| 1 |
207abd84
|
Colin Smith
|
<?php
|
| 2 |
|
|
/*
|
| 3 |
ce77a9c4
|
Phil Davis
|
xmlrpc.inc
|
| 4 |
09221bc3
|
Renato Botelho
|
|
| 5 |
|
|
part of pfSense (https://www.pfsense.org)
|
| 6 |
ce77a9c4
|
Phil Davis
|
Copyright (C) 2005-2006 Colin Smith
|
| 7 |
09221bc3
|
Renato Botelho
|
Copyright (c) 2005-2016 Electric Sheep Fencing, LLC.
|
| 8 |
ce77a9c4
|
Phil Davis
|
All rights reserved.
|
| 9 |
207abd84
|
Colin Smith
|
|
| 10 |
ce77a9c4
|
Phil Davis
|
Redistribution and use in source and binary forms, with or without
|
| 11 |
|
|
modification, are permitted provided that the following conditions are met:
|
| 12 |
207abd84
|
Colin Smith
|
|
| 13 |
ce77a9c4
|
Phil Davis
|
1. Redistributions of source code must retain the above copyright notice,
|
| 14 |
|
|
this list of conditions and the following disclaimer.
|
| 15 |
207abd84
|
Colin Smith
|
|
| 16 |
ce77a9c4
|
Phil Davis
|
2. Redistributions in binary form must reproduce the above copyright
|
| 17 |
09221bc3
|
Renato Botelho
|
notice, this list of conditions and the following disclaimer in
|
| 18 |
|
|
the documentation and/or other materials provided with the
|
| 19 |
|
|
distribution.
|
| 20 |
|
|
|
| 21 |
|
|
3. All advertising materials mentioning features or use of this software
|
| 22 |
|
|
must display the following acknowledgment:
|
| 23 |
|
|
"This product includes software developed by the pfSense Project
|
| 24 |
|
|
for use in the pfSense® software distribution. (http://www.pfsense.org/).
|
| 25 |
|
|
|
| 26 |
|
|
4. The names "pfSense" and "pfSense Project" must not be used to
|
| 27 |
|
|
endorse or promote products derived from this software without
|
| 28 |
|
|
prior written permission. For written permission, please contact
|
| 29 |
|
|
coreteam@pfsense.org.
|
| 30 |
|
|
|
| 31 |
|
|
5. Products derived from this software may not be called "pfSense"
|
| 32 |
|
|
nor may "pfSense" appear in their names without prior written
|
| 33 |
|
|
permission of the Electric Sheep Fencing, LLC.
|
| 34 |
|
|
|
| 35 |
|
|
6. Redistributions of any form whatsoever must retain the following
|
| 36 |
|
|
acknowledgment:
|
| 37 |
|
|
|
| 38 |
|
|
"This product includes software developed by the pfSense Project
|
| 39 |
|
|
for use in the pfSense software distribution (http://www.pfsense.org/).
|
| 40 |
|
|
|
| 41 |
|
|
THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY
|
| 42 |
|
|
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
| 43 |
|
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
| 44 |
|
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR
|
| 45 |
|
|
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
| 46 |
|
|
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
| 47 |
|
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
| 48 |
|
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
| 49 |
|
|
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
| 50 |
|
|
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
| 51 |
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
| 52 |
|
|
OF THE POSSIBILITY OF SUCH DAMAGE.
|
| 53 |
207abd84
|
Colin Smith
|
*/
|
| 54 |
|
|
|
| 55 |
b7d5a7ba
|
Ermal
|
require_once("auth.inc");
|
| 56 |
207abd84
|
Colin Smith
|
require_once("xmlrpc_client.inc");
|
| 57 |
|
|
|
| 58 |
|
|
/*
|
| 59 |
|
|
* xmlrpc_params_to_php: Convert params array passed from XMLRPC server into a PHP array and return it.
|
| 60 |
|
|
*/
|
| 61 |
|
|
function xmlrpc_params_to_php($params) {
|
| 62 |
79262830
|
Phil Davis
|
$array = array();
|
| 63 |
|
|
for ($i = 0; $i < $params->getNumParams(); $i++) {
|
| 64 |
|
|
$value = $params->getParam($i);
|
| 65 |
|
|
$array[] = XML_RPC_decode($value);
|
| 66 |
|
|
}
|
| 67 |
|
|
return $array;
|
| 68 |
207abd84
|
Colin Smith
|
}
|
| 69 |
79262830
|
Phil Davis
|
|
| 70 |
207abd84
|
Colin Smith
|
/*
|
| 71 |
|
|
* xmlrpc_value_to_php: Convert an XMLRPC value into a PHP scalar/array and return it.
|
| 72 |
|
|
*/
|
| 73 |
|
|
function xmlrpc_value_to_php($raw_value) {
|
| 74 |
79262830
|
Phil Davis
|
return XML_RPC_decode($raw_value);
|
| 75 |
207abd84
|
Colin Smith
|
}
|
| 76 |
|
|
|
| 77 |
|
|
/*
|
| 78 |
|
|
* php_value_to_xmlrpc: Convert a PHP scalar or array into its XMLRPC equivalent.
|
| 79 |
|
|
*/
|
| 80 |
|
|
function php_value_to_xmlrpc($value, $force_array = false) {
|
| 81 |
13657e92
|
Colin Smith
|
$toreturn = XML_RPC_encode($value);
|
| 82 |
|
|
return $force_array ? array($toreturn) : $toreturn;
|
| 83 |
207abd84
|
Colin Smith
|
}
|
| 84 |
|
|
|
| 85 |
|
|
/*
|
| 86 |
|
|
* xmlrpc_auth: Handle basic crypt() authentication of an XMLRPC request. This function assumes that
|
| 87 |
|
|
* $params[0] contains the local system's plaintext password and removes the password from
|
| 88 |
|
|
* the array before returning it.
|
| 89 |
|
|
*/
|
| 90 |
|
|
function xmlrpc_auth(&$params) {
|
| 91 |
ca092d26
|
Ermal
|
global $config, $_SERVER;
|
| 92 |
d064a115
|
Ermal
|
|
| 93 |
b7d5a7ba
|
Ermal
|
/* XXX: Should teach caller to pass username and use it here. */
|
| 94 |
|
|
/* XXX: Should clarify from old behaviour what is in params[0] that differs from params['xmlrpcauth'] */
|
| 95 |
|
|
if (isset($config['system']['webgui']['authmode'])) {
|
| 96 |
|
|
$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
|
| 97 |
79262830
|
Phil Davis
|
if (authenticate_user("admin", $params[0], $authcfg) ||
|
| 98 |
|
|
authenticate_user("admin", $params[0])) {
|
| 99 |
b7d5a7ba
|
Ermal
|
array_shift($params);
|
| 100 |
ccf46756
|
Ermal
|
unset($params['xmlrpcauth']);
|
| 101 |
b7d5a7ba
|
Ermal
|
return true;
|
| 102 |
9859f355
|
Renato Botelho
|
} else if (!empty($params['xmlrpcauth']) &&
|
| 103 |
|
|
(authenticate_user("admin", $params['xmlrpcauth'], $authcfg) ||
|
| 104 |
79262830
|
Phil Davis
|
authenticate_user("admin", $params['xmlrpcauth']))) {
|
| 105 |
b7d5a7ba
|
Ermal
|
array_shift($params);
|
| 106 |
|
|
unset($params['xmlrpcauth']);
|
| 107 |
|
|
return true;
|
| 108 |
|
|
}
|
| 109 |
|
|
} else if (authenticate_user("admin", $params[0])) {
|
| 110 |
4d775dd0
|
Ermal
|
array_shift($params);
|
| 111 |
ccf46756
|
Ermal
|
unset($params['xmlrpcauth']);
|
| 112 |
207abd84
|
Colin Smith
|
return true;
|
| 113 |
9859f355
|
Renato Botelho
|
} else if (!empty($params['xmlrpcauth']) &&
|
| 114 |
|
|
authenticate_user("admin", $params['xmlrpcauth'])) {
|
| 115 |
4d775dd0
|
Ermal
|
array_shift($params);
|
| 116 |
207abd84
|
Colin Smith
|
unset($params['xmlrpcauth']);
|
| 117 |
d064a115
|
Ermal
|
return true;
|
| 118 |
207abd84
|
Colin Smith
|
}
|
| 119 |
d064a115
|
Ermal
|
|
| 120 |
4d775dd0
|
Ermal
|
array_shift($params);
|
| 121 |
|
|
unset($params['xmlrpcauth']);
|
| 122 |
ca092d26
|
Ermal
|
log_error("webConfigurator authentication error for 'admin' from {$_SERVER['REMOTE_ADDR']} during sync settings.");
|
| 123 |
66752f24
|
Scott Ullrich
|
return false;
|
| 124 |
207abd84
|
Colin Smith
|
}
|
| 125 |
|
|
|
| 126 |
b7d5a7ba
|
Ermal
|
?>
|