parent
3a0f4bd959
commit
17a4bf2cc0
@ -0,0 +1,11 @@ |
|||||||
|
FROM httpd:alpine |
||||||
|
#ADD ./httpd.conf /usr/local/apache2/conf/httpd.conf |
||||||
|
RUN apk update \ |
||||||
|
apk add apache2-mod-perl \ |
||||||
|
apache2-proxy \ |
||||||
|
mod_dav_svn \ |
||||||
|
perl-dbd-mysql \ |
||||||
|
perl-ldap \ |
||||||
|
subversion \ |
||||||
|
; |
||||||
|
ADD ./Redmine.pm /usr/lib/perl5/Apache/Authn/Redmine.pm |
||||||
@ -0,0 +1,560 @@ |
|||||||
|
package Apache::Authn::Redmine; |
||||||
|
|
||||||
|
=head1 Apache::Authn::Redmine |
||||||
|
|
||||||
|
Redmine - a mod_perl module to authenticate webdav subversion users |
||||||
|
against redmine database |
||||||
|
|
||||||
|
=head1 SYNOPSIS |
||||||
|
|
||||||
|
This module allow anonymous users to browse public project and |
||||||
|
registred users to browse and commit their project. Authentication is |
||||||
|
done against the redmine database or the LDAP configured in redmine. |
||||||
|
|
||||||
|
This method is far simpler than the one with pam_* and works with all |
||||||
|
database without an hassle but you need to have apache/mod_perl on the |
||||||
|
svn server. |
||||||
|
|
||||||
|
=head1 INSTALLATION |
||||||
|
|
||||||
|
For this to automagically work, you need to have a recent reposman.rb |
||||||
|
(after r860) and if you already use reposman, read the last section to |
||||||
|
migrate. |
||||||
|
|
||||||
|
Sorry ruby users but you need some perl modules, at least mod_perl2, |
||||||
|
DBI and DBD::mysql (or the DBD driver for you database as it should |
||||||
|
work on allmost all databases). |
||||||
|
|
||||||
|
On debian/ubuntu you must do : |
||||||
|
|
||||||
|
aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl |
||||||
|
|
||||||
|
If your Redmine users use LDAP authentication, you will also need |
||||||
|
Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used): |
||||||
|
|
||||||
|
aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl |
||||||
|
|
||||||
|
=head1 CONFIGURATION |
||||||
|
|
||||||
|
## This module has to be in your perl path |
||||||
|
## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm |
||||||
|
PerlLoadModule Apache::Authn::Redmine |
||||||
|
<Location /svn> |
||||||
|
DAV svn |
||||||
|
SVNParentPath "/var/svn" |
||||||
|
|
||||||
|
AuthType Basic |
||||||
|
AuthName redmine |
||||||
|
Require valid-user |
||||||
|
|
||||||
|
PerlAccessHandler Apache::Authn::Redmine::access_handler |
||||||
|
PerlAuthenHandler Apache::Authn::Redmine::authen_handler |
||||||
|
|
||||||
|
## for mysql |
||||||
|
RedmineDSN "DBI:mysql:database=databasename;host=my.db.server" |
||||||
|
## for postgres |
||||||
|
# RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server" |
||||||
|
|
||||||
|
RedmineDbUser "redmine" |
||||||
|
RedmineDbPass "password" |
||||||
|
## Optional where clause (fulltext search would be slow and |
||||||
|
## database dependent). |
||||||
|
# RedmineDbWhereClause "and members.role_id IN (1,2)" |
||||||
|
## Optional credentials cache size |
||||||
|
# RedmineCacheCredsMax 50 |
||||||
|
</Location> |
||||||
|
|
||||||
|
To be able to browse repository inside redmine, you must add something |
||||||
|
like that : |
||||||
|
|
||||||
|
<Location /svn-private> |
||||||
|
DAV svn |
||||||
|
SVNParentPath "/var/svn" |
||||||
|
Order deny,allow |
||||||
|
Deny from all |
||||||
|
# only allow reading orders |
||||||
|
<Limit GET PROPFIND OPTIONS REPORT> |
||||||
|
Allow from redmine.server.ip |
||||||
|
</Limit> |
||||||
|
</Location> |
||||||
|
|
||||||
|
and you will have to use this reposman.rb command line to create repository : |
||||||
|
|
||||||
|
reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/ |
||||||
|
|
||||||
|
=head1 REPOSITORIES NAMING |
||||||
|
|
||||||
|
A project repository must be named with the project identifier. In case |
||||||
|
of multiple repositories for the same project, use the project identifier |
||||||
|
and the repository identifier separated with a dot: |
||||||
|
|
||||||
|
/var/svn/foo |
||||||
|
/var/svn/foo.otherrepo |
||||||
|
|
||||||
|
=head1 MIGRATION FROM OLDER RELEASES |
||||||
|
|
||||||
|
If you use an older reposman.rb (r860 or before), you need to change |
||||||
|
rights on repositories to allow the apache user to read and write |
||||||
|
S<them :> |
||||||
|
|
||||||
|
sudo chown -R www-data /var/svn/* |
||||||
|
sudo chmod -R u+w /var/svn/* |
||||||
|
|
||||||
|
And you need to upgrade at least reposman.rb (after r860). |
||||||
|
|
||||||
|
=head1 GIT SMART HTTP SUPPORT |
||||||
|
|
||||||
|
Git's smart HTTP protocol (available since Git 1.7.0) will not work with the |
||||||
|
above settings. Redmine.pm normally does access control depending on the HTTP |
||||||
|
method used: read-only methods are OK for everyone in public projects and |
||||||
|
members with read rights in private projects. The rest require membership with |
||||||
|
commit rights in the project. |
||||||
|
|
||||||
|
However, this scheme doesn't work for Git's smart HTTP protocol, as it will use |
||||||
|
POST even for a simple clone. Instead, read-only requests must be detected using |
||||||
|
the full URL (including the query string): anything that doesn't belong to the |
||||||
|
git-receive-pack service is read-only. |
||||||
|
|
||||||
|
To activate this mode of operation, add this line inside your <Location /git> |
||||||
|
block: |
||||||
|
|
||||||
|
RedmineGitSmartHttp yes |
||||||
|
|
||||||
|
Here's a sample Apache configuration which integrates git-http-backend with |
||||||
|
a MySQL database and this new option: |
||||||
|
|
||||||
|
SetEnv GIT_PROJECT_ROOT /var/www/git/ |
||||||
|
SetEnv GIT_HTTP_EXPORT_ALL |
||||||
|
ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/ |
||||||
|
<Location /git> |
||||||
|
Order allow,deny |
||||||
|
Allow from all |
||||||
|
|
||||||
|
AuthType Basic |
||||||
|
AuthName Git |
||||||
|
Require valid-user |
||||||
|
|
||||||
|
PerlAccessHandler Apache::Authn::Redmine::access_handler |
||||||
|
PerlAuthenHandler Apache::Authn::Redmine::authen_handler |
||||||
|
# for mysql |
||||||
|
RedmineDSN "DBI:mysql:database=redmine;host=127.0.0.1" |
||||||
|
RedmineDbUser "redmine" |
||||||
|
RedmineDbPass "xxx" |
||||||
|
RedmineGitSmartHttp yes |
||||||
|
</Location> |
||||||
|
|
||||||
|
Make sure that all the names of the repositories under /var/www/git/ have a |
||||||
|
matching identifier for some project: /var/www/git/myproject and |
||||||
|
/var/www/git/myproject.git will work. You can put both bare and non-bare |
||||||
|
repositories in /var/www/git, though bare repositories are strongly |
||||||
|
recommended. You should create them with the rights of the user running Redmine, |
||||||
|
like this: |
||||||
|
|
||||||
|
cd /var/www/git |
||||||
|
sudo -u user-running-redmine mkdir myproject |
||||||
|
cd myproject |
||||||
|
sudo -u user-running-redmine git init --bare |
||||||
|
|
||||||
|
Once you have activated this option, you have three options when cloning a |
||||||
|
repository: |
||||||
|
|
||||||
|
- Cloning using "http://user@host/git/repo(.git)" works, but will ask for the password |
||||||
|
all the time. |
||||||
|
|
||||||
|
- Cloning with "http://user:pass@host/git/repo(.git)" does not have this problem, but |
||||||
|
this could reveal accidentally your password to the console in some versions |
||||||
|
of Git, and you would have to ensure that .git/config is not readable except |
||||||
|
by the owner for each of your projects. |
||||||
|
|
||||||
|
- Use "http://host/git/repo(.git)", and store your credentials in the ~/.netrc |
||||||
|
file. This is the recommended solution, as you only have one file to protect |
||||||
|
and passwords will not be leaked accidentally to the console. |
||||||
|
|
||||||
|
IMPORTANT NOTE: It is *very important* that the file cannot be read by other |
||||||
|
users, as it will contain your password in cleartext. To create the file, you |
||||||
|
can use the following commands, replacing yourhost, youruser and yourpassword |
||||||
|
with the right values: |
||||||
|
|
||||||
|
touch ~/.netrc |
||||||
|
chmod 600 ~/.netrc |
||||||
|
echo -e "machine yourhost\nlogin youruser\npassword yourpassword" > ~/.netrc |
||||||
|
|
||||||
|
=cut |
||||||
|
|
||||||
|
use strict; |
||||||
|
use warnings FATAL => 'all', NONFATAL => 'redefine'; |
||||||
|
|
||||||
|
use DBI; |
||||||
|
use Digest::SHA; |
||||||
|
# optional module for LDAP authentication |
||||||
|
my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1"); |
||||||
|
|
||||||
|
use Apache2::Module; |
||||||
|
use Apache2::Access; |
||||||
|
use Apache2::ServerRec qw(); |
||||||
|
use Apache2::RequestRec qw(); |
||||||
|
use Apache2::RequestUtil qw(); |
||||||
|
use Apache2::Const qw(:common :override :cmd_how); |
||||||
|
use APR::Pool (); |
||||||
|
use APR::Table (); |
||||||
|
|
||||||
|
# use Apache2::Directive qw(); |
||||||
|
|
||||||
|
my @directives = ( |
||||||
|
{ |
||||||
|
name => 'RedmineDSN', |
||||||
|
req_override => OR_AUTHCFG, |
||||||
|
args_how => TAKE1, |
||||||
|
errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"', |
||||||
|
}, |
||||||
|
{ |
||||||
|
name => 'RedmineDbUser', |
||||||
|
req_override => OR_AUTHCFG, |
||||||
|
args_how => TAKE1, |
||||||
|
}, |
||||||
|
{ |
||||||
|
name => 'RedmineDbPass', |
||||||
|
req_override => OR_AUTHCFG, |
||||||
|
args_how => TAKE1, |
||||||
|
}, |
||||||
|
{ |
||||||
|
name => 'RedmineDbWhereClause', |
||||||
|
req_override => OR_AUTHCFG, |
||||||
|
args_how => TAKE1, |
||||||
|
}, |
||||||
|
{ |
||||||
|
name => 'RedmineCacheCredsMax', |
||||||
|
req_override => OR_AUTHCFG, |
||||||
|
args_how => TAKE1, |
||||||
|
errmsg => 'RedmineCacheCredsMax must be decimal number', |
||||||
|
}, |
||||||
|
{ |
||||||
|
name => 'RedmineGitSmartHttp', |
||||||
|
req_override => OR_AUTHCFG, |
||||||
|
args_how => TAKE1, |
||||||
|
}, |
||||||
|
); |
||||||
|
|
||||||
|
sub RedmineDSN { |
||||||
|
my ($self, $parms, $arg) = @_; |
||||||
|
$self->{RedmineDSN} = $arg; |
||||||
|
my $query = "SELECT |
||||||
|
users.hashed_password, users.salt, users.auth_source_id, roles.permissions, projects.status |
||||||
|
FROM projects, users, roles |
||||||
|
WHERE |
||||||
|
users.login=? |
||||||
|
AND projects.identifier=? |
||||||
|
AND EXISTS (SELECT 1 FROM enabled_modules em WHERE em.project_id = projects.id AND em.name = 'repository') |
||||||
|
AND users.type='User' |
||||||
|
AND users.status=1 |
||||||
|
AND ( |
||||||
|
roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id) |
||||||
|
OR |
||||||
|
(cast(projects.is_public as CHAR) IN ('t', '1') |
||||||
|
AND (roles.builtin=1 |
||||||
|
OR roles.id IN (SELECT member_roles.role_id FROM members, member_roles, users g |
||||||
|
WHERE members.user_id = g.id AND members.project_id = projects.id AND members.id = member_roles.member_id |
||||||
|
AND g.type = 'GroupNonMember')) |
||||||
|
) |
||||||
|
) |
||||||
|
AND roles.permissions IS NOT NULL"; |
||||||
|
$self->{RedmineQuery} = trim($query); |
||||||
|
} |
||||||
|
|
||||||
|
sub RedmineDbUser { set_val('RedmineDbUser', @_); } |
||||||
|
sub RedmineDbPass { set_val('RedmineDbPass', @_); } |
||||||
|
sub RedmineDbWhereClause { |
||||||
|
my ($self, $parms, $arg) = @_; |
||||||
|
$self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." "); |
||||||
|
} |
||||||
|
|
||||||
|
sub RedmineCacheCredsMax { |
||||||
|
my ($self, $parms, $arg) = @_; |
||||||
|
if ($arg) { |
||||||
|
$self->{RedmineCachePool} = APR::Pool->new; |
||||||
|
$self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg); |
||||||
|
$self->{RedmineCacheCredsCount} = 0; |
||||||
|
$self->{RedmineCacheCredsMax} = $arg; |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
sub RedmineGitSmartHttp { |
||||||
|
my ($self, $parms, $arg) = @_; |
||||||
|
$arg = lc $arg; |
||||||
|
|
||||||
|
if ($arg eq "yes" || $arg eq "true") { |
||||||
|
$self->{RedmineGitSmartHttp} = 1; |
||||||
|
} else { |
||||||
|
$self->{RedmineGitSmartHttp} = 0; |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
sub trim { |
||||||
|
my $string = shift; |
||||||
|
$string =~ s/\s{2,}/ /g; |
||||||
|
return $string; |
||||||
|
} |
||||||
|
|
||||||
|
sub set_val { |
||||||
|
my ($key, $self, $parms, $arg) = @_; |
||||||
|
$self->{$key} = $arg; |
||||||
|
} |
||||||
|
|
||||||
|
Apache2::Module::add(__PACKAGE__, \@directives); |
||||||
|
|
||||||
|
|
||||||
|
my %read_only_methods = map { $_ => 1 } qw/GET HEAD PROPFIND REPORT OPTIONS/; |
||||||
|
|
||||||
|
sub request_is_read_only { |
||||||
|
my ($r) = @_; |
||||||
|
my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); |
||||||
|
|
||||||
|
# Do we use Git's smart HTTP protocol, or not? |
||||||
|
if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp}) { |
||||||
|
my $uri = $r->unparsed_uri; |
||||||
|
my $location = $r->location; |
||||||
|
my $is_read_only = $uri !~ m{^$location/*[^/]+/+(info/refs\?service=)?git\-receive\-pack$}o; |
||||||
|
return $is_read_only; |
||||||
|
} else { |
||||||
|
# Standard behaviour: check the HTTP method |
||||||
|
my $method = $r->method; |
||||||
|
return defined $read_only_methods{$method}; |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
sub access_handler { |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
unless ($r->some_auth_required) { |
||||||
|
$r->log_reason("No authentication has been configured"); |
||||||
|
return FORBIDDEN; |
||||||
|
} |
||||||
|
|
||||||
|
return OK unless request_is_read_only($r); |
||||||
|
|
||||||
|
my $project_id = get_project_identifier($r); |
||||||
|
|
||||||
|
if (is_public_project($project_id, $r) && anonymous_allowed_to_browse_repository($project_id, $r)) { |
||||||
|
$r->user(""); |
||||||
|
$r->set_handlers(PerlAuthenHandler => [\&OK]); |
||||||
|
} |
||||||
|
|
||||||
|
return OK |
||||||
|
} |
||||||
|
|
||||||
|
sub authen_handler { |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
my ($res, $redmine_pass) = $r->get_basic_auth_pw(); |
||||||
|
return $res unless $res == OK; |
||||||
|
|
||||||
|
if (is_member($r->user, $redmine_pass, $r)) { |
||||||
|
return OK; |
||||||
|
} else { |
||||||
|
$r->note_auth_failure(); |
||||||
|
return DECLINED; |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
# check if authentication is forced |
||||||
|
sub is_authentication_forced { |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
my $dbh = connect_database($r); |
||||||
|
my $sth = $dbh->prepare( |
||||||
|
"SELECT value FROM settings where settings.name = 'login_required';" |
||||||
|
); |
||||||
|
|
||||||
|
$sth->execute(); |
||||||
|
my $ret = 0; |
||||||
|
if (my @row = $sth->fetchrow_array) { |
||||||
|
if ($row[0] eq "1" || $row[0] eq "t") { |
||||||
|
$ret = 1; |
||||||
|
} |
||||||
|
} |
||||||
|
$sth->finish(); |
||||||
|
undef $sth; |
||||||
|
|
||||||
|
$dbh->disconnect(); |
||||||
|
undef $dbh; |
||||||
|
|
||||||
|
$ret; |
||||||
|
} |
||||||
|
|
||||||
|
sub is_public_project { |
||||||
|
my $project_id = shift; |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
if (is_authentication_forced($r)) { |
||||||
|
return 0; |
||||||
|
} |
||||||
|
|
||||||
|
my $dbh = connect_database($r); |
||||||
|
my $sth = $dbh->prepare( |
||||||
|
"SELECT is_public FROM projects |
||||||
|
WHERE projects.identifier = ? AND projects.status <> 9 |
||||||
|
AND EXISTS (SELECT 1 FROM enabled_modules em WHERE em.project_id = projects.id AND em.name = 'repository');" |
||||||
|
); |
||||||
|
|
||||||
|
$sth->execute($project_id); |
||||||
|
my $ret = 0; |
||||||
|
if (my @row = $sth->fetchrow_array) { |
||||||
|
if ($row[0] eq "1" || $row[0] eq "t") { |
||||||
|
$ret = 1; |
||||||
|
} |
||||||
|
} |
||||||
|
$sth->finish(); |
||||||
|
undef $sth; |
||||||
|
$dbh->disconnect(); |
||||||
|
undef $dbh; |
||||||
|
|
||||||
|
$ret; |
||||||
|
} |
||||||
|
|
||||||
|
sub anonymous_allowed_to_browse_repository { |
||||||
|
my $project_id = shift; |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
my $dbh = connect_database($r); |
||||||
|
my $sth = $dbh->prepare( |
||||||
|
"SELECT permissions FROM roles WHERE permissions like '%browse_repository%' |
||||||
|
AND (roles.builtin = 2 |
||||||
|
OR roles.id IN (SELECT member_roles.role_id FROM projects, members, member_roles, users |
||||||
|
WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id |
||||||
|
AND projects.identifier = ? AND users.type = 'GroupAnonymous'));" |
||||||
|
); |
||||||
|
|
||||||
|
$sth->execute($project_id); |
||||||
|
my $ret = 0; |
||||||
|
if (my @row = $sth->fetchrow_array) { |
||||||
|
if ($row[0] =~ /:browse_repository/) { |
||||||
|
$ret = 1; |
||||||
|
} |
||||||
|
} |
||||||
|
$sth->finish(); |
||||||
|
undef $sth; |
||||||
|
$dbh->disconnect(); |
||||||
|
undef $dbh; |
||||||
|
|
||||||
|
$ret; |
||||||
|
} |
||||||
|
|
||||||
|
# perhaps we should use repository right (other read right) to check public access. |
||||||
|
# it could be faster BUT it doesn't work for the moment. |
||||||
|
# sub is_public_project_by_file { |
||||||
|
# my $project_id = shift; |
||||||
|
# my $r = shift; |
||||||
|
|
||||||
|
# my $tree = Apache2::Directive::conftree(); |
||||||
|
# my $node = $tree->lookup('Location', $r->location); |
||||||
|
# my $hash = $node->as_hash; |
||||||
|
|
||||||
|
# my $svnparentpath = $hash->{SVNParentPath}; |
||||||
|
# my $repos_path = $svnparentpath . "/" . $project_id; |
||||||
|
# return 1 if (stat($repos_path))[2] & 00007; |
||||||
|
# } |
||||||
|
|
||||||
|
sub is_member { |
||||||
|
my $redmine_user = shift; |
||||||
|
my $redmine_pass = shift; |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
my $project_id = get_project_identifier($r); |
||||||
|
|
||||||
|
my $pass_digest = Digest::SHA::sha1_hex($redmine_pass); |
||||||
|
|
||||||
|
my $access_mode = request_is_read_only($r) ? "R" : "W"; |
||||||
|
|
||||||
|
my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); |
||||||
|
my $usrprojpass; |
||||||
|
if ($cfg->{RedmineCacheCredsMax}) { |
||||||
|
$usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id.":".$access_mode); |
||||||
|
return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest)); |
||||||
|
} |
||||||
|
my $dbh = connect_database($r); |
||||||
|
my $query = $cfg->{RedmineQuery}; |
||||||
|
my $sth = $dbh->prepare($query); |
||||||
|
$sth->execute($redmine_user, $project_id); |
||||||
|
|
||||||
|
my $ret; |
||||||
|
while (my ($hashed_password, $salt, $auth_source_id, $permissions, $project_status) = $sth->fetchrow_array) { |
||||||
|
if ($project_status eq "9" || ($project_status ne "1" && $access_mode eq "W")) { |
||||||
|
last; |
||||||
|
} |
||||||
|
|
||||||
|
unless ($auth_source_id) { |
||||||
|
my $method = $r->method; |
||||||
|
my $salted_password = Digest::SHA::sha1_hex($salt.$pass_digest); |
||||||
|
if ($hashed_password eq $salted_password && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) { |
||||||
|
$ret = 1; |
||||||
|
last; |
||||||
|
} |
||||||
|
} elsif ($CanUseLDAPAuth) { |
||||||
|
my $sthldap = $dbh->prepare( |
||||||
|
"SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;" |
||||||
|
); |
||||||
|
$sthldap->execute($auth_source_id); |
||||||
|
while (my @rowldap = $sthldap->fetchrow_array) { |
||||||
|
my $bind_as = $rowldap[3] ? $rowldap[3] : ""; |
||||||
|
my $bind_pw = $rowldap[4] ? $rowldap[4] : ""; |
||||||
|
if ($bind_as =~ m/\$login/) { |
||||||
|
# replace $login with $redmine_user and use $redmine_pass |
||||||
|
$bind_as =~ s/\$login/$redmine_user/g; |
||||||
|
$bind_pw = $redmine_pass |
||||||
|
} |
||||||
|
my $ldap = Authen::Simple::LDAP->new( |
||||||
|
host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0], |
||||||
|
port => $rowldap[1], |
||||||
|
basedn => $rowldap[5], |
||||||
|
binddn => $bind_as, |
||||||
|
bindpw => $bind_pw, |
||||||
|
filter => "(".$rowldap[6]."=%s)" |
||||||
|
); |
||||||
|
my $method = $r->method; |
||||||
|
$ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/)); |
||||||
|
|
||||||
|
} |
||||||
|
$sthldap->finish(); |
||||||
|
undef $sthldap; |
||||||
|
} |
||||||
|
} |
||||||
|
$sth->finish(); |
||||||
|
undef $sth; |
||||||
|
$dbh->disconnect(); |
||||||
|
undef $dbh; |
||||||
|
|
||||||
|
if ($cfg->{RedmineCacheCredsMax} and $ret) { |
||||||
|
if (defined $usrprojpass) { |
||||||
|
$cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest); |
||||||
|
} else { |
||||||
|
if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) { |
||||||
|
$cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest); |
||||||
|
$cfg->{RedmineCacheCredsCount}++; |
||||||
|
} else { |
||||||
|
$cfg->{RedmineCacheCreds}->clear(); |
||||||
|
$cfg->{RedmineCacheCredsCount} = 0; |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
$ret; |
||||||
|
} |
||||||
|
|
||||||
|
sub get_project_identifier { |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); |
||||||
|
my $location = $r->location; |
||||||
|
$location =~ s/\.git$// if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp}); |
||||||
|
my ($identifier) = $r->uri =~ m{$location/*([^/.]+)}; |
||||||
|
$identifier; |
||||||
|
} |
||||||
|
|
||||||
|
sub connect_database { |
||||||
|
my $r = shift; |
||||||
|
|
||||||
|
my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); |
||||||
|
return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass}); |
||||||
|
} |
||||||
|
|
||||||
|
1; |
||||||
Loading…
Reference in new issue