1
2
3
4
5
6
7
8
9
10
11
12
13
14 import twisted
15 from twisted.web import http
16 from twisted.web.resource import ErrorPage
17 from zephir.backend import config
18 from zephir.backend.lib_backend import ResourceAuthError
19
20 from twisted.internet import defer
21 from twisted.web import xmlrpc,server
22 from zephir.eolerpclib import xmlrpclib
23 import psycopg2 as PgSQL
24 import time
25
26 try:
27 import ldap
28 except:
29 pass
30
31
33 """Transforme les objets unicode contenus dans un objet en chaines
34 """
35 if type(objet) == tuple:
36 l = []
37 for item in objet:
38 l.append(convert(item))
39 return l
40 if type(objet) == list:
41 l = []
42 for item in objet:
43 l.append(convert(item))
44 return l
45 if type(objet) == dict:
46 dico={}
47 for cle in objet.keys():
48 dico[cle] = convert(objet[cle])
49 return dico
50 if type(objet) == unicode:
51 string = objet.encode(config.charset)
52 return string
53 return objet
54
55
56
58
59
68
70
71 cx = PgSQL.connect(database='zephir',user='zephir',password=config.DB_PASSWD)
72 db_cursor = cx.cursor()
73 db_cursor.execute("""select id,libelle,droits from groupes_droits""")
74 res = db_cursor.fetchall()
75 db_cursor.close()
76 cx.close()
77 self.groupes={}
78 for groupe in res:
79 self.groupes[int(groupe[0])]=[str(res[1]),eval(str(groupe[2]))]
80
82 """examine la requête transmise par le client et apelle la procédure
83 correspondante si ses autorisations sont suffisantes"""
84
85 cred_user = request.getUser()
86 cred_password = request.getPassword()
87
88 if cred_user != 'zephir' or cred_password != 'zephir':
89
90 retry_auth = 0
91 while retry_auth < 2:
92 try:
93 if cred_password == "":
94 cred_password = None
95 query = ldap.open(self.serveur_ldap)
96 if config.LDAP_TLS == "oui":
97 query.start_tls_s()
98
99 result = query.search_s(config.BASE_LDAP, ldap.SCOPE_SUBTREE, "(uid="+cred_user+")")
100 cred_dn = result[0][0]
101 query.simple_bind_s(cred_dn,cred_password)
102 query.unbind()
103 except ldap.SERVER_DOWN:
104 print "ldap server not responding, retrying authentification"
105 time.sleep(0.3)
106 retry_auth += 1
107 except:
108
109
110 print "\nauthentification incorrecte : ",request.host.host
111 errpage = ErrorPage(http.UNAUTHORIZED,"Unauthorized","401 Authentication required")
112 return errpage.render(request)
113 retry_auth = 2
114 else:
115 retry_auth = 2
116 pass
117
118
119 request.content.seek(0, 0)
120 args, functionPath = xmlrpclib.loads(request.content.read())
121
122 ip_publique = None
123 if functionPath == 'uucp.maj_site':
124 ip_publique = request.getClientIP()
125 args_list=[]
126 if ip_publique is not None:
127 args_list.append(ip_publique)
128 for arg in args:
129 arg_conv=convert(arg)
130 args_list.append(arg_conv)
131 args = tuple(args_list)
132
133
134
135 cx = PgSQL.connect(database=config.DB_NAME,user=config.DB_USER,password=config.DB_PASSWD)
136 cursor=cx.cursor()
137 cursor.execute("""select droits from users where login=%s""", (cred_user,))
138 rs = cursor.fetchone()
139 cursor.close()
140 cx.close()
141 droits = []
142
143 if rs == [] or rs is None:
144 groupe = []
145 else:
146 for groupe in eval(rs[0]):
147 droits.extend(self.groupes[groupe][1])
148 try:
149
150 if functionPath not in droits:
151
152 if request.host.host not in ["localhost", "127.0.0.1"]:
153 host_addr = " (%s)" % request.host.host
154 else:
155 host_addr = ""
156 print "\nutilisation de la fonction %s interdite pour %s%s" % (functionPath,cred_user,host_addr)
157 errpage = ErrorPage(http.UNAUTHORIZED,"Unauthorized","erreur, ressource %s non autorisée !" % (request.uri))
158 return errpage.render(request)
159 except:
160 print "\n pas d'autorisations pour " + cred_user + " !"
161 errpage = ErrorPage(http.UNAUTHORIZED,"Unauthorized","erreur, ressource %s non autorisée !" % (request.uri))
162 return errpage.render(request)
163
164 try:
165 function = self._getFunction(functionPath)
166 except xmlrpc.NoSuchFunction:
167 self._cbRender(
168 xmlrpclib.Fault(self.NOT_FOUND, "no such function %s" % functionPath),
169 request
170 )
171 else:
172 request.setHeader("content-type", "text/xml")
173 if config.LOG_ACTIONS and cred_user not in ('zephir','', None):
174 try:
175 print "ZEPHIR_BACKEND : %s -> %s" % (cred_user, functionPath), args
176 except Exception, e:
177 print "Erreur lors du log d'une action : ", str(e)
178 defer.maybeDeferred(function, cred_user, *args).addErrback(
179 self.ebRender, request
180 ).addCallback(
181 self._cbRender, request
182 )
183 return server.NOT_DONE_YET
184
186 """errback intermédiaire pour catcher les ressources non autorisées"""
187 if ex.type == ResourceAuthError:
188 msg_err = ex.getErrorMessage()
189 errpage = ErrorPage(http.UNAUTHORIZED,"Unauthorized", "erreur, autorisations insuffisantes : {0} !".format(msg_err))
190 config.log.msg("tentative d'accès à une ressource interdite pour {0} : {1}".format(request.getUser(), msg_err))
191 return errpage.render(request)
192 else:
193 self._ebRender(ex)
194