Project

General

Profile

Download (10.4 KB) Statistics
| Branch: | Tag: | Revision:
1 16513324 Holger Bauer
<?php
2
/*
3 ce77a9c4 Phil Davis
	pfSense_MODULE: authgui
4 16513324 Holger Bauer
*/
5 995df6c3 Stephen Beaver
/* ====================================================================
6
 *	Copyright (c)  2004-2015  Electric Sheep Fencing, LLC. All rights reserved.
7
 *	Copyright (c)  2005-2006 Bill Marquette <bill.marquette@gmail.com>
8
 *	Copyright (c)  2006 Paul Taylor <paultaylor@winn-dixie.com>.
9
 *	Copyright (c)  2003-2006 Manuel Kasper <mk@neon1.net>.
10
 *
11
 *	Redistribution and use in source and binary forms, with or without modification,
12
 *	are permitted provided that the following conditions are met:
13
 *
14
 *	1. Redistributions of source code must retain the above copyright notice,
15
 *		this list of conditions and the following disclaimer.
16
 *
17
 *	2. Redistributions in binary form must reproduce the above copyright
18
 *		notice, this list of conditions and the following disclaimer in
19
 *		the documentation and/or other materials provided with the
20
 *		distribution.
21
 *
22
 *	3. All advertising materials mentioning features or use of this software
23
 *		must display the following acknowledgment:
24
 *		"This product includes software developed by the pfSense Project
25
 *		 for use in the pfSense software distribution. (http://www.pfsense.org/).
26
 *
27
 *	4. The names "pfSense" and "pfSense Project" must not be used to
28
 *		 endorse or promote products derived from this software without
29
 *		 prior written permission. For written permission, please contact
30
 *		 coreteam@pfsense.org.
31
 *
32
 *	5. Products derived from this software may not be called "pfSense"
33
 *		nor may "pfSense" appear in their names without prior written
34
 *		permission of the Electric Sheep Fencing, LLC.
35
 *
36
 *	6. Redistributions of any form whatsoever must retain the following
37
 *		acknowledgment:
38
 *
39
 *	"This product includes software developed by the pfSense Project
40
 *	for use in the pfSense software distribution (http://www.pfsense.org/).
41
 *
42
 *	THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY
43
 *	EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
44
 *	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
45
 *	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR
46
 *	ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
47
 *	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
48
 *	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
49
 *	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50
 *	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
51
 *	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
52
 *	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
53
 *	OF THE POSSIBILITY OF SUCH DAMAGE.
54
 *
55
 *	====================================================================
56
 *
57
 */
58 483e6de8 Scott Ullrich
include_once("auth.inc");
59 6dc88d53 Ermal Luci
include_once("priv.inc");
60 1e0b1727 Phil Davis
if (!function_exists('platform_booting')) {
61 cb054444 Ermal LUÇI
	require_once('globals.inc');
62 1e0b1727 Phil Davis
}
63 16513324 Holger Bauer
64
/* Authenticate user - exit if failed */
65 6306b5dd Ermal Lu?i
if (!session_auth()) {
66
	display_login_form();
67 45ee90ed Matthew Grooms
	exit;
68 6306b5dd Ermal Lu?i
}
69 45ee90ed Matthew Grooms
70
/*
71
 * Once here, the user has authenticated with the web server.
72
 * We give them access only to the appropriate pages based on
73
 * the user or group privileges.
74
 */
75 c4a9f99a jim-p
$allowedpages = getAllowedPages($_SESSION['Username'], $_SESSION['user_radius_attributes']);
76 16513324 Holger Bauer
77 45ee90ed Matthew Grooms
/*
78 403a270e Ermal Luçi
 * redirect to first allowed page if requesting a wrong url
79 45ee90ed Matthew Grooms
 */
80 14f5f705 marcelloc
if (!isAllowedPage($_SERVER['REQUEST_URI'])) {
81 403a270e Ermal Luçi
	if (count($allowedpages) > 0) {
82
		$page = str_replace('*', '', $allowedpages[0]);
83
		$_SESSION['Post_Login'] = true;
84 5c15e649 sullrich
		require_once("functions.inc");
85 403a270e Ermal Luçi
		pfSenseHeader("/{$page}");
86 0d4f348f jim-p
87
		$username = empty($_SESSION["Username"]) ? "(system)" : $_SESSION['Username'];
88 1e0b1727 Phil Davis
		if (!empty($_SERVER['REMOTE_ADDR'])) {
89 0d4f348f jim-p
			$username .= '@' . $_SERVER['REMOTE_ADDR'];
90 1e0b1727 Phil Davis
		}
91 0d4f348f jim-p
		log_error("{$username} attempted to access {$_SERVER['SCRIPT_NAME']} but does not have access to that page. Redirecting to {$page}.");
92
93 403a270e Ermal Luçi
		exit;
94
	} else {
95 0b70d9f4 Carlos Eduardo Ramos
		display_error_form("201", gettext("No page assigned to this user! Click here to logout."));
96 403a270e Ermal Luçi
		exit;
97
	}
98 1e0b1727 Phil Davis
} else {
99 403a270e Ermal Luçi
	$_SESSION['Post_Login'] = true;
100 1e0b1727 Phil Davis
}
101 16513324 Holger Bauer
102 45ee90ed Matthew Grooms
/*
103 d97ab688 Matthew Grooms
 * redirect browsers post-login to avoid pages
104 1e0b1727 Phil Davis
 * taking action in response to a POST request
105 45ee90ed Matthew Grooms
 */
106 d97ab688 Matthew Grooms
if (!$_SESSION['Post_Login']) {
107 c9dddd59 sullrich
	$_SESSION['Post_Login'] = true;
108 5c15e649 sullrich
	require_once("functions.inc");
109 d97ab688 Matthew Grooms
	pfSenseHeader($_SERVER['REQUEST_URI']);
110
	exit;
111
}
112 16513324 Holger Bauer
113 1180e4f0 Sjon Hortensius
/*
114 4111fcf5 Ermal
 * Close session data to allow other scripts from same host to come in.
115
 * A session can be reactivated from calling session_start again
116
 */
117
session_commit();
118
119 45ee90ed Matthew Grooms
/*
120
 * determine if the user is allowed access to the requested page
121
 */
122 16513324 Holger Bauer
function display_error_form($http_code, $desc) {
123 45ee90ed Matthew Grooms
	global $config, $g;
124 995df6c3 Stephen Beaver
125 1e0b1727 Phil Davis
	if (isAjax()) {
126 addc0439 Renato Botelho
		printf(gettext('Error: %1$s Description: %2$s'), $http_code, $desc);
127 16513324 Holger Bauer
		return;
128
	}
129
130 9d624e6b Jared Dillard
	$cssfile = "/bootstrap/css/pfSense.css";
131
132
	if (isset($config['system']['webgui']['webguicss'])) {
133
	if(file_exists("bootstrap/css/" . $config['system']['webgui']['webguicss'])) {
134
		$cssfile = "/bootstrap/css/" . $config['system']['webgui']['webguicss'];
135
	}
136
}
137
138 16513324 Holger Bauer
?>
139 1180e4f0 Sjon Hortensius
<!DOCTYPE html>
140
<html lang="en">
141
<head>
142 9d624e6b Jared Dillard
	<link rel="stylesheet" href="<?=$cssfile?>" />
143 1180e4f0 Sjon Hortensius
	<title><?=gettext("Error: not allowed"); ?></title>
144
</head>
145
<body id="error" class="no-menu">
146
	<div id="jumbotron">
147
		<div class="container">
148 c7d61071 Sander van Leeuwen
			<div class="col-sm-offset-3 col-sm-6 col-xs-12">
149
				<!-- FIXME: We really need to POST the logout action -->
150
				<div class="alert alert-danger" role="alert"><a href="index.php?logout"><?=$desc;?></a></div>
151
			</div>
152 45ee90ed Matthew Grooms
		</div>
153 1180e4f0 Sjon Hortensius
	</div>
154
</body>
155 16513324 Holger Bauer
</html>
156
<?php
157
158 45ee90ed Matthew Grooms
} // end function
159 16513324 Holger Bauer
160
161
function display_login_form() {
162 45ee90ed Matthew Grooms
	require_once("globals.inc");
163
	global $config, $g;
164
165
	unset($input_errors);
166
167 1e0b1727 Phil Davis
	if (isAjax()) {
168 45ee90ed Matthew Grooms
		if (isset($_POST['login'])) {
169 1e0b1727 Phil Davis
			if ($_SESSION['Logged_In'] <> "True") {
170 0b70d9f4 Carlos Eduardo Ramos
				isset($_SESSION['Login_Error']) ? $login_error = $_SESSION['Login_Error'] : $login_error = gettext("unknown reason");
171 3cfc695c Vinicius Coque
				printf("showajaxmessage('" . gettext("Invalid login (%s).") . "')", $login_error);
172 45ee90ed Matthew Grooms
			}
173
			if (file_exists("{$g['tmp_path']}/webconfigurator.lock")) {
174
				// TODO: add the IP from the user who did lock the device
175
				$whom = file_get_contents("{$g['tmp_path']}/webconfigurator.lock");
176 3cfc695c Vinicius Coque
				printf("showajaxmessage('" . gettext("This device is currently being maintained by: %s.") . "');", $whom);
177 45ee90ed Matthew Grooms
			}
178
		}
179
		exit;
180
	}
181 16513324 Holger Bauer
182 1180e4f0 Sjon Hortensius
/* Check against locally configured IP addresses, which will catch when someone
183 2003b5d8 jim-p
   port forwards WebGUI access from WAN to an internal IP on the router. */
184 6cfa23eb Scott Ullrich
global $FilterIflist, $nifty_background;
185 2003b5d8 jim-p
$local_ip = false;
186 1fb55001 Ermal LUÇI
if (strpos($_SERVER['HTTP_HOST'], ":") === FALSE) {
187 2003b5d8 jim-p
	$http_host_port = explode(":", $_SERVER['HTTP_HOST']);
188
	$http_host = $http_host_port[0];
189
} else {
190
	$http_host = $_SERVER['HTTP_HOST'];
191
}
192
if (empty($FilterIflist)) {
193
	require_once('filter.inc');
194
	require_once('shaper.inc');
195
	filter_generate_optcfg_array();
196
}
197 f48d337f Seth Mos
foreach ($FilterIflist as $iflist) {
198 1e0b1727 Phil Davis
	if ($iflist['ip'] == $http_host) {
199 2003b5d8 jim-p
		$local_ip = true;
200 1e0b1727 Phil Davis
	} else if ($iflist['ipv6'] == $http_host) {
201 f48d337f Seth Mos
		$local_ip = true;
202 1e0b1727 Phil Davis
	} else if (is_array($iflist['vips'])) {
203 1fb55001 Ermal LUÇI
		foreach ($iflist['vips'] as $vip) {
204
			if ($vip['ip'] == $http_host) {
205 067e48ab Scott Ullrich
				$local_ip = true;
206 1fb55001 Ermal LUÇI
				break;
207
			}
208 f48d337f Seth Mos
		}
209 1fb55001 Ermal LUÇI
		unset($vip);
210 f48d337f Seth Mos
	}
211 1e0b1727 Phil Davis
	if ($local_ip == true) {
212 1fb55001 Ermal LUÇI
		break;
213 1e0b1727 Phil Davis
	}
214 f48d337f Seth Mos
}
215 1fb55001 Ermal LUÇI
unset($FilterIflist);
216
unset($iflist);
217
218 02156b4b Ermal LUÇI
if ($local_ip == false) {
219
	if (is_array($config['openvpn']['openvpn-server'])) {
220
		foreach ($config['openvpn']['openvpn-server'] as $ovpns) {
221
			if (is_ipaddrv4($http_host) && !empty($ovpns['tunnel_network']) && ip_in_subnet($http_host, $ovpns['tunnel_network'])) {
222
				$local_ip = true;
223
			} else if (is_ipaddrv6($http_host) && !empty($ovpns['tunnel_networkv6']) && ip_in_subnet($http_host, $ovpns['tunnel_networkv6'])) {
224
				$local_ip = true;
225
			}
226 1e0b1727 Phil Davis
			if ($local_ip == true) {
227 02156b4b Ermal LUÇI
				break;
228 1e0b1727 Phil Davis
			}
229 71034b51 Renato Botelho
		}
230
	}
231
}
232 0041092c jim-p
233 9d624e6b Jared Dillard
$cssfile = "/bootstrap/css/pfSense.css";
234
235
if (isset($config['system']['webgui']['webguicss'])) {
236
	if(file_exists("bootstrap/css/" . $config['system']['webgui']['webguicss'])) {
237
		$cssfile = "/bootstrap/css/" . $config['system']['webgui']['webguicss'];
238
	}
239
}
240
241 16513324 Holger Bauer
?>
242 1180e4f0 Sjon Hortensius
<!DOCTYPE html>
243
<html lang="en">
244
<head>
245 9d624e6b Jared Dillard
	<link rel="stylesheet" href="<?=$cssfile?>" />
246 1180e4f0 Sjon Hortensius
	<title><?=gettext("Login"); ?></title>
247 a9e60275 Chris Buechler
	<script type="text/javascript">
248 8fd9052f Colin Fleming
	//<![CDATA{
249
	var events = events || [];
250
	//]]>
251
	</script>
252 1180e4f0 Sjon Hortensius
</head>
253
<body id="login" class="no-menu">
254
	<div id="jumbotron">
255
		<div class="container">
256 c7d61071 Sander van Leeuwen
			<div class="col-sm-offset-3 col-sm-6 col-xs-12">
257 a42e7aa2 Sjon Hortensius
<?php
258 4de8f7ba Phil Davis
	if (is_ipaddr($http_host) && !$local_ip && !isset($config['system']['webgui']['nohttpreferercheck'])) {
259 a42e7aa2 Sjon Hortensius
		$nifty_background = "#999";
260
		print_info_box(gettext("You are accessing this router by an IP address not configured locally, which may be forwarded by NAT or other means. <br /><br />If you did not setup this forwarding, you may be the target of a man-in-the-middle attack."));
261
	}
262 1180e4f0 Sjon Hortensius
263 a42e7aa2 Sjon Hortensius
	$loginautocomplete = isset($config['system']['webgui']['loginautocomplete']) ? '' : 'autocomplete="off"';
264
?>
265 1180e4f0 Sjon Hortensius
266 c7d61071 Sander van Leeuwen
				<div class="panel panel-default">
267
					<div class="panel-heading">
268
						<h2 class="panel-title">Login to pfSense</h2>
269
					</div>
270 1180e4f0 Sjon Hortensius
271 c7d61071 Sander van Leeuwen
					<div class="panel-body">
272 a42e7aa2 Sjon Hortensius
<?php if (!empty($_SESSION['Login_Error'])): ?>
273 c7d61071 Sander van Leeuwen
						<div class="alert alert-danger" role="alert"><?=$_SESSION['Login_Error'];?></div>
274 a42e7aa2 Sjon Hortensius
<?php endif ?>
275 c7d61071 Sander van Leeuwen
						<div class="alert alert-warning" class="hidden" id="no_cookies"><?= gettext("Your browser must support cookies to login."); ?></div>
276
277
						<form method="post" <?= $loginautocomplete ?> action="<?=$_SERVER['SCRIPT_NAME'];?>" class="form-horizontal">
278
							<div class="form-group">
279
								<label for="usernamefld" class="col-sm-3 control-label">Username</label>
280 0a353c81 Sander van Leeuwen
								<div class="col-sm-9 col-md-7">
281 17ef09c3 Colin Fleming
									<input type="text" class="form-control" name="usernamefld" id="usernamefld" placeholder="Enter your username">
282 c7d61071 Sander van Leeuwen
								</div>
283
							</div>
284
285
							<div class="form-group">
286
								<label for="passwordfld" class="col-sm-3 control-label">Password</label>
287 0a353c81 Sander van Leeuwen
								<div class="col-sm-9 col-md-7">
288 17ef09c3 Colin Fleming
									<input type="password" class="form-control" name="passwordfld" id="passwordfld" placeholder="Enter your password">
289 c7d61071 Sander van Leeuwen
								</div>
290
							</div>
291
292
							<div class="form-group">
293 0a353c81 Sander van Leeuwen
								<div class="col-sm-offset-3 col-sm-9 col-md-7">
294 c7d61071 Sander van Leeuwen
									<button type="submit" class="btn btn-primary" name="login">Login</button>
295
								</div>
296
							</div>
297
						</form>
298 a42e7aa2 Sjon Hortensius
					</div>
299 c7d61071 Sander van Leeuwen
				</div>
300 1180e4f0 Sjon Hortensius
			</div>
301 45ee90ed Matthew Grooms
		</div>
302 45d6ada5 Sjon Hortensius
303 8fd9052f Colin Fleming
		<script type="text/javascript">
304
		//!<[CDATA[
305 45d6ada5 Sjon Hortensius
		events.push(function() {
306
			document.cookie=
307
				"cookie_test=1" +
308
				"<?php echo $config['system']['webgui']['protocol'] == 'https' ? '; secure' : '';?>";
309
310
			if (document.cookie.indexOf("cookie_test") == -1)
311 60987639 Stephen Beaver
				document.getElementById("no_cookies").style.display="";
312
			else
313
				document.getElementById("no_cookies").style.display="none";
314 45d6ada5 Sjon Hortensius
315
			// Delete it
316
			document.cookie = "cookie_test=1; expires=Thu, 01-Jan-1970 00:00:01 GMT";
317
		});
318 8fd9052f Colin Fleming
		//]]>
319 45d6ada5 Sjon Hortensius
		</script>
320 16513324 Holger Bauer
<?php
321 45d6ada5 Sjon Hortensius
require('foot.inc');
322 16513324 Holger Bauer
323 17ef09c3 Colin Fleming
} // end function