql .= "and default_setting_enabled = 'false' ";
$database = new database;
$database->execute($sql);
//update default settings
@@ -104,7 +101,6 @@ if ($domains_processed == 1) {
$sql .= "where default_setting_category = 'provision' ";
$sql .= "and default_setting_subcategory = 'http_auth_password' ";
$sql .= "and default_setting_name = 'text' ";
$database = new database;
$database->execute($sql);
//update domain settings
@@ -113,7 +109,6 @@ if ($domains_processed == 1) {
$sql .= "where domain_setting_category = 'provision' ";
$sql .= "and domain_setting_subcategory = 'http_auth_password' ";
$sql .= "and domain_setting_name = 'text' ";
$database = new database;
$database->execute($sql);
}
app/provision/index.php
+34 -120
View File
@@ -36,6 +36,7 @@
$file_count = 0;
$row_count = 0;
$device_template = '';
$database = database::new(); //use an existing connection if possible
//define PHP variables from the HTTP values
if (isset($_REQUEST['address'])) {
@@ -165,14 +166,12 @@
$sql .= "where device_address = :device_address ";
$sql .= "and d.domain_uuid = n.domain_uuid; ";
$parameters['device_address'] = $device_address;
$database = new database;
$row = $database->select($sql, $parameters, 'row');
if (is_array($row)) {
$device_uuid = $row['device_uuid'];
$domain_uuid = $row['domain_uuid'];
$domain_name = $row['domain_name'];
$device_vendor = $row['device_vendor'];
$_SESSION['domain_uuid'] = $domain_uuid;
}
unset($sql, $parameters);
@@ -191,105 +190,6 @@
unset($sql, $parameters);
}
//get the default settings
$sql = "select * from v_default_settings ";
$sql .= "where default_setting_enabled = 'true' ";
$sql .= "order by default_setting_order asc ";
$database = new database;
$result = $database->select($sql, null, 'all');
//unset the previous settings
if (is_array($result) && @sizeof($result) != 0) {
foreach ($result as $row) {
unset($_SESSION[$row['default_setting_category']]);
}
//set the settings as a session
foreach ($result as $row) {
$name = $row['default_setting_name'];
$category = $row['default_setting_category'];
$subcategory = $row['default_setting_subcategory'];
if (empty($subcategory)) {
if ($name == "array") {
$_SESSION[$category][] = $row['default_setting_value'];
}
else {
$_SESSION[$category][$name] = $row['default_setting_value'];
}
}
else {
if ($name == "array") {
$_SESSION[$category][$subcategory][] = $row['default_setting_value'];
}
else {
$_SESSION[$category][$subcategory]['uuid'] = $row['default_setting_uuid'];
$_SESSION[$category][$subcategory][$name] = $row['default_setting_value'];
}
}
}
}
unset($sql, $result, $row);
//get the domains settings
if (is_uuid($domain_uuid)) {
$sql = "select * from v_domain_settings ";
$sql .= "where domain_uuid = :domain_uuid ";
$sql .= "and domain_setting_enabled = 'true' ";
$sql .= "order by domain_setting_order asc ";
$parameters['domain_uuid'] = $domain_uuid;
$database = new database;
$result = $database->select($sql, $parameters, 'all');
//unset the arrays that domains are overriding
if (is_array($result) && @sizeof($result) != 0) {
foreach ($result as $row) {
$name = $row['domain_setting_name'];
$category = $row['domain_setting_category'];
$subcategory = $row['domain_setting_subcategory'];
if ($name == "array") {
unset($_SESSION[$category][$subcategory]);
}
}
//set the settings as a session
foreach ($result as $row) {
$name = $row['domain_setting_name'];
$category = $row['domain_setting_category'];
$subcategory = $row['domain_setting_subcategory'];
if (empty($subcategory)) {
//$$category[$name] = $row['domain_setting_value'];
if ($name == "array") {
$_SESSION[$category][] = $row['domain_setting_value'];
}
else {
$_SESSION[$category][$name] = $row['domain_setting_value'];
}
}
else {
//$$category[$subcategory][$name] = $row['domain_setting_value'];
if ($name == "array") {
$_SESSION[$category][$subcategory][] = $row['domain_setting_value'];
}
else {
$_SESSION[$category][$subcategory][$name] = $row['domain_setting_value'];
}
}
}
}
}
//build the provision array
foreach($_SESSION['provision'] as $key=>$val) {
if (!empty($val['var'])) { $value = $val['var']; }
if (!empty($val['text'])) { $value = $val['text']; }
if (!empty($val['boolean'])) { $value = $val['boolean']; }
if (!empty($val['numeric'])) { $value = $val['numeric']; }
if (!empty($value)) { $provision[$key] = $value; }
unset($value);
}
//check if provisioning has been enabled
if ($provision["enabled"] != "true") {
syslog(LOG_WARNING, '['.$_SERVER['REMOTE_ADDR']."] provision attempt but provisioning is not enabled for ".escape($_REQUEST['mac']));
http_error('404');
}
//send a request to a remote server to validate the MAC address and secret
if (!empty($_SERVER['auth_server'])) {
$result = send_http_request($_SERVER['auth_server'], 'mac='.url_encode($_REQUEST['mac']).'&secret='.url_encode($_REQUEST['secret']));
@@ -304,15 +204,22 @@
$device_vendor = device::get_vendor($device_address);
}
//keep backwards compatibility
if (!empty($_SESSION['provision']["cidr"]["text"])) {
$_SESSION['provision']["cidr"][] = $_SESSION['provision']["cidr"]["text"];
//use settings object instead of session
$settings = new settings(['database' => $database, 'domain_uuid' => $domain_uuid]);
//check if provisioning has been enabled
if ($settings->get('provision', 'enabled', 'false') !== "true") {
syslog(LOG_WARNING, '['.$_SERVER['REMOTE_ADDR']."] provision attempt but provisioning is not enabled for ".escape($_REQUEST['mac']));
http_error('404');
}
//keep backwards compatibility
$provision_cidrs = $settings->get('provision','cidr', []);
//check the cidr range
if (!empty($_SESSION['provision']["cidr"]) && is_array($_SESSION['provision']["cidr"])) {
if (!empty($provision_cidrs)) {
$found = false;
foreach($_SESSION['provision']["cidr"] as $cidr) {
foreach($provision_cidrs as $cidr) {
if (check_cidr($cidr, $_SERVER['REMOTE_ADDR'])) {
$found = true;
break;
@@ -324,6 +231,10 @@
}
}
//get all provision settings
$provision = $settings->get('provision', null, []);
$auth_passwords = $settings->get('provision', 'http_auth_password', []);
//http authentication - digest
if (!empty($provision["http_auth_username"]) && empty($provision["http_auth_type"])) { $provision["http_auth_type"] = "digest"; }
if (!empty($provision["http_auth_username"]) && $provision["http_auth_type"] === "digest" && !empty($provision["http_auth_enabled"]) && $provision["http_auth_enabled"] === "true") {
@@ -353,7 +264,7 @@
}
//set the realm
$realm = $_SESSION['domain_name'];
$realm = $domain_name;
//request authentication
if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
@@ -361,7 +272,7 @@
}
//check for valid digest authentication details
if (isset($provision["http_auth_username"]) > 0 && strlen($provision["http_auth_username"])) {
if (isset($provision["http_auth_username"]) && strlen($provision["http_auth_username"]) > 0) {
if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) || ($data['username'] != $provision["http_auth_username"])) {
header('HTTP/1.1 401 Unauthorized');
header("Content-Type: text/html");
@@ -374,8 +285,9 @@
//generate the valid response
$authorized = false;
if (!$authorized && is_array($_SESSION['provision']["http_auth_password"])) {
foreach ($_SESSION['provision']["http_auth_password"] as $password) {
$auth_passwords = $settings->get('provision', 'http_auth_password', []);
if (!$authorized && is_array($auth_passwords)) {
foreach ($auth_passwords as $password) {
$A1 = md5($provision["http_auth_username"].':'.$realm.':'.$password);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);
@@ -399,7 +311,7 @@
//http authentication - basic
if (!empty($provision["http_auth_username"]) && $provision["http_auth_type"] === "basic" && $provision["http_auth_enabled"] === "true") {
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="'.$_SESSION['domain_name'].'"');
header('WWW-Authenticate: Basic realm="'.$domain_name.'"');
header('HTTP/1.0 401 Authorization Required');
header("Content-Type: text/html");
$content = 'Authorization Required';
@@ -409,20 +321,19 @@
}
else {
$authorized = false;
if (is_array($_SESSION['provision']["http_auth_password"])) {
foreach ($_SESSION['provision']["http_auth_password"] as $password) {
if ($_SERVER['PHP_AUTH_PW'] == $password) {
$authorized = true;
break;
}
foreach ($auth_passwords as $password) {
if ($_SERVER['PHP_AUTH_PW'] == $password) {
$authorized = true;
break;
}
unset($password);
}
unset($password, $auth_passwords);
if (!$authorized) {
//access denied
syslog(LOG_WARNING, '['.$_SERVER['REMOTE_ADDR']."] provision attempt but failed http basic authentication for ".check_str($_REQUEST['mac']));
header('HTTP/1.0 401 Unauthorized');
header('WWW-Authenticate: Basic realm="'.$_SESSION['domain_name'].'"');
header('WWW-Authenticate: Basic realm="'.$domain_name.'"');
unset($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW']);
$content = 'Unauthorized';
header("Content-Length: ".strval(strlen($content)));
@@ -445,8 +356,11 @@
}
}
//start the buffer
ob_start();
//output template to string for header processing
$prov = new provision;
$prov = new provision(['settings'=>$settings]);
$prov->domain_uuid = $domain_uuid;
$prov->device_address = $device_address;
$prov->file = $file;