diff --git a/app/Controllers/authController.php b/app/Controllers/authController.php index 02b8119e9..e1f895412 100644 --- a/app/Controllers/authController.php +++ b/app/Controllers/authController.php @@ -121,12 +121,8 @@ class FreshRSS_auth_Controller extends Minz_ActionController { $username = Minz_Request::param('username', ''); $challenge = Minz_Request::param('challenge', ''); - // TODO #730: change the way to get the configuration - try { - $conf = new FreshRSS_Configuration($username); - } catch(Minz_Exception $e) { - // $username is not a valid user, nor the configuration file! - Minz_Log::warning('Login failure: ' . $e->getMessage()); + $conf = get_user_configuration($username); + if (is_null($conf)) { Minz_Request::bad(_t('feedback.auth.login.invalid'), array('c' => 'auth', 'a' => 'login')); } @@ -167,12 +163,8 @@ class FreshRSS_auth_Controller extends Minz_ActionController { return; } - // TODO #730: change the way to get the configuration - try { - $conf = new FreshRSS_Configuration($username); - } catch(Minz_Exception $e) { - // $username is not a valid user, nor the configuration file! - Minz_Log::warning('Login failure: ' . $e->getMessage()); + $conf = get_user_configuration($username); + if (is_null($conf)) { return; } @@ -240,14 +232,12 @@ class FreshRSS_auth_Controller extends Minz_ActionController { $persona_file = DATA_PATH . '/persona/' . $email . '.txt'; if (($current_user = @file_get_contents($persona_file)) !== false) { $current_user = trim($current_user); - // TODO #730: change the way to get the configuration - try { - $conf = new FreshRSS_Configuration($current_user); + $conf = get_user_configuration($current_user); + if (!is_null($conf)) { $login_ok = strcasecmp($email, $conf->mail_login) === 0; - } catch (Minz_Exception $e) { - //Permission denied or conf file does not exist + } else { $reason = 'Invalid configuration for user ' . - '[' . $current_user . '] ' . $e->getMessage(); + '[' . $current_user . ']'; } } } else { @@ -309,8 +299,11 @@ class FreshRSS_auth_Controller extends Minz_ActionController { return; } - // TODO #730 - $conf = new FreshRSS_Configuration(FreshRSS_Context::$system_conf->default_user); + $conf = get_user_configuration(FreshRSS_Context::$system_conf->default_user); + if (is_null($conf)) { + return; + } + // Admin user must have set its master password. if (!$conf->passwordHash) { $this->view->message = array( diff --git a/app/Controllers/javascriptController.php b/app/Controllers/javascriptController.php index acd3fef69..421cf6f72 100755 --- a/app/Controllers/javascriptController.php +++ b/app/Controllers/javascriptController.php @@ -29,7 +29,7 @@ class FreshRSS_javascript_Controller extends Minz_ActionController { if (ctype_alnum($user)) { try { $salt = FreshRSS_Context::$system_conf->salt; - $conf = new FreshRSS_Configuration($user); + $conf = get_user_configuration($user); $s = $conf->passwordHash; if (strlen($s) >= 60) { $this->view->salt1 = substr($s, 0, 29); //CRYPT_BLOWFISH Salt: "$2a$", a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z". diff --git a/lib/lib_rss.php b/lib/lib_rss.php index 3a929631e..8bfc6eb10 100644 --- a/lib/lib_rss.php +++ b/lib/lib_rss.php @@ -237,6 +237,29 @@ function listUsers() { return $final_list; } + +/** + * Register and return the configuration for a given user. + * + * Note this function has been created to generate temporary configuration + * objects. If you need a long-time configuration, please don't use this function. + * + * @param $username the name of the user of which we want the configuration. + * @return a Minz_Configuration object, null if the configuration cannot be loaded. + */ +function get_user_configuration($username) { + $namespace = time() . '_user_' . $username; + try { + Minz_Configuration::register($namespace, + join_path(USERS_PATH, $username, 'config.php'), + join_path(USERS_PATH, '_', 'config.default.php')); + return Minz_Configuration::get($namespace); + } catch(Minz_ConfigurationException $e) { + return null; + } +} + + function httpAuthUser() { return isset($_SERVER['REMOTE_USER']) ? $_SERVER['REMOTE_USER'] : ''; }