73 lines
1.9 KiB
PHP
73 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace Modules\M3\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
|
|
class BasicAuth
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param Request $request
|
|
* @param Closure $next
|
|
*
|
|
* @return mixed
|
|
*/
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
|
|
// select md5 or crypt for $mode. md5 is for md5 encoded passwords, crypt is for passwords encoded using apache's httpasswd
|
|
$mode = 'crypt';
|
|
if (! m3_user() !== '') {
|
|
$this->authenticate();
|
|
} else {
|
|
if ($this->check_pass(m3_user(), m3_legacy_password(), $mode, '%%SYSTEM%%')) {
|
|
return $next($request);
|
|
} else {
|
|
$this->authenticate();
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
public static function check_pass($login, $password, $mode, $password_file)
|
|
{
|
|
if (! $fh = fopen($password_file, 'r')) {
|
|
exit('<P>Could Not Open Password File');
|
|
}
|
|
$match = 0;
|
|
while (! feof($fh)) {
|
|
$line = fgets($fh, 4096);
|
|
$from_file = explode(':', $line);
|
|
if ($from_file[0] == $login) {
|
|
if ($mode == 'crypt') {
|
|
$salt = substr($from_file[1], 0, 2);
|
|
$user_pass = crypt($password, $salt);
|
|
} elseif ($mode == 'md5') {
|
|
$user_pass = md5($password);
|
|
}
|
|
if (rtrim($from_file[1]) == $user_pass) {
|
|
$match = 1;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
if ($match) {
|
|
return 1;
|
|
} else {
|
|
return 0;
|
|
}
|
|
fclose($fh);
|
|
}
|
|
|
|
public static function authenticate()
|
|
{
|
|
header('WWW-Authenticate: Basic realm="RESTRICTED ACCESS"');
|
|
header('HTTP/1.0 401 Unauthorized');
|
|
echo '<h1>INVALID USERNAME OR PASSWORD. ACCESS DENIED<h1>';
|
|
exit;
|
|
}
|
|
}
|