delegate/index-functions.php ➔ handleAllowDelegation()

Complexity

Conditions	32
Paths	> 20000

Size

Total Lines

239

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function handleAllowDelegation($always = false)
{
    // The 'authorized' servlet may return a response URL to be used
    // instead of the success / failure URLs.
    $responseurl = '';

    $log = new Loggit();
    $log->info('Attempting to delegate a certificate to a portal...');

    $lifetime = 0;
    // Check the skin's forcelifetime and use it if it is configured.
    $forcelifetime = Util::getSkin()->getConfigOption(
        'delegate',
        'forcelifetime'
    );
    if ((!is_null($forcelifetime)) && ((int)$forcelifetime > 0)) {
        $lifetime = (int)$forcelifetime;
    }

    // Next, try to get the certificate lifetime from a submitted <form>
    if ($lifetime == 0) {
        $lifetime = (int)(trim(Util::getPostVar('lifetime')));
    }

    // If we couldn't get lifetime from the <form>, try the cookie
    $pc = new PortalCookie();
    if ($lifetime == 0) {
        $lifetime = (int)($pc->get('lifetime'));
    }

    // Default lifetime to 12 hours. And then make sure lifetime is in
    // acceptable range.
    if ($lifetime == 0) {
        $lifetime = 12;
    }
    list($minlifetime, $maxlifetime) =
        Content::getMinMaxLifetimes('delegate', 240);
    if ($lifetime < $minlifetime) {
        $lifetime = $minlifetime;
    } elseif ($lifetime > $maxlifetime) {
        $lifetime = $maxlifetime;
    }

    $pc->set('remember', (int)$always);
    $pc->set('lifetime', $lifetime);
    $pc->write();

    $success = false;  // Assume delegation of certificate failed
    $certtext = '';    // Output of 'openssl x509 -noout -text -in cert.pem'
    $myproxyinfo = Util::getSessionVar('myproxyinfo');

    // Now call out to the 'oauth/authorized' servlet to execute
    // the delegation the credential to the portal.
    $ch = curl_init();
    if ($ch !== false) {
        $tempcred = Util::getSessionVar('tempcred');
        $url = AUTHORIZED_URL . '?' .
               'oauth_token=' . urlencode($tempcred) . '&' .
               'cilogon_lifetime=' . $lifetime . '&' .
               'cilogon_loa=' . urlencode(Util::getSessionVar('loa')) . '&' .
               'cilogon_uid=' . urlencode(Util::getSessionVar('uid')) .
               ((strlen($myproxyinfo) > 0) ?
                   ('&cilogon_info=' . urlencode($myproxyinfo)) : '');
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_TIMEOUT, 35);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        $output = curl_exec($ch);
        if (curl_errno($ch)) { // Send alert on curl errors
            Util::sendErrorAlert(
                'cUrl Error',
                'cUrl Error    = ' . curl_error($ch) . "\n" .
                "URL Accessed  = $url"
            );
        }
        if (!empty($output)) {
            $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            if ($httpcode == 200) {
                // Check body of curl query for cilogon_status=ok
                if (preg_match('/cilogon_status=ok/', $output)) {
                    $success = true;
                    // Also check if the cert was returned as base64
                    // encoded PEM certificate.  If so, get info about it.
                    if (
                        preg_match(
                            '/cilogon_cert=([^\s]+)/',
                            $output,
                            $matches
                        )
                    ) {
                        $b64cert = $matches[1];
                        $cert = base64_decode($b64cert);
                        if ($cert !== false) {
                            // Run 'openssl x509' command for cert info
                            exec(
                                '/bin/env RANDFILE=/tmp/.rnd ' .
                                '/usr/bin/openssl x509 -text ' .
                                '<<< ' . escapeshellarg($cert) . ' 2>&1',
                                $x509out,
                                $retcode
                            );
                            if ($retcode == 0) {

It seems like you are loosely comparing $retcode of type integer|null to 0; this is ambiguous as not only 0 == 0 is true, but null == 0 is true, too. Consider using a strict comparison ===.

                                $certtext = implode("\n", $x509out);
                            } else {
                                $certtext = $cert;
                            }
                        }
                    }
                }
                // Check for an alternate response URL to be used
                // in place of success / failure URLs.
                if (
                    preg_match(
                        '/cilogon_response_url=([^\s]+)/',
                        $output,
                        $matches
                    )
                ) {
                    $responseurl = $matches[1];
                }
            }
        }
        curl_close($ch);
    }

    $log = new Loggit();
    $log->info('Delegation of certificate to portal ' .
               ($success ? 'succeeded.' : 'failed.'));
    //CIL-507 Special log message for XSEDE
    $log->info('USAGE email="' . Util::getSessionVar('emailaddr') .
               '" client="' . Util::getSessionVar('portalname') . '"');


    // Depending on the result (success or failure), output appropriate
    // HTML to allow the user to return to the portal, or if $always
    // was set, then automatically return the user to the successuri,
    // failureuri, or cilogon_reponse_url if supplied by authorized servlet.
    if ($always) {
        $log->info("Automatically returning to portal's " .
            ($success ? 'success' : 'failure') . ' url.');
        $location = 'Location: ' . ((strlen($responseurl) > 0) ? $responseurl :
            (Util::getSessionVar($success ? 'successuri' : 'failureuri')));
        if ($success) {
            Util::unsetClientSessionVars();
            /// Util::unsetAllUserSessionVars();
        } else {
            Util::unsetAllUserSessionVars();
        }
        header($location);
        exit; // No further processing necessary
    } else {
        Content::printHeader('Delegation ' .
            ($success ? 'Successful' : 'Failed'));

        echo '
        <div class="boxed">
        <div>
        <div class="icon">
        ';
        Content::printIcon(($success ? 'okay' : 'error'));
        echo '
        </div>
        <h2>' , ($success ? 'Success!' : 'Failure!') , '</h2>
        </div>
        ';
        if ($success) {
            echo '
            <p>
            The CILogon Service has issued a certificate to "' ,
            htmlspecialchars(Util::getSessionVar('portalname')) , '".
            Below is a link to return to
            the site to use the issued certificate.
            </p>
            ';
            // If we got the cert from the 'oauth/authorized' script,
            // output it in an expandable/scrollable <div> for user info.
            if (strlen($certtext) > 0) {
                echo '
                <noscript>
                <div class="nojs">
                Javascript is disabled. In order to expand the "Certificate
                Details" section below, please enable Javascript in your
                browser.
                </div>
                </noscript>

                <div class="summary">
                <div id="certtext1" style="display:inline"><span
                class="expander"><a
                href="javascript:showHideDiv(\'certtext\',-1)"><img
                src="/images/triright.gif" alt="&rArr;" width="14"
                height="14" />
                Certificate Details</a></span>
                </div>
                <div id="certtext2" style="display:none"><span
                class="expander"><a
                href="javascript:showHideDiv(\'certtext\',-1)"><img
                src="/images/tridown.gif" alt="&dArr;" width="14"
                height="14" />
                Certificate Details</a></span>
                </div>
                <br class="clear" />
                <div id="certtext3" style="display:none">
                  <div class="portalinfo">
                  <pre>' , htmlspecialchars($certtext) , '</pre>
                  </div>
                </div>
                </div>
                ';
            }
        } else {
            echo '
            <p>
            We were unable to issue a certificate to "' ,
            htmlspecialchars(Util::getSessionVar('portalname')) , '".
            Below is a link to return to the site.
            </p>
            ';
        }
        echo '
        <div class="returnlink">
          <a href="' ,
          ((strlen($responseurl) > 0) ? $responseurl :
           (Util::getSessionVar($success ? 'successuri' : 'failureuri'))) ,
          '">Return to ' ,
          htmlspecialchars(Util::getSessionVar('portalname')) , '</a>
        </div>
        </div>
        ';
        Content::printFooter();
        if ($success) {
            Util::unsetClientSessionVars();
            // Util::unsetAllUserSessionVars();
        } else {
            Util::unsetAllUserSessionVars();
        }
    }
}