@@ -19,7 +19,7 @@ |
||
19 | 19 | * <base_url>/copyright.php after deploying the software |
20 | 20 | */ |
21 | 21 | |
22 | -require_once dirname(dirname(dirname(dirname(__FILE__)))) . "/config/_config.php"; |
|
22 | +require_once dirname(dirname(dirname(dirname(__FILE__))))."/config/_config.php"; |
|
23 | 23 | |
24 | 24 | \core\CAT::sessionStart(); |
25 | 25 |
@@ -19,7 +19,7 @@ |
||
19 | 19 | * <base_url>/copyright.php after deploying the software |
20 | 20 | */ |
21 | 21 | |
22 | -require_once dirname(dirname(dirname(__FILE__))) . "/config/_config.php"; |
|
22 | +require_once dirname(dirname(dirname(__FILE__)))."/config/_config.php"; |
|
23 | 23 | |
24 | 24 | \core\CAT::sessionStart(); |
25 | 25 |
@@ -83,7 +83,7 @@ discard block |
||
83 | 83 | |
84 | 84 | // use HTML5 geolocation |
85 | 85 | function locateMe() { |
86 | - $('#address').val(\"" . _("locating") . "\"); |
|
86 | + $('#address').val(\"" . _("locating")."\"); |
|
87 | 87 | navigator.geolocation.getCurrentPosition(locate_succes,locate_fail,{maximumAge:3600000, timeout:5000}); |
88 | 88 | } |
89 | 89 | |
@@ -205,7 +205,7 @@ discard block |
||
205 | 205 | view.fit(extent, {padding: [10, 0, 10, 0]}); |
206 | 206 | } else { |
207 | 207 | view.setCenter([0,0]); |
208 | - locate_country('" . $cat->knownFederations[strtoupper($this->fedName)] . "'); // use the federation code to locate the country |
|
208 | + locate_country('" . $cat->knownFederations[strtoupper($this->fedName)]."'); // use the federation code to locate the country |
|
209 | 209 | map.setView(view); |
210 | 210 | } |
211 | 211 | view.setMaxZoom(20); |
@@ -227,14 +227,14 @@ discard block |
||
227 | 227 | function getAddressLocation() { |
228 | 228 | var city = $('#address').val(); |
229 | 229 | if(city == '') { |
230 | - alert(\"" . _("nothing entered in the address field") . "\"); |
|
230 | + alert(\"" . _("nothing entered in the address field")."\"); |
|
231 | 231 | return false; |
232 | 232 | } |
233 | 233 | city = city.replace(/\s*,\s*/g,',+'); |
234 | 234 | city = city.replace(/ +/,'+'); |
235 | 235 | $.get(addressService+'?format=json&addressdetails=0&q='+city, '', function(data) { |
236 | 236 | if (data[0] === undefined) { |
237 | - alert('" . _("Address not found, perhaps try another form, like putting the street number to the front.") . "'); |
|
237 | + alert('" . _("Address not found, perhaps try another form, like putting the street number to the front.")."'); |
|
238 | 238 | return; |
239 | 239 | } |
240 | 240 | showTmpPointer(data[0].lon, data[0].lat); |
@@ -285,7 +285,7 @@ discard block |
||
285 | 285 | if ($this->readOnly) { |
286 | 286 | return "<div id='map' class='locationmap'></div><script>generateMap('map')</script>"; |
287 | 287 | } else { |
288 | - return $this->htmlPreEdit($wizard, $additional) . $this->findLocationHtml() . "<span id='location-prompt'>You can drag the pointer to the final location before you save the results.</span><div id='map' class='locationmap'></div><script>generateMap('map')</script>" . $this->htmlPostEdit(FALSE); |
|
288 | + return $this->htmlPreEdit($wizard, $additional).$this->findLocationHtml()."<span id='location-prompt'>You can drag the pointer to the final location before you save the results.</span><div id='map' class='locationmap'></div><script>generateMap('map')</script>".$this->htmlPostEdit(FALSE); |
|
289 | 289 | } |
290 | 290 | } |
291 | 291 | |
@@ -310,7 +310,7 @@ discard block |
||
310 | 310 | // we don't need this parameter in this subclass |
311 | 311 | unset($coords); |
312 | 312 | \core\common\Entity::intoThePotatoes(); |
313 | - $retval = "<button id='location_b_" . $number . "' class='location_button'>" . _("Click to see location") . " $number</button>"; |
|
313 | + $retval = "<button id='location_b_".$number."' class='location_button'>"._("Click to see location")." $number</button>"; |
|
314 | 314 | \core\common\Entity::outOfThePotatoes(); |
315 | 315 | return $retval; |
316 | 316 | } |
@@ -322,7 +322,7 @@ discard block |
||
322 | 322 | */ |
323 | 323 | private function findLocationHtml() { |
324 | 324 | \core\common\Entity::intoThePotatoes(); |
325 | - $retval = "<p>" . _("Address:") . " <input name='address' id='address' /><button type='button' onclick='getAddressLocation()'>" . _("Find address") . "</button> <button type='button' onclick='locateMe()'>" . _("Locate Me!") . "</button></p>"; |
|
325 | + $retval = "<p>"._("Address:")." <input name='address' id='address' /><button type='button' onclick='getAddressLocation()'>"._("Find address")."</button> <button type='button' onclick='locateMe()'>"._("Locate Me!")."</button></p>"; |
|
326 | 326 | \core\common\Entity::outOfThePotatoes(); |
327 | 327 | return $retval; |
328 | 328 | } |
@@ -338,14 +338,14 @@ discard block |
||
338 | 338 | case \core\Options::TYPECODE_TEXT: |
339 | 339 | case \core\Options::TYPECODE_COORDINATES: |
340 | 340 | case \core\Options::TYPECODE_INTEGER: |
341 | - $varName = $listOfEntries["$objId-" . self::VALIDATOR_FUNCTIONS[$optioninfo['type']]['field']]; |
|
341 | + $varName = $listOfEntries["$objId-".self::VALIDATOR_FUNCTIONS[$optioninfo['type']]['field']]; |
|
342 | 342 | if (!empty($varName)) { |
343 | 343 | $content = call_user_func_array([$this->validator, self::VALIDATOR_FUNCTIONS[$optioninfo['type']]['function']], array_merge([$varName], self::VALIDATOR_FUNCTIONS[$optioninfo['type']]['extraarg'])); |
344 | 344 | break; |
345 | 345 | } |
346 | 346 | continue 2; |
347 | 347 | case \core\Options::TYPECODE_BOOLEAN: |
348 | - $varName = $listOfEntries["$objId-" . \core\Options::TYPECODE_BOOLEAN]; |
|
348 | + $varName = $listOfEntries["$objId-".\core\Options::TYPECODE_BOOLEAN]; |
|
349 | 349 | if (!empty($varName)) { |
350 | 350 | $contentValid = $this->validator->boolean($varName); |
351 | 351 | if ($contentValid) { |
@@ -358,7 +358,7 @@ discard block |
||
358 | 358 | } |
359 | 359 | continue 2; |
360 | 360 | case \core\Options::TYPECODE_STRING: |
361 | - $previsionalContent = $listOfEntries["$objId-" . \core\Options::TYPECODE_STRING]; |
|
361 | + $previsionalContent = $listOfEntries["$objId-".\core\Options::TYPECODE_STRING]; |
|
362 | 362 | if (!empty($previsionalContent)) { |
363 | 363 | $content = $this->furtherStringChecks($objValue, $previsionalContent, $bad); |
364 | 364 | if ($content === FALSE) { |
@@ -369,15 +369,15 @@ discard block |
||
369 | 369 | continue 2; |
370 | 370 | case \core\Options::TYPECODE_FILE: |
371 | 371 | // this is either actually an uploaded file, or a reference to a DB entry of a previously uploaded file |
372 | - $reference = $listOfEntries["$objId-" . \core\Options::TYPECODE_STRING]; |
|
372 | + $reference = $listOfEntries["$objId-".\core\Options::TYPECODE_STRING]; |
|
373 | 373 | if (!empty($reference)) { // was already in, by ROWID reference, extract |
374 | 374 | // ROWID means it's a multi-line string (simple strings are inline in the form; so allow whitespace) |
375 | 375 | $content = $this->validator->string(urldecode($reference), TRUE); |
376 | 376 | break; |
377 | 377 | } |
378 | - $fileName = $listOfEntries["$objId-" . \core\Options::TYPECODE_FILE] ?? ""; |
|
378 | + $fileName = $listOfEntries["$objId-".\core\Options::TYPECODE_FILE] ?? ""; |
|
379 | 379 | if ($fileName != "") { // let's do the download |
380 | - $rawContent = \core\common\OutsideComm::downloadFile("file:///" . $fileName); |
|
380 | + $rawContent = \core\common\OutsideComm::downloadFile("file:///".$fileName); |
|
381 | 381 | |
382 | 382 | if ($rawContent === FALSE || !$this->checkUploadSanity($objValue, $rawContent)) { |
383 | 383 | $bad[] = $objValue; |
@@ -388,7 +388,7 @@ discard block |
||
388 | 388 | } |
389 | 389 | continue 2; |
390 | 390 | default: |
391 | - throw new Exception("Internal Error: Unknown option type " . $objValue . "!"); |
|
391 | + throw new Exception("Internal Error: Unknown option type ".$objValue."!"); |
|
392 | 392 | } |
393 | 393 | // lang can be NULL here, if it's not a multilang attribute, or a ROWID reference. Never mind that. |
394 | 394 | $retval[] = ["$objValue" => ["lang" => $languageFlag, "content" => $content]]; |
@@ -121,7 +121,7 @@ |
||
121 | 121 | if ($trailerPosition !== FALSE) { |
122 | 122 | $base = substr($scriptself, 0, $trailerPosition); |
123 | 123 | if ($base !== FALSE) { |
124 | - $url = "//$servername" . $base . "/logout_check.php"; |
|
124 | + $url = "//$servername".$base."/logout_check.php"; |
|
125 | 125 | } |
126 | 126 | } |
127 | 127 |
@@ -136,19 +136,19 @@ discard block |
||
136 | 136 | protected function htmlPreEdit($wizardMode, $additional) { |
137 | 137 | \core\common\Entity::intoThePotatoes(); |
138 | 138 | $retval = "<fieldset class='option_container'> |
139 | - <legend><strong>" . _("Location") . "</strong></legend>"; |
|
139 | + <legend><strong>" . _("Location")."</strong></legend>"; |
|
140 | 140 | |
141 | 141 | if ($wizardMode) { |
142 | - $retval .= "<p>" . |
|
143 | - _("The user download interface (see <a href='../'>here</a>), uses geolocation to suggest possibly matching IdPs to the user. The more precise you define the location here, the easier your users will find you.") . |
|
142 | + $retval .= "<p>". |
|
143 | + _("The user download interface (see <a href='../'>here</a>), uses geolocation to suggest possibly matching IdPs to the user. The more precise you define the location here, the easier your users will find you."). |
|
144 | 144 | "</p> |
145 | 145 | <ul>" . |
146 | 146 | _("<li>Drag the marker in the map to your place, or</li> |
147 | 147 | <li>enter your street address in the field below for lookup, or</li> |
148 | -<li>use the 'Locate Me!' button</li>") . |
|
148 | +<li>use the 'Locate Me!' button</li>"). |
|
149 | 149 | "</ul> |
150 | 150 | <strong>" . |
151 | - _("We will use the coordinates as indicated by the marker for geolocation.") . |
|
151 | + _("We will use the coordinates as indicated by the marker for geolocation."). |
|
152 | 152 | "</strong>"; |
153 | 153 | } |
154 | 154 | if ($additional) { |
@@ -166,7 +166,7 @@ discard block |
||
166 | 166 | */ |
167 | 167 | protected function htmlPostEdit($allowDirectInput) { |
168 | 168 | \core\common\Entity::intoThePotatoes(); |
169 | - $retval = "<br/>" . _("Latitude:") . " <input style='width:80px' name='geo_lat' id='geo_lat' " .($allowDirectInput ? "": "readonly"). ">" . _("Longitude:") . " <input name='geo_long' id='geo_long' style='width:80px' " .($allowDirectInput ? "": "readonly"). "></fieldset>"; |
|
169 | + $retval = "<br/>"._("Latitude:")." <input style='width:80px' name='geo_lat' id='geo_lat' ".($allowDirectInput ? "" : "readonly").">"._("Longitude:")." <input name='geo_long' id='geo_long' style='width:80px' ".($allowDirectInput ? "" : "readonly")."></fieldset>"; |
|
170 | 170 | \core\common\Entity::outOfThePotatoes(); |
171 | 171 | return $retval; |
172 | 172 | } |
@@ -167,7 +167,7 @@ |
||
167 | 167 | $this->NAPTR_executed = RADIUSTests::RETVAL_NOTCONFIGURED; |
168 | 168 | return RADIUSTests::RETVAL_NOTCONFIGURED; |
169 | 169 | } |
170 | - $NAPTRs = dns_get_record($this->realm . ".", DNS_NAPTR); |
|
170 | + $NAPTRs = dns_get_record($this->realm.".", DNS_NAPTR); |
|
171 | 171 | if ($NAPTRs === FALSE || count($NAPTRs) == 0) { |
172 | 172 | $this->NAPTR_executed = RFC7585Tests::RETVAL_NONAPTR; |
173 | 173 | return RFC7585Tests::RETVAL_NONAPTR; |
@@ -197,7 +197,6 @@ |
||
197 | 197 | * - RETVAL_NOTCONFIGURED; needs \config\Diagnostics::RADIUSTESTS['TLS-discoverytag'] |
198 | 198 | * - RETVAL_INVALID (at least one format error) |
199 | 199 | * - RETVAL_OK (all fine) |
200 | - |
|
201 | 200 | * @return int one of two RETVALs above |
202 | 201 | */ |
203 | 202 | public function relevantNAPTRcompliance() |
@@ -72,96 +72,96 @@ |
||
72 | 72 | } |
73 | 73 | |
74 | 74 | switch ($operationMode) { |
75 | - case OPERATION_MODE_EDIT: |
|
76 | - $idp = $validator->existingIdP($_GET['inst_id']); |
|
77 | - // editing IdPs is done from within the popup. When we're done, send the |
|
78 | - // user back to the popup (append the result of the operation later) |
|
79 | - $redirectDestination = "manageAdmins.inc.php?inst_id=" . $idp->identifier . "&"; |
|
80 | - if (count($validAddresses) == 0) { |
|
81 | - header("Location: $redirectDestination" . "invitation=INVALIDSYNTAX"); |
|
82 | - exit(1); |
|
83 | - } |
|
84 | - // is the user primary admin of this IdP? |
|
85 | - $is_owner = $idp->isPrimaryOwner($_SESSION['user']); |
|
86 | - // check if he is (also) federation admin for the federation this IdP is in. His invitations have more blessing then. |
|
87 | - $fedadmin = $userObject->isFederationAdmin($idp->federation); |
|
88 | - // check if he is either one, if not, complain |
|
89 | - if (!$is_owner && !$fedadmin) { |
|
90 | - echo "<p>" . sprintf(_("Something's wrong... you are a %s admin, but not for the %s the requested %s belongs to!"), $uiElements->nomenclatureFed, $uiElements->nomenclatureFed, $uiElements->nomenclatureInst) . "</p>"; |
|
91 | - exit(1); |
|
92 | - } |
|
75 | + case OPERATION_MODE_EDIT: |
|
76 | + $idp = $validator->existingIdP($_GET['inst_id']); |
|
77 | + // editing IdPs is done from within the popup. When we're done, send the |
|
78 | + // user back to the popup (append the result of the operation later) |
|
79 | + $redirectDestination = "manageAdmins.inc.php?inst_id=" . $idp->identifier . "&"; |
|
80 | + if (count($validAddresses) == 0) { |
|
81 | + header("Location: $redirectDestination" . "invitation=INVALIDSYNTAX"); |
|
82 | + exit(1); |
|
83 | + } |
|
84 | + // is the user primary admin of this IdP? |
|
85 | + $is_owner = $idp->isPrimaryOwner($_SESSION['user']); |
|
86 | + // check if he is (also) federation admin for the federation this IdP is in. His invitations have more blessing then. |
|
87 | + $fedadmin = $userObject->isFederationAdmin($idp->federation); |
|
88 | + // check if he is either one, if not, complain |
|
89 | + if (!$is_owner && !$fedadmin) { |
|
90 | + echo "<p>" . sprintf(_("Something's wrong... you are a %s admin, but not for the %s the requested %s belongs to!"), $uiElements->nomenclatureFed, $uiElements->nomenclatureFed, $uiElements->nomenclatureInst) . "</p>"; |
|
91 | + exit(1); |
|
92 | + } |
|
93 | 93 | |
94 | - $prettyprintname = $idp->name; |
|
95 | - $newtokens = $mgmt->createTokens($fedadmin, $validAddresses, $idp); |
|
96 | - $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP " . $idp->identifier . " - Token created for " . implode(",", $validAddresses)); |
|
97 | - $introtext = "CO-ADMIN"; |
|
98 | - $participant_type = $idp->type; |
|
99 | - break; |
|
100 | - case OPERATION_MODE_NEWUNLINKED: |
|
101 | - $redirectDestination = "../overview_federation.php?"; |
|
102 | - if (count($validAddresses) == 0) { |
|
103 | - header("Location: $redirectDestination"."invitation=INVALIDSYNTAX"); |
|
104 | - exit(1); |
|
105 | - } |
|
106 | - // run an input check and conversion of the raw inputs... just in case |
|
107 | - $newinstname = $validator->string($_POST['name']); |
|
108 | - $newcountry = $validator->string($_POST['country']); |
|
109 | - $participant_type = $validator->partType($_POST['participant_type']); |
|
110 | - $new_idp_authorized_fedadmin = $userObject->isFederationAdmin($newcountry); |
|
111 | - if ($new_idp_authorized_fedadmin !== TRUE) { |
|
112 | - throw new Exception("Something's wrong... you want to create a new " . $uiElements->nomenclatureInst . ", but are not a " . $uiElements->nomenclatureFed . " admin for the " . $uiElements->nomenclatureFed . " it should be in!"); |
|
113 | - } |
|
114 | - $federation = $validator->existingFederation($newcountry); |
|
115 | - $prettyprintname = $newinstname; |
|
116 | - $introtext = "NEW-FED"; |
|
117 | - // send the user back to his federation overview page, append the result of the operation later |
|
118 | - // do the token creation magic |
|
119 | - $newtokens = $mgmt->createTokens(TRUE, $validAddresses, $newinstname, 0, $newcountry, $participant_type); |
|
120 | - $loggerInstance->writeAudit($_SESSION['user'], "NEW", "ORG FUTURE - Token created for $participant_type " . implode(",", $validAddresses)); |
|
121 | - break; |
|
122 | - case OPERATION_MODE_NEWFROMDB: |
|
123 | - $redirectDestination = "../overview_federation.php?"; |
|
124 | - if (count($validAddresses) == 0) { |
|
125 | - header("Location: $redirectDestination"."invitation=INVALIDSYNTAX"); |
|
126 | - exit(1); |
|
127 | - } |
|
128 | - // a real external DB entry was submitted and all the required parameters are there |
|
129 | - $newexternalid = $validator->string($_POST['externals']); |
|
130 | - $extinfo = $catInstance->getExternalDBEntityDetails($newexternalid); |
|
131 | - $new_idp_authorized_fedadmin = $userObject->isFederationAdmin($extinfo['country']); |
|
132 | - if ($new_idp_authorized_fedadmin !== TRUE) { |
|
133 | - throw new Exception("Something's wrong... you want to create a new " . $uiElements->nomenclatureInst . ", but are not a " . $uiElements->nomenclatureFed . " admin for the " . $uiElements->nomenclatureFed . " it should be in!"); |
|
134 | - } |
|
135 | - $federation = $validator->existingFederation($extinfo['country']); |
|
136 | - $newcountry = $extinfo['country']; |
|
137 | - // see if the inst name is defined in the currently set language; if not, pick its English name; if N/A, pick the last in the list |
|
138 | - $prettyprintname = ""; |
|
139 | - foreach ($extinfo['names'] as $lang => $name) { |
|
140 | - if ($lang == $languageInstance->getLang()) { |
|
141 | - $prettyprintname = $name; |
|
94 | + $prettyprintname = $idp->name; |
|
95 | + $newtokens = $mgmt->createTokens($fedadmin, $validAddresses, $idp); |
|
96 | + $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP " . $idp->identifier . " - Token created for " . implode(",", $validAddresses)); |
|
97 | + $introtext = "CO-ADMIN"; |
|
98 | + $participant_type = $idp->type; |
|
99 | + break; |
|
100 | + case OPERATION_MODE_NEWUNLINKED: |
|
101 | + $redirectDestination = "../overview_federation.php?"; |
|
102 | + if (count($validAddresses) == 0) { |
|
103 | + header("Location: $redirectDestination"."invitation=INVALIDSYNTAX"); |
|
104 | + exit(1); |
|
142 | 105 | } |
143 | - } |
|
144 | - if ($prettyprintname == "" && isset($extinfo['names']['en'])) { |
|
145 | - $prettyprintname = $extinfo['names']['en']; |
|
146 | - } |
|
147 | - if ($prettyprintname == "") { |
|
148 | - foreach ($extinfo['names'] as $name) { |
|
149 | - $prettyprintname = $name; |
|
106 | + // run an input check and conversion of the raw inputs... just in case |
|
107 | + $newinstname = $validator->string($_POST['name']); |
|
108 | + $newcountry = $validator->string($_POST['country']); |
|
109 | + $participant_type = $validator->partType($_POST['participant_type']); |
|
110 | + $new_idp_authorized_fedadmin = $userObject->isFederationAdmin($newcountry); |
|
111 | + if ($new_idp_authorized_fedadmin !== TRUE) { |
|
112 | + throw new Exception("Something's wrong... you want to create a new " . $uiElements->nomenclatureInst . ", but are not a " . $uiElements->nomenclatureFed . " admin for the " . $uiElements->nomenclatureFed . " it should be in!"); |
|
150 | 113 | } |
151 | - } |
|
152 | - $participant_type = $extinfo['type']; |
|
153 | - // fill the rest of the text |
|
154 | - $introtext = "EXISTING-FED"; |
|
155 | - // do the token creation magic |
|
156 | - $newtokens = $mgmt->createTokens(TRUE, $validAddresses, $prettyprintname, $newexternalid); |
|
157 | - $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP FUTURE - Token created for " . implode(",", $validAddresses)); |
|
158 | - break; |
|
159 | - default: // includes OPERATION_MODE_INVALID |
|
160 | - $wrongcontent = print_r($_POST, TRUE); |
|
161 | - echo "<pre>Wrong parameters in POST: |
|
114 | + $federation = $validator->existingFederation($newcountry); |
|
115 | + $prettyprintname = $newinstname; |
|
116 | + $introtext = "NEW-FED"; |
|
117 | + // send the user back to his federation overview page, append the result of the operation later |
|
118 | + // do the token creation magic |
|
119 | + $newtokens = $mgmt->createTokens(TRUE, $validAddresses, $newinstname, 0, $newcountry, $participant_type); |
|
120 | + $loggerInstance->writeAudit($_SESSION['user'], "NEW", "ORG FUTURE - Token created for $participant_type " . implode(",", $validAddresses)); |
|
121 | + break; |
|
122 | + case OPERATION_MODE_NEWFROMDB: |
|
123 | + $redirectDestination = "../overview_federation.php?"; |
|
124 | + if (count($validAddresses) == 0) { |
|
125 | + header("Location: $redirectDestination"."invitation=INVALIDSYNTAX"); |
|
126 | + exit(1); |
|
127 | + } |
|
128 | + // a real external DB entry was submitted and all the required parameters are there |
|
129 | + $newexternalid = $validator->string($_POST['externals']); |
|
130 | + $extinfo = $catInstance->getExternalDBEntityDetails($newexternalid); |
|
131 | + $new_idp_authorized_fedadmin = $userObject->isFederationAdmin($extinfo['country']); |
|
132 | + if ($new_idp_authorized_fedadmin !== TRUE) { |
|
133 | + throw new Exception("Something's wrong... you want to create a new " . $uiElements->nomenclatureInst . ", but are not a " . $uiElements->nomenclatureFed . " admin for the " . $uiElements->nomenclatureFed . " it should be in!"); |
|
134 | + } |
|
135 | + $federation = $validator->existingFederation($extinfo['country']); |
|
136 | + $newcountry = $extinfo['country']; |
|
137 | + // see if the inst name is defined in the currently set language; if not, pick its English name; if N/A, pick the last in the list |
|
138 | + $prettyprintname = ""; |
|
139 | + foreach ($extinfo['names'] as $lang => $name) { |
|
140 | + if ($lang == $languageInstance->getLang()) { |
|
141 | + $prettyprintname = $name; |
|
142 | + } |
|
143 | + } |
|
144 | + if ($prettyprintname == "" && isset($extinfo['names']['en'])) { |
|
145 | + $prettyprintname = $extinfo['names']['en']; |
|
146 | + } |
|
147 | + if ($prettyprintname == "") { |
|
148 | + foreach ($extinfo['names'] as $name) { |
|
149 | + $prettyprintname = $name; |
|
150 | + } |
|
151 | + } |
|
152 | + $participant_type = $extinfo['type']; |
|
153 | + // fill the rest of the text |
|
154 | + $introtext = "EXISTING-FED"; |
|
155 | + // do the token creation magic |
|
156 | + $newtokens = $mgmt->createTokens(TRUE, $validAddresses, $prettyprintname, $newexternalid); |
|
157 | + $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP FUTURE - Token created for " . implode(",", $validAddresses)); |
|
158 | + break; |
|
159 | + default: // includes OPERATION_MODE_INVALID |
|
160 | + $wrongcontent = print_r($_POST, TRUE); |
|
161 | + echo "<pre>Wrong parameters in POST: |
|
162 | 162 | " . htmlspecialchars($wrongcontent) . " |
163 | 163 | </pre>"; |
164 | - exit(1); |
|
164 | + exit(1); |
|
165 | 165 | } |
166 | 166 | |
167 | 167 | // send, and invalidate the token immediately if the mail could not be sent! |
@@ -20,7 +20,7 @@ discard block |
||
20 | 20 | * <base_url>/copyright.php after deploying the software |
21 | 21 | */ |
22 | 22 | |
23 | -require_once dirname(dirname(dirname(__DIR__))) . "/config/_config.php"; |
|
23 | +require_once dirname(dirname(dirname(__DIR__)))."/config/_config.php"; |
|
24 | 24 | |
25 | 25 | $auth = new \web\lib\admin\Authentication(); |
26 | 26 | $auth->authenticate(); |
@@ -76,9 +76,9 @@ discard block |
||
76 | 76 | $idp = $validator->existingIdP($_GET['inst_id']); |
77 | 77 | // editing IdPs is done from within the popup. When we're done, send the |
78 | 78 | // user back to the popup (append the result of the operation later) |
79 | - $redirectDestination = "manageAdmins.inc.php?inst_id=" . $idp->identifier . "&"; |
|
79 | + $redirectDestination = "manageAdmins.inc.php?inst_id=".$idp->identifier."&"; |
|
80 | 80 | if (count($validAddresses) == 0) { |
81 | - header("Location: $redirectDestination" . "invitation=INVALIDSYNTAX"); |
|
81 | + header("Location: $redirectDestination"."invitation=INVALIDSYNTAX"); |
|
82 | 82 | exit(1); |
83 | 83 | } |
84 | 84 | // is the user primary admin of this IdP? |
@@ -87,13 +87,13 @@ discard block |
||
87 | 87 | $fedadmin = $userObject->isFederationAdmin($idp->federation); |
88 | 88 | // check if he is either one, if not, complain |
89 | 89 | if (!$is_owner && !$fedadmin) { |
90 | - echo "<p>" . sprintf(_("Something's wrong... you are a %s admin, but not for the %s the requested %s belongs to!"), $uiElements->nomenclatureFed, $uiElements->nomenclatureFed, $uiElements->nomenclatureInst) . "</p>"; |
|
90 | + echo "<p>".sprintf(_("Something's wrong... you are a %s admin, but not for the %s the requested %s belongs to!"), $uiElements->nomenclatureFed, $uiElements->nomenclatureFed, $uiElements->nomenclatureInst)."</p>"; |
|
91 | 91 | exit(1); |
92 | 92 | } |
93 | 93 | |
94 | 94 | $prettyprintname = $idp->name; |
95 | 95 | $newtokens = $mgmt->createTokens($fedadmin, $validAddresses, $idp); |
96 | - $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP " . $idp->identifier . " - Token created for " . implode(",", $validAddresses)); |
|
96 | + $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP ".$idp->identifier." - Token created for ".implode(",", $validAddresses)); |
|
97 | 97 | $introtext = "CO-ADMIN"; |
98 | 98 | $participant_type = $idp->type; |
99 | 99 | break; |
@@ -109,7 +109,7 @@ discard block |
||
109 | 109 | $participant_type = $validator->partType($_POST['participant_type']); |
110 | 110 | $new_idp_authorized_fedadmin = $userObject->isFederationAdmin($newcountry); |
111 | 111 | if ($new_idp_authorized_fedadmin !== TRUE) { |
112 | - throw new Exception("Something's wrong... you want to create a new " . $uiElements->nomenclatureInst . ", but are not a " . $uiElements->nomenclatureFed . " admin for the " . $uiElements->nomenclatureFed . " it should be in!"); |
|
112 | + throw new Exception("Something's wrong... you want to create a new ".$uiElements->nomenclatureInst.", but are not a ".$uiElements->nomenclatureFed." admin for the ".$uiElements->nomenclatureFed." it should be in!"); |
|
113 | 113 | } |
114 | 114 | $federation = $validator->existingFederation($newcountry); |
115 | 115 | $prettyprintname = $newinstname; |
@@ -117,7 +117,7 @@ discard block |
||
117 | 117 | // send the user back to his federation overview page, append the result of the operation later |
118 | 118 | // do the token creation magic |
119 | 119 | $newtokens = $mgmt->createTokens(TRUE, $validAddresses, $newinstname, 0, $newcountry, $participant_type); |
120 | - $loggerInstance->writeAudit($_SESSION['user'], "NEW", "ORG FUTURE - Token created for $participant_type " . implode(",", $validAddresses)); |
|
120 | + $loggerInstance->writeAudit($_SESSION['user'], "NEW", "ORG FUTURE - Token created for $participant_type ".implode(",", $validAddresses)); |
|
121 | 121 | break; |
122 | 122 | case OPERATION_MODE_NEWFROMDB: |
123 | 123 | $redirectDestination = "../overview_federation.php?"; |
@@ -130,7 +130,7 @@ discard block |
||
130 | 130 | $extinfo = $catInstance->getExternalDBEntityDetails($newexternalid); |
131 | 131 | $new_idp_authorized_fedadmin = $userObject->isFederationAdmin($extinfo['country']); |
132 | 132 | if ($new_idp_authorized_fedadmin !== TRUE) { |
133 | - throw new Exception("Something's wrong... you want to create a new " . $uiElements->nomenclatureInst . ", but are not a " . $uiElements->nomenclatureFed . " admin for the " . $uiElements->nomenclatureFed . " it should be in!"); |
|
133 | + throw new Exception("Something's wrong... you want to create a new ".$uiElements->nomenclatureInst.", but are not a ".$uiElements->nomenclatureFed." admin for the ".$uiElements->nomenclatureFed." it should be in!"); |
|
134 | 134 | } |
135 | 135 | $federation = $validator->existingFederation($extinfo['country']); |
136 | 136 | $newcountry = $extinfo['country']; |
@@ -154,12 +154,12 @@ discard block |
||
154 | 154 | $introtext = "EXISTING-FED"; |
155 | 155 | // do the token creation magic |
156 | 156 | $newtokens = $mgmt->createTokens(TRUE, $validAddresses, $prettyprintname, $newexternalid); |
157 | - $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP FUTURE - Token created for " . implode(",", $validAddresses)); |
|
157 | + $loggerInstance->writeAudit($_SESSION['user'], "NEW", "IdP FUTURE - Token created for ".implode(",", $validAddresses)); |
|
158 | 158 | break; |
159 | 159 | default: // includes OPERATION_MODE_INVALID |
160 | 160 | $wrongcontent = print_r($_POST, TRUE); |
161 | 161 | echo "<pre>Wrong parameters in POST: |
162 | -" . htmlspecialchars($wrongcontent) . " |
|
162 | +" . htmlspecialchars($wrongcontent)." |
|
163 | 163 | </pre>"; |
164 | 164 | exit(1); |
165 | 165 | } |
@@ -184,14 +184,14 @@ discard block |
||
184 | 184 | } |
185 | 185 | |
186 | 186 | if (count($status) == 0) { |
187 | - header("Location: $redirectDestination" . "invitation=FAILURE"); |
|
187 | + header("Location: $redirectDestination"."invitation=FAILURE"); |
|
188 | 188 | exit; |
189 | 189 | } |
190 | 190 | $finalDestParams = "invitation=SUCCESS"; |
191 | 191 | if (count($status) < count($totalSegments)) { // only a subset of mails was sent, update status |
192 | 192 | $finalDestParams = "invitation=PARTIAL"; |
193 | 193 | } |
194 | -$finalDestParams .= "&successcount=" . count($status); |
|
194 | +$finalDestParams .= "&successcount=".count($status); |
|
195 | 195 | if ($allEncrypted === TRUE) { |
196 | 196 | $finalDestParams .= "&transportsecurity=ENCRYPTED"; |
197 | 197 | } elseif ($allClear === TRUE) { |
@@ -200,4 +200,4 @@ discard block |
||
200 | 200 | $finalDestParams .= "&transportsecurity=PARTIAL"; |
201 | 201 | } |
202 | 202 | |
203 | -header("Location: $redirectDestination" . $finalDestParams); |
|
203 | +header("Location: $redirectDestination".$finalDestParams); |
@@ -20,7 +20,7 @@ discard block |
||
20 | 20 | * <base_url>/copyright.php after deploying the software |
21 | 21 | */ |
22 | 22 | |
23 | -require_once dirname(dirname(dirname(__FILE__))) . "/config/_config.php"; |
|
23 | +require_once dirname(dirname(dirname(__FILE__)))."/config/_config.php"; |
|
24 | 24 | |
25 | 25 | // no SAML auth on this page. The API key authenticates the entity |
26 | 26 | |
@@ -38,7 +38,7 @@ discard block |
||
38 | 38 | $inputRaw = file_get_contents('php://input'); |
39 | 39 | $inputDecoded = json_decode($inputRaw, TRUE); |
40 | 40 | if (!is_array($inputDecoded)) { |
41 | - $adminApi->returnError(web\lib\admin\API::ERROR_MALFORMED_REQUEST, "Unable to decode JSON POST data." . json_last_error_msg() . $inputRaw); |
|
41 | + $adminApi->returnError(web\lib\admin\API::ERROR_MALFORMED_REQUEST, "Unable to decode JSON POST data.".json_last_error_msg().$inputRaw); |
|
42 | 42 | exit(1); |
43 | 43 | } |
44 | 44 | |
@@ -132,7 +132,7 @@ discard block |
||
132 | 132 | throw new Exception("A required parameter is missing, and this wasn't caught earlier?!"); |
133 | 133 | } |
134 | 134 | $newtokens = $mgmt->createTokens(true, [$admin], $idp); |
135 | - $URL = "https://" . $_SERVER['SERVER_NAME'] . dirname($_SERVER['SCRIPT_NAME']) . "/action_enrollment.php?token=" . array_keys($newtokens)[0]; |
|
135 | + $URL = "https://".$_SERVER['SERVER_NAME'].dirname($_SERVER['SCRIPT_NAME'])."/action_enrollment.php?token=".array_keys($newtokens)[0]; |
|
136 | 136 | $success = ["TOKEN URL" => $URL, "TOKEN" => array_keys($newtokens)[0]]; |
137 | 137 | // done with the essentials - display in response. But if we also have an email address, send it there |
138 | 138 | $email = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_TARGETMAIL); |
@@ -169,7 +169,7 @@ discard block |
||
169 | 169 | if ($found) { |
170 | 170 | $adminApi->returnSuccess([]); |
171 | 171 | } |
172 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "The admin with ID $toBeDeleted is not associated to IdP " . $idp->identifier); |
|
172 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "The admin with ID $toBeDeleted is not associated to IdP ".$idp->identifier); |
|
173 | 173 | break; |
174 | 174 | case web\lib\admin\API::ACTION_STATISTICS_FED: |
175 | 175 | $adminApi->returnSuccess($fed->downloadStats("array")); |
@@ -216,10 +216,10 @@ discard block |
||
216 | 216 | $outer = ""; |
217 | 217 | $profile->setAnonymousIDSupport(FALSE); |
218 | 218 | } else { |
219 | - $outer = $outer . "@"; |
|
219 | + $outer = $outer."@"; |
|
220 | 220 | $profile->setAnonymousIDSupport(TRUE); |
221 | 221 | } |
222 | - $profile->setRealm($outer . $realm); |
|
222 | + $profile->setRealm($outer.$realm); |
|
223 | 223 | } |
224 | 224 | /* const AUXATTRIB_PROFILE_TESTUSER = 'ATTRIB-PROFILE-TESTUSER'; */ |
225 | 225 | $testuser = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_TESTUSER); |
@@ -447,7 +447,7 @@ discard block |
||
447 | 447 | // extract relevant subset of information from cert objects |
448 | 448 | $certDetails = []; |
449 | 449 | foreach ($certs as $cert) { |
450 | - $certDetails[$cert->ca_type . ":" . $cert->serial] = ["ISSUED" => $cert->issued, "EXPIRY" => $cert->expiry, "STATUS" => $cert->status, "DEVICE" => $cert->device, "CN" => $cert->username, "ANNOTATION" => $cert->annotation]; |
|
450 | + $certDetails[$cert->ca_type.":".$cert->serial] = ["ISSUED" => $cert->issued, "EXPIRY" => $cert->expiry, "STATUS" => $cert->status, "DEVICE" => $cert->device, "CN" => $cert->username, "ANNOTATION" => $cert->annotation]; |
|
451 | 451 | } |
452 | 452 | $adminApi->returnSuccess($certDetails); |
453 | 453 | break; |
@@ -417,7 +417,7 @@ |
||
417 | 417 | $userId = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID); |
418 | 418 | $userName = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERNAME); |
419 | 419 | $certSerial = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
420 | - $certCN = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTCN); |
|
420 | + $certCN = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTCN); |
|
421 | 421 | if ($userId === FALSE && $userName === FALSE && $certSerial === FALSE && $certCN === FALSE) { |
422 | 422 | // we need at least one of those |
423 | 423 | $adminApi->returnError(\web\lib\admin\API::ERROR_MISSING_PARAMETER, "At least one of User ID, Username, certificate serial, or certificate CN is required."); |
@@ -84,218 +84,218 @@ discard block |
||
84 | 84 | } |
85 | 85 | |
86 | 86 | switch ($inputDecoded['ACTION']) { |
87 | - case web\lib\admin\API::ACTION_NEWINST: |
|
88 | - // create the inst, no admin, no attributes |
|
89 | - $typeRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_INSTTYPE); |
|
90 | - if ($typeRaw === FALSE) { |
|
91 | - throw new Exception("We did not receive a valid participant type!"); |
|
92 | - } |
|
93 | - $type = $validator->partType($typeRaw); |
|
94 | - $idp = new \core\IdP($fed->newIdP($type, "PENDING", "API")); |
|
95 | - // now add all submitted attributes |
|
96 | - $inputs = $adminApi->uglify($scrubbedParameters); |
|
97 | - $optionParser->processSubmittedFields($idp, $inputs["POST"], $inputs["FILES"]); |
|
98 | - $adminApi->returnSuccess([web\lib\admin\API::AUXATTRIB_CAT_INST_ID => $idp->identifier]); |
|
99 | - break; |
|
100 | - case web\lib\admin\API::ACTION_DELINST: |
|
101 | - try { |
|
102 | - $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
103 | - } catch (Exception $e) { |
|
104 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
105 | - exit(1); |
|
106 | - } |
|
107 | - $idp->destroy(); |
|
108 | - $adminApi->returnSuccess([]); |
|
109 | - break; |
|
110 | - case web\lib\admin\API::ACTION_ADMIN_LIST: |
|
111 | - try { |
|
112 | - $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
113 | - } catch (Exception $e) { |
|
114 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
115 | - exit(1); |
|
116 | - } |
|
117 | - $adminApi->returnSuccess($idp->listOwners()); |
|
118 | - break; |
|
119 | - case web\lib\admin\API::ACTION_ADMIN_ADD: |
|
120 | - // IdP in question |
|
121 | - try { |
|
122 | - $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
123 | - } catch (Exception $e) { |
|
124 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
125 | - exit(1); |
|
126 | - } |
|
127 | - // here is the token |
|
128 | - $mgmt = new core\UserManagement(); |
|
129 | - // we know we have an admin ID but scrutinizer wants this checked more explicitly |
|
130 | - $admin = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_ADMINID); |
|
131 | - if ($admin === FALSE) { |
|
132 | - throw new Exception("A required parameter is missing, and this wasn't caught earlier?!"); |
|
133 | - } |
|
134 | - $newtokens = $mgmt->createTokens(true, [$admin], $idp); |
|
135 | - $URL = "https://" . $_SERVER['SERVER_NAME'] . dirname($_SERVER['SCRIPT_NAME']) . "/action_enrollment.php?token=" . array_keys($newtokens)[0]; |
|
136 | - $success = ["TOKEN URL" => $URL, "TOKEN" => array_keys($newtokens)[0]]; |
|
137 | - // done with the essentials - display in response. But if we also have an email address, send it there |
|
138 | - $email = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_TARGETMAIL); |
|
139 | - if ($email !== FALSE) { |
|
140 | - $sent = \core\common\OutsideComm::adminInvitationMail($email, "EXISTING-FED", array_keys($newtokens)[0], $idp->name, $fed, $idp->type); |
|
141 | - $success["EMAIL SENT"] = $sent["SENT"]; |
|
142 | - if ($sent["SENT"] === TRUE) { |
|
143 | - $success["EMAIL TRANSPORT SECURE"] = $sent["TRANSPORT"]; |
|
87 | + case web\lib\admin\API::ACTION_NEWINST: |
|
88 | + // create the inst, no admin, no attributes |
|
89 | + $typeRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_INSTTYPE); |
|
90 | + if ($typeRaw === FALSE) { |
|
91 | + throw new Exception("We did not receive a valid participant type!"); |
|
144 | 92 | } |
145 | - } |
|
146 | - $adminApi->returnSuccess($success); |
|
147 | - break; |
|
148 | - case web\lib\admin\API::ACTION_ADMIN_DEL: |
|
149 | - // IdP in question |
|
150 | - try { |
|
151 | - $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
152 | - } catch (Exception $e) { |
|
153 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
154 | - exit(1); |
|
155 | - } |
|
156 | - $currentAdmins = $idp->listOwners(); |
|
157 | - $toBeDeleted = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_ADMINID); |
|
158 | - if ($toBeDeleted === FALSE) { |
|
159 | - throw new Exception("A required parameter is missing, and this wasn't caught earlier?!"); |
|
160 | - } |
|
161 | - $found = FALSE; |
|
162 | - foreach ($currentAdmins as $oneAdmin) { |
|
163 | - if ($oneAdmin['MAIL'] == $toBeDeleted) { |
|
164 | - $found = TRUE; |
|
165 | - $mgmt = new core\UserManagement(); |
|
166 | - $mgmt->removeAdminFromIdP($idp, $oneAdmin['ID']); |
|
93 | + $type = $validator->partType($typeRaw); |
|
94 | + $idp = new \core\IdP($fed->newIdP($type, "PENDING", "API")); |
|
95 | + // now add all submitted attributes |
|
96 | + $inputs = $adminApi->uglify($scrubbedParameters); |
|
97 | + $optionParser->processSubmittedFields($idp, $inputs["POST"], $inputs["FILES"]); |
|
98 | + $adminApi->returnSuccess([web\lib\admin\API::AUXATTRIB_CAT_INST_ID => $idp->identifier]); |
|
99 | + break; |
|
100 | + case web\lib\admin\API::ACTION_DELINST: |
|
101 | + try { |
|
102 | + $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
103 | + } catch (Exception $e) { |
|
104 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
105 | + exit(1); |
|
167 | 106 | } |
168 | - } |
|
169 | - if ($found) { |
|
107 | + $idp->destroy(); |
|
170 | 108 | $adminApi->returnSuccess([]); |
171 | - } |
|
172 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "The admin with ID $toBeDeleted is not associated to IdP " . $idp->identifier); |
|
173 | - break; |
|
174 | - case web\lib\admin\API::ACTION_STATISTICS_FED: |
|
175 | - $adminApi->returnSuccess($fed->downloadStats("array")); |
|
176 | - break; |
|
177 | - case \web\lib\admin\API::ACTION_FEDERATION_LISTIDP: |
|
178 | - $retArray = []; |
|
179 | - $idpIdentifier = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID); |
|
180 | - if ($idpIdentifier === FALSE) { |
|
181 | - $allIdPs = $fed->listIdentityProviders(0); |
|
182 | - foreach ($allIdPs as $instanceId => $oneIdP) { |
|
183 | - $theIdP = $oneIdP["instance"]; |
|
184 | - $retArray[$instanceId] = $theIdP->getAttributes(); |
|
185 | - } |
|
186 | - } else { |
|
109 | + break; |
|
110 | + case web\lib\admin\API::ACTION_ADMIN_LIST: |
|
187 | 111 | try { |
188 | - $thisIdP = $validator->existingIdP($idpIdentifier); |
|
112 | + $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
189 | 113 | } catch (Exception $e) { |
190 | 114 | $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
191 | 115 | exit(1); |
192 | 116 | } |
193 | - $retArray[$idpIdentifier] = $thisIdP->getAttributes(); |
|
194 | - } |
|
195 | - foreach ($retArray as $instNumber => $oneInstData) { |
|
196 | - foreach ($oneInstData as $attribNumber => $oneAttrib) { |
|
197 | - if ($oneAttrib['name'] == "general:logo_file") { |
|
198 | - // JSON doesn't cope well with raw binary data, so b64 it |
|
199 | - $retArray[$instNumber][$attribNumber]['value'] = base64_encode($oneAttrib['value']); |
|
117 | + $adminApi->returnSuccess($idp->listOwners()); |
|
118 | + break; |
|
119 | + case web\lib\admin\API::ACTION_ADMIN_ADD: |
|
120 | + // IdP in question |
|
121 | + try { |
|
122 | + $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
123 | + } catch (Exception $e) { |
|
124 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
125 | + exit(1); |
|
126 | + } |
|
127 | + // here is the token |
|
128 | + $mgmt = new core\UserManagement(); |
|
129 | + // we know we have an admin ID but scrutinizer wants this checked more explicitly |
|
130 | + $admin = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_ADMINID); |
|
131 | + if ($admin === FALSE) { |
|
132 | + throw new Exception("A required parameter is missing, and this wasn't caught earlier?!"); |
|
133 | + } |
|
134 | + $newtokens = $mgmt->createTokens(true, [$admin], $idp); |
|
135 | + $URL = "https://" . $_SERVER['SERVER_NAME'] . dirname($_SERVER['SCRIPT_NAME']) . "/action_enrollment.php?token=" . array_keys($newtokens)[0]; |
|
136 | + $success = ["TOKEN URL" => $URL, "TOKEN" => array_keys($newtokens)[0]]; |
|
137 | + // done with the essentials - display in response. But if we also have an email address, send it there |
|
138 | + $email = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_TARGETMAIL); |
|
139 | + if ($email !== FALSE) { |
|
140 | + $sent = \core\common\OutsideComm::adminInvitationMail($email, "EXISTING-FED", array_keys($newtokens)[0], $idp->name, $fed, $idp->type); |
|
141 | + $success["EMAIL SENT"] = $sent["SENT"]; |
|
142 | + if ($sent["SENT"] === TRUE) { |
|
143 | + $success["EMAIL TRANSPORT SECURE"] = $sent["TRANSPORT"]; |
|
200 | 144 | } |
201 | 145 | } |
202 | - } |
|
203 | - $adminApi->returnSuccess($retArray); |
|
204 | - break; |
|
205 | - case \web\lib\admin\API::ACTION_NEWPROF_RADIUS: |
|
206 | - // fall-through intended: both get mostly identical treatment |
|
207 | - case web\lib\admin\API::ACTION_NEWPROF_SB: |
|
208 | - try { |
|
209 | - $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
210 | - } catch (Exception $e) { |
|
211 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
212 | - exit(1); |
|
213 | - } |
|
214 | - if ($inputDecoded['ACTION'] == web\lib\admin\API::ACTION_NEWPROF_RADIUS) { |
|
215 | - $type = "RADIUS"; |
|
216 | - } else { |
|
217 | - $type = "SILVERBULLET"; |
|
218 | - } |
|
219 | - $profile = $idp->newProfile($type); |
|
220 | - if ($profile === NULL) { |
|
221 | - $adminApi->returnError(\web\lib\admin\API::ERROR_INTERNAL_ERROR, "Unable to create a new Profile, for no apparent reason. Please contact support."); |
|
222 | - exit(1); |
|
223 | - } |
|
224 | - $inputs = $adminApi->uglify($scrubbedParameters); |
|
225 | - $optionParser->processSubmittedFields($profile, $inputs["POST"], $inputs["FILES"]); |
|
226 | - if ($inputDecoded['ACTION'] == web\lib\admin\API::ACTION_NEWPROF_SB) { |
|
227 | - // auto-accept ToU? |
|
228 | - if ($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_TOU) !== FALSE) { |
|
229 | - $profile->addAttribute("hiddenprofile:tou_accepted", NULL, 1); |
|
230 | - } |
|
231 | - // we're done at this point |
|
232 | - $adminApi->returnSuccess([\web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID => $profile->identifier]); |
|
146 | + $adminApi->returnSuccess($success); |
|
233 | 147 | break; |
234 | - } |
|
235 | - if (!$profile instanceof core\ProfileRADIUS) { |
|
236 | - throw new Exception("Can't be. This is only here to convince Scrutinizer that we're really talking RADIUS."); |
|
237 | - } |
|
238 | - /* const AUXATTRIB_PROFILE_REALM = 'ATTRIB-PROFILE-REALM'; |
|
239 | - const AUXATTRIB_PROFILE_OUTERVALUE = 'ATTRIB-PROFILE-OUTERVALUE'; */ |
|
240 | - $realm = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_REALM); |
|
241 | - $outer = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_OUTERVALUE); |
|
242 | - if ($realm !== FALSE) { |
|
243 | - if ($outer === FALSE) { |
|
244 | - $outer = ""; |
|
245 | - $profile->setAnonymousIDSupport(FALSE); |
|
148 | + case web\lib\admin\API::ACTION_ADMIN_DEL: |
|
149 | + // IdP in question |
|
150 | + try { |
|
151 | + $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
152 | + } catch (Exception $e) { |
|
153 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
154 | + exit(1); |
|
155 | + } |
|
156 | + $currentAdmins = $idp->listOwners(); |
|
157 | + $toBeDeleted = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_ADMINID); |
|
158 | + if ($toBeDeleted === FALSE) { |
|
159 | + throw new Exception("A required parameter is missing, and this wasn't caught earlier?!"); |
|
160 | + } |
|
161 | + $found = FALSE; |
|
162 | + foreach ($currentAdmins as $oneAdmin) { |
|
163 | + if ($oneAdmin['MAIL'] == $toBeDeleted) { |
|
164 | + $found = TRUE; |
|
165 | + $mgmt = new core\UserManagement(); |
|
166 | + $mgmt->removeAdminFromIdP($idp, $oneAdmin['ID']); |
|
167 | + } |
|
168 | + } |
|
169 | + if ($found) { |
|
170 | + $adminApi->returnSuccess([]); |
|
171 | + } |
|
172 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "The admin with ID $toBeDeleted is not associated to IdP " . $idp->identifier); |
|
173 | + break; |
|
174 | + case web\lib\admin\API::ACTION_STATISTICS_FED: |
|
175 | + $adminApi->returnSuccess($fed->downloadStats("array")); |
|
176 | + break; |
|
177 | + case \web\lib\admin\API::ACTION_FEDERATION_LISTIDP: |
|
178 | + $retArray = []; |
|
179 | + $idpIdentifier = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID); |
|
180 | + if ($idpIdentifier === FALSE) { |
|
181 | + $allIdPs = $fed->listIdentityProviders(0); |
|
182 | + foreach ($allIdPs as $instanceId => $oneIdP) { |
|
183 | + $theIdP = $oneIdP["instance"]; |
|
184 | + $retArray[$instanceId] = $theIdP->getAttributes(); |
|
185 | + } |
|
246 | 186 | } else { |
247 | - $outer = $outer . "@"; |
|
248 | - $profile->setAnonymousIDSupport(TRUE); |
|
187 | + try { |
|
188 | + $thisIdP = $validator->existingIdP($idpIdentifier); |
|
189 | + } catch (Exception $e) { |
|
190 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
191 | + exit(1); |
|
192 | + } |
|
193 | + $retArray[$idpIdentifier] = $thisIdP->getAttributes(); |
|
249 | 194 | } |
250 | - $profile->setRealm($outer . $realm); |
|
251 | - } |
|
252 | - /* const AUXATTRIB_PROFILE_TESTUSER = 'ATTRIB-PROFILE-TESTUSER'; */ |
|
253 | - $testuser = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_TESTUSER); |
|
254 | - if ($testuser !== FALSE) { |
|
255 | - $profile->setRealmCheckUser(TRUE, $testuser); |
|
256 | - } |
|
257 | - /* const AUXATTRIB_PROFILE_INPUT_HINT = 'ATTRIB-PROFILE-HINTREALM'; |
|
195 | + foreach ($retArray as $instNumber => $oneInstData) { |
|
196 | + foreach ($oneInstData as $attribNumber => $oneAttrib) { |
|
197 | + if ($oneAttrib['name'] == "general:logo_file") { |
|
198 | + // JSON doesn't cope well with raw binary data, so b64 it |
|
199 | + $retArray[$instNumber][$attribNumber]['value'] = base64_encode($oneAttrib['value']); |
|
200 | + } |
|
201 | + } |
|
202 | + } |
|
203 | + $adminApi->returnSuccess($retArray); |
|
204 | + break; |
|
205 | + case \web\lib\admin\API::ACTION_NEWPROF_RADIUS: |
|
206 | + // fall-through intended: both get mostly identical treatment |
|
207 | + case web\lib\admin\API::ACTION_NEWPROF_SB: |
|
208 | + try { |
|
209 | + $idp = $validator->existingIdP($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_INST_ID)); |
|
210 | + } catch (Exception $e) { |
|
211 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "IdP identifier does not exist!"); |
|
212 | + exit(1); |
|
213 | + } |
|
214 | + if ($inputDecoded['ACTION'] == web\lib\admin\API::ACTION_NEWPROF_RADIUS) { |
|
215 | + $type = "RADIUS"; |
|
216 | + } else { |
|
217 | + $type = "SILVERBULLET"; |
|
218 | + } |
|
219 | + $profile = $idp->newProfile($type); |
|
220 | + if ($profile === NULL) { |
|
221 | + $adminApi->returnError(\web\lib\admin\API::ERROR_INTERNAL_ERROR, "Unable to create a new Profile, for no apparent reason. Please contact support."); |
|
222 | + exit(1); |
|
223 | + } |
|
224 | + $inputs = $adminApi->uglify($scrubbedParameters); |
|
225 | + $optionParser->processSubmittedFields($profile, $inputs["POST"], $inputs["FILES"]); |
|
226 | + if ($inputDecoded['ACTION'] == web\lib\admin\API::ACTION_NEWPROF_SB) { |
|
227 | + // auto-accept ToU? |
|
228 | + if ($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_TOU) !== FALSE) { |
|
229 | + $profile->addAttribute("hiddenprofile:tou_accepted", NULL, 1); |
|
230 | + } |
|
231 | + // we're done at this point |
|
232 | + $adminApi->returnSuccess([\web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID => $profile->identifier]); |
|
233 | + break; |
|
234 | + } |
|
235 | + if (!$profile instanceof core\ProfileRADIUS) { |
|
236 | + throw new Exception("Can't be. This is only here to convince Scrutinizer that we're really talking RADIUS."); |
|
237 | + } |
|
238 | + /* const AUXATTRIB_PROFILE_REALM = 'ATTRIB-PROFILE-REALM'; |
|
239 | + const AUXATTRIB_PROFILE_OUTERVALUE = 'ATTRIB-PROFILE-OUTERVALUE'; */ |
|
240 | + $realm = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_REALM); |
|
241 | + $outer = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_OUTERVALUE); |
|
242 | + if ($realm !== FALSE) { |
|
243 | + if ($outer === FALSE) { |
|
244 | + $outer = ""; |
|
245 | + $profile->setAnonymousIDSupport(FALSE); |
|
246 | + } else { |
|
247 | + $outer = $outer . "@"; |
|
248 | + $profile->setAnonymousIDSupport(TRUE); |
|
249 | + } |
|
250 | + $profile->setRealm($outer . $realm); |
|
251 | + } |
|
252 | + /* const AUXATTRIB_PROFILE_TESTUSER = 'ATTRIB-PROFILE-TESTUSER'; */ |
|
253 | + $testuser = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_TESTUSER); |
|
254 | + if ($testuser !== FALSE) { |
|
255 | + $profile->setRealmCheckUser(TRUE, $testuser); |
|
256 | + } |
|
257 | + /* const AUXATTRIB_PROFILE_INPUT_HINT = 'ATTRIB-PROFILE-HINTREALM'; |
|
258 | 258 | const AUXATTRIB_PROFILE_INPUT_VERIFY = 'ATTRIB-PROFILE-VERIFYREALM'; */ |
259 | - $hint = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_INPUT_HINT); |
|
260 | - $enforce = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_INPUT_VERIFY); |
|
261 | - if ($enforce !== FALSE) { |
|
262 | - $profile->setInputVerificationPreference($enforce, $hint); |
|
263 | - } |
|
264 | - /* const AUXATTRIB_PROFILE_EAPTYPE */ |
|
265 | - $iterator = 1; |
|
266 | - foreach ($scrubbedParameters as $oneParam) { |
|
267 | - if ($oneParam['NAME'] == web\lib\admin\API::AUXATTRIB_PROFILE_EAPTYPE && is_int($oneParam["VALUE"])) { |
|
268 | - $type = new \core\common\EAP($oneParam["VALUE"]); |
|
269 | - $profile->addSupportedEapMethod($type, $iterator); |
|
270 | - $iterator = $iterator + 1; |
|
259 | + $hint = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_INPUT_HINT); |
|
260 | + $enforce = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_PROFILE_INPUT_VERIFY); |
|
261 | + if ($enforce !== FALSE) { |
|
262 | + $profile->setInputVerificationPreference($enforce, $hint); |
|
271 | 263 | } |
272 | - } |
|
273 | - // reinstantiate $profile freshly from DB - it was updated in the process |
|
274 | - $profileFresh = new core\ProfileRADIUS($profile->identifier); |
|
275 | - $profileFresh->prepShowtime(); |
|
276 | - $adminApi->returnSuccess([\web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID => $profileFresh->identifier]); |
|
277 | - break; |
|
278 | - case web\lib\admin\API::ACTION_ENDUSER_NEW: |
|
279 | - // fall-through intentional, those two actions are doing nearly identical things |
|
280 | - case web\lib\admin\API::ACTION_ENDUSER_CHANGEEXPIRY: |
|
281 | - $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
282 | - if ($prof_id === FALSE) { |
|
283 | - exit(1); |
|
284 | - } |
|
285 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
286 | - if ($evaluation === FALSE) { |
|
287 | - exit(1); |
|
288 | - } |
|
289 | - list($idp, $profile) = $evaluation; |
|
290 | - $user = $validator->string($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERNAME)); |
|
291 | - $expiryRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_EXPIRY); |
|
292 | - if ($expiryRaw === FALSE) { |
|
293 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "The expiry date wasn't found in the request."); |
|
264 | + /* const AUXATTRIB_PROFILE_EAPTYPE */ |
|
265 | + $iterator = 1; |
|
266 | + foreach ($scrubbedParameters as $oneParam) { |
|
267 | + if ($oneParam['NAME'] == web\lib\admin\API::AUXATTRIB_PROFILE_EAPTYPE && is_int($oneParam["VALUE"])) { |
|
268 | + $type = new \core\common\EAP($oneParam["VALUE"]); |
|
269 | + $profile->addSupportedEapMethod($type, $iterator); |
|
270 | + $iterator = $iterator + 1; |
|
271 | + } |
|
272 | + } |
|
273 | + // reinstantiate $profile freshly from DB - it was updated in the process |
|
274 | + $profileFresh = new core\ProfileRADIUS($profile->identifier); |
|
275 | + $profileFresh->prepShowtime(); |
|
276 | + $adminApi->returnSuccess([\web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID => $profileFresh->identifier]); |
|
294 | 277 | break; |
295 | - } |
|
296 | - $expiry = new DateTime($expiryRaw); |
|
297 | - try { |
|
298 | - switch ($inputDecoded['ACTION']) { |
|
278 | + case web\lib\admin\API::ACTION_ENDUSER_NEW: |
|
279 | + // fall-through intentional, those two actions are doing nearly identical things |
|
280 | + case web\lib\admin\API::ACTION_ENDUSER_CHANGEEXPIRY: |
|
281 | + $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
282 | + if ($prof_id === FALSE) { |
|
283 | + exit(1); |
|
284 | + } |
|
285 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
286 | + if ($evaluation === FALSE) { |
|
287 | + exit(1); |
|
288 | + } |
|
289 | + list($idp, $profile) = $evaluation; |
|
290 | + $user = $validator->string($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERNAME)); |
|
291 | + $expiryRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_EXPIRY); |
|
292 | + if ($expiryRaw === FALSE) { |
|
293 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "The expiry date wasn't found in the request."); |
|
294 | + break; |
|
295 | + } |
|
296 | + $expiry = new DateTime($expiryRaw); |
|
297 | + try { |
|
298 | + switch ($inputDecoded['ACTION']) { |
|
299 | 299 | case web\lib\admin\API::ACTION_ENDUSER_NEW: |
300 | 300 | $retval = $profile->addUser($user, $expiry); |
301 | 301 | break; |
@@ -308,7 +308,7 @@ discard block |
||
308 | 308 | $retval = 1; // function doesn't have any failure vectors not raising an Exception and doesn't return a value |
309 | 309 | } |
310 | 310 | break; |
311 | - } |
|
311 | + } |
|
312 | 312 | } catch (Exception $e) { |
313 | 313 | $adminApi->returnError(web\lib\admin\API::ERROR_INTERNAL_ERROR, "The operation failed. Maybe a duplicate username, or malformed expiry date?"); |
314 | 314 | exit(1); |
@@ -319,25 +319,25 @@ discard block |
||
319 | 319 | } |
320 | 320 | $adminApi->returnSuccess([web\lib\admin\API::AUXATTRIB_SB_USERNAME => $user, \web\lib\admin\API::AUXATTRIB_SB_USERID => $retval]); |
321 | 321 | break; |
322 | - case \web\lib\admin\API::ACTION_ENDUSER_DEACTIVATE: |
|
323 | - // fall-through intended: both actions are very similar |
|
324 | - case \web\lib\admin\API::ACTION_TOKEN_NEW: |
|
325 | - $profile_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
326 | - if ($profile_id === FALSE) { |
|
327 | - exit(1); |
|
328 | - } |
|
329 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $profile_id); |
|
330 | - if ($evaluation === FALSE) { |
|
331 | - exit(1); |
|
332 | - } |
|
333 | - list($idp, $profile) = $evaluation; |
|
334 | - $userId = $validator->integer($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID)); |
|
335 | - if ($userId === FALSE) { |
|
336 | - $adminApi->returnError(\web\lib\admin\API::ERROR_INVALID_PARAMETER, "User ID is not an integer."); |
|
337 | - exit(1); |
|
338 | - } |
|
339 | - $additionalInfo = []; |
|
340 | - switch ($inputDecoded['ACTION']) { // this is where the two differ |
|
322 | + case \web\lib\admin\API::ACTION_ENDUSER_DEACTIVATE: |
|
323 | + // fall-through intended: both actions are very similar |
|
324 | + case \web\lib\admin\API::ACTION_TOKEN_NEW: |
|
325 | + $profile_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
326 | + if ($profile_id === FALSE) { |
|
327 | + exit(1); |
|
328 | + } |
|
329 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $profile_id); |
|
330 | + if ($evaluation === FALSE) { |
|
331 | + exit(1); |
|
332 | + } |
|
333 | + list($idp, $profile) = $evaluation; |
|
334 | + $userId = $validator->integer($adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID)); |
|
335 | + if ($userId === FALSE) { |
|
336 | + $adminApi->returnError(\web\lib\admin\API::ERROR_INVALID_PARAMETER, "User ID is not an integer."); |
|
337 | + exit(1); |
|
338 | + } |
|
339 | + $additionalInfo = []; |
|
340 | + switch ($inputDecoded['ACTION']) { // this is where the two differ |
|
341 | 341 | case \web\lib\admin\API::ACTION_ENDUSER_DEACTIVATE: |
342 | 342 | $result = $profile->deactivateUser($userId); |
343 | 343 | break; |
@@ -370,7 +370,7 @@ discard block |
||
370 | 370 | } |
371 | 371 | } |
372 | 372 | break; |
373 | - } |
|
373 | + } |
|
374 | 374 | |
375 | 375 | if ($result !== TRUE) { |
376 | 376 | $adminApi->returnError(\web\lib\admin\API::ERROR_INVALID_PARAMETER, "These parameters did not lead to an existing, active user."); |
@@ -378,69 +378,69 @@ discard block |
||
378 | 378 | } |
379 | 379 | $adminApi->returnSuccess($additionalInfo); |
380 | 380 | break; |
381 | - case \web\lib\admin\API::ACTION_ENDUSER_IDENTIFY: |
|
382 | - $profile_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
383 | - if ($profile_id === FALSE) { |
|
384 | - exit(1); |
|
385 | - } |
|
386 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $profile_id); |
|
387 | - if ($evaluation === FALSE) { |
|
388 | - exit(1); |
|
389 | - } |
|
390 | - list($idp, $profile) = $evaluation; |
|
391 | - $userId = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID); |
|
392 | - $userName = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERNAME); |
|
393 | - $certSerial = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
|
394 | - $certCN = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTCN); |
|
395 | - if ($userId === FALSE && $userName === FALSE && $certSerial === FALSE && $certCN === FALSE) { |
|
396 | - // we need at least one of those |
|
397 | - $adminApi->returnError(\web\lib\admin\API::ERROR_MISSING_PARAMETER, "At least one of User ID, Username, certificate serial, or certificate CN is required."); |
|
398 | - break; |
|
399 | - } |
|
400 | - if ($certSerial !== FALSE) { // we got a cert serial |
|
401 | - $serial = explode(":", $certSerial); |
|
402 | - $cert = new \core\SilverbulletCertificate($serial[1], $serial[0]); |
|
381 | + case \web\lib\admin\API::ACTION_ENDUSER_IDENTIFY: |
|
382 | + $profile_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
383 | + if ($profile_id === FALSE) { |
|
384 | + exit(1); |
|
403 | 385 | } |
404 | - if ($certCN !== FALSE) { // we got a cert CN |
|
405 | - $cert = new \core\SilverbulletCertificate($certCN); |
|
406 | - } |
|
407 | - if ($cert !== NULL) { // we found a cert; verify it and extract userId |
|
408 | - if ($cert->status == \core\SilverbulletCertificate::CERTSTATUS_INVALID) { |
|
409 | - return $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Certificate not found."); |
|
386 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $profile_id); |
|
387 | + if ($evaluation === FALSE) { |
|
388 | + exit(1); |
|
410 | 389 | } |
411 | - if ($cert->profileId != $profile->identifier) { |
|
412 | - return $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Certificate does not belong to this profile."); |
|
390 | + list($idp, $profile) = $evaluation; |
|
391 | + $userId = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID); |
|
392 | + $userName = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERNAME); |
|
393 | + $certSerial = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
|
394 | + $certCN = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTCN); |
|
395 | + if ($userId === FALSE && $userName === FALSE && $certSerial === FALSE && $certCN === FALSE) { |
|
396 | + // we need at least one of those |
|
397 | + $adminApi->returnError(\web\lib\admin\API::ERROR_MISSING_PARAMETER, "At least one of User ID, Username, certificate serial, or certificate CN is required."); |
|
398 | + break; |
|
413 | 399 | } |
414 | - $userId = $cert->userId; |
|
415 | - } |
|
416 | - if ($userId !== FALSE) { |
|
417 | - $userList = $profile->getUserById($userId); |
|
418 | - } |
|
419 | - if ($userName !== FALSE) { |
|
420 | - $userList = $profile->getUserByName($userName); |
|
421 | - } |
|
422 | - if (count($userList) === 1) { |
|
423 | - foreach ($userList as $oneUserId => $oneUserName) { |
|
424 | - return $adminApi->returnSuccess([web\lib\admin\API::AUXATTRIB_SB_USERNAME => $oneUserName, \web\lib\admin\API::AUXATTRIB_SB_USERID => $oneUserId]); |
|
400 | + if ($certSerial !== FALSE) { // we got a cert serial |
|
401 | + $serial = explode(":", $certSerial); |
|
402 | + $cert = new \core\SilverbulletCertificate($serial[1], $serial[0]); |
|
403 | + } |
|
404 | + if ($certCN !== FALSE) { // we got a cert CN |
|
405 | + $cert = new \core\SilverbulletCertificate($certCN); |
|
425 | 406 | } |
426 | - } |
|
427 | - $adminApi->returnError(\web\lib\admin\API::ERROR_INVALID_PARAMETER, "No matching user found in this profile."); |
|
428 | - break; |
|
429 | - case \web\lib\admin\API::ACTION_ENDUSER_LIST: |
|
430 | - // fall-through: those two are similar |
|
431 | - case \web\lib\admin\API::ACTION_TOKEN_LIST: |
|
432 | - $profile_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
433 | - if ($profile_id === FALSE) { |
|
434 | - exit(1); |
|
435 | - } |
|
436 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $profile_id); |
|
437 | - if ($evaluation === FALSE) { |
|
438 | - exit(1); |
|
439 | - } |
|
440 | - list($idp, $profile) = $evaluation; |
|
441 | - $allUsers = $profile->listAllUsers(); |
|
442 | - // this is where they differ |
|
443 | - switch ($inputDecoded['ACTION']) { |
|
407 | + if ($cert !== NULL) { // we found a cert; verify it and extract userId |
|
408 | + if ($cert->status == \core\SilverbulletCertificate::CERTSTATUS_INVALID) { |
|
409 | + return $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Certificate not found."); |
|
410 | + } |
|
411 | + if ($cert->profileId != $profile->identifier) { |
|
412 | + return $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Certificate does not belong to this profile."); |
|
413 | + } |
|
414 | + $userId = $cert->userId; |
|
415 | + } |
|
416 | + if ($userId !== FALSE) { |
|
417 | + $userList = $profile->getUserById($userId); |
|
418 | + } |
|
419 | + if ($userName !== FALSE) { |
|
420 | + $userList = $profile->getUserByName($userName); |
|
421 | + } |
|
422 | + if (count($userList) === 1) { |
|
423 | + foreach ($userList as $oneUserId => $oneUserName) { |
|
424 | + return $adminApi->returnSuccess([web\lib\admin\API::AUXATTRIB_SB_USERNAME => $oneUserName, \web\lib\admin\API::AUXATTRIB_SB_USERID => $oneUserId]); |
|
425 | + } |
|
426 | + } |
|
427 | + $adminApi->returnError(\web\lib\admin\API::ERROR_INVALID_PARAMETER, "No matching user found in this profile."); |
|
428 | + break; |
|
429 | + case \web\lib\admin\API::ACTION_ENDUSER_LIST: |
|
430 | + // fall-through: those two are similar |
|
431 | + case \web\lib\admin\API::ACTION_TOKEN_LIST: |
|
432 | + $profile_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
433 | + if ($profile_id === FALSE) { |
|
434 | + exit(1); |
|
435 | + } |
|
436 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $profile_id); |
|
437 | + if ($evaluation === FALSE) { |
|
438 | + exit(1); |
|
439 | + } |
|
440 | + list($idp, $profile) = $evaluation; |
|
441 | + $allUsers = $profile->listAllUsers(); |
|
442 | + // this is where they differ |
|
443 | + switch ($inputDecoded['ACTION']) { |
|
444 | 444 | case \web\lib\admin\API::ACTION_ENDUSER_LIST: |
445 | 445 | $adminApi->returnSuccess($allUsers); |
446 | 446 | break; |
@@ -459,105 +459,105 @@ discard block |
||
459 | 459 | $infoSet[$oneTokenObject->userId] = [\web\lib\admin\API::AUXATTRIB_TOKEN => $oneTokenObject->invitationTokenString, "STATUS" => $oneTokenObject->invitationTokenStatus]; |
460 | 460 | } |
461 | 461 | $adminApi->returnSuccess($infoSet); |
462 | - } |
|
463 | - break; |
|
464 | - case \web\lib\admin\API::ACTION_TOKEN_REVOKE: |
|
465 | - $tokenRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_TOKEN); |
|
466 | - if ($tokenRaw === FALSE) { |
|
467 | - exit(1); |
|
468 | - } |
|
469 | - $token = new core\SilverbulletInvitation($tokenRaw); |
|
470 | - if ($token->invitationTokenStatus !== core\SilverbulletInvitation::SB_TOKENSTATUS_VALID && $token->invitationTokenStatus !== core\SilverbulletInvitation::SB_TOKENSTATUS_PARTIALLY_REDEEMED) { |
|
471 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "This is not a currently valid token."); |
|
472 | - exit(1); |
|
473 | - } |
|
474 | - $token->revokeInvitation(); |
|
475 | - $adminApi->returnSuccess([]); |
|
476 | - break; |
|
477 | - case \web\lib\admin\API::ACTION_CERT_LIST: |
|
478 | - $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
479 | - $user_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID); |
|
480 | - if ($prof_id === FALSE || !is_int($user_id)) { |
|
481 | - exit(1); |
|
482 | - } |
|
483 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
484 | - if ($evaluation === FALSE) { |
|
485 | - exit(1); |
|
486 | - } |
|
487 | - list($idp, $profile) = $evaluation; |
|
488 | - $invitations = $profile->userStatus($user_id); |
|
489 | - // now pull out cert information from the object |
|
490 | - $certs = []; |
|
491 | - foreach ($invitations as $oneInvitation) { |
|
492 | - $certs = array_merge($certs, $oneInvitation->associatedCertificates); |
|
493 | - } |
|
494 | - // extract relevant subset of information from cert objects |
|
495 | - $certDetails = []; |
|
496 | - foreach ($certs as $cert) { |
|
497 | - $certDetails[$cert->ca_type . ":" . $cert->serial] = ["ISSUED" => $cert->issued, "EXPIRY" => $cert->expiry, "STATUS" => $cert->status, "DEVICE" => $cert->device, "CN" => $cert->username, "ANNOTATION" => $cert->annotation]; |
|
498 | - } |
|
499 | - $adminApi->returnSuccess($certDetails); |
|
500 | - break; |
|
501 | - case \web\lib\admin\API::ACTION_CERT_REVOKE: |
|
502 | - $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
503 | - if ($prof_id === FALSE) { |
|
504 | - exit(1); |
|
505 | - } |
|
506 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
507 | - if ($evaluation === FALSE) { |
|
508 | - exit(1); |
|
509 | - } |
|
510 | - list($idp, $profile) = $evaluation; |
|
511 | - // tear apart the serial |
|
512 | - $serialRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
|
513 | - if ($serialRaw === FALSE) { |
|
514 | - exit(1); |
|
515 | - } |
|
516 | - $serial = explode(":", $serialRaw); |
|
517 | - $cert = new \core\SilverbulletCertificate($serial[1], $serial[0]); |
|
518 | - if ($cert->status == \core\SilverbulletCertificate::CERTSTATUS_INVALID) { |
|
519 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial not found."); |
|
520 | - } |
|
521 | - if ($cert->profileId != $profile->identifier) { |
|
522 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial does not belong to this profile."); |
|
523 | - } |
|
524 | - $cert->revokeCertificate(); |
|
525 | - $adminApi->returnSuccess([]); |
|
462 | + } |
|
526 | 463 | break; |
527 | - case \web\lib\admin\API::ACTION_CERT_ANNOTATE: |
|
528 | - $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
529 | - if ($prof_id === FALSE) { |
|
530 | - exit(1); |
|
531 | - } |
|
532 | - $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
533 | - if ($evaluation === FALSE) { |
|
534 | - exit(1); |
|
535 | - } |
|
536 | - list($idp, $profile) = $evaluation; |
|
537 | - // tear apart the serial |
|
538 | - $serialRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
|
539 | - if ($serialRaw === FALSE) { |
|
540 | - exit(1); |
|
541 | - } |
|
542 | - $serial = explode(":", $serialRaw); |
|
543 | - $cert = new \core\SilverbulletCertificate($serial[1], $serial[0]); |
|
544 | - if ($cert->status == \core\SilverbulletCertificate::CERTSTATUS_INVALID) { |
|
545 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial not found."); |
|
546 | - } |
|
547 | - if ($cert->profileId != $profile->identifier) { |
|
548 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial does not belong to this profile."); |
|
549 | - } |
|
550 | - $annotationRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTANNOTATION); |
|
551 | - if ($annotationRaw === FALSE) { |
|
552 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Unable to extract annotation."); |
|
464 | + case \web\lib\admin\API::ACTION_TOKEN_REVOKE: |
|
465 | + $tokenRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_TOKEN); |
|
466 | + if ($tokenRaw === FALSE) { |
|
467 | + exit(1); |
|
468 | + } |
|
469 | + $token = new core\SilverbulletInvitation($tokenRaw); |
|
470 | + if ($token->invitationTokenStatus !== core\SilverbulletInvitation::SB_TOKENSTATUS_VALID && $token->invitationTokenStatus !== core\SilverbulletInvitation::SB_TOKENSTATUS_PARTIALLY_REDEEMED) { |
|
471 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "This is not a currently valid token."); |
|
472 | + exit(1); |
|
473 | + } |
|
474 | + $token->revokeInvitation(); |
|
475 | + $adminApi->returnSuccess([]); |
|
553 | 476 | break; |
554 | - } |
|
555 | - $annotation = json_decode($annotationRaw, TRUE); |
|
556 | - $cert->annotate($annotation); |
|
557 | - $adminApi->returnSuccess([]); |
|
477 | + case \web\lib\admin\API::ACTION_CERT_LIST: |
|
478 | + $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
479 | + $user_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_USERID); |
|
480 | + if ($prof_id === FALSE || !is_int($user_id)) { |
|
481 | + exit(1); |
|
482 | + } |
|
483 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
484 | + if ($evaluation === FALSE) { |
|
485 | + exit(1); |
|
486 | + } |
|
487 | + list($idp, $profile) = $evaluation; |
|
488 | + $invitations = $profile->userStatus($user_id); |
|
489 | + // now pull out cert information from the object |
|
490 | + $certs = []; |
|
491 | + foreach ($invitations as $oneInvitation) { |
|
492 | + $certs = array_merge($certs, $oneInvitation->associatedCertificates); |
|
493 | + } |
|
494 | + // extract relevant subset of information from cert objects |
|
495 | + $certDetails = []; |
|
496 | + foreach ($certs as $cert) { |
|
497 | + $certDetails[$cert->ca_type . ":" . $cert->serial] = ["ISSUED" => $cert->issued, "EXPIRY" => $cert->expiry, "STATUS" => $cert->status, "DEVICE" => $cert->device, "CN" => $cert->username, "ANNOTATION" => $cert->annotation]; |
|
498 | + } |
|
499 | + $adminApi->returnSuccess($certDetails); |
|
500 | + break; |
|
501 | + case \web\lib\admin\API::ACTION_CERT_REVOKE: |
|
502 | + $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
503 | + if ($prof_id === FALSE) { |
|
504 | + exit(1); |
|
505 | + } |
|
506 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
507 | + if ($evaluation === FALSE) { |
|
508 | + exit(1); |
|
509 | + } |
|
510 | + list($idp, $profile) = $evaluation; |
|
511 | + // tear apart the serial |
|
512 | + $serialRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
|
513 | + if ($serialRaw === FALSE) { |
|
514 | + exit(1); |
|
515 | + } |
|
516 | + $serial = explode(":", $serialRaw); |
|
517 | + $cert = new \core\SilverbulletCertificate($serial[1], $serial[0]); |
|
518 | + if ($cert->status == \core\SilverbulletCertificate::CERTSTATUS_INVALID) { |
|
519 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial not found."); |
|
520 | + } |
|
521 | + if ($cert->profileId != $profile->identifier) { |
|
522 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial does not belong to this profile."); |
|
523 | + } |
|
524 | + $cert->revokeCertificate(); |
|
525 | + $adminApi->returnSuccess([]); |
|
526 | + break; |
|
527 | + case \web\lib\admin\API::ACTION_CERT_ANNOTATE: |
|
528 | + $prof_id = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_CAT_PROFILE_ID); |
|
529 | + if ($prof_id === FALSE) { |
|
530 | + exit(1); |
|
531 | + } |
|
532 | + $evaluation = $adminApi->commonSbProfileChecks($fed, $prof_id); |
|
533 | + if ($evaluation === FALSE) { |
|
534 | + exit(1); |
|
535 | + } |
|
536 | + list($idp, $profile) = $evaluation; |
|
537 | + // tear apart the serial |
|
538 | + $serialRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTSERIAL); |
|
539 | + if ($serialRaw === FALSE) { |
|
540 | + exit(1); |
|
541 | + } |
|
542 | + $serial = explode(":", $serialRaw); |
|
543 | + $cert = new \core\SilverbulletCertificate($serial[1], $serial[0]); |
|
544 | + if ($cert->status == \core\SilverbulletCertificate::CERTSTATUS_INVALID) { |
|
545 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial not found."); |
|
546 | + } |
|
547 | + if ($cert->profileId != $profile->identifier) { |
|
548 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Serial does not belong to this profile."); |
|
549 | + } |
|
550 | + $annotationRaw = $adminApi->firstParameterInstance($scrubbedParameters, web\lib\admin\API::AUXATTRIB_SB_CERTANNOTATION); |
|
551 | + if ($annotationRaw === FALSE) { |
|
552 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_PARAMETER, "Unable to extract annotation."); |
|
553 | + break; |
|
554 | + } |
|
555 | + $annotation = json_decode($annotationRaw, TRUE); |
|
556 | + $cert->annotate($annotation); |
|
557 | + $adminApi->returnSuccess([]); |
|
558 | 558 | |
559 | - break; |
|
559 | + break; |
|
560 | 560 | |
561 | - default: |
|
562 | - $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_ACTION, "Not implemented yet."); |
|
561 | + default: |
|
562 | + $adminApi->returnError(web\lib\admin\API::ERROR_INVALID_ACTION, "Not implemented yet."); |
|
563 | 563 | } |
564 | 564 | \ No newline at end of file |