1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
/** |
4
|
|
|
* This file contains functions called by index.php. The index.php |
5
|
|
|
* file should include this file with the following statement at the top: |
6
|
|
|
* |
7
|
|
|
* require_once __DIR__ . '/index-functions.php'; |
8
|
|
|
*/ |
9
|
|
|
|
10
|
|
|
use CILogon\Service\Util; |
11
|
|
|
use CILogon\Service\Content; |
12
|
|
|
use CILogon\Service\PortalCookie; |
13
|
|
|
|
14
|
|
|
/** |
15
|
|
|
* printMainCookiesPage |
16
|
|
|
* |
17
|
|
|
* This function prints out the main 'Manage Cookies' page on each |
18
|
|
|
* reload. It calls other functions to print out the subsections of |
19
|
|
|
* the page. Note that all subsections are enclosed in a <form> so |
20
|
|
|
* we need only a single <form> group. |
21
|
|
|
*/ |
22
|
|
|
function printMainCookiesPage() |
23
|
|
|
{ |
24
|
|
|
// CIL-555 Allow for deletion of session/cookie vars without |
25
|
|
|
// refreshing the user's browser. |
26
|
|
|
if ((isset($_GET['nooutput'])) || (isset($_POST['nooutput']))) { |
27
|
|
|
http_response_code(204); |
28
|
|
|
exit; |
29
|
|
|
} |
30
|
|
|
|
31
|
|
|
$browsercount = countBrowserCookies(); |
32
|
|
|
$sessioncount = countSessionVariables(); |
33
|
|
|
|
34
|
|
|
Content::printHeader('Manage CILogon Cookies', '', false); // Don't set CSRF |
35
|
|
|
Content::printPageHeader('Manage CILogon Cookies'); |
36
|
|
|
|
37
|
|
|
Content::printFormHead(); |
38
|
|
|
|
39
|
|
|
printAboutThisPage($browsercount, $sessioncount); |
40
|
|
|
printBrowserCookies($browsercount); |
41
|
|
|
printSessionVariables($sessioncount); |
42
|
|
|
printEnvironmentVars(); |
43
|
|
|
|
44
|
|
|
echo '</form>'; |
45
|
|
|
|
46
|
|
|
Content::printFooter(); |
47
|
|
|
} |
48
|
|
|
|
49
|
|
|
/** |
50
|
|
|
* printAboutThisPage |
51
|
|
|
* |
52
|
|
|
* This function prints the 'About This Page' subsection, which also |
53
|
|
|
* contains several 'submit' buttons (such as .Delete Browser Cookies. |
54
|
|
|
* and 'Reload Page'). |
55
|
|
|
* |
56
|
|
|
* @param int $browsercount The number of deletable browser cookies. |
57
|
|
|
* @param int $sessioncount The number of deletable session variables |
58
|
|
|
*/ |
59
|
|
|
function printAboutThisPage($browsercount, $sessioncount) |
60
|
|
|
{ |
61
|
|
|
echo ' |
62
|
|
|
<div class="boxed"> |
63
|
|
|
<div class="boxheader"> |
64
|
|
|
About This Page |
65
|
|
|
</div> |
66
|
|
|
<p> |
67
|
|
|
This page allows you to view and (potentially) delete various cookies |
68
|
|
|
associated with the <a target="_blank" href="..">CILogon Service</a>. |
69
|
|
|
There are three sections below. |
70
|
|
|
</p> |
71
|
|
|
|
72
|
|
|
<ol> |
73
|
|
|
<li><b>Browser Cookies</b> - These are "cookies" |
74
|
|
|
which are stored in your browser. They are used as preferences for the |
75
|
|
|
CILogon Service. |
76
|
|
|
</li> |
77
|
|
|
<li><b>Session Variables</b> - These are "short-lived" |
78
|
|
|
values related to your current CILogon session. Deleting any of these |
79
|
|
|
values may require you to re-logon. |
80
|
|
|
</li> |
81
|
|
|
<li><b>Environment Variables</b> - These are values set by the |
82
|
|
|
interaction between your browser and the web server. These are displayed |
83
|
|
|
mainly for information purposes. |
84
|
|
|
</li> |
85
|
|
|
</ol> |
86
|
|
|
'; |
87
|
|
|
|
88
|
|
|
// If there are brower cookies or session variables which can be |
89
|
|
|
// deleted, output the appropriate 'Delete ...' button(s). |
90
|
|
|
if (($browsercount > 0) || ($sessioncount > 0)) { |
91
|
|
|
echo ' |
92
|
|
|
<p> |
93
|
|
|
You can delete cookies individually by checking the associated |
94
|
|
|
checkbox(es) and clicking the "Delete Checked" button. |
95
|
|
|
You can also delete groups of cookies by clicking '; |
96
|
|
|
if ($browsercount > 0) { |
97
|
|
|
echo 'the "Delete Browser Cookies" button'; |
98
|
|
|
} |
99
|
|
|
if ($sessioncount > 0) { |
100
|
|
|
if ($browsercount > 0) { |
101
|
|
|
echo ', '; |
102
|
|
|
} |
103
|
|
|
echo 'the "Delete Session Variables" button'; |
104
|
|
|
if ($browsercount > 0) { |
105
|
|
|
echo ', or the "Delete ALL" button'; |
106
|
|
|
} |
107
|
|
|
} |
108
|
|
|
echo '.'; |
109
|
|
|
} |
110
|
|
|
|
111
|
|
|
echo ' |
112
|
|
|
</p> |
113
|
|
|
|
114
|
|
|
<p class="centered"> |
115
|
|
|
'; |
116
|
|
|
|
117
|
|
|
if ($browsercount > 0) { |
118
|
|
|
echo '<input type="submit" name="submit" class="submit" |
119
|
|
|
value="Delete Browser Cookies" /> '; |
120
|
|
|
} |
121
|
|
|
if ($sessioncount > 0) { |
122
|
|
|
echo '<input type="submit" name="submit" class="submit" |
123
|
|
|
value="Delete Session Variables" /> '; |
124
|
|
|
} |
125
|
|
|
if (($browsercount > 0) && ($sessioncount > 0)) { |
126
|
|
|
echo '<input type="submit" name="submit" class="submit" |
127
|
|
|
value="Delete ALL" /> '; |
128
|
|
|
} |
129
|
|
|
echo ' |
130
|
|
|
<input type="submit" name="submit" class="submit" value="Reload Page" /> |
131
|
|
|
</p> |
132
|
|
|
</div> |
133
|
|
|
'; |
134
|
|
|
} |
135
|
|
|
|
136
|
|
|
/** |
137
|
|
|
* printBrowserCookies |
138
|
|
|
* |
139
|
|
|
* This function prints the 'Browser Cookies' section, with checkboxes |
140
|
|
|
* next to the cookies to allow for deletion. If there are no browser |
141
|
|
|
* cookies, then simply output 'none found' message. |
142
|
|
|
* |
143
|
|
|
* @param int $browsercount The number of deletable browser cookies |
144
|
|
|
*/ |
145
|
|
|
function printBrowserCookies($browsercount) |
146
|
|
|
{ |
147
|
|
|
global $hide; |
148
|
|
|
|
149
|
|
|
echo ' |
150
|
|
|
<p> </p> |
151
|
|
|
<div class="boxed"> |
152
|
|
|
<div class="boxheader"> |
153
|
|
|
Browser Cookies |
154
|
|
|
</div> |
155
|
|
|
'; |
156
|
|
|
|
157
|
|
|
if ($browsercount > 0) { |
158
|
|
|
echo ' |
159
|
|
|
<table rules="rows" width="100%"> |
160
|
|
|
'; |
161
|
|
|
|
162
|
|
|
ksort($_COOKIE); |
163
|
|
|
foreach ($_COOKIE as $key => $value) { |
164
|
|
|
if (!in_array($key, $hide)) { |
165
|
|
|
echo '<tr title="' , getTitleText($key) , '">' , |
166
|
|
|
'<td><input type="checkbox" name="del_browser[]" ', |
167
|
|
|
'value="', $key , '"/></td>' , |
168
|
|
|
'<td style="padding-right:2em"><tt>' , |
169
|
|
|
Util::htmlent($key) , |
170
|
|
|
'</tt></td><td><tt>'; |
171
|
|
|
// Special handling of portalparams cookie |
172
|
|
|
if ($key == PortalCookie::COOKIENAME) { |
173
|
|
|
$pc = new PortalCookie(); |
174
|
|
|
echo Util::htmlent($pc); |
175
|
|
|
} else { |
176
|
|
|
echo Util::htmlent($value); |
177
|
|
|
} |
178
|
|
|
echo '</tt></td></tr>'; |
179
|
|
|
} |
180
|
|
|
} |
181
|
|
|
|
182
|
|
|
echo ' |
183
|
|
|
</table> |
184
|
|
|
|
185
|
|
|
<p class="centered"> |
186
|
|
|
<input type="submit" name="submit" class="submit" |
187
|
|
|
value="Delete Checked" /> |
188
|
|
|
</p> |
189
|
|
|
'; |
190
|
|
|
} else { |
191
|
|
|
echo '<p>No browser cookies found.</p>'; |
192
|
|
|
} |
193
|
|
|
|
194
|
|
|
echo ' |
195
|
|
|
</div> |
196
|
|
|
'; |
197
|
|
|
} |
198
|
|
|
|
199
|
|
|
/** |
200
|
|
|
* printSessionVariables |
201
|
|
|
* |
202
|
|
|
* This function prints the 'Session Variables' section, with |
203
|
|
|
* checkboxes next to the variables to allow for deletion. If there |
204
|
|
|
* are no session variables, then simply output 'none found' message. |
205
|
|
|
* |
206
|
|
|
* @param int $sessioncount The number of deletable session variables |
207
|
|
|
*/ |
208
|
|
|
function printSessionVariables($sessioncount) |
209
|
|
|
{ |
210
|
|
|
global $hide; |
211
|
|
|
|
212
|
|
|
echo ' |
213
|
|
|
<p> </p> |
214
|
|
|
<div class="boxed"> |
215
|
|
|
<div class="boxheader"> |
216
|
|
|
Session Variables |
217
|
|
|
</div> |
218
|
|
|
'; |
219
|
|
|
|
220
|
|
|
if ($sessioncount > 0) { |
221
|
|
|
echo ' |
222
|
|
|
<table rules="rows" width="100%"> |
223
|
|
|
'; |
224
|
|
|
|
225
|
|
|
ksort($_SESSION); |
226
|
|
|
foreach ($_SESSION as $key => $value) { |
227
|
|
|
if (!in_array($key, $hide)) { |
228
|
|
|
echo '<tr title="' , getTitleText($key) , '">' , |
229
|
|
|
'<td><input type="checkbox" name="del_session[]" ', |
230
|
|
|
'value="', $key , '"/></td>' , |
231
|
|
|
'<td style="padding-right:2em"><tt>' , |
232
|
|
|
Util::htmlent($key) , |
233
|
|
|
'</tt></td><td><tt>' , |
234
|
|
|
Util::htmlent($value) , |
235
|
|
|
'</tt></td></tr>'; |
236
|
|
|
} |
237
|
|
|
} |
238
|
|
|
|
239
|
|
|
echo ' |
240
|
|
|
</table> |
241
|
|
|
|
242
|
|
|
<p class="centered"> |
243
|
|
|
<input type="submit" name="submit" class="submit" |
244
|
|
|
value="Delete Checked" /> |
245
|
|
|
</p> |
246
|
|
|
'; |
247
|
|
|
} else { |
248
|
|
|
echo '<p>No session variables found.</p>'; |
249
|
|
|
} |
250
|
|
|
|
251
|
|
|
echo ' |
252
|
|
|
</div> |
253
|
|
|
'; |
254
|
|
|
} |
255
|
|
|
|
256
|
|
|
/** |
257
|
|
|
* printEnvironmentVars |
258
|
|
|
* |
259
|
|
|
* This function prints out the display-only web environment variables |
260
|
|
|
* (e.g. the $_SERVER array). |
261
|
|
|
*/ |
262
|
|
|
function printEnvironmentVars() |
263
|
|
|
{ |
264
|
|
|
echo ' |
265
|
|
|
<p> </p> |
266
|
|
|
<div class="boxed"> |
267
|
|
|
<div class="boxheader"> |
268
|
|
|
Environment Variables |
269
|
|
|
</div> |
270
|
|
|
|
271
|
|
|
<table rules="rows" width="100%"> |
272
|
|
|
'; |
273
|
|
|
|
274
|
|
|
ksort($_SERVER); |
275
|
|
|
foreach ($_SERVER as $key => $value) { |
276
|
|
|
echo '<tr><td style="padding-right:2em"><tt>' , |
277
|
|
|
Util::htmlent($key) , |
278
|
|
|
'</tt></td><td><tt>' , |
279
|
|
|
Util::htmlent($value) , |
280
|
|
|
'</tt></td></tr>'; |
281
|
|
|
} |
282
|
|
|
|
283
|
|
|
echo ' |
284
|
|
|
</table> |
285
|
|
|
</div> |
286
|
|
|
'; |
287
|
|
|
} |
288
|
|
|
|
289
|
|
|
/** |
290
|
|
|
* countBrowsercookies |
291
|
|
|
* |
292
|
|
|
* This function counts the number of elements in the $_COOKIE array, |
293
|
|
|
* minus those elements in the global $hide array. |
294
|
|
|
* |
295
|
|
|
* @return int The number of deletable browser cookies |
296
|
|
|
*/ |
297
|
|
|
function countBrowserCookies() |
298
|
|
|
{ |
299
|
|
|
global $hide; |
300
|
|
|
|
301
|
|
|
$retval = count($_COOKIE); |
302
|
|
|
|
303
|
|
|
foreach ($hide as $h) { |
304
|
|
|
if (isset($_COOKIE[$h])) { |
305
|
|
|
$retval--; |
306
|
|
|
} |
307
|
|
|
} |
308
|
|
|
|
309
|
|
|
if ($retval < 0) { |
310
|
|
|
$retval = 0; |
311
|
|
|
} |
312
|
|
|
|
313
|
|
|
return $retval; |
314
|
|
|
} |
315
|
|
|
|
316
|
|
|
/** |
317
|
|
|
* countSessionVariables |
318
|
|
|
* |
319
|
|
|
* This function counts the number of elements in the $_SESSION array, |
320
|
|
|
* minus those elements in the global $hide array. |
321
|
|
|
* |
322
|
|
|
* @return int The number of deletable session variables |
323
|
|
|
*/ |
324
|
|
|
function countSessionVariables() |
325
|
|
|
{ |
326
|
|
|
global $hide; |
327
|
|
|
|
328
|
|
|
$retval = count($_SESSION); |
329
|
|
|
|
330
|
|
|
foreach ($hide as $h) { |
331
|
|
|
if (isset($_SESSION[$h])) { |
332
|
|
|
$retval--; |
333
|
|
|
} |
334
|
|
|
} |
335
|
|
|
|
336
|
|
|
if ($retval < 0) { |
337
|
|
|
$retval = 0; |
338
|
|
|
} |
339
|
|
|
|
340
|
|
|
return $retval; |
341
|
|
|
} |
342
|
|
|
|
343
|
|
|
/** |
344
|
|
|
* deleteChecked |
345
|
|
|
* |
346
|
|
|
* This function is called when the 'Delete Checked' button is clicked. |
347
|
|
|
* It iterates through all of the checked boxes for the 'Browser |
348
|
|
|
* Cookies' and 'Session Variables' sections and deletes the |
349
|
|
|
* corresponding cookie or session variable. |
350
|
|
|
*/ |
351
|
|
|
function deleteChecked() |
352
|
|
|
{ |
353
|
|
|
$del_browser = Util::getPostVar('del_browser'); |
354
|
|
|
if (is_array($del_browser)) { |
355
|
|
|
foreach ($del_browser as $value) { |
356
|
|
|
Util::unsetCookieVar($value); |
357
|
|
|
} |
358
|
|
|
} |
359
|
|
|
|
360
|
|
|
$del_session = Util::getPostVar('del_session'); |
361
|
|
|
if (is_array($del_session)) { |
362
|
|
|
foreach ($del_session as $value) { |
363
|
|
|
Util::unsetSessionVar($value); |
364
|
|
|
} |
365
|
|
|
} |
366
|
|
|
} |
367
|
|
|
|
368
|
|
|
/** |
369
|
|
|
* deleteBrowserCookies |
370
|
|
|
* |
371
|
|
|
* This function is called when the 'Delete Browser Cookies' button |
372
|
|
|
* or the 'Delete ALL' button is pressed. It deletes all elements in |
373
|
|
|
* the $_COOKIE array except for those in the global $hide array. |
374
|
|
|
*/ |
375
|
|
|
function deleteBrowserCookies() |
376
|
|
|
{ |
377
|
|
|
global $hide; |
378
|
|
|
|
379
|
|
|
foreach ($_COOKIE as $key => $value) { |
380
|
|
|
if (!in_array($key, $hide)) { |
381
|
|
|
Util::unsetCookieVar($key); |
382
|
|
|
} |
383
|
|
|
} |
384
|
|
|
} |
385
|
|
|
|
386
|
|
|
/** |
387
|
|
|
* deleteSessionVariables |
388
|
|
|
* |
389
|
|
|
* This function is called when the 'Delete Session Variables' button |
390
|
|
|
* or the 'Delete ALL' button is pressed. It deletes all elements in |
391
|
|
|
* the $_SESSION array except for those in the global $hide array. |
392
|
|
|
*/ |
393
|
|
|
function deleteSessionVariables() |
394
|
|
|
{ |
395
|
|
|
global $hide; |
396
|
|
|
|
397
|
|
|
foreach ($_SESSION as $key => $value) { |
398
|
|
|
if (!in_array($key, $hide)) { |
399
|
|
|
Util::unsetSessionVar($key); |
400
|
|
|
} |
401
|
|
|
} |
402
|
|
|
} |
403
|
|
|
|
404
|
|
|
/** |
405
|
|
|
* getTitleText |
406
|
|
|
* |
407
|
|
|
* This function takes in a browser cookie or session variable and |
408
|
|
|
* returns an 'explanation' string which is used in the 'title=...' |
409
|
|
|
* attribute. This text is displayed in the user's browser when the |
410
|
|
|
* mouse cursor hovers over the row containing the cookie/variable |
411
|
|
|
* and corresponding value. The function simply looks in the $explain |
412
|
|
|
* array for the $cookie key, and returns the value (if any). |
413
|
|
|
* |
414
|
|
|
* @param string $cookie The name of a browser cookie or session variable. |
415
|
|
|
* @return string A string explaining the cookie/variable in question. |
416
|
|
|
* Returns empty string if no such cookie/variable found. |
417
|
|
|
*/ |
418
|
|
|
function getTitleText($cookie) |
419
|
|
|
{ |
420
|
|
|
$retval = ''; |
421
|
|
|
|
422
|
|
|
// Keys are brower cookies / session variables. Values are |
423
|
|
|
// explanation string to be shown in 'title=...' attributes. |
424
|
|
|
// NOTE: the array is searched using 'preg_match' to allow for |
425
|
|
|
// substring matches (which is important in the case of |
426
|
|
|
// _shibsession...). Thus, it is important that longer strings |
427
|
|
|
// appear before shorter strings with the same prefix, e.g. |
428
|
|
|
// 'p12 error' appears before 'p12'. |
429
|
|
|
$explain = array( |
430
|
|
|
"acr" => "Authentication Context Class Ref", |
431
|
|
|
"affiliation" => "A list of attributes describing your affiliations at your Identity Provider." , |
432
|
|
|
"authntime" => "The Unix timestamp of the last successful user authentication." , |
433
|
|
|
"callbackuri" => "The URL of the callback servlet used by portals connecting to the CILogon Delegate service." , |
434
|
|
|
"cilogon_skin" => "The skin affects the look-and-feel and " . |
435
|
|
|
"functionality of the CILogon Service. It is typically " . |
436
|
|
|
"specified by a portal." , |
437
|
|
|
"clientparams" => "A set of cookies for each portal you have used with CILogon." , |
438
|
|
|
"displayname" => "Your full name set by your Identity Provider." , |
439
|
|
|
"dn" => "A quasi distinguished name for the certificate issued by a MyProxy server to the CILogon Service." , |
440
|
|
|
"emailaddr" => "Your email address given by your Identity Provider." , |
441
|
|
|
"entitlement" => "A list of URIs representing permissions to access a resource or service." , |
442
|
|
|
"ePPN" => "'eduPerson Principal Name' - a SAML attribute set by your Identity Provider." , |
443
|
|
|
"ePTID" => "'eduPerson Targeted Identifier' - a SAML attribute set by your Identity Provider" , |
444
|
|
|
"failureuri" => "A URL used by portals in case the CILogon " . |
445
|
|
|
"Service is unable to issue a certificate on your behalf. " , |
446
|
|
|
"firstname" => "Your given name set by your Identity Provider." , |
447
|
|
|
"idpname" => "The display name of your chosen Identity Provider." , |
448
|
|
|
"idp" => "The authentication URI of your chosen Identity Provider." , |
449
|
|
|
"itrustuin" => "Your university ID number.", |
450
|
|
|
"keepidp" => "Remember if you checked the 'Remember this " . |
451
|
|
|
"selection' checkbox when you selected and Identity Provider." , |
452
|
|
|
"lastname" => "Your surname set by your Identity Provider." , |
453
|
|
|
"loa" => "Level of Assurance set by your Identity Provider." , |
454
|
|
|
"logonerror" => "A text message of the reason for the last authentication error." , |
455
|
|
|
"memberof" => "Groups of which you are a member", |
456
|
|
|
"oidcID" => "Your user identifier set by the OpenID Connect Identity Provider." , |
457
|
|
|
"openidID" => "Your user identifier set by the OpenID Identity Provider." , |
458
|
|
|
"ou" => "Your organizational unit set by your Identity Provider." , |
459
|
|
|
"p12error" => "A text message of the reason why the PKCS12 certificate could not be created." , |
460
|
|
|
"p12lifetime" => "This multiplied by the p12multipler gives the lifetime of the PKCS12 certificate in hours." , |
461
|
|
|
"p12multiplier" => "This multiplied by the p12lifetime gives the lifetime of the PKCS12 certificate in hours." , |
462
|
|
|
"p12" => "The expiration time and URL to download a PKCS12 certificate file." , |
463
|
|
|
"portalcookie" => "Contains certificate lifetimes for all " . |
464
|
|
|
"portals you have used with the CILogon Delegate service." , |
465
|
|
|
"portalname" => "The display name of the portal connected to the CILogon Delegate service. " , |
466
|
|
|
"portalparams" => "For portals previously using the CILogon " . |
467
|
|
|
"Delegate service, this is the saved lifetime of the " . |
468
|
|
|
"delegated certificate." , |
469
|
|
|
"portalstatus" => "An internal return code when fetching portal parameters from the datastore." , |
470
|
|
|
"providerId" => "The previously selected Identity Provider." , |
471
|
|
|
"requestsilver" => "Set to 1 if attempting to get a 'silver' " . |
472
|
|
|
"Level of Assurance from your chosen Identity Provider." , |
473
|
|
|
"responsesubmit" => "The name of the 'stage' to return to after " . |
474
|
|
|
"authentication at your chosen Identity Provider." , |
475
|
|
|
"responseurl" => "The URL to return to after authentication at your chosen Identity Provider." , |
476
|
|
|
"_shibsession" => "A shibboleth session token set by an InCommon Identity Provider." , |
477
|
|
|
"showhelp" => "Whether to show help text or not." , |
478
|
|
|
"stage" => "The current page displayed." , |
479
|
|
|
"status" => "An internal return code when fetching user data from the datastore." , |
480
|
|
|
"submit" => "The name of the 'submit' button clicked." , |
481
|
|
|
"successuri" => "A URL used by portals for redirection after successful issuance of a certificate." , |
482
|
|
|
"tempcred" => "An OAUTH identifier used to track portal sessions." , |
483
|
|
|
"twofactor" => "The types of two-factor authentication " . |
484
|
|
|
"configured for your account, ga for Google Authenticator, " . |
485
|
|
|
"duo for Duo Security." , |
486
|
|
|
"uid" => "The datastore user identifier." , |
487
|
|
|
); |
488
|
|
|
|
489
|
|
|
foreach ($explain as $key => $value) { |
490
|
|
|
if (preg_match("/^$key$/", $cookie)) { |
491
|
|
|
$retval = $value; |
492
|
|
|
break; |
493
|
|
|
} |
494
|
|
|
} |
495
|
|
|
|
496
|
|
|
return $retval; |
497
|
|
|
} |
498
|
|
|
|