CGI-Application-Plugin-Authentication-0.20000755001750001750 011563746137 21307 5ustar00nicholasnicholas000000000000Makefile.PL000444001750001750 240111563746137 23334 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20# Note: this file was auto-generated by Module::Build::Compat version 0.3800 require 5.006; use ExtUtils::MakeMaker; WriteMakefile ( 'NAME' => 'CGI::Application::Plugin::Authentication', 'VERSION_FROM' => 'lib/CGI/Application/Plugin/Authentication.pm', 'PREREQ_PM' => { 'Attribute::Handlers' => 0, 'CGI' => '3.16', 'CGI::Application' => 4, 'Class::ISA' => 0, 'Digest::SHA' => 0, 'MIME::Base64' => 0, 'Readonly' => 0, 'Scalar::Util' => 0, 'Test::Exception' => 0, 'Test::MockObject' => 0, 'Test::More' => '0.93', 'Test::NoWarnings' => 0, 'Test::Regression' => 0, 'Test::Taint' => 0, 'Test::Warn' => '0.11', 'Test::Without::Module' => 0, 'UNIVERSAL::require' => 0 }, 'INSTALLDIRS' => 'site', 'EXE_FILES' => [], 'PL_FILES' => {} ) ; META.yml000444001750001750 745411563746137 22650 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20--- abstract: 'Authentication framework for CGI::Application' author: - 'Cees Hek ' build_requires: Readonly: 0 Test::Exception: 0 Test::MockObject: 0 Test::More: 0.93 Test::NoWarnings: 0 Test::Regression: 0 Test::Taint: 0 Test::Warn: 0.11 Test::Without::Module: 0 configure_requires: Module::Build: 0.38 dynamic_config: 1 generated_by: 'Module::Build version 0.38, CPAN::Meta::Converter version 2.110930' keywords: - cgiapp - Titanium - authentication license: perl meta-spec: url: http://module-build.sourceforge.net/META-spec-v1.4.html version: 1.4 name: CGI-Application-Plugin-Authentication provides: CGI::Application::Plugin::Authentication: file: lib/CGI/Application/Plugin/Authentication.pm version: 0.20 CGI::Application::Plugin::Authentication::Display: file: lib/CGI/Application/Plugin/Authentication/Display.pm version: 0.20 CGI::Application::Plugin::Authentication::Display::Basic: file: lib/CGI/Application/Plugin/Authentication/Display/Basic.pm version: 0.20 CGI::Application::Plugin::Authentication::Display::Classic: file: lib/CGI/Application/Plugin/Authentication/Display/Classic.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver: file: lib/CGI/Application/Plugin/Authentication/Driver.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Authen::Simple: file: lib/CGI/Application/Plugin/Authentication/Driver/Authen/Simple.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::DBI: file: lib/CGI/Application/Plugin/Authentication/Driver/DBI.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Dummy: file: lib/CGI/Application/Plugin/Authentication/Driver/Dummy.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Filter::crypt: file: lib/CGI/Application/Plugin/Authentication/Driver/Filter/crypt.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Filter::lc: file: lib/CGI/Application/Plugin/Authentication/Driver/Filter/lc.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Filter::md5: file: lib/CGI/Application/Plugin/Authentication/Driver/Filter/md5.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Filter::sha1: file: lib/CGI/Application/Plugin/Authentication/Driver/Filter/sha1.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Filter::strip: file: lib/CGI/Application/Plugin/Authentication/Driver/Filter/strip.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Filter::uc: file: lib/CGI/Application/Plugin/Authentication/Driver/Filter/uc.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::Generic: file: lib/CGI/Application/Plugin/Authentication/Driver/Generic.pm version: 0.20 CGI::Application::Plugin::Authentication::Driver::HTPasswd: file: lib/CGI/Application/Plugin/Authentication/Driver/HTPasswd.pm version: 0.20 CGI::Application::Plugin::Authentication::Store: file: lib/CGI/Application/Plugin/Authentication/Store.pm version: 0.20 CGI::Application::Plugin::Authentication::Store::Cookie: file: lib/CGI/Application/Plugin/Authentication/Store/Cookie.pm version: 0.20 CGI::Application::Plugin::Authentication::Store::Session: file: lib/CGI/Application/Plugin/Authentication/Store/Session.pm version: 0.20 recommends: Apache::Htpasswd: 1.8 CGI::Application::Plugin::Session: 0 Color::Calc: 0.12 Digest::MD5: 0 requires: Attribute::Handlers: 0 CGI: 3.16 CGI::Application: 4 Class::ISA: 0 Digest::SHA: 0 MIME::Base64: 0 Scalar::Util: 0 UNIVERSAL::require: 0 perl: 5.006 resources: license: http://dev.perl.org/licenses/ repository: http://github.com/cees/cgi-application-plugin-authentication/tree version: 0.20 META.json000444001750001750 1243611563746137 23034 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20{ "abstract" : "Authentication framework for CGI::Application", "author" : [ "Cees Hek " ], "dynamic_config" : 1, "generated_by" : "Module::Build version 0.38, CPAN::Meta::Converter version 2.110930", "keywords" : [ "cgiapp", "Titanium", "authentication" ], "license" : [ "perl_5" ], "meta-spec" : { "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec", "version" : "2" }, "name" : "CGI-Application-Plugin-Authentication", "prereqs" : { "build" : { "requires" : { "Readonly" : 0, "Test::Exception" : 0, "Test::MockObject" : 0, "Test::More" : "0.93", "Test::NoWarnings" : 0, "Test::Regression" : 0, "Test::Taint" : 0, "Test::Warn" : "0.11", "Test::Without::Module" : 0 } }, "configure" : { "requires" : { "Module::Build" : "0.38" } }, "runtime" : { "recommends" : { "Apache::Htpasswd" : "1.8", "CGI::Application::Plugin::Session" : 0, "Color::Calc" : "0.12", "Digest::MD5" : 0 }, "requires" : { "Attribute::Handlers" : 0, "CGI" : "3.16", "CGI::Application" : "4", "Class::ISA" : 0, "Digest::SHA" : 0, "MIME::Base64" : 0, "Scalar::Util" : 0, "UNIVERSAL::require" : 0, "perl" : "5.006" } } }, "provides" : { "CGI::Application::Plugin::Authentication" : { "file" : "lib/CGI/Application/Plugin/Authentication.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Display" : { "file" : "lib/CGI/Application/Plugin/Authentication/Display.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Display::Basic" : { "file" : "lib/CGI/Application/Plugin/Authentication/Display/Basic.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Display::Classic" : { "file" : "lib/CGI/Application/Plugin/Authentication/Display/Classic.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Authen::Simple" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Authen/Simple.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::DBI" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/DBI.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Dummy" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Dummy.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Filter::crypt" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Filter/crypt.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Filter::lc" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Filter/lc.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Filter::md5" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Filter/md5.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Filter::sha1" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Filter/sha1.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Filter::strip" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Filter/strip.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Filter::uc" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Filter/uc.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::Generic" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/Generic.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Driver::HTPasswd" : { "file" : "lib/CGI/Application/Plugin/Authentication/Driver/HTPasswd.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Store" : { "file" : "lib/CGI/Application/Plugin/Authentication/Store.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Store::Cookie" : { "file" : "lib/CGI/Application/Plugin/Authentication/Store/Cookie.pm", "version" : "0.20" }, "CGI::Application::Plugin::Authentication::Store::Session" : { "file" : "lib/CGI/Application/Plugin/Authentication/Store/Session.pm", "version" : "0.20" } }, "release_status" : "stable", "resources" : { "license" : [ "http://dev.perl.org/licenses/" ], "repository" : { "url" : "http://github.com/cees/cgi-application-plugin-authentication/tree" } }, "version" : "0.20" } Build.PL000444001750001750 300111563746137 22653 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20use Module::Build; Module::Build->new( module_name => 'CGI::Application::Plugin::Authentication', license => 'perl', requires => { 'CGI::Application' => 4, 'Scalar::Util' => 0, 'Class::ISA' => 0, 'Attribute::Handlers' => 0, 'UNIVERSAL::require' => 0, 'CGI' => '3.16', 'MIME::Base64' => 0, 'Digest::SHA' => 0, 'perl' => 5.006, }, recommends => { 'Digest::MD5' => 0, 'CGI::Application::Plugin::Session' => 0, 'Apache::Htpasswd' => '1.8', 'Color::Calc' => '0.12', }, build_requires => { 'Test::More' => '0.93', 'Test::Warn' => 0.11, # older versions may have problems with fresh Sub::Uplevel 'Test::MockObject' => 0, 'Test::Exception' => 0, 'Test::NoWarnings' => 0, 'Test::Regression' => 0, # login_box generates a lot of HTML to verify 'Test::Taint' => 0, 'Test::Without::Module' => 0, 'Readonly' => 0, }, meta_merge => { resources => { repository => 'http://github.com/cees/cgi-application-plugin-authentication/tree', }, keywords => [ 'cgiapp', 'Titanium', 'authentication' ], }, create_readme=>1, create_makefile_pl => 'traditional', dist_author => 'Cees Hek ', )->create_build_script; MANIFEST000444001750001750 632011563746137 22517 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20Build.PL Changes example/basic.cgi example/httpdocs/css/ieonly.css example/httpdocs/css/ieonly6.css example/httpdocs/css/template.css example/httpdocs/js/focus.js example/sample.cgi example/template.cgi example/templates/login.tmpl example/templates/one.tmpl example/templates/two.tmpl lib/CGI/Application/Plugin/Authentication.pm lib/CGI/Application/Plugin/Authentication/Display.pm lib/CGI/Application/Plugin/Authentication/Display/Basic.pm lib/CGI/Application/Plugin/Authentication/Display/Classic.pm lib/CGI/Application/Plugin/Authentication/Driver.pm lib/CGI/Application/Plugin/Authentication/Driver/Authen/Simple.pm lib/CGI/Application/Plugin/Authentication/Driver/DBI.pm lib/CGI/Application/Plugin/Authentication/Driver/Dummy.pm lib/CGI/Application/Plugin/Authentication/Driver/Filter/crypt.pm lib/CGI/Application/Plugin/Authentication/Driver/Filter/lc.pm lib/CGI/Application/Plugin/Authentication/Driver/Filter/md5.pm lib/CGI/Application/Plugin/Authentication/Driver/Filter/sha1.pm lib/CGI/Application/Plugin/Authentication/Driver/Filter/strip.pm lib/CGI/Application/Plugin/Authentication/Driver/Filter/uc.pm lib/CGI/Application/Plugin/Authentication/Driver/Generic.pm lib/CGI/Application/Plugin/Authentication/Driver/HTPasswd.pm lib/CGI/Application/Plugin/Authentication/Store.pm lib/CGI/Application/Plugin/Authentication/Store/Cookie.pm lib/CGI/Application/Plugin/Authentication/Store/Session.pm Makefile.PL MANIFEST This list of files MANIFEST.SKIP META.json META.yml README t/01_basic.t t/02_config.t t/03_authenticate.t t/03_destination.t t/03_login_box.t t/03_login_box_basic.t t/03_login_box_other.t t/03_missing_color.t t/04_attributes.t t/05_autorunmode.t t/06_timeout.t t/07_protected_runmodes.t t/40_encoder_crypt.t t/40_encoder_lc.t t/40_encoder_md5.t t/40_encoder_sha1.t t/40_encoder_strip.t t/40_encoder_uc.t t/50_driver_missing_modules.t t/50_driver_undefined.t t/51_driver_dummy.t t/52_driver_generic.t t/53_driver_dbi.t t/53_driver_dbi_bad.t t/53_driver_dbi_die.t t/53_driver_dbi_syntax.t t/54_driver_htpasswd.t t/55_driver_authensimple.t t/55_driver_authensimple_die.t t/55_driver_missing_authensimple.t t/60_parsimony.t t/60_store.t t/60_store_cookie.t t/60_store_session.t t/61_cookie_badargs.t t/61_store_cookie_noexpiry.t t/61_store_cookie_other.t t/70_action_dispatch.t t/80_devpopup.t t/98_pod.t t/99_pod_coverage.t t/Authen/Simple/Dummy.pm t/CGI/Application/Plugin/Authentication/Display/Null.pm t/CGI/Application/Plugin/Authentication/Driver/Die.pm t/CGI/Application/Plugin/Authentication/Driver/Silly.pm t/changes.t t/htpasswd t/htpasswd2 t/manifest.t t/out/basic_login_box t/out/basic_login_box_options t/out/cosmetic t/out/crlf t/out/default t/out/frontpage t/out/frontpage-dev t/out/generic_login t/out/green t/out/grey t/out/grey2 t/out/grey_extra t/out/grey_extra2 t/out/login t/out/login-dev t/out/loginurl t/out/logout t/out/missing_color t/out/names_of_colours t/out/names_of_colours_2 t/out/names_of_colours_3 t/out/other_permutations t/out/percentage t/out/red t/out/redirect t/out/redirection_failure t/out/redirection_failure_basic t/out/restricted t/out/runmode t/out/success t/out/success-dev t/out/username t/out/username-basic t/podspell.t t/prereq.t t/Store/Dummy.pm t/TestAppDriver.pm t/TestAppParsimony.pm t/TestAppStore.pm MANIFEST.SKIP000444001750001750 14011563746137 23236 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20^MYMETA.yml$ ^cover_db ^_build ^blib ^.git ^Build$ .*\.swp$ .*\.tar\.gz ^MYMETA\.json$ .*\.bak$ README000444001750001750 10361211563746137 22310 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20NAME CGI::Application::Plugin::Authentication - Authentication framework for CGI::Application VERSION This document describes CGI::Application::Plugin::Authentication version 0.20 SYNOPSIS package MyCGIApp; use base qw(CGI::Application); # make sure this occurs before you load the plugin use CGI::Application::Plugin::Authentication; MyCGIApp->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], ); MyCGIApp->authen->protected_runmodes('myrunmode'); sub myrunmode { my $self = shift; # The user should be logged in if we got here my $username = $self->authen->username; } DESCRIPTION CGI::Application::Plugin::Authentication adds the ability to authenticate users in your CGI::Application modules. It imports one method called 'authen' into your CGI::Application module. Through the authen method you can call all the methods of the CGI::Application::Plugin::Authentication plugin. There are two main decisions that you need to make when using this module. How will the usernames and password be verified (i.e. from a database, LDAP, etc...), and how can we keep the knowledge that a user has already logged in persistent, so that they will not have to enter their credentials again on the next request (i.e. how do we 'Store' the authentication information across requests). Choosing a Driver There are three drivers that are included with the distribution. Also, there is built in support for all of the Authen::Simple modules (search CPAN for Authen::Simple for more information). This should be enough to cover everyone's needs. If you need to authenticate against a source that is not provided, you can use the Generic driver which will accept either a hash of username/password pairs, or an array of arrays of credentials, or a subroutine reference that can verify the credentials. So through the Generic driver you should be able to write your own verification system. There is also a Dummy driver, which blindly accepts any credentials (useful for testing). See the CGI::Application::Plugin::Authentication::Driver::Generic, CGI::Application::Plugin::Authentication::Driver::DBI and, CGI::Application::Plugin::Authentication::Driver::Dummy docs for more information on how to use these drivers. And see the Authen::Simple suite of modules for information on those drivers. Choosing a Store The Store modules keep information about the authentication status of the user persistent across multiple requests. The information that is stored in the store include the username, and the expiry time of the login. There are two Store modules included with this distribution. A Session based store, and a Cookie based store. If your application is already using Sessions (through the CGI::Application::Plugin::Session module), then I would recommend that you use the Session store for authentication. If you are not using the Session plugin, then you can use the Cookie store. The Cookie store keeps all the authentication in a cookie, which contains a checksum to ensure that users can not change the information. If you do not specify which Store module you wish to use, the plugin will try to determine the best one for you. Login page The Authentication plugin comes with a default login page that can be used if you do not want to create a custom login page. This login form will automatically be used if you do not provide either a LOGIN_URL or LOGIN_RUNMODE parameter in the configuration. If you plan to create your own login page, I would recommend that you start with the HTML code for the default login page, so that your login page will contain the correct form fields and hidden fields. Ticket based authentication This Authentication plugin can handle ticket based authentication systems as well. All that is required of you is to write a Store module that can understand the contents of the ticket. The Authentication plugin will require at least the 'username' to be retrieved from the ticket. A Ticket based authentication scheme will not need a Driver module at all, since the actual verification of credentials is done by an external authentication system, possibly even on a different host. You will need to specify the location of the login page using the LOGIN_URL configuration variable, and unauthenticated users will automatically be redirected to your ticket authentication login page. EXPORTED METHODS authen This is the only method exported from this module. Everything is controlled through this method call, which will return a CGI::Application::Plugin::Authentication object, or just the class name if called as a class method. When using the plugin, you will always first call $self->authen or __PACKAGE__->authen and then the method you wish to invoke. For example: __PACKAGE__->authen->config( LOGIN_RUNMODE => 'login', ); - or - $self->authen->protected_runmodes(qw(one two)); METHODS config This method is used to configure the CGI::Application::Plugin::Authentication module. It can be called as an object method, or as a class method. Calling this function, will not itself generate cookies or session ids. The following parameters are accepted: DRIVER Here you can choose which authentication module(s) you want to use to perform the authentication. For simplicity, you can leave off the CGI::Application::Plugin::Authentication::Driver:: part when specifying the DRIVER name If this module requires extra parameters, you can pass an array reference that contains as the first parameter the name of the module, and the rest of the values in the array will be considered options for the driver. You can provide multiple drivers which will be used, in order, to check the credentials until a valid response is received. DRIVER => 'Dummy' # let anyone in regardless of the password - or - DRIVER => [ 'DBI', DBH => $self->dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'MD5:user.password' => '__CREDENTIAL_2__' }, ], - or - DRIVER => [ [ 'Generic', { user1 => '123' } ], [ 'Generic', sub { my ($u, $p) = @_; is_prime($p) ? 1 : 0 } ] ], - or - DRIVER => [ 'Authen::Simple::LDAP', host => 'ldap.company.com', basedn => 'ou=People,dc=company,dc=net' ], STORE Here you can choose how we store the authenticated information after a user has successfully logged in. We need to store the username so that on the next request we can tell the user has already logged in, and we do not have to present them with another login form. If you do not provide the STORE option, then the plugin will look to see if you are using the CGI::Application::Plugin::Session module and based on that info use either the Session module, or fall back on the Cookie module. If the module requires extra parameters, you can pass an array reference that contains as the first parameter the name of the module, and the rest of the array should contain key value pairs of options for this module. These storage modules generally live under the CGI::Application::Plugin::Authentication::Store:: name-space, and this part of the package name can be left off when specifying the STORE parameter. STORE => 'Session' - or - STORE => ['Cookie', NAME => 'MYAuthCookie', SECRET => 'FortyTwo', EXPIRY => '1d', ] POST_LOGIN_RUNMODE Here you can specify a runmode that the user will be redirected to if they successfully login. POST_LOGIN_RUNMODE => 'welcome' POST_LOGIN_URL Here you can specify a URL that the user will be redirected to if they successfully login. If both POST_LOGIN_URL and POST_LOGIN_RUNMODE are specified, then the latter will take precedence. POST_LOGIN_URL => 'http://example.com/start.cgi' POST_LOGIN_CALLBACK A code reference that is executed after login processing but before POST_LOGIN_RUNMODE or redirecting to POST_LOGIN_URL. This is normally a method in your CGI::Application application and as such the CGI::Application object is passed as a parameter. POST_LOGIN_CALLBACK => \&update_login_date and later in your code: sub update_login_date { my $self = shift; return unless($self->authen->is_authenticated); ... } LOGIN_RUNMODE Here you can specify a runmode that the user will be redirected to if they need to login. LOGIN_RUNMODE => 'login' LOGIN_URL If your login page is external to this module, then you can use this option to specify a URL that the user will be redirected to when they need to login. If both LOGIN_URL and LOGIN_RUNMODE are specified, then the latter will take precedence. LOGIN_URL => 'http://example.com/login.cgi' LOGOUT_RUNMODE Here you can specify a runmode that the user will be redirected to if they ask to logout. LOGOUT_RUNMODE => 'logout' LOGOUT_URL If your logout page is external to this module, then you can use this option to specify a URL that the user will be redirected to when they ask to logout. If both LOGOUT_URL and LOGOUT_RUNMODE are specified, then the latter will take precedence. LOGIN_URL => 'http://example.com/logout.html' DETAINT_URL_REGEXP This is a regular expression used to detaint URLs used in the login form. By default it will be set to ^([\w\_\%\?\&\;\-\/\@\.\+\$\=\#\:\!\*\"\'\(\)\,]+)$ This regular expression is based upon the document http://www.w3.org/Addressing/URL/url-spec.txt. You could set it to a more specific regular expression to limit the domains to which users could be directed. DETAINT_USERNAME_REGEXP This is a regular expression used to detaint the username parameter used in the login form. By default it will be set to ^([\w\_]+)$ CREDENTIALS Set this to the list of form fields where the user will type in their username and password. By default this is set to ['authen_username', 'authen_password']. The form field names should be set to a value that you are not likely to use in any other forms. This is important because this plugin will automatically look for query parameters that match these values on every request to see if a user is trying to log in. So if you use the same parameter names on a user management page, you may inadvertently perform a login when that was not intended. Most of the Driver modules will return the first CREDENTIAL as the username, so make sure that you list the username field first. This option can be ignored if you use the built in login box CREDENTIALS => 'authen_password' - or - CREDENTIALS => [ 'authen_username', 'authen_domain', 'authen_password' ] LOGIN_SESSION_TIMEOUT This option can be used to tell the system when to force the user to re-authenticate. There are a few different possibilities that can all be used concurrently: IDLE_FOR If this value is set, a re-authentication will be forced if the user was idle for more then x amount of time. EVERY If this value is set, a re-authentication will be forced every x amount of time. CUSTOM This value can be set to a subroutine reference that returns true if the session should be timed out, and false if it is still active. This can allow you to be very selective about how the timeout system works. The authen object will be passed in as the only parameter. Time values are specified in seconds. You can also specify the time by using a number with the following suffixes (m h d w), which represent minutes, hours, days and weeks. The default is 0 which means the login will never timeout. Note that the login is also dependent on the type of STORE that is used. If the Session store is used, and the session expires, then the login will also automatically expire. The same goes for the Cookie store. For backwards compatibility, if you set LOGIN_SESSION_TIMEOUT to a time value instead of a hashref, it will be treated as an IDLE_FOR time out. # force re-authentication if idle for more than 15 minutes LOGIN_SESSION_TIMEOUT => '15m' # Everyone must re-authentication if idle for more than 30 minutes # also, everyone must re-authentication at least once a day # and root must re-authentication if idle for more than 5 minutes LOGIN_SESSION_TIMEOUT => { IDLE_FOR => '30m', EVERY => '1d', CUSTOM => sub { my $authen = shift; return ($authen->username eq 'root' && (time() - $authen->last_access) > 300) ? 1 : 0; } } RENDER_LOGIN This value can be set to a subroutine reference that returns the HTML of a login form. The subroutine reference overrides the default call to login_box. The subroutine is normally a method in your CGI::Application application and as such the CGI::Application object is passed as the first parameter. RENDER_LOGIN => \&login_form and later in your code: sub login_form { my $self = shift; ... return $html } LOGIN_FORM You can set this option to customize the login form that is created when a user needs to be authenticated. If you wish to replace the entire login form with a completely custom version, then just set LOGIN_RUNMODE to point to your custom runmode. All of the parameters listed below are optional, and a reasonable default will be used if left blank: DISPLAY_CLASS (default: Classic) the class used to display the login form. The alternative is `Basic' which aims for XHTML compliance and leaving style to CSS. See CGI::Application::Plugin::Authentication::Display for more details. TITLE (default: Sign In) the heading at the top of the login box USERNAME_LABEL (default: User Name) the label for the user name input PASSWORD_LABEL (default: Password) the label for the password input SUBMIT_LABEL (default: Sign In) the label for the submit button COMMENT (default: Please enter your username and password in the fields below.) a message provided on the first login attempt REMEMBERUSER_OPTION (default: 1) provide a checkbox to offer to remember the users name in a cookie so that their user name will be pre-filled the next time they log in REMEMBERUSER_LABEL (default: Remember User Name) the label for the remember user name checkbox REMEMBERUSER_COOKIENAME (default: CAPAUTHTOKEN) the name of the cookie where the user name will be saved REGISTER_URL (default: ) the URL for the register new account link REGISTER_LABEL (default: Register Now!) the label for the register new account link FORGOTPASSWORD_URL (default: ) the URL for the forgot password link FORGOTPASSWORD_LABEL (default: Forgot Password?) the label for the forgot password link INVALIDPASSWORD_MESSAGE (default: Invalid username or password
(login attempt %d) a message given when a login failed INCLUDE_STYLESHEET (default: 1) use this to disable the built in style-sheet for the login box so you can provide your own custom styles FORM_SUBMIT_METHOD (default: post) use this to get the form to submit using 'get' instead of 'post' FOCUS_FORM_ONLOAD (default: 1) use this to automatically focus the login form when the page loads so a user can start typing right away. BASE_COLOUR (default: #445588) This is the base colour that will be used in the included login box. All other colours are automatically calculated based on this colour (unless you hardcode the colour values). In order to calculate other colours, you will need the Color::Calc module. If you do not have the Color::Calc module, then you will need to use fixed values for all of the colour options. All colour values besides the BASE_COLOUR can be simple percentage values (including the % sign). For example if you set the LIGHTER_COLOUR option to 80%, then the calculated colour will be 80% lighter than the BASE_COLOUR. LIGHT_COLOUR (default: 50% or #a2aac4) A colour that is lighter than the base colour. LIGHTER_COLOUR (default: 75% or #d0d5e1) A colour that is another step lighter than the light colour. DARK_COLOUR (default: 30% or #303c5f) A colour that is darker than the base colour. DARKER_COLOUR (default: 60% or #1b2236) A colour that is another step darker than the dark colour. GREY_COLOUR (default: #565656) A grey colour that is calculated by desaturating the base colour. protected_runmodes This method takes a list of runmodes that are to be protected by authentication. If a user tries to access one of these runmodes, then they will be redirected to a login page unless they are properly logged in. The runmode names can be a list of simple strings, regular expressions, or special directives that start with a colon. This method is cumulative, so if it is called multiple times, the new values are added to existing entries. It returns a list of all entries that have been saved so far. Calling this function, will not itself generate cookies or session ids. :all - All runmodes in this module will require authentication # match all runmodes __PACKAGE__->authen->protected_runmodes(':all'); # only protect runmodes one two and three __PACKAGE__->authen->protected_runmodes(qw(one two three)); # protect only runmodes that start with auth_ __PACKAGE__->authen->protected_runmodes(qr/^auth_/); # protect all runmodes that *do not* start with public_ __PACKAGE__->authen->protected_runmodes(qr/^(?!public_)/); is_protected_runmode This method accepts the name of a runmode, and will tell you if that runmode is a protected runmode (i.e. does a user need to be authenticated to access this runmode). Calling this function, will not itself generate cookies or session ids. redirect_after_login This method is be called during the prerun stage to redirect the user to the page that has been configured as the destination after a successful login. The location is determined as follows: POST_LOGIN_RUNMODE If the POST_LOGIN_RUNMODE config parameter is set, that run mode will be the chosen location. POST_LOGIN_URL If the above fails and the POST_LOGIN_URL config parameter is set, then there will be a 302 redirection to that location. destination If the above fails and there is a destination query parameter, which must a taint check against the DETAINT_URL_REGEXP config parameter, then there will be a 302 redirection to that location. original destination If all the above fail then there the originally requested page will be delivered. redirect_to_login This method is be called during the prerun stage if the current user is not logged in, and they are trying to access a protected runmode. It will redirect to the page that has been configured as the login page, based on the value of LOGIN_RUNMODE or LOGIN_URL If nothing is configured a simple login page will be automatically provided. redirect_to_logout This method is called during the prerun stage if the user has requested to be logged out. It will redirect to the page that has been configured as the logout page, based on the value of LOGOUT_RUNMODE or LOGOUT_URL If nothing is configured, the page will redirect to the website homepage. setup_runmodes This method is called during the prerun stage to register some custom runmodes that the Authentication plugin requires in order to function. Calling this function, will not itself generate cookies or session ids. last_login This will return return the time of the last login for this user my $last_login = $self->authen->last_login; This function will initiate a session or cookie if one has not been created already. last_access This will return return the time of the last access for this user my $last_access = $self->authen->last_access; This function will initiate a session or cookie if one has not been created already. is_login_timeout This will return true or false depending on whether the users login status just timed out $self->add_message('login session timed out') if $self->authen->is_login_timeout; This function will initiate a session or cookie if one has not been created already. is_authenticated This will return true or false depending on the login status of this user assert($self->authen->is_authenticated); # The user should be logged in if we got here This function will initiate a session or cookie if one has not been created already. login_attempts This method will return the number of failed login attempts have been made by this user since the last successful login. This is not a number that can be trusted, as it is dependent on the underlying store to be able to return the correct value for this user. For example, if the store uses a cookie based session, the user trying to login could delete their cookies, and hence get a new session which will not have any login attempts listed. The number will be cleared upon a successful login. This function will initiate a session or cookie if one has not been created already. username This will return the username of the currently logged in user, or undef if no user is currently logged in. my $username = $self->authen->username; This function will initiate a session or cookie if one has not been created already. is_new_login This will return true or false depending on if this is a fresh login $self->log->info("New Login") if $self->authen->is_new_login; This function will initiate a session or cookie if one has not been created already. credentials This method will return the names of the form parameters that will be looked for during a login. By default they are authen_username and authen_password, but these values can be changed by supplying the CREDENTIALS parameters in the configuration. Calling this function, will not itself generate cookies or session ids. logout This will attempt to logout the user. If during a request the Authentication module sees a parameter called 'authen_logout', it will automatically call this method to log out the user. $self->authen->logout(); This function will initiate a session or cookie if one has not been created already. drivers This method will return a list of driver objects that are used for verifying the login credentials. Calling this function, will not itself generate cookies or session ids. store This method will return a store object that is used to store information about the status of the authentication across multiple requests. This function will initiate a session or cookie if one has not been created already. initialize This does most of the heavy lifting for the Authentication plugin. It will check to see if the user is currently attempting to login by looking for the credential form fields in the query object. It will load the required driver objects and authenticate the user. It is OK to call this method multiple times as it checks to see if it has already been executed and will just return without doing anything if called multiple times. This allows us to call initialize as late as possible in the request so that no unnecessary work is done. The user will be logged out by calling the `logout()' method if the login session has been idle for too long, if it has been too long since the last login, or if the login has timed out. If you need to know if a user was logged out because of a time out, you can call the `is_login_timeout' method. If all goes well, a true value will be returned, although it is usually not necessary to check. This function will initiate a session or cookie if one has not been created already. display This method will return the CGI::Application::Plugin::Authentication::Display object, creating and caching it if necessary. login_box This method will return the HTML for a login box that can be embedded into another page. This is the same login box that is used in the default authen_login runmode that the plugin provides. This function will initiate a session or cookie if one has not been created already. new This method creates a new CGI::Application::Plugin::Authentication object. It requires as it's only parameter a CGI::Application object. This method should never be called directly, since the 'authen' method that is imported into the CGI::Application module will take care of creating the CGI::Application::Plugin::Authentication object when it is required. Calling this function, will not itself generate cookies or session ids. instance This method works the same way as 'new', except that it returns the same Authentication object for the duration of the request. This method should never be called directly, since the 'authen' method that is imported into the CGI::Application module will take care of creating the CGI::Application::Plugin::Authentication object when it is required. Calling this function, will not itself generate cookies or session ids. CGI::Application CALLBACKS prerun_callback This method is a CGI::Application prerun callback that will be automatically registered for you if you are using CGI::Application 4.0 or greater. If you are using an older version of CGI::Application you will have to create your own cgiapp_prerun method and make sure you call this method from there. sub cgiapp_prerun { my $self = shift; $self->CGI::Application::Plugin::Authentication::prerun_callback(); } CGI::Application RUNMODES authen_login_runmode This runmode is provided if you do not want to create your own login runmode. It will display a simple login form for the user, which can be replaced by assigning RENDER_LOGIN a coderef that returns the HTML. authen_dummy_redirect This runmode is provided for convenience when an external redirect needs to be done. It just returns an empty string. EXAMPLE In a CGI::Application module: use base qw(CGI::Application); use CGI::Application::Plugin::AutoRunmode; use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], STORE => 'Session', LOGOUT_RUNMODE => 'start', ); __PACKAGE__->authen->protected_runmodes(qr/^auth_/, 'one'); sub start : RunMode { my $self = shift; } sub one : RunMode { my $self = shift; # The user will only get here if they are logged in } sub auth_two : RunMode { my $self = shift; # This is also protected because of the # regexp call to protected_runmodes above } COMPATIBILITY WITH CGI::Application::Plugin::ActionDispatch The prerun callback has been modified so that it will check for the presence of a prerun mode. This is for compatibility with CGI::Application::Plugin::ActionDispatch. This change should be considered experimental. It is necessary to load the ActionDispatch module so that the two prerun callbacks will be called in the correct order. RECOMMENDED USAGE CSS The best practice nowadays is generally considered to be to not have CSS embedded in HTML. Thus it should be best to set LOGIN_FORM -> DISPLAY_CLASS to 'Basic'. Post login destination Of the various means of selecting a post login destination the most secure would seem to be POST_LOGIN_URL. The `destination' parameter could potentially be hijacked by hackers. The POST_LOGIN_RUNMODE parameter requires a hidden parameter that could potentially be hijacked. Taint mode Do run your code under taint mode. It should help protect your application against a number of attacks. URL and username checking Please set the `DETAINT_URL_REGEXP' and `DETAINT_USERNAME_REGEXP' parameters as tightly as possible. In particular you should prevent the destination parameter being used to redirect authenticated users to external sites; unless of course that is what you want in which case that site should be the only possible external site. The login form The HTML currently generated does not seem to be standards compliant as per RT bug 58023. Also the default login form includes hidden forms which could conceivably be hijacked. Set LOGIN_FORM -> DISPLAY_CLASS to 'Basic' to fix this. TODO There are lots of things that can still be done to improve this plugin. If anyone else is interested in helping out feel free to dig right in. Many of these things don't need my input, but if you want to avoid duplicated efforts, send me a note, and I'll let you know of anyone else is working in the same area. review the code for security bugs and report complete the separation of presentation and logic write a tutorial build more Drivers (Class::DBI, LDAP, Radius, etc...) Add support for method attributes to identify runmodes that require authentication finish the test suite provide more example code clean up the documentation build a DB driver that builds it's own table structure. This can be used by people that don't have their own user database to work with, and could include a simple user management application. BUGS This is alpha software and as such, the features and interface are subject to change. So please check the Changes file when upgrading. Some of the test scripts appear to be incompatible with versions of Devel::Cover later than 0.65. SEE ALSO CGI::Application, perl(1) AUTHOR Author: Cees Hek ; Co-maintainer: Nicholas Bamber . CREDITS Thanks to SiteSuite for funding the development of this plugin and for releasing it to the world. Thanks to Christian Walde for suggesting changes to fix the incompatibility with CGI::Application::Plugin::ActionDispatch and for help with github. Thanks to Alexandr Ciornii for pointing out some typos. LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. Copyright (c) 2010, Nicholas Bamber. (Portions of the code). This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. The background images in the default login forms are used courtesy of www.famfamfam.com. Those icons are issued under the Creative Commons Attribution 3.0 License. Those icons are copyrighted 2006 by Mark James DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Changes000444001750001750 2357511563746137 22714 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20Revision history for Perl extension CGI::Application::Plugin::Authentication. 0.20 Fri 29 Apr 2011 Use Test::ConsistentVersion rather than Test::CheckVersion Fixed spelling errors and added descriptions - Closes #rt63839 Removed now unused login_styles method from core module Added more tests completing test coverage for the Cookie module. Changed from using the Digest::SHA1 module to usuing Digest::SHA instead - Closes #rt67840 Experimentally restored standard Test::Exception. See #53874 0.19 Wed 24 Nov 2010 Incoporated developer changes. Made pod tests only run when TEST_AUTHOR=1. Automatically generate README. 0.18_2 Mon 20 Jul 2010 Separate out display code and provide Basic and Classic alternatives to the login form. Added more examples. Implementd typo fix reported by Alexandr Ciornii. Added copyright declaration for icons in the login form. 0.18_1 Thu Jun 25 2010 Put OS dependent guards in certain tests. Removed deprecated *_DESTINATION parameters. Added first test for devpopup and fixed undefined variable therein. Cannot use Test::More 0.92 as that has an issue with subtests. 0.18 Mon Jun 23 2010 Completed test coverage for Driver and below TABLES parameter was not made mandatory in DBI driver. Fixed dependency on Test::More - must be at least version 0.90. Fixed handling of custom filters - now they must have a $param and a $value. Incorporated Christian Walde's suggested changes for compatibility with CGI::Application::Plugin::ActionDispatch. Adding tests around the HTML generated by the login_box function and verifying that it is taint free. Upped requiredment on CGI to 3.16 as that seems to cause unusual behaviour in returning self referring urls and further upped requirement on CGI to 3.16 as 3.15 has an unusual interpretation of redirection headers. Fixed regular expressions in destination test to respect HTTP header CRLF conventions. 0.17 Thu Jan 21 19:16 GMT 2010 Bug Fixes rt53533 - During initialization deferred checking the users credentials to the last possible moment. This ensures that sessions are not created unless actually required. Also attempted to document which functions add session/cookie state. Build Fixes rt35030 - Upped the requirement on Apache::Htpasswd to 1.8 as this simplifies our dependency management. 0.16 Mon Jan 18 22:18 GMT 2010 Release dedicated to improving CPAN readiness - see RT:50670. Fixed spelling mistakes and added a test script that uses Test::Spelling. Fixed dependency on Test::Exception and added a test script that uses Test::Prereq::Build. Added test scripts to validate the MANIFEST file and Changes file. Removed files that are generated during './Build dist' from repository. 0.15 Tue Jan 12 15:42 GMT 2010 Redist to fix tar format issues RT:45155 & 23705 0.14 Sun Oct 18 02:48:10 EST 2009 Bug Fixes - Make sure the 'action' attribute of the login_box includes the path_info in the URL (resolves RT:38049 patch by Alex Becker) New Features - Add options for LIMIT and ORDER_BY to DBI driver (requested by tbone) - Add FORM_SUBMIT_METHOD option to the login box which allows you to change the form method to GET instead of the default POST. (resolves RT:34198 requested by jaldhar) - Add hooks for devpopup (resolves RT:35989 patch by Alexandr Ciornii) 0.13 Mon Mar 30 23:58:25 EST 2009 Build fixes - There are no code changes to this release, just fixes in the build and test systems to solve some outstanding test failures - unit tests now skip tests where optional modules are not installed (gtermars@cpan.org) - remove build dependency on Test::Exception, replacing it with hand-rolled equivalent methods. Newer Perls have been seen to fail our tests with "Bizarre copy of HASH in sassign..." when using Test::Exception. Cause of the issue may be far lower/internal than Test::Exception, but replacing these methods eliminates the issue for us. (gtermars@cpan.org) - cleanup prerequisites and build files (Alexandr Ciornii) 0.12 Bug Fixes - when issuing a redirect, remember to set header_type to 'redirect' (reported by Graham TerMarsch) Other updates - Fix inconsistency in doc example (reported by POLETTIX) 0.11 Wed Jul 26 11:16:12 EDT 2006 - suppress warning about missing Color::Calc unless the user is actually trying to use it (reported by Ron Savage) - explicitly load CGI.pm since some users may be using CGI::Simple (reported by Ron Savage) - Fixed bug in Cookie store where the expiry time of the cookie was ignored (patch by POLETTIX) 0.10 Thu May 18 22:59:56 EDT 2006 - Add support for Authen::Simple (all Authen::Simple modules can be used directly as Drivers) - Made the login page much more customizable: - change any of the text - customize the colours - provide one base colour and lighter and darker shades are automatically generated (requires Color::Calc) - offer to remember the users username in a cookie for the next time they login - add option for a 'forgotten password' URL - add option for a 'register new account' URL - add option to supress the stylesheet so you can provide your own 0.09 Thu Jan 26 20:56:29 EST 2006 API Changes - Added option to provide your own HTML for the login box through a callback (Shawn Sorichetti) - Added POST_LOGIN_RUNMODE callback (Shawn Sorichetti) 0.08 Wed Nov 23 20:20:24 EST 2005 API Changes - Removed ability to configure the DBI driver with a DSN and username/password. CGI::Application::Plugin::DBH should be used for that instead (Mark Stosberg) - DBI driver defaults to $self->dbh() if DBH not provided (Mark Stosberg) Bug Fixes - Made MIME::Base64, Digest::SHA1 and CGI::Cookie mandatory requirements and load them at compile time instead of runtime in the Cookie store. (fixes problem reported by Richard Jones) Other updates - Added Driver that can authenticate against htpasswd files - Fixed typo in examples/sample.cgi - Fixed typo in lc filter example (Mark Stosberg) - Updated docs for initialize(), and made it return true value (Mark Stosberg) 0.07 Sat Oct 29 17:08:48 EDT 2005 API Changes - Config parameters ending in _DESTINATION have been renamed to _URL for clarity. (Mark Stosberg) Bug Fixes - DBI Driver was incorrectly using DBH option when it should have used the DSN option (patch from Jim McQuillan) - Tests were failing if certain modules were not installed. (fixed by Shawn Sorichetti) Other updates - add negative regexp example for the 'protected_runmodes' method (suggested by Larry Leszczynski) 0.06 Fri Oct 14 14:05:52 EDT 2005 Bug Fixes - fix autorunmode test so it doesn't fail if the AutoRunmode plugin is not installed 0.05 Fri Oct 14 13:15:23 EDT 2005 New Stuff - add ability to timeout logins based on last successful login, or with a custom callback (as well as the original last access timeout) - add 'last_access' and 'last_login' methods - add 'is_login_timeout' to show when a login request is caused by an idle login session - added lots more tests Bug Fixes - login timeouts were not working properly - the Cookie Store was not honouring the EXPIRY option - using :all in protected_runmodes now works - fix test failure when Test::Warn not installed (fixed by Shawn Sorichetti) Experimental - subroutine attributes: you can specify that a runmode should be protected with a subroutine attribute. example: sub my_rm :Authen { ... } This conflicts with the AutoRunmode plugin right now 0.04 Thu Sep 22 21:06:54 EDT 2005 API Changes - renamed 'encoders' to 'filters' - This should only affect driver writers and not end users New Stuff - filters (formerly encoders) can now be chained (See docs) - filters can take a param (See docs) - added filters for uc, lc and trim - added a simple sample application - more docs (based on suggestions from Ron Savage) 0.03 Mon Sep 19 14:57:47 EDT 2005 API Changes - renamed the 'auth' method to 'authen' to make it easier to distinguish from the upcoming 'authz' plugin. There is also an alias to 'authentication' for those who like clarity over brevity. - For the DBI driver, changed credential identifiers from cred_1 to __CREDENTIAL_1__ New Drivers - Dummy Driver - accepts any credentials as valid New Stuff - Added little icons to the default login and password fields (only works in Mozilla based browsers) - if STORE config is not given, the plugin will detect if you are already using the Session plugin, and use the Session Store instead of the Cookie Store. - Added a lot of new documentation Bug Fixes - 'run_modes' method was incorrectly being used in the test suite (reported by Ron Savage) 0.02 Fri Sep 16 00:19:10 EDT 2005 New Drivers - DBI Driver New Stores - Cookie store (requires no server side storage) New Stuff - Added field encoding support for datastores that keep passwords in an encoded format, like Unix crypt, or MD5. - Added encoders for crypt, MD5 and SHA1 - Added some more methods to Driver.pm that can simplify the building of new Driver modules (find_option, encode, check_encoded, strip_field_names) - Added lots more tests to the test suite (Cees and Shawn Sorichetti) Bug Fixes - Fixed Generic Driver when using array of arrays method. - Options no longer get clobbered by the modules. (reported by Shawn Sorichetti) 0.01 Fri Sep 9 00:44:17 EDT 2005 - original version t000755001750001750 011563746137 21473 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.2001_basic.t000444001750001750 400611563746137 23376 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More tests => 9; use Test::Exception; use Scalar::Util; BEGIN { require_ok('CGI::Application::Plugin::Authentication') }; use lib './t'; use strict; use warnings; { package TestAppBasic; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; } { package TestAppBasicNOTCA; use Test::More; sub new { return bless {}, 'TestAppBasicNOTCA'; } SKIP: { eval "use Test::Warn"; skip "Test::Warn required for this test", 1 if $@; warning_like( sub { CGI::Application::Plugin::Authentication->import() }, qr/Calling package is not a CGI::Application module so not setting up the prerun hook/, "warning when the plugin is used in a non-CGIApp module"); }; { local $SIG{__WARN__} = sub {}; # supress all warnings for the next line CGI::Application::Plugin::Authentication->import(); }; Test::Exception::throws_ok( sub { TestAppBasicNOTCA->new->authen }, qr/CGI::Application::Plugin::Authentication->instance must be called with a CGI::Application object/, "instance dies when called passed non CGI::App module" ); } is(TestAppBasic->authen, "CGI::Application::Plugin::Authentication", "->authen called as a class method works"); my $t1_obj = TestAppBasic->new(); my $authen = $t1_obj->authen; my $authen_again = $t1_obj->authen; isa_ok($authen, 'CGI::Application::Plugin::Authentication'); my $t2_obj = TestAppBasic->new(); my $authen2 = $t2_obj->authen; isa_ok($authen2, 'CGI::Application::Plugin::Authentication'); ok(Scalar::Util::refaddr($authen) != Scalar::Util::refaddr($authen2), "Objects have same different address"); is(Scalar::Util::refaddr($authen), Scalar::Util::refaddr($authen_again), "Objects have same address"); throws_ok(sub { CGI::Application::Plugin::Authentication->instance }, qr/CGI::Application::Plugin::Authentication->instance must be called with a CGI::Application object/, "instance dies when called incorrectly"); changes.t000444001750001750 61111563746137 23403 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuse strict; use warnings; use Test::More; if ( not $ENV{TEST_AUTHOR} ) { my $msg = 'Author test. Set $ENV{TEST_AUTHOR} to a true value to run.'; plan( skip_all => $msg ); } eval { require Test::ConsistentVersion; }; if ( $@ ) { my $msg = 'Test::ConsistentVersion required to check Changes'; plan( skip_all => $msg ); } Test::ConsistentVersion::check_consistent_versions(); 98_pod.t000444001750001750 41711563746137 23101 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuse Test::More; if ( not $ENV{TEST_AUTHOR} ) { my $msg = 'Author test. Set $ENV{TEST_AUTHOR} to a true value to run.'; plan( skip_all => $msg ); } eval "use Test::Pod 1.00"; plan skip_all => "Test::Pod 1.00 required for testing POD" if $@; all_pod_files_ok(); 55_driver_authensimple_die.t000444001750001750 172311563746137 27223 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use Test::Exception; use Test::Warn; use Test::MockObject; use lib qw(t); BEGIN { eval {require Params::Validate}; if ($@) { my $msg = "Authen::Simple depends on Params::Validate, hence this test also"; plan skip_all => $msg; } } my $authensimple = Test::MockObject->new; $authensimple->fake_module('Authen::Simple::Adapter', new=>sub{return undef},options=>sub{1}); plan tests => 1; use strict; use warnings; { package TestAppDriverAuthenSimple; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'Authen::Simple::Dummy', testuser => 'user1', testpass => '123' ], STORE => 'Store::Dummy', ); } throws_ok { TestAppDriverAuthenSimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], ); } qr/Error executing class callback in prerun stage: Failed to create Authen::Simple::Dummy instance/, 'throws error correctly'; 03_login_box_other.t000444001750001750 1420211563746137 25517 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl # taint chcking seems to break Devel::Cover use Test::More; use Test::Regression; use Test::Warn; use English qw(-no_match_vars); BEGIN { use Test::More; eval {require Color::Calc;}; if ($@) { my $msg = 'Color::Calc required'; diag $msg; plan skip_all => $msg; } if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; } plan tests => 7; } use strict; use warnings; use CGI (); my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_CALLBACK => \&TestAppAuthenticate::post_login, }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two three)]); $self->authen->protected_runmodes(qw(two three)); $self->authen->config($cap_options); } sub one { my $self = shift; return "ONE"; } sub two { my $self = shift; return "TWO"; } sub three { my $self = shift; return "THREE"; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; subtest 'Various other pemutations' => sub { plan tests => 1; undef local $cap_options->{LOGIN_FORM}->{COMMENT}; local $cap_options->{LOGIN_FORM}->{FOCUS_FORM_ONLOAD} = 1; local $cap_options->{LOGIN_FORM}->{REMEMBERUSER_OPTION} = 0; local $cap_options->{LOGIN_FORM}->{REGISTER_URL} = '/register'; local $cap_options->{LOGIN_FORM}->{FORGOTPASSWORD_URL} = '/forgot'; local $cap_options->{LOGIN_FORM}->{GREY_COLOUR} = 'purple'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/other_permutations", "Other permutations"); }; subtest 'Percentage' => sub { plan tests => 1; local $cap_options->{LOGIN_FORM}->{LIGHT_COLOUR} = '20%'; local $cap_options->{LOGIN_FORM}->{LIGHTER_COLOUR} = '10%'; local $cap_options->{LOGIN_FORM}->{DARK_COLOUR} = '80%'; local $cap_options->{LOGIN_FORM}->{DARKER_COLOUR} = '90%'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/percentage", "Percentage"); }; subtest 'Names of colours' => sub { plan tests => 1; local $cap_options->{LOGIN_FORM}->{LIGHT_COLOUR} = '110%'; local $cap_options->{LOGIN_FORM}->{LIGHTER_COLOUR} = 'red'; local $cap_options->{LOGIN_FORM}->{DARK_COLOUR} = 'green'; local $cap_options->{LOGIN_FORM}->{DARKER_COLOUR} = 'blue'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/names_of_colours", "Names of colours"); }; subtest 'Names of colours II' => sub { plan tests => 1; local $cap_options->{LOGIN_FORM}->{LIGHT_COLOUR} = 'orange'; local $cap_options->{LOGIN_FORM}->{LIGHTER_COLOUR} = 'red'; local $cap_options->{LOGIN_FORM}->{DARK_COLOUR} = '110%'; local $cap_options->{LOGIN_FORM}->{DARKER_COLOUR} = 'blue'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/names_of_colours_2", "Names of colours"); }; subtest 'Names of colours III' => sub { plan tests => 1; local $cap_options->{LOGIN_FORM}->{LIGHT_COLOUR} = 'orange'; local $cap_options->{LOGIN_FORM}->{LIGHTER_COLOUR} = 'red'; local $cap_options->{LOGIN_FORM}->{DARK_COLOUR} = 'purple'; local $cap_options->{LOGIN_FORM}->{DARKER_COLOUR} = 'blue'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/names_of_colours_3", "Names of colours"); }; subtest 'grey' => sub { plan tests => 1; local $cap_options->{LOGIN_FORM}->{LIGHT_COLOUR} = 'orange'; local $cap_options->{LOGIN_FORM}->{LIGHTER_COLOUR} = '15%'; local $cap_options->{LOGIN_FORM}->{DARK_COLOUR} = 'purple'; local $cap_options->{LOGIN_FORM}->{DARKER_COLOUR} = 'blue'; local $cap_options->{LOGIN_FORM}->{GREY_COLOUR} = 'blue'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/grey", "grey"); }; subtest 'grey II' => sub { plan tests => 1; local $cap_options->{LOGIN_FORM}->{LIGHT_COLOUR} = 'orange'; local $cap_options->{LOGIN_FORM}->{LIGHTER_COLOUR} = '15%'; local $cap_options->{LOGIN_FORM}->{DARK_COLOUR} = 'purple'; local $cap_options->{LOGIN_FORM}->{DARKER_COLOUR} = 'blue'; local $cap_options->{LOGIN_FORM}->{GREY_COLOUR} = '0'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/grey2", "grey"); }; sub make_output_timeless { my $output = shift; $output =~ s/^(Set-Cookie: CAPAUTH_DATA=\w+\%3D\%3D\; path=\/\; expires=\w{3},\s\d{2}\-\w{3}\-\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Set-Cookie: CAPAUTH_DATA=; path=\/; expires=;$2/m; $output =~ s/^(Expires:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Expires$2/m; $output =~ s/^(Date:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Date$2/m; #$output =~ s/\r//g; return $output; } 40_encoder_uc.t000444001750001750 61311563746137 24406 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More tests => 4; BEGIN { use_ok('CGI::Application::Plugin::Authentication::Driver::Filter::uc') }; use strict; use warnings; my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::uc'; is($class->filter(undef, 'abc'), 'ABC', "filter"); ok($class->check(undef, 'abc', 'ABC'), "check passes"); ok(!$class->check(undef, 'xxx', 'ABC'), "check fails"); 61_store_cookie_noexpiry.t000444001750001750 1012311563746137 26762 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); use Readonly; Readonly my $SECRET_WARN => qr/using default SECRET\! Please provide a proper SECRET when using the Cookie store/; use Test::NoWarnings; use CGI::Util; use Test::More; plan tests => 21; { package TestAppStoreCookie; use Test::More; use Test::Warn; use base qw(TestAppStore); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Cookie'], CREDENTIALS => [qw(auth_username auth_password)], ); sub get_store_entries { my $class = shift; my $cgiapp = shift; my $results = shift; my ($capauth_data, $therest) = $results =~ qr/^Set\-Cookie:\s+CAPAUTH_DATA=([\d\w%]+);(.*)$/m; return undef unless $capauth_data; main::unlike($therest, qr/expires=/, 'Expiry on the cookie is not set'); my $data = CGI::Util::unescape($capauth_data); return $data ? $cgiapp->authen->store->_decode($data) : undef; } sub maintain_state { my $class = shift; my $old_cgiapp = shift; my $old_results = shift; my $new_query = shift; delete $ENV{'COOKIE'}; $old_results =~ qr/Set\-Cookie:\s+(CAPAUTH_DATA=[\d\w%]+);/; $ENV{'COOKIE'} = $1 if $1; } sub clear_state { my $class = shift; delete $ENV{'COOKIE'}; $class->SUPER::clear_state(@_); } sub run_store_tests { my $class = shift; my ( $cgiapp, $results, $store_entries ); # Regular call to unprotected page shouldn't create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'unprotected' } ); ok(!$store_entries, "Store entry not created when calling unprotected page" ); # Regular call to protected page (without a valid login) shouldn't create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected' } ); ok(!$store_entries, "Store entry not created when calling protected page without valid login" ); # Regular call to protected page (with an invalid login) should create a store entry marking login attempts warnings_like { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => 'badpassword' } ); } [$SECRET_WARN, $SECRET_WARN], 'bad SECRET warning'; ok(!$cgiapp->authen->is_authenticated,'failed login attempt'); ok($store_entries, "Store entry created when calling protected page with invalid login" ); isnt($store_entries->{username}, 'test', "Store entry contained the right username" ); is($store_entries->{login_attempts}, 1, "Store entry contained the right value for login_attempts" ); # Regular call to protected page (with an invalid login) should create a store entry marking login attempts warnings_like { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => 'badpassword' } ); } [$SECRET_WARN, $SECRET_WARN, $SECRET_WARN], 'bad SECRET warning'; ok(!$cgiapp->authen->is_authenticated,'failed login attempt'); ok($store_entries, "Store entry created when calling protected page with invalid login" ); isnt($store_entries->{username}, 'test', "Store entry contained the right username" ); is($store_entries->{login_attempts}, 2, "Store entry contained the right value for login_attempts" ); # Regular call to protected page (with a valid login) should create a store entry warnings_like { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => '123' } ); } [$SECRET_WARN, $SECRET_WARN, $SECRET_WARN], 'bad SECRET warning'; ok($cgiapp->authen->is_authenticated,'successful login'); ok($store_entries, "Store entry created when calling protected page with valid login" ); is($store_entries->{username}, 'test', "Store entry contained the right username" ); ok(!$store_entries->{login_attempts}, "Store entry cleared login_attempts" ); } } TestAppStoreCookie->run_store_tests; 53_driver_dbi.t000444001750001750 2313511563746137 24461 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use lib qw(t); eval "use DBD::SQLite"; plan skip_all => "DBD::SQLite required for this test" if $@; plan tests => 90; use strict; use warnings; our $DBNAME = 't/sqlite.db'; unlink $DBNAME if -e $DBNAME; my $dbh = DBI->connect( "dbi:SQLite:dbname=$DBNAME", "", "" ); $dbh->do(<<""); CREATE TABLE user ( name VARCHAR(20), password VARCHAR(50) ) $dbh->do(<<""); INSERT INTO user VALUES ('user1', '123'); $dbh->do(<<""); INSERT INTO user VALUES ('user2', 'mQPVY1HNg8SJ2'); # crypt("123", "mQ") { package TestAppDriverDBISimple; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ [ 'DBI', DBH => $dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__' }, ], [ 'DBI', DBH => $dbh, TABLES => 'user', COLUMNS => { 'crypt:user.password' => '__CREDENTIAL_2__' }, CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__' }, ], ], STORE => 'Store::Dummy', ); } TestAppDriverDBISimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '123' ], ); $dbh->do(<<""); DROP TABLE user; # # MULTIPLE TABLES # $dbh->do(<<""); CREATE TABLE domain ( id INTEGER, name VARCHAR(20) ); $dbh->do(<<""); CREATE TABLE user ( id INTEGER, domainid INTEGER, name VARCHAR(20), password VARCHAR(50) ) $dbh->do(<<""); INSERT INTO domain VALUES (1, 'domain1'); $dbh->do(<<""); INSERT INTO domain VALUES (2, 'domain2'); $dbh->do(<<""); INSERT INTO user VALUES (1, 1, 'user1', '123'); $dbh->do(<<""); INSERT INTO user VALUES (2, 2, 'user1', '234'); $dbh->do(<<""); INSERT INTO user VALUES (3, 1, 'user2', '345'); $dbh->do(<<""); INSERT INTO user VALUES (4, 1, 'user3', 'mQPVY1HNg8SJ2'); # crypt("123", "mQ") { package TestAppDriverDBIMultiTable; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ [ 'DBI', DBH => $dbh, TABLES => [ 'user', 'domain' ], JOIN_ON => 'user.domainid = domain.id', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__', 'domain.name' => '__CREDENTIAL_3__' } ], [ 'DBI', DBH => $dbh, TABLES => [ 'user', 'domain' ], JOIN_ON => 'user.domainid = domain.id', COLUMNS => { 'user.password' => '__CREDENTIAL_3__', 'domain.name' => '__CREDENTIAL_2__' }, CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__' } ], ], STORE => 'Store::Dummy', CREDENTIALS => [qw(username password domain)], ); } TestAppDriverDBIMultiTable->run_authen_tests( [ 'username', 'password', 'domain' ], [ 'user1', '123', 'domain1' ], [ 'user1', '234', 'domain2' ], [ 'user1', 'domain1', '123' ], [ 'user1', 'domain2', '234' ], ); $dbh->do(<<""); DROP TABLE domain; $dbh->do(<<""); DROP TABLE user; # # ENCODED FIELDS # $dbh->do(<<""); CREATE TABLE user ( name VARCHAR(20), password VARCHAR(50) ) $dbh->do(<<""); INSERT INTO user VALUES ('user1', 'mQPVY1HNg8SJ2'); # crypt("123", "mQ") $dbh->do(<<""); INSERT INTO user VALUES ('user2', '202cb962ac59075b964b07152d234b70'); # md5_hex("123") { package TestAppDriverDBIEncode; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ [ 'DBI', DBH => $dbh, TABLE => 'user', COLUMNS => { 'crypt:password' => '__CREDENTIAL_2__' }, CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__' } ], [ 'DBI', DBH => $dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'MD5:password' => '__CREDENTIAL_2__' } ], ], STORE => 'Store::Dummy', CREDENTIALS => [qw(username password)], ); } TestAppDriverDBIEncode->run_authen_tests( [ 'username', 'password' ], [ 'user1', '123' ], [ 'user2', '123' ], ); $dbh->do(<<""); DROP TABLE user; # # ENCODED FIELDS # $dbh->do(<<""); CREATE TABLE user ( name VARCHAR(20), password VARCHAR(50), active INTEGER ) $dbh->do(<<""); INSERT INTO user VALUES ('user1', '123', 1); $dbh->do(<<""); INSERT INTO user VALUES ('user2', '123', 0); { package TestAppDriverDBIEncode; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'DBI', DBH => $dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__', 'active' => '1' }, ], STORE => 'Store::Dummy', CREDENTIALS => [qw(username password)], ); } TestAppDriverDBIEncode->run_authen_tests( [ 'username', 'password' ], [ 'user1', '123' ], ); TestAppDriverDBIEncode->run_authen_failure_tests( [ 'username', 'password' ], [ 'user2', '123' ], ); $dbh->do(<<""); DROP TABLE user; # # ORDER BY # $dbh->do(<<""); CREATE TABLE user ( id INTEGER, name VARCHAR(20), password VARCHAR(50), created TIMESTAMP ) $dbh->do(<<""); INSERT INTO user VALUES (1, 'user1', '123', '2009-01-01'); $dbh->do(<<""); INSERT INTO user VALUES (2, 'user2', '123', '2009-01-01'); $dbh->do(<<""); INSERT INTO user VALUES (3, 'user1', '321', '2009-01-02'); $dbh->do(<<""); INSERT INTO user VALUES (4, 'user2', '321', '2009-01-02'); { package TestAppDriverDBIEncode; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'DBI', DBH => $dbh, TABLE => 'user', COLUMNS => { 'user.password' => '__CREDENTIAL_2__' }, CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', }, ORDER_BY => 'created DESC', LIMIT => 1, ], STORE => 'Store::Dummy', CREDENTIALS => [qw(username password)], ); } TestAppDriverDBIEncode->run_authen_tests( [ 'username', 'password' ], [ 'user1', '321' ], [ 'user2', '321' ], ); TestAppDriverDBIEncode->run_authen_failure_tests( [ 'username', 'password' ], [ 'user1', '123' ], [ 'user2', '123' ], ); $dbh->do(<<""); DROP TABLE user; # # ALL TOGETHER # $dbh->do(<<""); CREATE TABLE user ( id INTEGER, name VARCHAR(20), password VARCHAR(50) ) $dbh->do(<<""); CREATE TABLE dailycode ( id INTEGER, userid INTEGER, date DATE DEFAULT 'CURRENT_DATE', code VARCHAR(20) ); $dbh->do(<<""); INSERT INTO user VALUES (1, 'user1', 'mQPVY1HNg8SJ2'); # crypt("123", "mQ") $dbh->do(<<""); INSERT INTO user VALUES (2, 'user2', 'mQPVY1HNg8SJ2'); # crypt("123", "mQ") $dbh->do(<<""); INSERT INTO dailycode VALUES (1, 1, 'CURRENT_DATE', '202CB962AC59075B964B07152D234B70'); # uc(md5_hex("123")) $dbh->do(<<""); INSERT INTO dailycode VALUES (2, 2, '2000-01-01', '202CB962AC59075B964B07152D234B70'); # uc(md5_hex("123")) { package TestAppDriverDBIEncode; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'DBI', DBH => $dbh, TABLES => ['user U', 'dailycode D'], JOIN_ON => 'U.id = D.userid', COLUMNS => { 'crypt:U.password' => '__CREDENTIAL_2__' }, CONSTRAINTS => { 'U.name' => '__CREDENTIAL_1__', 'uc:MD5_hex:D.code' => '__CREDENTIAL_3__', 'D.date' => 'CURRENT_DATE' }, ], STORE => 'Store::Dummy', CREDENTIALS => [qw(username password dailycode)], ); } TestAppDriverDBIEncode->run_authen_tests( [ 'username', 'password', 'dailycode' ], [ 'user1', '123', '123' ], ); TestAppDriverDBIEncode->run_authen_failure_tests( [ 'username', 'password', 'dailycode' ], [ 'user1', '123', 'xxx' ], [ 'user1', 'xxx', '123' ], [ 'user2', '123', '123' ], ); $dbh->do(<<""); DROP TABLE user; $dbh->do(<<""); DROP TABLE dailycode; $dbh->do(<<""); CREATE TABLE user ( name VARCHAR(20), password VARCHAR(50) ) $dbh->do(<<""); INSERT INTO user VALUES ('user1', '123'); SKIP: { eval "use DBI;"; skip "DBI not available", 6 if $@; { package TestAppDriverDBIDBH; use base qw(TestAppDriver); use Test::More; eval "use CGI::Application::Plugin::DBH (qw/dbh dbh_config/);"; skip "CGI::Application::Plugin::DBH not available", 6 if $@; sub cgiapp_init { my $self = shift; $self->dbh_config($dbh); $self->authen->config( DRIVER => [ 'DBI', TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__' }, ], STORE => 'Store::Dummy', CREDENTIALS => [qw(authen_username authen_password)], ); } } TestAppDriverDBIDBH->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], ); } $dbh->do(<<""); DROP TABLE user; undef $dbh; unlink $DBNAME if -e $DBNAME; 07_protected_runmodes.t000444001750001750 531411563746137 26233 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -wT use Test::More; plan tests => 22; use strict; use warnings; use CGI (); { package TestAppProtectedRunmodes; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], STORE => 'Store::Dummy', ); } $ENV{CGI_APP_RETURN_ONLY} = 1; my $cgiapp = TestAppProtectedRunmodes->new; my $authen = $cgiapp->authen; ok($authen->protected_runmodes(qw(one)), 'we can register protected runmodes'); is_deeply( [$authen->protected_runmodes], [ 'one' ], 'verify that runmode is registered correctly' ); ok($authen->protected_runmodes(qw(two three)), 'we can register multiple protected runmodes'); is_deeply( [$authen->protected_runmodes], [ qw(one two three) ], 'verify that runmodes are cummulative' ); ok($authen->protected_runmodes(qr/^auth_/), 'we can register protected runmodes as a regexp'); is_deeply( [$authen->protected_runmodes], [ qw(one two three), qr/^auth_/ ], 'verify that this test was added' ); my $sub = sub { $_[0] eq 'sub' ? 1 : 0 }; ok($authen->protected_runmodes($sub), 'we can register protected runmodes as a subroutine reference'); is_deeply( [$authen->protected_runmodes], [ qw(one two three), qr/^auth_/, $sub ], 'verify that this test was added' ); # test valid runmodes ok($authen->is_protected_runmode('one'), "Test 'is_protected_runmode' with valid string"); ok($authen->is_protected_runmode('two'), "Test 'is_protected_runmode' with valid string"); ok($authen->is_protected_runmode('three'), "Test 'is_protected_runmode' with valid string"); ok($authen->is_protected_runmode('auth_test'), "Test 'is_protected_runmode' with valid regexp test string"); ok($authen->is_protected_runmode('sub'), "Test 'is_protected_runmode' with valid subroutine test string"); # test invalid runmodes ok(!$authen->is_protected_runmode('notone'), "Test 'is_protected_runmode' with invalid value"); ok(!$authen->is_protected_runmode('authtest'), "Test 'is_protected_runmode' with invalid value"); ok(!$authen->is_protected_runmode('subtest'), "Test 'is_protected_runmode' with invalid value"); ok(!$authen->is_protected_runmode(''), "Test 'is_protected_runmode' with empty string value"); ok(!$authen->is_protected_runmode( [] ), "Test 'is_protected_runmode' with invalid value (arrayref)"); ok(!$authen->is_protected_runmode( {} ), "Test 'is_protected_runmode' with invalid value (arrayref)"); ok($authen->protected_runmodes(':all'), 'we can mark all runmodes as protected'); is_deeply( [$authen->protected_runmodes], [ qw(one two three), qr/^auth_/, $sub, ':all' ], 'verify that this test was added' ); ok($authen->is_protected_runmode('anything_goes'), "Test 'is_protected_runmode' with any string"); 06_timeout.t000444001750001750 1034511563746137 24033 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More tests => 13; use strict; use warnings; use lib qw(t); use CGI (); our %STORE; { package TestAppTimeout; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user => '123' } ], STORE => [ 'Store::Dummy', \%STORE ], LOGIN_SESSION_TIMEOUT => { IDLE_FOR => '30', EVERY => '30', CUSTOM => sub { 0 }, }, ); sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two)]); $self->authen->protected_runmodes(qw(two)); } sub one { my $self = shift; } sub two { my $self = shift; } } $ENV{CGI_APP_RETURN_ONLY} = 1; my ($now, $query, $cgiapp, $results); diag('The following tests have some small time delays'); $query = CGI->new( { authen_username => 'user', authen_password => '123', rm => 'two' } ); $cgiapp = TestAppTimeout->new( QUERY => $query ); $results = $cgiapp->run; ok( $cgiapp->authen->is_authenticated,'successful login' ); is( $cgiapp->authen->username, 'user', 'username set' ); is( $STORE{username}, 'user', 'username set in store' ); $now = time(); ok( $STORE{last_access} <= $now && $STORE{last_access} >= $now - 5, 'last access looks reasonable' ); ok( $STORE{last_login} <= $now && $STORE{last_login} >= $now - 5, 'last login looks reasonable' ); # Sleep so we know if the last_access time is updated select(undef, undef, undef, 1.1); $query = CGI->new( { rm => 'two' } ); $cgiapp = TestAppTimeout->new( QUERY => $query ); $results = $cgiapp->run; ok( $STORE{last_access} > $STORE{last_login}, 'last access updated on next request' ); # If we log out, make sure it is not marked as caused by a timeout ok ($cgiapp->authen->logout, "Logout manually"); ok( !$cgiapp->authen->is_authenticated, 'user logged out' ); ok( !$cgiapp->authen->is_login_timeout, 'logout not caused by timeout' ); { package TestAppTimeoutIDLE_FOR; use base qw(TestAppTimeout); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user => '123' } ], STORE => [ 'Store::Dummy', \%STORE ], LOGIN_SESSION_TIMEOUT => { IDLE_FOR => '1', }, ); } # login again $query = CGI->new( { authen_username => 'user', authen_password => '123', rm => 'two' } ); $cgiapp = TestAppTimeout->new( QUERY => $query ); $results = $cgiapp->run; # Sleep so we have enough idle time select(undef, undef, undef, 1.1); $query = CGI->new( { rm => 'two' } ); $cgiapp = TestAppTimeoutIDLE_FOR->new( QUERY => $query ); $results = $cgiapp->run; ok( !$cgiapp->authen->is_authenticated, 'IDLE_FOR idle time exceeded so user logged out' ); ok( $cgiapp->authen->is_login_timeout, 'logout caused by timeout' ); { package TestAppTimeoutEVERY; use base qw(TestAppTimeout); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user => '123' } ], STORE => [ 'Store::Dummy', \%STORE ], LOGIN_SESSION_TIMEOUT => { EVERY => '1', }, ); } # login again $query = CGI->new( { authen_username => 'user', authen_password => '123', rm => 'two' } ); $cgiapp = TestAppTimeoutEVERY->new( QUERY => $query ); $results = $cgiapp->run; # Sleep so we have enough idle time select(undef, undef, undef, 1.1); $query = CGI->new( { rm => 'two' } ); $cgiapp = TestAppTimeoutEVERY->new( QUERY => $query ); $results = $cgiapp->run; ok( !$cgiapp->authen->is_authenticated, 'EVERY idle time exceeded so user logged out' ); { package TestAppTimeoutCUSTOM; use base qw(TestAppTimeout); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user => '123' } ], STORE => [ 'Store::Dummy', \%STORE ], LOGIN_SESSION_TIMEOUT => { CUSTOM => sub { 1 }, }, ); } # login again $query = CGI->new( { authen_username => 'user', authen_password => '123', rm => 'two' } ); $cgiapp = TestAppTimeoutCUSTOM->new( QUERY => $query ); $results = $cgiapp->run; # no need to sleep here $query = CGI->new( { rm => 'two' } ); $cgiapp = TestAppTimeoutCUSTOM->new( QUERY => $query ); $results = $cgiapp->run; ok( !$cgiapp->authen->is_authenticated, 'CUSTOM idle time exceeded so user logged out' ); 02_config.t000444001750001750 3071111563746137 23605 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More tests => 69; use Test::Exception; use Test::Warn; use Scalar::Util; use CGI; use strict; use warnings; use lib qw(t); ############################################################################### # FAKE our own versions of these methods; newer Perls fail when we use the # versions from Test::Exception, throwing "Bizarre copy of HASH in sassign...". #sub lives_ok(&;$) { # my ($coderef, $name) = @_; # local $Test::Builder::Level = $Test::Builder::Level + 1; # my $rc = eval { $coderef->() }; # ok !$@, $name; #} #sub throws_ok(&$;$) { # my ($coderef, $expecting, $name) = @_; # local $Test::Builder::Level = $Test::Builder::Level + 1; # my $rc = eval { $coderef->() }; # like $@, $expecting, $name; #} # END FAKE ############################################################################### { package TestAppConfig; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; } my %config = ( DRIVER => [ 'Generic', { user1 => '123', user2 => '123'} ], STORE => 'Store::Dummy', LOGIN_RUNMODE => 'login', LOGOUT_RUNMODE => 'logout', POST_LOGIN_RUNMODE => 'start', CREDENTIALS => ['authen_username', 'authen_password'], LOGIN_SESSION_TIMEOUT => '1h', ); my $cgiapp=TestAppConfig->new; lives_ok { $cgiapp->authen->config(%config) } 'All config parameters accepted'; is_deeply( $cgiapp->authen->credentials,[qw/authen_username authen_password/],'credentials set'); isa_ok($cgiapp->authen->drivers,'CGI::Application::Plugin::Authentication::Driver::Generic'); isa_ok($cgiapp->authen->store,'Store::Dummy'); %config = ( DRIVER => [ 'HTPassword', file => 't/htpasswd' ], STORE => 'Store::Dummy', LOGIN_URL => '/login.cgi', LOGOUT_URL => '/', POST_LOGIN_URL => '/protected/', CREDENTIALS => ['authen_username', 'authen_password'], LOGIN_SESSION_TIMEOUT => '1h', ); lives_ok { TestAppConfig->new->authen->config(%config) } 'All config parameters accepted'; # test DRIVER throws_ok { TestAppConfig->new->authen->config(DRIVER => { }) } qr/parameter DRIVER is not a string or arrayref/, 'config dies when DRIVER is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(DRIVER => 'MODULE' ) } 'config accepts single DRIVER without options'; lives_ok { TestAppConfig->new->authen->config(DRIVER => [ 'MODULE', option => 'parameter' ] ) } 'config accepts single DRIVER with options'; lives_ok { TestAppConfig->new->authen->config(DRIVER => [ [ 'MODULE', option => 'parameter' ], [ 'MODULE', option => 'parameter' ] ] ) } 'config accepts multiple DRIVERs'; # test STORE throws_ok { TestAppConfig->new->authen->config(STORE => { }) } qr/parameter STORE is not a string or arrayref/, 'config dies when STORE is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(STORE => 'MODULE' ) } 'config accepts STORE without options'; lives_ok { TestAppConfig->new->authen->config(STORE => [ 'MODULE', option => 'parameter' ] ) } 'config accepts STORE with options'; # test LOGIN_RUNMODE throws_ok { TestAppConfig->new->authen->config(LOGIN_RUNMODE => { }) } qr/parameter LOGIN_RUNMODE is not a string/, 'config dies when LOGIN_RUNMODE is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(LOGIN_RUNMODE => 'runmode' ) } 'config accepts LOGIN_RUNMODE as a string'; # test LOGIN_URL throws_ok { TestAppConfig->new->authen->config(LOGIN_URL => { }) } qr/parameter LOGIN_URL is not a string/, 'config dies when LOGIN_URL is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(LOGIN_URL => '/' ) } 'config accepts LOGIN_URL as a string'; warning_like { TestAppConfig->new->authen->config(LOGIN_URL => '/', LOGIN_RUNMODE => 'runmode' ) } qr/authen config warning: parameter LOGIN_URL ignored since we already have LOGIN_RUNMODE/, "LOGIN_URL ignored when LOGIN_RUNMODE is configured"; # test LOGOUT_RUNMODE throws_ok { TestAppConfig->new->authen->config(LOGOUT_RUNMODE => { }) } qr/parameter LOGOUT_RUNMODE is not a string/, 'config dies when LOGOUT_RUNMODE is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(LOGOUT_RUNMODE => 'runmode' ) } 'config accepts LOGOUT_RUNMODE as a string'; # test LOGOUT_URL throws_ok { TestAppConfig->new->authen->config(LOGOUT_URL => { }) } qr/parameter LOGOUT_URL is not a string/, 'config dies when LOGOUT_URL is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(LOGOUT_URL => '/' ) } 'config accepts LOGOUT_URL as a string'; warning_like { TestAppConfig->new->authen->config(LOGOUT_URL => '/', LOGOUT_RUNMODE => 'runmode' ) } qr/authen config warning: parameter LOGOUT_URL ignored since we already have LOGOUT_RUNMODE/, "LOGOUT_URL ignored when LOGOUT_RUNMODE is configured"; # test POST_LOGIN_RUNMODE throws_ok { TestAppConfig->new->authen->config(POST_LOGIN_RUNMODE => { }) } qr/parameter POST_LOGIN_RUNMODE is not a string/, 'config dies when POST_LOGIN_RUNMODE is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(POST_LOGIN_RUNMODE => 'runmode' ) } 'config accepts POST_LOGIN_RUNMODE as a string'; # test POST_LOGIN_URL throws_ok { TestAppConfig->new->authen->config(POST_LOGIN_URL => { }) } qr/parameter POST_LOGIN_URL is not a string/, 'config dies when POST_LOGIN_URL is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(POST_LOGIN_URL => '/' ) } 'config accepts POST_LOGIN_URL as a string'; warning_like { TestAppConfig->new->authen->config(POST_LOGIN_URL => '/', POST_LOGIN_RUNMODE => 'runmode' ) } qr/authen config warning: parameter POST_LOGIN_URL ignored since we already have POST_LOGIN_RUNMODE/, "POST_LOGIN_UR_URL ignored when POST_LOGIN_RUNMODE is configured"; # test POST_LOGIN_CALLBACK throws_ok { TestAppConfig->new->authen->config(POST_LOGIN_CALLBACK => { }) } qr/parameter POST_LOGIN_CALLBACK is not a coderef/, 'config dies when POST_LOGIN_CALLBACK is passed a hashref'; throws_ok { TestAppConfig->new->authen->config(POST_LOGIN_CALLBACK => ' ') } qr/parameter POST_LOGIN_CALLBACK is not a coderef/, 'config dies when POST_LOGIN_CALLBACK is passed a string'; lives_ok { TestAppConfig->new->authen->config(POST_LOGIN_CALLBACK => sub { } ) } 'config accepts POST_LOGIN_CALLBACK as a coderef'; # test RENDER_LOGIN throws_ok { TestAppConfig->new->authen->config(RENDER_LOGIN => { }) } qr/parameter RENDER_LOGIN is not a coderef/, 'config dies when RENDER_LOGIN is passed a hashref'; throws_ok { TestAppConfig->new->authen->config(RENDER_LOGIN => ' ') } qr/parameter RENDER_LOGIN is not a coderef/, 'config dies when RENDER_LOGIN is passed a string'; lives_ok { TestAppConfig->new->authen->config(RENDER_LOGIN => sub { } ) } 'config accepts RENDER_LOGIN as a coderef'; # test LOGIN_FORM throws_ok { TestAppConfig->new->authen->config(LOGIN_FORM => ' ') } qr/parameter LOGIN_FORM is not a hashref/, 'config dies when LOGIN_FORM is passed a string'; lives_ok { TestAppConfig->new->authen->config(LOGIN_FORM => { }) } 'config accepts LOGIN_FORM as a hashref'; # test CREDENTIALS throws_ok { TestAppConfig->new->authen->config(CREDENTIALS => { }) } qr/parameter CREDENTIALS is not a string/, 'config dies when CREDENTIALS is passed a hashref'; lives_ok { TestAppConfig->new->authen->config(CREDENTIALS => 'authen_username' ) } 'config accepts CREDENTIALS as a string'; lives_ok { TestAppConfig->new->authen->config(CREDENTIALS => ['authen_username', 'authen_password'] ) } 'config accepts CREDENTIALS as an arrayref'; # test LOGIN_SESSION_TIMEOUT lives_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => '5h' ) } 'config accepts LOGIN_SESSION_TIMEOUT as a string'; lives_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { IDLE_FOR => 1 } ) } 'config accepts LOGIN_SESSION_TIMEOUT with IDLE_FOR option'; lives_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { EVERY => 1 } ) } 'config accepts LOGIN_SESSION_TIMEOUT with EVERY option'; lives_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { CUSTOM => sub { 1 } } ) } 'config accepts LOGIN_SESSION_TIMEOUT with CUSTOM option'; lives_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { IDLE_FOR => 1, EVERY => 1, CUSTOM => sub { 1 } } ) } 'config accepts LOGIN_SESSION_TIMEOUT as a hashref'; throws_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => [ ]) } qr/parameter LOGIN_SESSION_TIMEOUT is not a string or a hashref/, 'config dies when LOGIN_SESSION_TIMEOUT is passed a hashref'; throws_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => '5dodgy' ) } qr/parameter LOGIN_SESSION_TIMEOUT is not a valid time string/, 'config dies when LOGIN_SESSION_TIMEOUT recieves an unparsable string'; throws_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { IDLE_FOR => '5dodgy' } ) } qr/IDLE_FOR option to LOGIN_SESSION_TIMEOUT is not a valid time string/, 'config dies when LOGIN_SESSION_TIMEOUT IDLE_FOR recieves an unparsable string'; throws_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { EVERY => '5dodgy' } ) } qr/EVERY option to LOGIN_SESSION_TIMEOUT is not a valid time string/, 'config dies when LOGIN_SESSION_TIMEOUT EVERY recieves an unparsable string'; throws_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { CUSTOM => 'notasub' } ) } qr/CUSTOM option to LOGIN_SESSION_TIMEOUT must be a code reference/, 'config dies when LOGIN_SESSION_TIMEOUT CUSTOM receives something other than a coderef'; throws_ok { TestAppConfig->new->authen->config(LOGIN_SESSION_TIMEOUT => { BADOPTION => 1 } ) } qr/Invalid option\(s\) \(BADOPTION\) passed to LOGIN_SESSION_TIMEOUT/, 'config dies when LOGIN_SESSION_TIMEOUT recieves an unparsable string'; # authen->config as a class method lives_ok { TestAppConfig->authen->config(%config) } 'config can be called as a class method'; # authen->config as a class method with hashref lives_ok { TestAppConfig->authen->config(\%config) } 'config can be called with a hashref or hash'; # authen->config with no parameters lives_ok { TestAppConfig->authen->config() } 'current configuration returned'; # authen->config dies when passed an invalid parameter throws_ok { TestAppConfig->new->authen->config(BAD_PARAM => 'foobar' ) } qr/Invalid option\(s\)/, 'config dies when passed an invalid parameter'; # authen->config dies when it is called after the plugin has been initialized my $app = TestAppConfig->new; my $authen = $app->authen; $authen->config( \%config ); $authen->initialize; throws_ok { $authen->config( \%config ) } qr/Calling config after the Authentication object has already been initialized/, 'config dies when called after initialization with new configuration info'; # test _time_to_seconds is(CGI::Application::Plugin::Authentication::_time_to_seconds('10'), 10, "_time_to_seconds works with number only"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10s'), 10, "_time_to_seconds works with seconds"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10m'), 600, "_time_to_seconds works with minutes"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10h'), 36000, "_time_to_seconds works with hours"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10d'), 864000, "_time_to_seconds works with days"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10w'), 6048000, "_time_to_seconds works with weeks"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10M'), 25920000, "_time_to_seconds works with months"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('10y'), 315360000, "_time_to_seconds works with years"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('.5m'), 30, "_time_to_seconds works with decimal values"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('0.5m'), 30, "_time_to_seconds works with decimal values"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('1.5m'), 90, "_time_to_seconds works with decimal values"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('1.m'), 60, "_time_to_seconds works with decimal values"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('1.0m'), 60, "_time_to_seconds works with decimal values"); is(CGI::Application::Plugin::Authentication::_time_to_seconds((1 / 7).'m'), 8, "_time_to_seconds works with decimal value that wouldn't result in an integer offset"); is(CGI::Application::Plugin::Authentication::_time_to_seconds('.5'), undef, "_time_to_seconds fails with decimal values and no modifier"); TODO: { local $TODO = "TestAppConfig->new->authen->config not finished"; } 03_destination.t000444001750001750 2175211563746137 24667 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; use Test::Taint; use Test::Regression; use Test::Warn; use English qw(-no_match_vars); use strict; use warnings; if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; exit(0); } plan tests => 11; use strict; use warnings; taint_checking_ok('taint checking is on'); use CGI (); my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_CALLBACK => \&TestAppAuthenticate::post_login, }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two three)]); $self->authen->protected_runmodes(qw(two three)); $self->authen->config($cap_options); } sub one { my $self = shift; return "ONE"; } sub two { my $self = shift; return "TWO"; } sub three { my $self = shift; return "THREE"; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; # successful login subtest 'straightforward use of destination parameter' => sub { plan tests => 5; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password=>'123', destination=>'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/redirect", "redirection"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); }; subtest 'redirection including CRLF' => sub { plan tests => 5; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password=>'123', destination=>'http://news.bbc.co.uk\r\nLocation: blah' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/crlf", "crlf"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); }; subtest 'redirection with constraining taint check' => sub { plan tests => 5; local $cap_options->{DETAINT_URL_REGEXP} = '^(http\:\/\/www\.perl.org\/[\w\_\%\?\&\;\-\/\@\.\+\$\=\#\:\!\*\"\'\(\)\,]+)$'; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password=>'123', destination=>'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/restricted", "restricted"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); }; subtest 'user name failing taint check' => sub { plan tests => 5; local $cap_options->{DETAINT_USERNAME_REGEXP} = '^([A-Z]+)$'; my $query = CGI->new( { authen_username => 'user1', rm => 'two', destination=>'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/username", "username"); ok(!$cgiapp->authen->is_authenticated,'login failure'); is( $cgiapp->authen->username, undef, "login failure - username not set" ); is( $cgiapp->authen->login_attempts, 1, "failed login - failed login count" ); is( $cgiapp->param('post_login'),1,'failed login - POST_LOGIN_CALLBACK executed' ); }; subtest 'user name failing taint check - basic' => sub { plan tests => 5; local $cap_options->{LOGIN_FORM}->{DISPLAY_CLASS} = 'Basic'; local $cap_options->{DETAINT_USERNAME_REGEXP} = '^([A-Z]+)$'; my $query = CGI->new( { authen_username => 'user1', rm => 'two', destination=>'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/username-basic", "username basic"); ok(!$cgiapp->authen->is_authenticated,'login failure'); is( $cgiapp->authen->username, undef, "login failure - username not set" ); is( $cgiapp->authen->login_attempts, 1, "failed login - failed login count" ); is( $cgiapp->param('post_login'),1,'failed login - POST_LOGIN_CALLBACK executed' ); }; subtest 'POST_LOGIN_URL usage' => sub { plan tests => 5; local $cap_options->{POST_LOGIN_URL} = 'http://www.perl.org'; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password=>'123', destination=>'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/loginurl", "loginurl"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); }; subtest 'POST_LOGIN_RUNMODE usage' => sub { plan tests => 6; local $cap_options->{POST_LOGIN_RUNMODE} = 'three'; local $cap_options->{POST_LOGIN_URL} = 'http://www.perl.org'; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password=>'123', destination=>'http://news.bbc.co.uk' } ); my $cgiapp; warning_is {$cgiapp = TestAppAuthenticate->new( QUERY => $query );} "authen config warning: parameter POST_LOGIN_URL ignored since we already have POST_LOGIN_RUNMODE", "checking generated warning"; ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/runmode", "runmode"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); }; subtest 'LOGOUT usage' => sub { plan tests => 2; local $cap_options->{POST_LOGIN_RUNMODE} = 'three'; local $cap_options->{POST_LOGIN_URL} = 'http://www.perl.org'; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password=>'123', authen_logout=>1, destination=>'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/logout", "logout"); ok(!$cgiapp->authen->is_authenticated,'logout success'); }; subtest 'Redirection failure' => sub { plan tests => 1; local $ENV{PATH_INFO} = '!!!!'; local $cap_options->{DETAINT_URL_REGEXP} = '^(\w+)$'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/redirection_failure", "redirection_failure"); }; subtest 'Redirection failure [Basic]' => sub { plan tests => 1; local $ENV{PATH_INFO} = '!!!!'; local $cap_options->{DETAINT_URL_REGEXP} = '^(\w+)$'; local $cap_options->{LOGIN_FORM}->{DISPLAY_CLASS} = 'Basic'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/redirection_failure_basic", "redirection_failure [Basic]"); }; sub make_output_timeless { my $output = shift; $output =~ s/^(Set-Cookie: CAPAUTH_DATA=\w+\%3D(?:\%3D)?\; path=\/\; expires=\w{3},\s\d{2}\-\w{3}\-\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Set-Cookie: CAPAUTH_DATA=; path=\/; expires=;$2/m; $output =~ s/^(Expires:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Expires$2/m; $output =~ s/^(Date:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Date$2/m; #$output =~ s/\r//g; return $output; } 60_parsimony.t000444001750001750 464511563746137 24354 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); # Test script to test the following scenario: # Once upon a time there was a perfectly good CGI::Application website with no need for authentication, sessions or cookies. # Then one day the wicked step-boss came in and said "We need to have a login screen, or else I'll # have to send you out into the big forest to fend for yourselves. Oh and if you change so much as a single # header on the existing web pages, I'll grind your bones for the shareholders' bread." # Well what is a poor programmer to do? She can use CGI::Application::Plugin::Authentication # but the unprotected pages never needed sessions or cookies so that must still be the case. # However as long as this test passes, they all live happily ever after. use Test::More; eval "use TestAppParsimony"; plan skip_all => "CGI::Application::Plugin::Session etc required for this test" if $@; plan tests => 6; $ENV{CGI_APP_RETURN_ONLY} = 1; sub response_like { my ($app, $header_re, $body_re, $comment) = @_; my $output = $app->run; my ($header, $body) = split /\r\n\r\n/m, $output; $header =~ s/\r\n/|/g; like($header, $header_re, "$comment (header match)"); is($body, $body_re, "$comment (body match)"); } { my $app = TestAppParsimony->new(); $app->query(CGI->new({'rm' => 'unprotected'})); response_like( $app, qr{^Content-Type: text/html; charset=ISO-8859-1$}, 'This is public.', 'TestAppParsimony, unprotected' ); } { my $app = TestAppParsimony->new(); $app->query(CGI->new({'rm' => 'protected',auth_username=>'test', auth_password=>'123'})); response_like( $app, qr{^Set-Cookie: CGISESSID=\w{1,100}; path=/|Date: \w{3}, \d{1,2} \w{3} \d{4} \d{2}:\d{2}:\d{2} \d{3}|Content-Type: text/html; charset=ISO-8859-1$}, 'This is private.', 'TestAppParsimony, protected' ); } { my $app = TestAppParsimony->new(); $app->query(CGI->new({'rm' => 'unprotected'})); response_like( $app, qr{^Content-Type: text/html; charset=ISO-8859-1$}, 'This is public.', 'TestAppParsimony, unprotected reprise' ); } 70_action_dispatch.t000444001750001750 667711563746137 25477 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -wT use Test::More; use Test::Taint; use Test::Regression; use English qw(-no_match_vars); use lib qw(t); BEGIN { use Test::More; eval {require CGI::Application::Plugin::ActionDispatch;}; if ($@) { my $msg = 'CGI::Application::Plugin::ActionDispatch required'; plan skip_all => $msg; } if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; } plan tests => 4; } use strict; use warnings; use CGI (); taint_checking_ok('taint checking is on'); my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_CALLBACK => \&TestAppAuthenticate::post_login, }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::ActionDispatch; use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->authen->protected_runmodes(qw(protected)); $self->authen->config($cap_options); } sub unprotected : Default { return "This is public"; } sub protected : Path('private') { return "This is private"; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; # front page subtest 'front page' => sub { plan tests => 2; my $query = CGI->new(); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/frontpage", "frontpage"); ok(!$cgiapp->authen->is_authenticated,'not authenticated'); }; # login intercepted subtest 'interception' => sub { plan tests => 3; local $ENV{PATH_INFO} = '/private'; my $query = CGI->new(); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/login", "login"); ok(!$cgiapp->authen->is_authenticated,'not authenticated'); ok( !defined($cgiapp->param('post_login')),'unsuccessful login' ); }; # successful login subtest 'successful login' => sub { plan tests => 5; local $ENV{PATH_INFO} = '/private'; my $query = CGI->new( { authen_username => 'user1', authen_password=>'123'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/success", "success"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); }; sub make_output_timeless { my $output = shift; $output =~ s/^(Set-Cookie: CAPAUTH_DATA=\w+\%3D\%3D\; path=\/\; expires=\w{3},\s\d{2}\-\w{3}\-\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Set-Cookie: CAPAUTH_DATA=; path=\/; expires=;$2/m; $output =~ s/^(Expires:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Expires$2/m; $output =~ s/^(Date:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Date$2/m; #$output =~ s/\r//g; return $output; } prereq.t000444001750001750 103111563746137 23306 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuse strict; use warnings; use Test::More; if ( not $ENV{TEST_PREREQ} ) { my $msg = 'Author test. Set $ENV{TEST_PREREQ} to a true value to run.'; plan( skip_all => $msg ); } eval { require Test::Prereq::Build; }; if ( $@) { my $msg = 'Test::Prereq required to criticise code'; plan( skip_all => $msg ); } Test::Prereq::Build::prereq_ok(undef, 'prereq', ['Params::Validate', 'Test::ConsistentVersion', 'Test::CheckManifest', 'Test::Spelling', 'Test::Prereq', 'Test::Prereq::Build', 'Color::Calc','Apache::Htpasswd']); TestAppParsimony.pm000444001750001750 136511563746137 25455 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tpackage TestAppParsimony; use strict; use warnings; use Carp; use base qw(CGI::Application); use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('unprotected'); #$self->mode_param('rm'); $self->run_modes( 'unprotected' => sub {return "This is public.";}, 'protected' => sub {return "This is private.";} ); $self->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Session' ], CREDENTIALS => [qw(auth_username auth_password)], ); $self->authen->protected_runmodes('protected'); } 1 99_pod_coverage.t000444001750001750 45611563746137 24760 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuse Test::More; if ( not $ENV{TEST_AUTHOR} ) { my $msg = 'Author test. Set $ENV{TEST_AUTHOR} to a true value to run.'; plan( skip_all => $msg ); } eval "use Test::Pod::Coverage 1.00"; plan skip_all => "Test::Pod::Coverage 1.00 required for testing POD coverage" if $@; all_pod_coverage_ok(); 80_devpopup.t000444001750001750 663411563746137 24177 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -wT use Test::More; use Test::Taint; use Test::Regression; use English qw(-no_match_vars); use lib qw(t); BEGIN { $ENV{CGI_APP_RETURN_ONLY} = 1; $ENV{CAP_DEVPOPUP_EXEC} = 1; use Test::More; eval {require CGI::Application::Plugin::DevPopup}; if ($@) { my $msg = 'CGI::Application::Plugin::DevPopup required'; plan skip_all => $msg; } if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; } if ($CGI::Application::Plugin::DevPopup::VERSION < 1.05) { my $msg = 'There are some odd test failures that MAY be due to old versions of DevPopup'; plan skip_all => $msg; } plan tests => 4; } use strict; use warnings; use CGI (); taint_checking_ok('taint checking is on'); my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_RUNMODE=>'protected', }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::DevPopup; use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->authen->protected_runmodes(qw(protected)); $self->authen->config($cap_options); $self->run_modes( protected=>'protected', unprotected=>'unprotected', ); $self->start_mode('unprotected'); } sub unprotected { return "This is public"; } sub protected { return "This is private"; } } # front page subtest 'front page' => sub { plan tests => 2; my $query = CGI->new(); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/frontpage-dev", "frontpage"); ok(!$cgiapp->authen->is_authenticated,'not authenticated'); }; # login intercepted subtest 'interception' => sub { plan tests => 2; local $ENV{PATH_INFO} = '/private'; my $query = CGI->new(); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/login-dev", "login"); ok(!$cgiapp->authen->is_authenticated,'not authenticated'); }; # successful login subtest 'successful login' => sub { plan tests => 4; local $ENV{PATH_INFO} = '/private'; my $query = CGI->new( { authen_username => 'user1', authen_password=>'123'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/success-dev", "success"); ok($cgiapp->authen->is_authenticated,'login success'); is( $cgiapp->authen->username, 'user1', "login success - username set" ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); }; sub make_output_timeless { my $output = shift; $output =~ s/^(Set-Cookie: CAPAUTH_DATA=\w+\%3D\%3D\; path=\/\; expires=\w{3},\s\d{2}\-\w{3}\-\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Set-Cookie: CAPAUTH_DATA=; path=\/; expires=;$2/m; $output =~ s/^(Expires:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Expires$2/m; $output =~ s/^(Date:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Date$2/m; #$output =~ s/\r//g; return $output; } 40_encoder_sha1.t000444001750001750 305111563746137 24652 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use strict; use warnings; use Digest::SHA; plan tests => 17; use_ok('CGI::Application::Plugin::Authentication::Driver::Filter::sha1'); my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::sha1'; # Test binary my $binary = Digest::SHA::sha1('123'); is($class->filter('binary', '123'), $binary, "filter"); ok($class->check('binary', '123', $binary), "check passes"); ok(!$class->check('binary', 'xxx', $binary), "check fails"); ok($class->check(undef, '123', $binary), "check passes"); ok(!$class->check(undef, 'xxx', $binary), "check fails"); # Test base64 is($class->filter('base64', '123'), 'QL0AFWMIX8NRZTKeof9cXsvbvu8', "filter"); ok($class->check('base64', '123', 'QL0AFWMIX8NRZTKeof9cXsvbvu8'), "check passes"); ok(!$class->check('base64', 'xxx', 'QL0AFWMIX8NRZTKeof9cXsvbvu8'), "check fails"); ok($class->check(undef, '123', 'QL0AFWMIX8NRZTKeof9cXsvbvu8'), "check passes"); ok(!$class->check(undef, 'xxx', 'QL0AFWMIX8NRZTKeof9cXsvbvu8'), "check fails"); # Test hex is($class->filter('hex', '123'), '40bd001563085fc35165329ea1ff5c5ecbdbbeef', "filter"); ok($class->check('hex', '123', '40bd001563085fc35165329ea1ff5c5ecbdbbeef'), "check passes"); ok(!$class->check('hex', 'xxx', '40bd001563085fc35165329ea1ff5c5ecbdbbeef'), "check fails"); is($class->filter(undef, '123'), '40bd001563085fc35165329ea1ff5c5ecbdbbeef', "filter"); ok($class->check(undef, '123', '40bd001563085fc35165329ea1ff5c5ecbdbbeef'), "check passes"); ok(!$class->check(undef, 'xxx', '40bd001563085fc35165329ea1ff5c5ecbdbbeef'), "check fails"); 61_cookie_badargs.t000444001750001750 170611563746137 25263 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); use CGI::Util; use Test::More; use Test::NoWarnings; plan tests => 2; { package TestAppStoreCookie; use Test::More; use Test::Exception; use base qw(TestAppStore); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Cookie', EXPIRY=>'+1y', 'YAH_BOO_SUCKS'], CREDENTIALS => [qw(auth_username auth_password)], ); sub run_store_tests { my $class = shift; my ( $cgiapp, $results, $store_entries ); # Regular call to unprotected page shouldn't create a store entry throws_ok { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'unprotected' } ); } qr/Error executing run mode 'unprotected': Invalid Store Configuration for the Cookie store - options section must contain a hash of values/, 'invalid args'; } } TestAppStoreCookie->run_store_tests; 03_login_box_basic.t000444001750001750 1326511563746137 25467 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; use Test::Taint; use Test::Regression; use Test::NoWarnings; use Test::Exception; use English qw(-no_match_vars); use lib qw(t); plan tests => 6; use strict; use warnings; use CGI (); taint_checking_ok('taint checking is on'); $ENV{CGI_APP_RETURN_ONLY} = 1; my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_CALLBACK => \&TestAppAuthenticate::post_login, LOGIN_FORM=>{ DISPLAY_CLASS=>'Basic', }, }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two)]); $self->authen->protected_runmodes(qw(two)); $self->authen->config($cap_options); } sub one { my $self = shift; } sub two { my $self = shift; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } subtest 'empty' => sub { plan tests => 14; my $cgiapp = TestAppAuthenticate->new; my $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,"login failure"); is( $cgiapp->authen->username, undef, "username not set" ); my $display = $cgiapp->authen->display; isa_ok($display, 'CGI::Application::Plugin::Authentication::Display'); isa_ok($display, 'CGI::Application::Plugin::Authentication::Display::Basic'); is($display->login_title, 'Sign In', 'title'); ok_regression(sub {return $display->login_box}, 't/out/basic_login_box', 'login box'); is($display->logout_form, '', 'logout_form'); is($display->is_authenticated, 0, 'is_authenticated'); is($display->username, undef, 'username'); is($display->last_login, undef, 'last_login'); is($display->last_access, undef, 'last_access'); is($display->is_login_timeout, 0, 'is_login_timeout'); is($display->login_attempts, undef, 'login_attempts'); throws_ok(sub {$display->enforce_protection}, qr/Attempt to bypass authentication on protected template/, 'not authenticated'); }; subtest 'authenticated' => sub { plan tests => 14; my $cgiapp = TestAppAuthenticate->new; $cgiapp->query->param(rm=>'two'); $cgiapp->query->param(authen_username=>'user1'); $cgiapp->query->param(authen_password=>'123'); $cgiapp->run; ok($cgiapp->authen->is_authenticated,"login success"); is( $cgiapp->authen->username, 'user1', "username set" ); my $display = $cgiapp->authen->display; isa_ok($display, 'CGI::Application::Plugin::Authentication::Display'); isa_ok($display, 'CGI::Application::Plugin::Authentication::Display::Basic'); is($display->login_title, 'Sign In', 'title'); throws_ok(sub {return $display->login_box}, qr{already authenticated}, 'login box'); is($display->logout_form, 'Logout', 'logout_form'); is($display->is_authenticated, 1, 'is_authenticated'); is($display->username, 'user1', 'username'); ok(abs(time - $display->last_login) < 100, 'last_login'); ok(abs(time - $display->last_access) < 100, 'last_access'); is($display->is_login_timeout, 0, 'is_login_timeout'); is($display->login_attempts, 0, 'login_attempts'); is($display->enforce_protection, "\n", 'authenticated'); }; subtest 'failure_and_options' => sub { plan tests => 8; local $cap_options->{LOGIN_FORM}->{REMEMBERUSER_OPTION} = 0; local $cap_options->{LOGIN_FORM}->{REGISTER_URL} = '/register'; local $cap_options->{LOGIN_FORM}->{FORGOTPASSWORD_URL} = '/forgotpassword'; my $cgiapp = TestAppAuthenticate->new; $cgiapp->query->param(rm=>'two'); $cgiapp->query->param(authen_username=>'user1'); $cgiapp->query->param(authen_password=>'666'); $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,"login failure"); is( $cgiapp->authen->username, undef, "username not set" ); my $display = $cgiapp->authen->display; isa_ok($display, 'CGI::Application::Plugin::Authentication::Display'); isa_ok($display, 'CGI::Application::Plugin::Authentication::Display::Basic'); is($display->login_title, 'Sign In', 'title'); ok_regression(sub {return $display->login_box}, 't/out/basic_login_box_options', 'login box'); is($display->logout_form, '', 'logout_form'); is($display->is_authenticated, 0, 'is_authenticated'); }; subtest 'null' => sub { plan tests => 14; local $cap_options->{LOGIN_FORM}->{DISPLAY_CLASS} = 'Null'; my $cgiapp = TestAppAuthenticate->new; my $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,"login failure"); is( $cgiapp->authen->username, undef, "username not set" ); my $display = $cgiapp->authen->display; isa_ok($display, 'CGI::Application::Plugin::Authentication::Display'); isa_ok($display, 'CGI::Application::Plugin::Authentication::Display::Null'); is($display->login_title, 'Sign In', 'title'); throws_ok(sub {return $display->login_box}, qr/not implemented in base class/, 'login box'); is($display->logout_form, '', 'logout_form'); is($display->is_authenticated, 0, 'is_authenticated'); is($display->username, undef, 'username'); is($display->last_login, undef, 'last_login'); is($display->last_access, undef, 'last_access'); is($display->is_login_timeout, 0, 'is_login_timeout'); is($display->login_attempts, undef, 'login_attempts'); throws_ok(sub {$display->enforce_protection}, qr/Attempt to bypass authentication on protected template/, 'not authenticated'); }; 55_driver_missing_authensimple.t000444001750001750 366311563746137 30140 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use Test::Exception; use lib qw(t); use Test::Without::Module qw(Authen::Simple::Adapter); plan tests => 4; srand(0); use strict; use warnings; use CGI (); my $cap_options = { STORE => [ 'Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y' ], }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes( [qw(one two three)] ); $self->authen->protected_runmodes(qw(two three)); $self->authen->config($cap_options); } sub one { my $self = shift; return "ONE"; } sub two { my $self = shift; return "TWO"; } sub three { my $self = shift; return "THREE"; } sub post_login { my $self = shift; my $count = $self->param('post_login') || 0; $self->param( 'post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; # Authen::Simple { local $cap_options->{DRIVER} = [ 'Authen::Simple::Dummy', testuser => 'user1', testpass => '123' ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); throws_ok {$cgiapp->run;} qr/Error executing class callback in prerun stage: The Authen::Simple::Dummy module is not installed/, "missing Authen::Simple"; } htpasswd2000444001750001750 2411563746137 23426 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuser5:gp7/wfxeqCqXw 53_driver_dbi_syntax.t000444001750001750 312611563746137 26045 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use Test::Exception; use Test::Warn; use lib qw(t); eval "use DBD::SQLite"; plan skip_all => "DBD::SQLite required for this test" if $@; plan tests => 2; use strict; use warnings; our $DBNAME = 't/sqlite.db'; unlink $DBNAME if -e $DBNAME; my $dbh = DBI->connect( "dbi:SQLite:dbname=$DBNAME", "", "" ); $dbh->do(<<""); CREATE TABLE user ( name VARCHAR(20), password VARCHAR(50) ) $dbh->do(<<""); INSERT INTO user VALUES ('user1', '123'); $dbh->do(<<""); INSERT INTO user VALUES ('user2', 'mQPVY1HNg8SJ2'); # crypt("123", "mQ") { package TestAppDriverDBISimple; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ [ 'DBI', DBH => $dbh, TABLE => 'user', JOIN_ON => ' blah blah blah', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__' }, ], ], STORE => 'Store::Dummy', ); } $ENV{CGI_APP_RETURN_ONLY} = 1; my $params = { authen_username => 'user1', authen_password => '123', rm => 'protected', }; my $query = CGI->new( $params ); my $cgiapp = TestAppDriverDBISimple->new( QUERY => $query ); warning_like {throws_ok {$cgiapp->run;} qr/Error executing class callback in prerun stage: Failed to prepare SQL statement: near "blah": syntax error/, 'Syntax error';} qr/DBD::SQLite::db prepare_cached failed: near "blah": syntax error/, 'checking warnings'; $dbh->do(<<""); DROP TABLE user; undef $dbh; unlink $DBNAME if -e $DBNAME; 53_driver_dbi_die.t000444001750001750 226511563746137 25263 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl BEGIN {push @ARGV, '--dbtest';} use Test::More; use Test::Exception; use Test::Warn; use lib qw(t); my $dbh; use Test::MockObject; $dbh = Test::MockObject->new; $dbh->set_isa('DBI'); $dbh->fake_module('DBI'); $dbh->mock('prepare_cached', sub {return $dbh;}); $dbh->set_false('execute'); $dbh->set_always('errstr', 'Mock error'); plan tests => 1; use strict; use warnings; { package TestAppDriverDBISimple; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ [ 'DBI', DBH => $dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__' }, ], ], STORE => 'Store::Dummy', ); } $ENV{CGI_APP_RETURN_ONLY} = 1; my $params = { authen_username => 'user1', authen_password => '123', rm => 'protected', }; my $query = CGI->new( $params ); my $cgiapp = TestAppDriverDBISimple->new( QUERY => $query ); throws_ok {$cgiapp->run;} qr/Error executing class callback in prerun stage: Mock error/, 'throws error correctly'; undef $dbh; 04_attributes.t000444001750001750 437311563746137 24515 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More tests => 7; use lib './t'; use strict; use warnings; use CGI (); { package TestAppAttributes; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], STORE => 'Store::Dummy', ); sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes( [qw(one two three four)] ); $self->authen->protected_runmodes(qw(two)); } sub one { return 'test one return value'; } sub two { return 'test two return value'; } sub three : RequireAuthentication { return 'test three return value'; } sub four : Authen(value) { return 'test four return value'; } } $ENV{CGI_APP_RETURN_ONLY} = 1; { # Open runmode my $query = CGI->new( { rm => 'one' } ); my $cgiapp = TestAppAttributes->new( QUERY => $query ); my $results = $cgiapp->run; like($results, qr/test one return value/, 'runmode one is open'); } { # Protected runmode (regular) my $query = CGI->new( { rm => 'two' } ); my $cgiapp = TestAppAttributes->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test two return value/, 'runmode two is protected'); } { # Protected runmode (attribute RequireAuthentication) my $query = CGI->new( { rm => 'three' } ); my $cgiapp = TestAppAttributes->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test three return value/, 'runmode three is protected'); } { # Protected runmode (attribute Authen) my $query = CGI->new( { rm => 'four' } ); my $cgiapp = TestAppAttributes->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test four return value/, 'runmode four is protected'); } { # Successful Login my $query = CGI->new( { authen_username => 'user1', authen_password => '123', rm => 'three' } ); my $cgiapp = TestAppAttributes->new( QUERY => $query ); my $results = $cgiapp->run; ok($cgiapp->authen->is_authenticated,'successful login'); is( $cgiapp->authen->username, 'user1', 'successful login - username set' ); like($results, qr/test three return value/, 'runmode three is visible after login'); } 03_login_box.t000444001750001750 713411563746137 24304 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; use Test::Taint; use Test::Regression; use English qw(-no_match_vars); if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; exit(0); } plan tests => 7; use strict; use warnings; use CGI (); taint_checking_ok('taint checking is on'); $ENV{CGI_APP_RETURN_ONLY} = 1; my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_CALLBACK => \&TestAppAuthenticate::post_login, }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two)]); $self->authen->protected_runmodes(qw(two)); $self->authen->config($cap_options); } sub one { my $self = shift; } sub two { my $self = shift; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } test_auth(); test_auth('cosmetic', { TITLE=>'Aanmelden', USERNAME_LABEL=>'Gebruikersnaam', PASSWORD_LABEL=>'Wachtwoord', SUBMIT_LABEL=>'Aanmelden', COMMENT=>'Vul uw gebruikersnaam en wachtwoord in de velden hieronder.', REMEMBERUSER_LABEL=>'Onthouden Gebruikersnaam', INVALIDPASSWORD_MESSAGE=>'Ongeldige gebruikersnaam of wachtwoord
(login poging% d)', INCLUDE_STYLESHEET=>0 }); test_auth('red', { BASE_COLOUR=>'#884454', LIGHT_COLOUR=>'49%', LIGHTER_COLOUR=>'74%', DARK_COLOUR=>'29%', DARKER_COLOUR=>'59%' }, 1); test_auth('green', { BASE_COLOUR=>'#2cf816' }, 1); test_auth('grey_extra', { BASE_COLOUR=>'#445588', }, 1); test_auth('grey_extra2', { GREY_COLOUR=>'#334488', BASE_COLOUR=>'#445588', }, 1); sub test_auth { my $test_name = shift || "default"; my $login_form = shift; my $color_calc_required = shift; if (defined $color_calc_required) { eval "use Color::Calc"; if ($@) { diag "Color::Calc required for this sub test"; pass($test_name); return; } } subtest $test_name => sub { plan tests => 11; local $cap_options->{LOGIN_FORM} = $login_form if $login_form; # Missing Credentials my $param = { authen_username => 'user1', rm => 'two' }; taint_deeply($param); my $query = CGI->new( $param); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); my $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,"$test_name - login failure"); is( $cgiapp->authen->username, undef, "$test_name - username not set" ); is( $cgiapp->param('post_login'),1,"$test_name - POST_LOGIN_CALLBACK executed" ); is( $cgiapp->authen->_detaint_destination, '', "$test_name - _detaint_destination"); untainted_ok($cgiapp->authen->_detaint_destination, "$test_name - _detaint_destination untainted"); is( $cgiapp->authen->_detaint_selfurl, 'http://localhost?rm=two;authen_username=user1', "$test_name - _detaint_selfurl"); untainted_ok($cgiapp->authen->_detaint_selfurl, "$test_name - _detaint_selfurl untainted"); is( $cgiapp->authen->_detaint_url, '', "$test_name - _detaint_url"); untainted_ok($cgiapp->authen->_detaint_url, "$test_name - _detaint_url untainted"); ok_regression(sub {$cgiapp->authen->login_box}, "t/out/$test_name", "$test_name - verify login box"); untainted_ok($cgiapp->authen->login_box, "$test_name - check login box taint"); } } 03_missing_color.t000444001750001750 541611563746137 25174 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; use Test::Taint; use Test::Regression; use Test::NoWarnings; use Test::Warn; use Test::Without::Module qw(Color::Calc); use English qw(-no_match_vars); plan tests => 4; use strict; use warnings; taint_checking_ok('taint checking is on'); use CGI (); my $cap_options = { DRIVER => [ 'Generic', { user1 => '123' } ], STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], POST_LOGIN_CALLBACK => \&TestAppAuthenticate::post_login, }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two three)]); $self->authen->protected_runmodes(qw(two three)); $self->authen->config($cap_options); } sub one { my $self = shift; return "ONE"; } sub two { my $self = shift; return "TWO"; } sub three { my $self = shift; return "THREE"; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; subtest 'Base color' => sub { plan tests => 2; local $cap_options->{LOGIN_FORM}->{BASE_COLOUR} = 'purple'; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); my $output; warning_is {$output = $cgiapp->run;} "Color::Calc is required when specifying a custom BASE_COLOUR, and leaving LIGHTER_COLOUR, LIGHT_COLOUR, DARK_COLOUR or DARKER_COLOUR blank or when providing percentage based colour", "checking generated warning"; ok_regression(sub {make_output_timeless($output)}, "t/out/missing_color", "Missing color"); }; subtest 'No Base color' => sub { plan tests => 1; my $query = CGI->new( { rm => 'two'} ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok_regression(sub {make_output_timeless($cgiapp->run)}, "t/out/missing_color", "Missing color"); }; sub make_output_timeless { my $output = shift; $output =~ s/^(Set-Cookie: CAPAUTH_DATA=\w+\%3D\%3D\; path=\/\; expires=\w{3},\s\d{2}\-\w{3}\-\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Set-Cookie: CAPAUTH_DATA=; path=\/; expires=;$2/m; $output =~ s/^(Expires:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Expires$2/m; $output =~ s/^(Date:\s\w{3},\s\d{2}\s\w{3}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\w{3})([\r\n\s]*)$/Date$2/m; #$output =~ s/\r//g; return $output; } 05_autorunmode.t000444001750001750 1162111563746137 24704 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; eval "require CGI::Application::Plugin::AutoRunmode"; plan skip_all => "CGI::Application::Plugin::AutoRunmode required for this test" if $@; use lib './t'; use strict; use warnings; use CGI (); { package TestAppAutoRunmode; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; CGI::Application::Plugin::AutoRunmode->import; use Test::More; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], STORE => [ 'Store::Dummy' ], ); sub setup { my $self = shift; $self->authen->protected_runmodes(qw(two)); } eval < "CGI::Application::Plugin::AutoRunmode version does not work with Authentication" if $@; package TestAppAutoRunmode::Subclass; use base qw(TestAppAutoRunmode); use Test::More; sub setup { my $self = shift; $self->authen->protected_runmodes(qw(six)); } eval < "CGI::Application::Plugin::AutoRunmode version does not work with Authentication" if $@; } plan tests => 14; $ENV{CGI_APP_RETURN_ONLY} = 1; my $class = 'TestAppAutoRunmode'; { # Open runmode my $query = CGI->new( { rm => 'one' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; like($results, qr/test one return value/, 'runmode one is open'); } { # Protected runmode (regular) my $query = CGI->new( { rm => 'two' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test two return value/, 'runmode two is protected'); } { # Protected runmode (attribute RequireAuthentication) my $query = CGI->new( { rm => 'three' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test three return value/, 'runmode three is protected'); } { # Protected runmode (attribute Authen) my $query = CGI->new( { rm => 'four' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test four return value/, 'runmode four is protected'); } { # Successful Login my $query = CGI->new( { authen_username => 'user1', authen_password => '123', rm => 'three' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; ok($cgiapp->authen->is_authenticated,'successful login'); is( $cgiapp->authen->username, 'user1', 'successful login - username set' ); like($results, qr/test three return value/, 'runmode three is visible after login'); } $class = 'TestAppAutoRunmode::Subclass'; { # Open runmode my $query = CGI->new( { rm => 'five' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; like($results, qr/test five return value/, 'runmode five is open'); } { # Protected runmode (regular) my $query = CGI->new( { rm => 'six' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test six return value/, 'runmode six is protected'); } { # Protected runmode (attribute RequireAuthentication) my $query = CGI->new( { rm => 'seven' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test seven return value/, 'runmode seven is protected'); } { # Protected runmode (attribute Authen) my $query = CGI->new( { rm => 'eight' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; unlike($results, qr/test eight return value/, 'runmode eight is protected'); } { # Successful Login my $query = CGI->new( { authen_username => 'user1', authen_password => '123', rm => 'seven' } ); my $cgiapp = $class->new( QUERY => $query ); my $results = $cgiapp->run; ok($cgiapp->authen->is_authenticated,'successful login'); is( $cgiapp->authen->username, 'user1', 'successful login - username set' ); like($results, qr/test seven return value/, 'runmode seven is visible after login'); } 40_encoder_crypt.t000444001750001750 70411563746137 25141 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -wT use Test::More tests => 4; BEGIN { use_ok('CGI::Application::Plugin::Authentication::Driver::Filter::crypt') }; use strict; use warnings; my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::crypt'; is($class->filter(undef, '123', 'mQPVY1HNg8SJ2'), 'mQPVY1HNg8SJ2', "encode"); ok($class->check(undef, '123', 'mQPVY1HNg8SJ2'), "check passes"); ok(!$class->check(undef, 'xxx', 'mQPVY1HNg8SJ2'), "check fails"); 40_encoder_lc.t000444001750001750 61311563746137 24375 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More tests => 4; BEGIN { use_ok('CGI::Application::Plugin::Authentication::Driver::Filter::lc') }; use strict; use warnings; my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::lc'; is($class->filter(undef, 'ABC'), 'abc', "filter"); ok($class->check(undef, 'ABC', 'abc'), "check passes"); ok(!$class->check(undef, 'XXX', 'abc'), "check fails"); 60_store_session.t000444001750001750 304211563746137 25220 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); use CGI::Util; use Test::More; eval "use CGI::Application::Plugin::Session"; plan skip_all => "CGI::Application::Plugin::Session required for this test" if $@; plan tests => 14; { package TestAppStoreSession; use base qw(TestAppStore); CGI::Application::Plugin::Session->import; # was loaded conditionally above __PACKAGE__->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Session' ], CREDENTIALS => [qw(auth_username auth_password)], ); sub get_store_entries { my $class = shift; my $cgiapp = shift; my $results = shift; my $data = { username => $cgiapp->session->param('AUTH_USERNAME'), login_attempts => $cgiapp->session->param('AUTH_LOGIN_ATTEMPTS'), }; return ($data->{username} || $data->{login_attempts}) ? $data : undef; } sub maintain_state { my $class = shift; my $old_cgiapp = shift; my $old_results = shift; my $new_query = shift; $old_cgiapp->session->flush; $new_query->param(-name => CGI::Session->name, -value => $old_cgiapp->session->id, -override => 1); } sub clear_state { my $class = shift; my $old_cgiapp = shift; my $old_results = shift; $old_cgiapp->session->clear(['AUTH_USERNAME','AUTH_LOGIN_ATTEMPTS']), $old_cgiapp->session->flush; $class->SUPER::clear_state(@_); } } TestAppStoreSession->run_store_tests; 54_driver_htpasswd.t000444001750001750 225011563746137 25534 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -w use strict; use warnings; use Test::More; use Test::Exception; use lib qw(t); eval "use Apache::Htpasswd 1.8;"; plan skip_all => "Apache::Htpasswd >= 1.8 required for this test" if $@; plan tests => 31; use strict; use warnings; our $HTPASSWD = 't/htpasswd'; our $HTPASSWD2 = 't/htpasswd2'; { package TestAppDriverHTPasswd; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'HTPasswd', $HTPASSWD, $HTPASSWD2 ], STORE => 'Store::Dummy', ); } TestAppDriverHTPasswd->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '123' ], [ 'user3', '123' ], [ 'user4', '123' ], [ 'user5', '123' ], ); # Test bad config { package TestAppDriverHTPasswd2; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'HTPasswd' ], STORE => 'Store::Dummy', ); } throws_ok {TestAppDriverHTPasswd2->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], );} qr/Error executing class callback in prerun stage: The HTPasswd driver requires at least one htpasswd file/, 'no htpasswd files'; 52_driver_generic.t000444001750001750 156711563746137 25323 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use lib qw(t); plan tests => 32; use strict; use warnings; { package TestAppDriverGeneric; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ [ 'Generic', { user1 => '123' } ], [ 'Generic', [ [ 'user2', '234' ], [ 'user3', '345' ], ], ], [ 'Generic', sub { no warnings qw(uninitialized); $_[0] eq 'user4' && $_[1] eq '456' ? $_[0] : 0 } ], ], STORE => 'Store::Dummy', ); } TestAppDriverGeneric->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '234' ], [ 'user3', '345' ], [ 'user4', '456' ], ); TestAppDriverGeneric->run_authen_failure_tests( [ 'authen_username', 'authen_password' ], [ 'user1', 'xxx' ], [ 'user2', 'xxx' ], [ 'user3', 'xxx' ], [ 'user4', 'xxx' ], ); TestAppDriver.pm000444001750001750 722611563746137 24731 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tpackage TestAppDriver; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; use Test::More; use CGI (); sub setup { my $self = shift; $self->start_mode('unprotected'); $self->run_modes([qw(unprotected protected)]); $self->authen->protected_runmodes(qw(protected)); } sub unprotected { my $self = shift; my $username = $self->authen->username; return "username:$username\n"; } sub protected { my $self = shift; my $username = $self->authen->username; return "username:$username\n"; } # # These tests should pass with the credentials that were passed # But other tests are performed that should successfully fail # sub run_authen_tests { my $class = shift; my $credentials = shift; my @testdata = @_; $ENV{CGI_APP_RETURN_ONLY} = 1; foreach my $data (@testdata) { my ($params, $query, $cgiapp, $results); # Successful Login $params = { map { $credentials->[$_] => $data->[$_] } 0..$#$credentials }; $params->{rm} = 'protected'; $query = CGI->new( $params ); $cgiapp = $class->new( QUERY => $query ); $results = $cgiapp->run; ok($cgiapp->authen->is_authenticated,'successful login'); is( $cgiapp->authen->username, $data->[0], 'successful login - username set' ); # Missing Credentials $params = { map { $credentials->[$_] => $data->[$_] } 1..$#$credentials }; $params->{rm} = 'protected'; $query = CGI->new( $params ); $cgiapp = $class->new( QUERY => $query ); $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,'missing credentials - login failure'); is( $cgiapp->authen->username, undef, 'missing credentials - username not set' ); # Bad user or password $params = { map { $credentials->[$_] => 'badvalue' } 0..$#$credentials }; $params->{rm} = 'protected'; $query = CGI->new( $params ); $cgiapp = $class->new( QUERY => $query ); $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,'login failure'); is( $cgiapp->authen->username, undef, "login failure - username not set" ); } } # # These tests should pass with the credentials that were passed # sub run_authen_success_tests { my $class = shift; my $credentials = shift; my @testdata = @_; $ENV{CGI_APP_RETURN_ONLY} = 1; foreach my $data (@testdata) { my ($params, $query, $cgiapp, $results); # Failed Login $params = { map { $credentials->[$_] => $data->[$_] } 0..$#$credentials }; $params->{rm} = 'protected'; $query = CGI->new( $params ); $cgiapp = $class->new( QUERY => $query ); $results = $cgiapp->run; ok( $cgiapp->authen->is_authenticated,'good credentials - login success'); is( $cgiapp->authen->username, $data->[0], 'good credentials - username set' ); } } # # These tests should fail with the credentials that were passed # sub run_authen_failure_tests { my $class = shift; my $credentials = shift; my @testdata = @_; $ENV{CGI_APP_RETURN_ONLY} = 1; foreach my $data (@testdata) { my ($params, $query, $cgiapp, $results); # Failed Login $params = { map { $credentials->[$_] => $data->[$_] } 0..$#$credentials }; $params->{rm} = 'protected'; $query = CGI->new( $params ); $cgiapp = $class->new( QUERY => $query ); $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,'failed credentials - login failure'); is( $cgiapp->authen->username, undef, 'failed credentials - username not set' ); } } 1; 55_driver_authensimple.t000444001750001750 230311563746137 26375 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use lib qw(t); eval "use Authen::Simple"; plan skip_all => "Authen::Simple required for this test" if $@; plan tests => 11; use strict; use warnings; { package TestAppDriverAuthenSimple; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => [ 'Authen::Simple::Dummy', testuser => 'user1', testpass => '123' ], STORE => 'Store::Dummy', ); } TestAppDriverAuthenSimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], ); TestAppDriverAuthenSimple->run_authen_failure_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '1234' ], ); # Test covering certain coverage cases TestAppDriverAuthenSimple->run_authen_failure_tests( [ 'authen_username', 'authen_password' ], [ 0, 'hhhh'], ); $ENV{CGI_APP_RETURN_ONLY} = 1; my $params = { rm => 'protected', authen_username => undef, authen_password => '2234' }; { use CGI; my $query = CGI->new( $params ); my $cgiapp = TestAppDriverAuthenSimple->new( QUERY => $query ); my @drivers = $cgiapp->authen->drivers; ok(!defined $drivers[0]->verify_credentials(undef, '2234'), 'impossible case'); } 50_driver_undefined.t000444001750001750 2644711563746137 25672 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; use Test::Taint; use Test::Exception; use Test::Regression; use English qw(-no_match_vars); use lib qw(t); if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; } plan tests => 46; srand(0); use strict; use warnings; taint_checking_ok('taint checking is on'); use CGI (); my $cap_options = { STORE => [ 'Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y' ], }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes( [qw(one two three)] ); $self->authen->protected_runmodes(qw(two three)); $self->authen->config($cap_options); } sub one { my $self = shift; return "ONE"; } sub two { my $self = shift; return "TWO"; } sub three { my $self = shift; return "THREE"; } sub post_login { my $self = shift; my $count = $self->param('post_login') || 0; $self->param( 'post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; # Test 'find_options' function and what happens when we don't define 'verify_credentials' { local $cap_options->{DRIVER} = [ 'Silly', option1 => 'Tom', option2 => 'Dick', option3 => 'Harry' ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( $drivers[0]->find_option( 'option1', 'Tom' ), 'Tom' ); ok( $drivers[0]->find_option( 'option2', 'Dick' ), 'Dick' ); ok( $drivers[0]->find_option( 'option3', 'Harry' ), 'Harry' ); throws_ok { $cgiapp->run } qr/verify_credentials must be implemented in the subclass/, 'undefined function caught okay'; }; # Test what happens when we have no options. { local $cap_options->{DRIVER} = [ 'Silly', ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); # test caching my @drivers1 = $cgiapp->authen->drivers; ok( scalar(@drivers1) == 1, 'We should have just one driver' ); ok( $drivers[0] == $drivers1[0], 'test caching' ); ok( !defined( $drivers[0]->find_option( 'option1', 'Tom' ) ), 'Tom' ); ok( !defined( $drivers[0]->find_option( 'option2', 'Dick' ) ), 'Dick' ); ok( !defined( $drivers[0]->find_option( 'option3', 'Harry' ) ), 'Harry' ); }; # Test what happens when no driver is defined { my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); isa_ok( $drivers[0], 'CGI::Application::Plugin::Authentication::Driver::Dummy', 'Dummy is the default driver' ); }; # Test what happens when a non-existent driver is called { local $cap_options->{DRIVER} = ['Blah']; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); throws_ok { $cgiapp->authen->drivers } qr/Driver Blah can not be found/, 'Non existent driver'; }; # Test what happens when a driver constructor dies { local $cap_options->{DRIVER} = ['Die']; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); throws_ok { $cgiapp->authen->drivers } qr/Could not create new CGI::Application::Plugin::Authentication::Driver::Die object/, 'Suicidal driver'; }; # Start playing with filter { my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); my $driver = ($cgiapp->authen->drivers)[0]; is($driver->filter('crypt_blah:password', 'hello123', 'UDI'), "UDAdLpAU1oHWU", "crypt - salt=UDI"); is($driver->filter('crypt_blah:password', 'hello123', 'JJJ'), "JJfyQYJkUrAE6", "crypt - salt=JJJ"); is($driver->filter('crypt_blah:password', 'hello123'), "8jtQ9rloNVKU.", "crypt - no salt"); is($driver->filter('crypt_blah:password', 'hello123', ''), "4rJy6RLB765G6", "crypt - bland salt"); throws_ok { $driver->filter('nonsense:crypt_blah:password', 'hello123', '') } qr/No filters found for 'nonsense'/, "undefined filter"; throws_ok { $driver->filter('md5_blah:crypt_blah:password', 'hello123', '') } qr/Unknown MD5 format blah/, "Unknown MD5 parameter"; throws_ok { $driver->filter('sha1_blah:crypt_blah:password', 'hello123', '') } qr/Unknown SHA1 format blah/, "Unknown SHA1 parameter"; }; # Nonsense filter { local $cap_options->{DRIVER} = [ 'Dummy', FILTERS=>{nonsense=>'not a suboutine'} ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); my $driver = ($cgiapp->authen->drivers)[0]; throws_ok { $driver->filter('nonsense1_blah:crypt_blah:password', 'hello123', '') } qr/No filter found for 'nonsense1'/, "undefined filter"; throws_ok { $driver->filter('nonsense:crypt_blah:password', 'hello123', '') } qr/the 'nonsense' filter listed in FILTERS must be a subroutine reference/, "undefined filter"; }; # FILTERS option not a hashref { local $cap_options->{DRIVER} = [ 'Dummy', FILTERS=>'not a hashref' ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); my $driver = ($cgiapp->authen->drivers)[0]; throws_ok { $driver->filter('nonsense_blah:crypt_blah:password', 'hello123', '') } qr/the FILTERS configuration option must be a hashref/, "undefined filter"; }; # FILTERS option not a hashref { local $cap_options->{DRIVER} = [ 'Dummy', FILTERS=>{nonsense=>\&obfuscate}, ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); my $driver = ($cgiapp->authen->drivers)[0]; is($driver->filter('nonsense:password', 'hello123', ''), "|hello123|G", "custom filter"); }; # Generic driver { local $cap_options->{DRIVER} = [ 'Generic', 'Use me if you can' ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); throws_ok { $cgiapp->run } qr/Unknown options for Generic Driver/, 'Unknown options for Generic Driver'; }; # DBI driver { local $cap_options->{DRIVER} = [ 'DBI', 'Use me if you can' ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); throws_ok { $cgiapp->run } qr/The DBI driver requires a hash of options/, 'The DBI driver requires a hash of options'; }; # DBI driver (no dbh) { local $cap_options->{DRIVER} = [ 'DBI', ]; my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); throws_ok { $cgiapp->run } qr/No DBH handle passed to the DBI Driver, and no dbh\(\) method detected/, 'No DBH'; }; # Generic driver where first credential is undefined { local $cap_options->{DRIVER} = [ 'Generic', {user=>'123',}, ]; my $query = CGI->new( { authen_username => undef, rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); $cgiapp->run; ok(!$cgiapp->authen->is_authenticated, "undefined username"); my @drivers = $cgiapp->authen->drivers; ok(!defined($drivers[0]->verify_credentials(undef, 'blah'))); }; sub obfuscate { my $param = shift || "G"; my $value = shift; return "|$value|$param"; } 40_encoder_md5.t000444001750001750 317111563746137 24506 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use strict; use warnings; eval "use Digest::MD5"; plan skip_all => "Digest::MD5 required for this test" if $@; plan tests => 17; use_ok('CGI::Application::Plugin::Authentication::Driver::Filter::md5'); my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::md5'; # Test binary my $binary = Digest::MD5::md5('123'); is( $class->filter( 'binary', '123' ), $binary, "filter" ); ok( $class->check( 'binary', '123', $binary ), "check passes" ); ok( !$class->check( 'binary', 'xxx', $binary ), "check fails" ); ok( $class->check( undef, '123', $binary ), "check passes" ); ok( !$class->check( undef, 'xxx', $binary ), "check fails" ); # Test base64 is( $class->filter( 'base64', '123' ), 'ICy5YqxZB1uWSwcVLSNLcA', "filter" ); ok( $class->check( 'base64', '123', 'ICy5YqxZB1uWSwcVLSNLcA' ), "check passes" ); ok( !$class->check( 'base64', 'xxx', 'ICy5YqxZB1uWSwcVLSNLcA' ), "check fails" ); ok( $class->check( undef, '123', 'ICy5YqxZB1uWSwcVLSNLcA' ), "check passes" ); ok( !$class->check( undef, 'xxx', 'ICy5YqxZB1uWSwcVLSNLcA' ), "check fails" ); # Test hex is( $class->filter( 'hex', '123' ), '202cb962ac59075b964b07152d234b70', "filter" ); ok( $class->check( 'hex', '123', '202cb962ac59075b964b07152d234b70' ), "check passes" ); ok( !$class->check( 'hex', 'xxx', '202cb962ac59075b964b07152d234b70' ), "check fails" ); is( $class->filter( undef, '123' ), '202cb962ac59075b964b07152d234b70', "filter" ); ok( $class->check( undef, '123', '202cb962ac59075b964b07152d234b70' ), "check passes" ); ok( !$class->check( undef, 'xxx', '202cb962ac59075b964b07152d234b70' ), "check fails" ); TestAppStore.pm000444001750001750 706111563746137 24567 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tpackage TestAppStore; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; use Test::More; use CGI (); $ENV{CGI_APP_RETURN_ONLY} = 1; sub setup { my $self = shift; $self->start_mode('unprotected'); $self->run_modes([qw(unprotected protected)]); $self->authen->protected_runmodes(qw(protected)); } sub unprotected { my $self = shift; my $username = $self->authen->username || ''; return "unprotected\nusername:$username\n"; } sub protected { my $self = shift; my $username = $self->authen->username; return "protected\nusername:$username\n"; } # helper class method that runs the app with certain parameters our ($CGIAPP, $RESULTS); sub run_app { my $class = shift; my $params = shift || {}; my $query = CGI->new( $params ); $class->maintain_state($CGIAPP, $RESULTS, $query) if $CGIAPP && $RESULTS; $CGIAPP = $class->new( QUERY => $query ); $RESULTS = $CGIAPP->run; my $store_entries = $class->can('get_store_entries') ? $class->get_store_entries($CGIAPP, $RESULTS) : undef; return ($CGIAPP, $RESULTS, $store_entries); } sub maintain_state {} sub clear_state { my $class = shift; $CGIAPP = undef; $RESULTS = undef; } sub run_store_tests { my $class = shift; my ( $cgiapp, $results, $store_entries ); # Regular call to unprotected page shouldn't create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'unprotected' } ); ok(!$store_entries, "Store entry not created when calling unprotected page" ); # Regular call to protected page (without a valid login) shouldn't create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected' } ); ok(!$store_entries, "Store entry not created when calling protected page without valid login" ); # Regular call to protected page (with an invalid login) should create a store entry marking login attempts ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => 'badpassword' } ); ok(!$cgiapp->authen->is_authenticated,'failed login attempt'); ok($store_entries, "Store entry created when calling protected page with invalid login" ); isnt($store_entries->{username}, 'test', "Store entry contained the right username" ); is($store_entries->{login_attempts}, 1, "Store entry contained the right value for login_attempts" ); # Regular call to protected page (with an invalid login) should create a store entry marking login attempts ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => 'badpassword' } ); ok(!$cgiapp->authen->is_authenticated,'failed login attempt'); ok($store_entries, "Store entry created when calling protected page with invalid login" ); isnt($store_entries->{username}, 'test', "Store entry contained the right username" ); is($store_entries->{login_attempts}, 2, "Store entry contained the right value for login_attempts" ); # Regular call to protected page (with a valid login) should create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => '123' } ); ok($cgiapp->authen->is_authenticated,'successful login'); ok($store_entries, "Store entry created when calling protected page with valid login" ); is($store_entries->{username}, 'test', "Store entry contained the right username" ); ok(!$store_entries->{login_attempts}, "Store entry cleared login_attempts" ); } 1; 60_store_cookie.t000444001750001750 252611563746137 25014 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); use CGI::Util; use Test::More; plan tests => 17; { package TestAppStoreCookie; use base qw(TestAppStore); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CUSTOM_NAME', EXPIRY => '+1y' ], CREDENTIALS => [qw(auth_username auth_password)], ); sub get_store_entries { my $class = shift; my $cgiapp = shift; my $results = shift; my ($capauth_data, $therest) = $results =~ qr/^Set\-Cookie:\s+CUSTOM_NAME=([\d\w%]+);(.*)$/m; return undef unless $capauth_data; main::like($therest, qr/expires=/, 'Expiry on the cookie is set'); my $data = CGI::Util::unescape($capauth_data); return $data ? $cgiapp->authen->store->_decode($data) : undef; } sub maintain_state { my $class = shift; my $old_cgiapp = shift; my $old_results = shift; my $new_query = shift; delete $ENV{'COOKIE'}; $old_results =~ qr/Set\-Cookie:\s+(CUSTOM_NAME=[\d\w%]+);/; $ENV{'COOKIE'} = $1 if $1; } sub clear_state { my $class = shift; delete $ENV{'COOKIE'}; $class->SUPER::clear_state(@_); } } TestAppStoreCookie->run_store_tests; 51_driver_dummy.t000444001750001750 70511563746137 25012 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use lib qw(t); plan tests => 8; use strict; use warnings; { package TestAppDriverGeneric; use base qw(TestAppDriver); __PACKAGE__->authen->config( DRIVER => 'Dummy', STORE => 'Store::Dummy', ); } TestAppDriverGeneric->run_authen_success_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '234' ], [ 'user3', '' ], [ 'user4' ], ); podspell.t000444001750001750 156311563746137 23644 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuse strict; use warnings; use English qw(-no_match_vars); use Test::More; if ( not $ENV{TEST_AUTHOR} ) { my $msg = 'Author test. Set $ENV{TEST_AUTHOR} to a true value to run.'; plan( skip_all => $msg ); } eval { require Test::Spelling; }; if ( $EVAL_ERROR ) { my $msg = 'Test::Spelling required to criticise code'; plan( skip_all => $msg ); } my @STOP_WORDS = qw(ActionDispatch Walde CPAN Bamber Cees Hek github AnnoCPAN RT API SiteSuite crypted SHA CRC DBD DBH SQL DBI username usernames CALLBACKS CALLBACKS HTML LDAP RUNMODES TODO URL CAPAUTHTOKEN webserver Hardcode hardcode everytime initialize authen customizations runmode runmodes prerun pre callback callbacks checkbox customize customized desaturating Alexandr Ciornii www famfamfam com gmail XHTML detaint URLs); Test::Spelling::add_stopwords(@STOP_WORDS); Test::Spelling::all_pod_files_spelling_ok(); 60_store.t000444001750001750 324011563746137 23455 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); use CGI::Util; use Test::More; use Test::Exception; plan tests => 17; our %STORAGE; { package TestAppStoreDummy; use base qw(TestAppStore); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Store::Dummy', \%STORAGE ], CREDENTIALS => [qw(auth_username auth_password)], ); sub get_store_entries { return %STORAGE ? \%STORAGE : undef; } #-------------------------------------------------- # sub maintain_state { # my $class = shift; # my $old_cgiapp = shift; # my $old_results = shift; # my $new_query = shift; # } #-------------------------------------------------- sub clear_state { my $class = shift; my $old_cgiapp = shift; my $old_results = shift; delete $STORAGE{$_} foreach keys %STORAGE; } } TestAppStoreDummy->run_store_tests; # Test some methods that should never be called my $store = TestAppStoreDummy->new->authen->store; throws_ok { $store->CGI::Application::Plugin::Authentication::Store::fetch('username') } qr/fetch must be implemented in the/, 'Store dies when fetch is called without being overridden in the subclass'; throws_ok { $store->CGI::Application::Plugin::Authentication::Store::save(username => 'test1') } qr/save must be implemented in the/, 'Store dies when save is called without being overridden in the subclass'; throws_ok { $store->CGI::Application::Plugin::Authentication::Store::delete('username') } qr/delete must be implemented in the/, 'Store dies when delete is called without being overridden in the subclass'; manifest.t000444001750001750 75711563746137 23614 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuse strict; use warnings; use Test::More; if ( not $ENV{TEST_AUTHOR} ) { my $msg = 'Author test. Set $ENV{TEST_AUTHOR} to a true value to run.'; plan( skip_all => $msg ); } eval { require Test::CheckManifest; }; if ( $@ ) { my $msg = 'Test::CheckManifest required to check manifest'; plan( skip_all => $msg ); } Test::CheckManifest::ok_manifest({filter=>[qr/\/cover_db/,qr/\/\.git/,qr/\/\.dotest/,qr/\.bak$/,qr/\.old$/,qr/t\/dbfile$/,qr/\.tar\.gz$/,qr/Makefile(?:\.PL)$/]}); 53_driver_dbi_bad.t000444001750001750 647411563746137 25256 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More; use Test::Exception; use Test::Warn; use lib qw(t); eval "use DBD::SQLite"; plan skip_all => "DBD::SQLite required for this test" if $@; plan tests => 9; use strict; use warnings; our $DBNAME = 't/sqlite.db'; unlink $DBNAME if -e $DBNAME; my $dbh = DBI->connect( "dbi:SQLite:dbname=$DBNAME", "", "" ); $dbh->do(<<""); CREATE TABLE user ( name VARCHAR(20), password VARCHAR(50), active INT ) $dbh->do(<<""); INSERT INTO user VALUES ('user1', '123', 1); $dbh->do(<<""); INSERT INTO user VALUES ('user3', '123', 0); $dbh->do(<<""); INSERT INTO user VALUES ('user2', 'mQPVY1HNg8SJ2', 1); # crypt("123", "mQ") my %options = ( DRIVER => [ 'DBI', DBH => $dbh, TABLE => 'user', ], STORE => 'Store::Dummy', ); { package TestAppDriverDBISimple; use base qw(TestAppDriver); sub setup { my $self = shift; $self->SUPER::setup(); $self->authen->config(%options); } } { local $options{DRIVER}->[4] = undef; throws_ok {TestAppDriverDBISimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '123' ], );} qr/Error executing class callback in prerun stage: No TABLE parameter defined/, "no TABLE"; } { my @opts = @{$options{DRIVER}}; local $options{DRIVER} = [@opts, 'COLUMNS', 'bad column']; throws_ok {TestAppDriverDBISimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '123' ], );} qr/Error executing class callback in prerun stage: COLUMNS must be a hashref/, "COLUMNS not a hashref"; } { my @opts = @{$options{DRIVER}}; local $options{DRIVER} = [@opts, 'CONSTRAINTS', 'bad constraints']; throws_ok {TestAppDriverDBISimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '123' ], );} qr/Error executing class callback in prerun stage: CONSTRAINTS must be a hashref/, "CONSTRAINTS not a hashref"; } { my @opts = @{$options{DRIVER}}; local $options{DRIVER} = [@opts, 'CONSTRAINTS', 0]; warning_like {throws_ok {TestAppDriverDBISimple->run_authen_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], [ 'user2', '123' ], );} qr/Error executing class callback in prerun stage: Failed to prepare SQL statement: near " "/, "DBI syntax error";} qr/DBD::SQLite::db prepare_cached failed: near " ": syntax error/, "DBD:SQLite"; } { my @opts = @{$options{DRIVER}}; local $options{DRIVER} = [ @opts, 'COLUMNS', {active=>1}, 'CONSTRAINTS', { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__' }, ]; TestAppDriverDBISimple->run_authen_success_tests( [ 'authen_username', 'authen_password' ], [ 'user1', '123' ], ); TestAppDriverDBISimple->run_authen_failure_tests( [ 'authen_username', 'authen_password' ], [ 'user3', '123' ], ); } $dbh->do(<<""); DROP TABLE user; undef $dbh; unlink $DBNAME if -e $DBNAME; 40_encoder_strip.t000444001750001750 64311563746137 25143 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use Test::More tests => 4; BEGIN { use_ok('CGI::Application::Plugin::Authentication::Driver::Filter::strip') }; use strict; use warnings; my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::strip'; is($class->filter(undef, " abc\t\n"), 'abc', "filter"); ok($class->check(undef, " abc\t\n", 'abc'), "check passes"); ok(!$class->check(undef, " xxx\t\n", 'abc'), "check fails"); htpasswd000444001750001750 17411563746137 23372 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tuser1:E56EEScnmcTO2 user2:Ux85jxU8F45gU user3:$apr1$igjJA...$XDyNFHnD879UQGZyMCng60 user4:{SHA}QL0AFWMIX8NRZTKeof9cXsvbvu8= 50_driver_missing_modules.t000444001750001750 561411563746137 27103 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; use Test::Taint; use Test::Exception; use lib qw(t); use Test::Without::Module qw(Digest::MD5); use Test::Without::Module qw(Digest::SHA); use English qw(-no_match_vars); if ($OSNAME eq 'MSWin32') { my $msg = 'Not running these tests on windows yet'; plan skip_all => $msg; } plan tests => 11; srand(0); use strict; use warnings; taint_checking_ok('taint checking is on'); use CGI (); my $cap_options = { STORE => [ 'Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y' ], }; { package TestAppAuthenticate; use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes( [qw(one two three)] ); $self->authen->protected_runmodes(qw(two three)); $self->authen->config($cap_options); } sub one { my $self = shift; return "ONE"; } sub two { my $self = shift; return "TWO"; } sub three { my $self = shift; return "THREE"; } sub post_login { my $self = shift; my $count = $self->param('post_login') || 0; $self->param( 'post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; # Start playing with filter { my $query = CGI->new( { authen_username => 'user1', rm => 'two', authen_password => '123', destination => 'http://news.bbc.co.uk' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); ok( !exists $cgiapp->authen->{drivers}, 'nothing cached yet' ); my @drivers = $cgiapp->authen->drivers; ok( scalar(@drivers) == 1, 'We should have just one driver' ); ok( scalar( @{ $cgiapp->authen->{drivers} } ) == 1, 'cached now' ); my $driver = ($cgiapp->authen->drivers)[0]; is($driver->filter('crypt_blah:password', 'hello123', 'UDI'), "UDAdLpAU1oHWU", "crypt - salt=UDI"); is($driver->filter('crypt_blah:password', 'hello123', 'JJJ'), "JJfyQYJkUrAE6", "crypt - salt=JJJ"); is($driver->filter('crypt_blah:password', 'hello123'), "8jtQ9rloNVKU.", "crypt - no salt"); is($driver->filter('crypt_blah:password', 'hello123', ''), "4rJy6RLB765G6", "crypt - bland salt"); throws_ok { $driver->filter('nonsense:crypt_blah:password', 'hello123', '') } qr/No filters found for 'nonsense'/, "undefined filter"; throws_ok { $driver->filter('md5:crypt_blah:password', 'hello123', '') } qr/Digest::MD5 is required to check MD5 passwords/, "Digest::MD5 not present"; throws_ok { $driver->filter('sha1:crypt_blah:password', 'hello123', '') } qr/Digest::SHA is required to check SHA1 passwords/, "Digest::SHA not present"; }; 03_authenticate.t000444001750001750 466211563746137 25005 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl -T use Test::More; eval "use CGI::Application::Plugin::Session"; plan skip_all => "CGI::Application::Plugin::Session required for this test" if $@; plan tests => 11; use strict; use warnings; use CGI (); { package TestAppAuthenticate; use base qw(CGI::Application); CGI::Application::Plugin::Session->import; # it was used conditionally above use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], STORE => 'Session', POST_LOGIN_CALLBACK => \&post_login, ); sub setup { my $self = shift; $self->start_mode('one'); $self->run_modes([qw(one two)]); $self->authen->protected_runmodes(qw(two)); } sub one { my $self = shift; } sub two { my $self = shift; } sub post_login { my $self = shift; my $count=$self->param('post_login')||0; $self->param('post_login' => $count + 1 ); } } $ENV{CGI_APP_RETURN_ONLY} = 1; # Missing Credentials my $query = CGI->new( { authen_username => 'user1', rm => 'two' } ); my $cgiapp = TestAppAuthenticate->new( QUERY => $query ); my $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,'missing credentials - login failure'); is( $cgiapp->authen->username, undef, 'missing credentials - username not set' ); is( $cgiapp->param('post_login'),1,'missing credentials - POST_LOGIN_CALLBACK executed' ); # Successful Login $query = CGI->new( { authen_username => 'user1', authen_password => '123', rm => 'two' } ); $cgiapp = TestAppAuthenticate->new( QUERY => $query ); $results = $cgiapp->run; ok($cgiapp->authen->is_authenticated,'successful login'); is( $cgiapp->authen->username, 'user1', 'successful login - username set' ); is( $cgiapp->authen->login_attempts, 0, "successful login - failed login count" ); is( $cgiapp->param('post_login'),1,'successful login - POST_LOGIN_CALLBACK executed' ); # Bad user or password $query = CGI->new( { authen_username => 'user2', authen_password => '123', rm => 'two' } ); $cgiapp = TestAppAuthenticate->new( QUERY => $query ); $results = $cgiapp->run; ok(!$cgiapp->authen->is_authenticated,'login failure'); is( $cgiapp->authen->username, undef, "login failure - username not set" ); is( $cgiapp->authen->login_attempts, 1, "login failure - failed login count" ); is( $cgiapp->param('post_login'),1,'login failure - POST_LOGIN_CALLBACK executed' ); 61_store_cookie_other.t000444001750001750 1155011563746137 26233 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t#!/usr/bin/perl use strict; use warnings; use lib qw(t); use Readonly; Readonly my $SECRET_WARN => qr/using default SECRET\! Please provide a proper SECRET when using the Cookie store/; use Test::NoWarnings; use CGI::Util; use Test::More; plan tests => 25; { package TestAppStoreCookie; use Test::More; use Test::Warn; use base qw(TestAppStore); __PACKAGE__->authen->config( DRIVER => [ 'Generic', { 'test' => '123' } ], STORE => [ 'Cookie', EXPIRY=>'+1y'], CREDENTIALS => [qw(auth_username auth_password)], ); sub get_store_entries { my $class = shift; my $cgiapp = shift; my $results = shift; my ($capauth_data, $therest) = $results =~ qr/^Set\-Cookie:\s+CAPAUTH_DATA=([\d\w%]+);(.*)$/m; return undef unless $capauth_data; main::like($therest, qr/expires=/, 'Expiry on the cookie is set'); my $data = CGI::Util::unescape($capauth_data); return $data ? $cgiapp->authen->store->_decode($data) : undef; } sub maintain_state { my $class = shift; my $old_cgiapp = shift; my $old_results = shift; my $new_query = shift; delete $ENV{'COOKIE'}; $old_results =~ qr/Set\-Cookie:\s+(CAPAUTH_DATA=[\d\w%]+);/; $ENV{'COOKIE'} = $1 if $1; } sub clear_state { my $class = shift; delete $ENV{'COOKIE'}; $class->SUPER::clear_state(@_); } sub run_store_tests { my $class = shift; my ( $cgiapp, $results, $store_entries ); # Regular call to unprotected page shouldn't create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'unprotected' } ); ok(!$store_entries, "Store entry not created when calling unprotected page" ); # Regular call to protected page (without a valid login) shouldn't create a store entry ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected' } ); ok(!$store_entries, "Store entry not created when calling protected page without valid login" ); # Regular call to protected page (with an invalid login) should create a store entry marking login attempts warnings_like { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => 'badpassword' } ); } [$SECRET_WARN, $SECRET_WARN], 'bad SECRET warning'; ok(!$cgiapp->authen->is_authenticated,'failed login attempt'); ok($store_entries, "Store entry created when calling protected page with invalid login" ); isnt($store_entries->{username}, 'test', "Store entry contained the right username" ); is($store_entries->{login_attempts}, 1, "Store entry contained the right value for login_attempts" ); # Regular call to protected page (with an invalid login) should create a store entry marking login attempts warnings_like { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => 'badpassword' } ); } [$SECRET_WARN, $SECRET_WARN, $SECRET_WARN], 'bad SECRET warning'; ok(!$cgiapp->authen->is_authenticated,'failed login attempt'); ok($store_entries, "Store entry created when calling protected page with invalid login" ); isnt($store_entries->{username}, 'test', "Store entry contained the right username" ); is($store_entries->{login_attempts}, 2, "Store entry contained the right value for login_attempts" ); # Regular call to protected page (with a valid login) should create a store entry warnings_like { ($cgiapp, $results, $store_entries) = $class->run_app( { rm => 'protected', auth_username => 'test', auth_password => '123' } ); } [$SECRET_WARN, $SECRET_WARN, $SECRET_WARN], 'bad SECRET warning'; ok($cgiapp->authen->is_authenticated,'successful login'); ok($store_entries, "Store entry created when calling protected page with valid login" ); is($store_entries->{username}, 'test', "Store entry contained the right username" ); ok(!$store_entries->{login_attempts}, "Store entry cleared login_attempts" ); my $nothing = $cgiapp->authen->store->_decode(''); is($nothing, undef, 'decode nothing'); use MIME::Base64; my %hash = (c=>'I am not a checksum',f=>'Bubble'); my $rawdata = join("\0", map {join ('=', $_, $hash{$_}) } keys %hash); my $nonsense; warning_like { $nonsense = $cgiapp->authen->store->_decode(MIME::Base64::encode($rawdata)); } $SECRET_WARN, 'decode warning'; is($nonsense, undef, 'decode nonsense'); { use CGI::Application::Plugin::Authentication::Store::Cookie; $CGI::Application::Plugin::Authentication::Store::Cookie::SECRET = 'you would never guess'; } $nonsense = $cgiapp->authen->store->_decode(MIME::Base64::encode($rawdata)); is($nonsense, undef, 'decode nonsense with secret'); } } TestAppStoreCookie->run_store_tests; Authen000755001750001750 011563746137 22717 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tSimple000755001750001750 011563746137 24150 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/AuthenDummy.pm000444001750001750 73511563746137 25723 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/Authen/Simplepackage Authen::Simple::Dummy; use strict; use warnings; use base 'Authen::Simple::Adapter'; use Params::Validate; __PACKAGE__->options({ testuser => { type => Params::Validate::SCALAR, optional => 1 }, testpass => { type => Params::Validate::SCALAR, optional => 1 }, }); sub check { my ( $self, $username, $password ) = @_; return $username eq $self->testuser && $password eq $self->testpass ? 1 : 0; } 1; CGI000755001750001750 011563746137 22075 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tApplication000755001750001750 011563746137 24340 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGIPlugin000755001750001750 011563746137 25576 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/ApplicationAuthentication000755001750001750 011563746137 30555 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/Application/PluginDisplay000755001750001750 011563746137 32162 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/Application/Plugin/AuthenticationNull.pm000444001750001750 43611563746137 33552 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/Application/Plugin/Authentication/Displaypackage CGI::Application::Plugin::Authentication::Display::Null; use base CGI::Application::Plugin::Authentication::Display; sub new { my $class = shift; my $self = CGI::Application::Plugin::Authentication::Display->new(shift); bless $self, $class; return $self; } 1 Driver000755001750001750 011563746137 32010 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/Application/Plugin/AuthenticationSilly.pm000444001750001750 20311563746137 33552 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/Application/Plugin/Authentication/Driverpackage CGI::Application::Plugin::Authentication::Driver::Silly; use base qw(CGI::Application::Plugin::Authentication::Driver); 1 Die.pm000444001750001750 23611563746137 33165 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/CGI/Application/Plugin/Authentication/Driverpackage CGI::Application::Plugin::Authentication::Driver::Die; use base qw(CGI::Application::Plugin::Authentication::Driver); sub new { return undef; } 1 out000755001750001750 011563746137 22302 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tredirection_failure_basic000444001750001750 343211563746137 27543 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
logout000444001750001750 12611563746137 23652 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outStatus: 302 Found Set-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Location: / frontpage000444001750001750 7511563746137 24311 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 This is publicpercentage000444001750001750 1366111563746137 24526 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
names_of_colours_2000444001750001750 1363711563746137 26172 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
success-dev000444001750001750 764311563746137 24620 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 This is private runmode000444001750001750 20211563746137 24005 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 THREErestricted000444001750001750 20011563746137 24502 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 TWOgrey_extra2000444001750001750 1327611563746137 24646 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
default000444001750001750 1327611563746137 24037 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
red000444001750001750 1327611563746137 23165 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
redirect000444001750001750 15211563746137 24141 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outStatus: 302 Found Set-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Location: http://news.bbc.co.uk green000444001750001750 1327611563746137 23513 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
grey2000444001750001750 1364411563746137 23442 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
basic_login_box_options000444001750001750 261111563746137 27256 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
basic_login_box000444001750001750 264111563746137 25506 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
grey_extra000444001750001750 1327611563746137 24564 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
loginurl000444001750001750 15011563746137 24171 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outStatus: 302 Found Set-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Location: http://www.perl.org grey000444001750001750 1361711563746137 23360 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
generic_login000444001750001750 1413211563746137 25207 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 Sign In
username-basic000444001750001750 355211563746137 25265 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 Sign In
names_of_colours_3000444001750001750 1363411563746137 26170 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
missing_color000444001750001750 1366111563746137 25260 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
redirection_failure000444001750001750 1363211563746137 26425 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
cosmetic000444001750001750 246711563746137 24201 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/out
success000444001750001750 16211563746137 24011 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 This is privatelogin000444001750001750 1367211563746137 23523 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
frontpage-dev000444001750001750 743211563746137 25131 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 This is public names_of_colours000444001750001750 1364011563746137 25743 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
crlf000444001750001750 20011563746137 23260 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 TWOlogin-dev000444001750001750 743211563746137 24254 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 This is public other_permutations000444001750001750 1375311563746137 26346 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outContent-Type: text/html; charset=ISO-8859-1 Sign In
username000444001750001750 1375211563746137 24231 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/outSet-Cookie: CAPAUTH_DATA=; path=/; expires=; Date Content-Type: text/html; charset=ISO-8859-1 Sign In
Store000755001750001750 011563746137 22567 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/tDummy.pm000444001750001750 111511563746137 24353 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/t/Storepackage Store::Dummy; use strict; use warnings; use base qw(CGI::Application::Plugin::Authentication::Store); sub initialize { my $self = shift; my ($storage) = $self->options; $self->{__DUMMY} = $storage || {}; } sub fetch { my $self = shift; return (map { $self->{__DUMMY}->{$_}||undef } @_)[0..$#_]; } sub save { my $self = shift; my %data = @_; foreach my $key (keys %data) { $self->{__DUMMY}->{$key} = $data{$key}; } return 1; } sub delete { my $self = shift; delete $self->{__DUMMY}->{$_} foreach @_; return 1; } 1; lib000755001750001750 011563746137 21776 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20CGI000755001750001750 011563746137 22400 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/libApplication000755001750001750 011563746137 24643 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/lib/CGIPlugin000755001750001750 011563746137 26101 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/lib/CGI/ApplicationAuthentication.pm000444001750001750 16574511563746137 31635 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Pluginpackage CGI::Application::Plugin::Authentication; use 5.006; use strict; our $VERSION = '0.20'; our %__CONFIG; use Class::ISA (); use Scalar::Util (); use UNIVERSAL::require; use Carp; use CGI (); sub import { my $pkg = shift; my $callpkg = caller; { no strict qw(refs); *{$callpkg.'::authen'} = \&CGI::Application::Plugin::_::Authentication::authen; } if ( ! UNIVERSAL::isa($callpkg, 'CGI::Application') ) { warn "Calling package is not a CGI::Application module so not setting up the prerun hook. If you are using \@ISA instead of 'use base', make sure it is in a BEGIN { } block, and make sure these statements appear before the plugin is loaded"; } else { $callpkg->add_callback( prerun => \&prerun_callback ); } } use Attribute::Handlers; my %RUNMODES; sub CGI::Application::RequireAuthentication : ATTR(CODE) { my ( $package, $symbol, $referent, $attr, $data, $phase ) = @_; $RUNMODES{$referent} = $data || 1; } sub CGI::Application::Authen : ATTR(CODE) { my ( $package, $symbol, $referent, $attr, $data, $phase ) = @_; $RUNMODES{$referent} = $data || 1; } =head1 NAME CGI::Application::Plugin::Authentication - Authentication framework for CGI::Application =head1 VERSION This document describes CGI::Application::Plugin::Authentication version 0.20 =head1 SYNOPSIS package MyCGIApp; use base qw(CGI::Application); # make sure this occurs before you load the plugin use CGI::Application::Plugin::Authentication; MyCGIApp->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], ); MyCGIApp->authen->protected_runmodes('myrunmode'); sub myrunmode { my $self = shift; # The user should be logged in if we got here my $username = $self->authen->username; } =head1 DESCRIPTION CGI::Application::Plugin::Authentication adds the ability to authenticate users in your L modules. It imports one method called 'authen' into your CGI::Application module. Through the authen method you can call all the methods of the CGI::Application::Plugin::Authentication plugin. There are two main decisions that you need to make when using this module. How will the usernames and password be verified (i.e. from a database, LDAP, etc...), and how can we keep the knowledge that a user has already logged in persistent, so that they will not have to enter their credentials again on the next request (i.e. how do we 'Store' the authentication information across requests). =head2 Choosing a Driver There are three drivers that are included with the distribution. Also, there is built in support for all of the Authen::Simple modules (search CPAN for Authen::Simple for more information). This should be enough to cover everyone's needs. If you need to authenticate against a source that is not provided, you can use the Generic driver which will accept either a hash of username/password pairs, or an array of arrays of credentials, or a subroutine reference that can verify the credentials. So through the Generic driver you should be able to write your own verification system. There is also a Dummy driver, which blindly accepts any credentials (useful for testing). See the L, L and, L docs for more information on how to use these drivers. And see the L suite of modules for information on those drivers. =head2 Choosing a Store The Store modules keep information about the authentication status of the user persistent across multiple requests. The information that is stored in the store include the username, and the expiry time of the login. There are two Store modules included with this distribution. A Session based store, and a Cookie based store. If your application is already using Sessions (through the L module), then I would recommend that you use the Session store for authentication. If you are not using the Session plugin, then you can use the Cookie store. The Cookie store keeps all the authentication in a cookie, which contains a checksum to ensure that users can not change the information. If you do not specify which Store module you wish to use, the plugin will try to determine the best one for you. =head2 Login page The Authentication plugin comes with a default login page that can be used if you do not want to create a custom login page. This login form will automatically be used if you do not provide either a LOGIN_URL or LOGIN_RUNMODE parameter in the configuration. If you plan to create your own login page, I would recommend that you start with the HTML code for the default login page, so that your login page will contain the correct form fields and hidden fields. =head2 Ticket based authentication This Authentication plugin can handle ticket based authentication systems as well. All that is required of you is to write a Store module that can understand the contents of the ticket. The Authentication plugin will require at least the 'username' to be retrieved from the ticket. A Ticket based authentication scheme will not need a Driver module at all, since the actual verification of credentials is done by an external authentication system, possibly even on a different host. You will need to specify the location of the login page using the LOGIN_URL configuration variable, and unauthenticated users will automatically be redirected to your ticket authentication login page. =head1 EXPORTED METHODS =head2 authen This is the only method exported from this module. Everything is controlled through this method call, which will return a CGI::Application::Plugin::Authentication object, or just the class name if called as a class method. When using the plugin, you will always first call $self->authen or __PACKAGE__->authen and then the method you wish to invoke. For example: __PACKAGE__->authen->config( LOGIN_RUNMODE => 'login', ); - or - $self->authen->protected_runmodes(qw(one two)); =cut { package # Hide from PAUSE CGI::Application::Plugin::_::Authentication; ############################################## ### ### authen ### ############################################## # # Return an authen object that can be used # for managing authentication. # # This will return a class name if called # as a class name, and a singleton object # if called as an object method # sub authen { my $cgiapp = shift; if (ref($cgiapp)) { return CGI::Application::Plugin::Authentication->instance($cgiapp); } else { return 'CGI::Application::Plugin::Authentication'; } } } package CGI::Application::Plugin::Authentication; =head1 METHODS =head2 config This method is used to configure the CGI::Application::Plugin::Authentication module. It can be called as an object method, or as a class method. Calling this function, will not itself generate cookies or session ids. The following parameters are accepted: =over 4 =item DRIVER Here you can choose which authentication module(s) you want to use to perform the authentication. For simplicity, you can leave off the CGI::Application::Plugin::Authentication::Driver:: part when specifying the DRIVER name If this module requires extra parameters, you can pass an array reference that contains as the first parameter the name of the module, and the rest of the values in the array will be considered options for the driver. You can provide multiple drivers which will be used, in order, to check the credentials until a valid response is received. DRIVER => 'Dummy' # let anyone in regardless of the password - or - DRIVER => [ 'DBI', DBH => $self->dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'MD5:user.password' => '__CREDENTIAL_2__' }, ], - or - DRIVER => [ [ 'Generic', { user1 => '123' } ], [ 'Generic', sub { my ($u, $p) = @_; is_prime($p) ? 1 : 0 } ] ], - or - DRIVER => [ 'Authen::Simple::LDAP', host => 'ldap.company.com', basedn => 'ou=People,dc=company,dc=net' ], =item STORE Here you can choose how we store the authenticated information after a user has successfully logged in. We need to store the username so that on the next request we can tell the user has already logged in, and we do not have to present them with another login form. If you do not provide the STORE option, then the plugin will look to see if you are using the L module and based on that info use either the Session module, or fall back on the Cookie module. If the module requires extra parameters, you can pass an array reference that contains as the first parameter the name of the module, and the rest of the array should contain key value pairs of options for this module. These storage modules generally live under the CGI::Application::Plugin::Authentication::Store:: name-space, and this part of the package name can be left off when specifying the STORE parameter. STORE => 'Session' - or - STORE => ['Cookie', NAME => 'MYAuthCookie', SECRET => 'FortyTwo', EXPIRY => '1d', ] =item POST_LOGIN_RUNMODE Here you can specify a runmode that the user will be redirected to if they successfully login. POST_LOGIN_RUNMODE => 'welcome' =item POST_LOGIN_URL Here you can specify a URL that the user will be redirected to if they successfully login. If both POST_LOGIN_URL and POST_LOGIN_RUNMODE are specified, then the latter will take precedence. POST_LOGIN_URL => 'http://example.com/start.cgi' =item POST_LOGIN_CALLBACK A code reference that is executed after login processing but before POST_LOGIN_RUNMODE or redirecting to POST_LOGIN_URL. This is normally a method in your CGI::Application application and as such the CGI::Application object is passed as a parameter. POST_LOGIN_CALLBACK => \&update_login_date and later in your code: sub update_login_date { my $self = shift; return unless($self->authen->is_authenticated); ... } =item LOGIN_RUNMODE Here you can specify a runmode that the user will be redirected to if they need to login. LOGIN_RUNMODE => 'login' =item LOGIN_URL If your login page is external to this module, then you can use this option to specify a URL that the user will be redirected to when they need to login. If both LOGIN_URL and LOGIN_RUNMODE are specified, then the latter will take precedence. LOGIN_URL => 'http://example.com/login.cgi' =item LOGOUT_RUNMODE Here you can specify a runmode that the user will be redirected to if they ask to logout. LOGOUT_RUNMODE => 'logout' =item LOGOUT_URL If your logout page is external to this module, then you can use this option to specify a URL that the user will be redirected to when they ask to logout. If both LOGOUT_URL and LOGOUT_RUNMODE are specified, then the latter will take precedence. LOGIN_URL => 'http://example.com/logout.html' =item DETAINT_URL_REGEXP This is a regular expression used to detaint URLs used in the login form. By default it will be set to ^([\w\_\%\?\&\;\-\/\@\.\+\$\=\#\:\!\*\"\'\(\)\,]+)$ This regular expression is based upon the document http://www.w3.org/Addressing/URL/url-spec.txt. You could set it to a more specific regular expression to limit the domains to which users could be directed. =item DETAINT_USERNAME_REGEXP This is a regular expression used to detaint the username parameter used in the login form. By default it will be set to ^([\w\_]+)$ =item CREDENTIALS Set this to the list of form fields where the user will type in their username and password. By default this is set to ['authen_username', 'authen_password']. The form field names should be set to a value that you are not likely to use in any other forms. This is important because this plugin will automatically look for query parameters that match these values on every request to see if a user is trying to log in. So if you use the same parameter names on a user management page, you may inadvertently perform a login when that was not intended. Most of the Driver modules will return the first CREDENTIAL as the username, so make sure that you list the username field first. This option can be ignored if you use the built in login box CREDENTIALS => 'authen_password' - or - CREDENTIALS => [ 'authen_username', 'authen_domain', 'authen_password' ] =item LOGIN_SESSION_TIMEOUT This option can be used to tell the system when to force the user to re-authenticate. There are a few different possibilities that can all be used concurrently: =over 4 =item IDLE_FOR If this value is set, a re-authentication will be forced if the user was idle for more then x amount of time. =item EVERY If this value is set, a re-authentication will be forced every x amount of time. =item CUSTOM This value can be set to a subroutine reference that returns true if the session should be timed out, and false if it is still active. This can allow you to be very selective about how the timeout system works. The authen object will be passed in as the only parameter. =back Time values are specified in seconds. You can also specify the time by using a number with the following suffixes (m h d w), which represent minutes, hours, days and weeks. The default is 0 which means the login will never timeout. Note that the login is also dependent on the type of STORE that is used. If the Session store is used, and the session expires, then the login will also automatically expire. The same goes for the Cookie store. For backwards compatibility, if you set LOGIN_SESSION_TIMEOUT to a time value instead of a hashref, it will be treated as an IDLE_FOR time out. # force re-authentication if idle for more than 15 minutes LOGIN_SESSION_TIMEOUT => '15m' # Everyone must re-authentication if idle for more than 30 minutes # also, everyone must re-authentication at least once a day # and root must re-authentication if idle for more than 5 minutes LOGIN_SESSION_TIMEOUT => { IDLE_FOR => '30m', EVERY => '1d', CUSTOM => sub { my $authen = shift; return ($authen->username eq 'root' && (time() - $authen->last_access) > 300) ? 1 : 0; } } =item RENDER_LOGIN This value can be set to a subroutine reference that returns the HTML of a login form. The subroutine reference overrides the default call to login_box. The subroutine is normally a method in your CGI::Application application and as such the CGI::Application object is passed as the first parameter. RENDER_LOGIN => \&login_form and later in your code: sub login_form { my $self = shift; ... return $html } =item LOGIN_FORM You can set this option to customize the login form that is created when a user needs to be authenticated. If you wish to replace the entire login form with a completely custom version, then just set LOGIN_RUNMODE to point to your custom runmode. All of the parameters listed below are optional, and a reasonable default will be used if left blank: =over 4 =item DISPLAY_CLASS (default: Classic) the class used to display the login form. The alternative is C which aims for XHTML compliance and leaving style to CSS. See L for more details. =item TITLE (default: Sign In) the heading at the top of the login box =item USERNAME_LABEL (default: User Name) the label for the user name input =item PASSWORD_LABEL (default: Password) the label for the password input =item SUBMIT_LABEL (default: Sign In) the label for the submit button =item COMMENT (default: Please enter your username and password in the fields below.) a message provided on the first login attempt =item REMEMBERUSER_OPTION (default: 1) provide a checkbox to offer to remember the users name in a cookie so that their user name will be pre-filled the next time they log in =item REMEMBERUSER_LABEL (default: Remember User Name) the label for the remember user name checkbox =item REMEMBERUSER_COOKIENAME (default: CAPAUTHTOKEN) the name of the cookie where the user name will be saved =item REGISTER_URL (default: ) the URL for the register new account link =item REGISTER_LABEL (default: Register Now!) the label for the register new account link =item FORGOTPASSWORD_URL (default: ) the URL for the forgot password link =item FORGOTPASSWORD_LABEL (default: Forgot Password?) the label for the forgot password link =item INVALIDPASSWORD_MESSAGE (default: Invalid username or password
(login attempt %d) a message given when a login failed =item INCLUDE_STYLESHEET (default: 1) use this to disable the built in style-sheet for the login box so you can provide your own custom styles =item FORM_SUBMIT_METHOD (default: post) use this to get the form to submit using 'get' instead of 'post' =item FOCUS_FORM_ONLOAD (default: 1) use this to automatically focus the login form when the page loads so a user can start typing right away. =item BASE_COLOUR (default: #445588) This is the base colour that will be used in the included login box. All other colours are automatically calculated based on this colour (unless you hardcode the colour values). In order to calculate other colours, you will need the Color::Calc module. If you do not have the Color::Calc module, then you will need to use fixed values for all of the colour options. All colour values besides the BASE_COLOUR can be simple percentage values (including the % sign). For example if you set the LIGHTER_COLOUR option to 80%, then the calculated colour will be 80% lighter than the BASE_COLOUR. =item LIGHT_COLOUR (default: 50% or #a2aac4) A colour that is lighter than the base colour. =item LIGHTER_COLOUR (default: 75% or #d0d5e1) A colour that is another step lighter than the light colour. =item DARK_COLOUR (default: 30% or #303c5f) A colour that is darker than the base colour. =item DARKER_COLOUR (default: 60% or #1b2236) A colour that is another step darker than the dark colour. =item GREY_COLOUR (default: #565656) A grey colour that is calculated by desaturating the base colour. =back =back =cut sub config { my $self = shift; my $class = ref $self ? ref $self : $self; die "Calling config after the Authentication object has already been initialized" if ref $self && defined $self->{initialized}; my $config = $self->_config; if (@_) { my $props; if ( ref( $_[0] ) eq 'HASH' ) { my $rthash = %{ $_[0] }; $props = CGI::Application->_cap_hash( $_[0] ); } else { $props = CGI::Application->_cap_hash( {@_} ); } # Check for DRIVER if ( defined $props->{DRIVER} ) { croak "authen config error: parameter DRIVER is not a string or arrayref" if ref $props->{DRIVER} && Scalar::Util::reftype( $props->{DRIVER} ) ne 'ARRAY'; $config->{DRIVER} = delete $props->{DRIVER}; # We will accept a string, or an arrayref of options, but what we really want # is an array of arrayrefs of options, so that we can support multiple drivers # each with their own custom options no warnings qw(uninitialized); $config->{DRIVER} = [ $config->{DRIVER} ] if Scalar::Util::reftype( $config->{DRIVER} ) ne 'ARRAY'; $config->{DRIVER} = [ $config->{DRIVER} ] if Scalar::Util::reftype( $config->{DRIVER}->[0] ) ne 'ARRAY'; } # Check for STORE if ( defined $props->{STORE} ) { croak "authen config error: parameter STORE is not a string or arrayref" if ref $props->{STORE} && Scalar::Util::reftype( $props->{STORE} ) ne 'ARRAY'; $config->{STORE} = delete $props->{STORE}; # We will accept a string, but what we really want is an arrayref of the store driver, # and any custom options no warnings qw(uninitialized); $config->{STORE} = [ $config->{STORE} ] if Scalar::Util::reftype( $config->{STORE} ) ne 'ARRAY'; } # Check for POST_LOGIN_RUNMODE if ( defined $props->{POST_LOGIN_RUNMODE} ) { croak "authen config error: parameter POST_LOGIN_RUNMODE is not a string" if ref $props->{POST_LOGIN_RUNMODE}; $config->{POST_LOGIN_RUNMODE} = delete $props->{POST_LOGIN_RUNMODE}; } # Check for POST_LOGIN_URL if ( defined $props->{POST_LOGIN_URL} ) { carp "authen config warning: parameter POST_LOGIN_URL ignored since we already have POST_LOGIN_RUNMODE" if $config->{POST_LOGIN_RUNMODE}; croak "authen config error: parameter POST_LOGIN_URL is not a string" if ref $props->{POST_LOGIN_URL}; $config->{POST_LOGIN_URL} = delete $props->{POST_LOGIN_URL}; } # Check for LOGIN_RUNMODE if ( defined $props->{LOGIN_RUNMODE} ) { croak "authen config error: parameter LOGIN_RUNMODE is not a string" if ref $props->{LOGIN_RUNMODE}; $config->{LOGIN_RUNMODE} = delete $props->{LOGIN_RUNMODE}; } # Check for LOGIN_URL if ( defined $props->{LOGIN_URL} ) { carp "authen config warning: parameter LOGIN_URL ignored since we already have LOGIN_RUNMODE" if $config->{LOGIN_RUNMODE}; croak "authen config error: parameter LOGIN_URL is not a string" if ref $props->{LOGIN_URL}; $config->{LOGIN_URL} = delete $props->{LOGIN_URL}; } # Check for LOGOUT_RUNMODE if ( defined $props->{LOGOUT_RUNMODE} ) { croak "authen config error: parameter LOGOUT_RUNMODE is not a string" if ref $props->{LOGOUT_RUNMODE}; $config->{LOGOUT_RUNMODE} = delete $props->{LOGOUT_RUNMODE}; } # Check for LOGOUT_URL if ( defined $props->{LOGOUT_URL} ) { carp "authen config warning: parameter LOGOUT_URL ignored since we already have LOGOUT_RUNMODE" if $config->{LOGOUT_RUNMODE}; croak "authen config error: parameter LOGOUT_URL is not a string" if ref $props->{LOGOUT_URL}; $config->{LOGOUT_URL} = delete $props->{LOGOUT_URL}; } # Check for CREDENTIALS if ( defined $props->{CREDENTIALS} ) { croak "authen config error: parameter CREDENTIALS is not a string or arrayref" if ref $props->{CREDENTIALS} && Scalar::Util::reftype( $props->{CREDENTIALS} ) ne 'ARRAY'; $config->{CREDENTIALS} = delete $props->{CREDENTIALS}; # We will accept a string, but what we really want is an arrayref of the credentials no warnings qw(uninitialized); $config->{CREDENTIALS} = [ $config->{CREDENTIALS} ] if Scalar::Util::reftype( $config->{CREDENTIALS} ) ne 'ARRAY'; } # Check for LOGIN_SESSION_TIMEOUT if ( defined $props->{LOGIN_SESSION_TIMEOUT} ) { croak "authen config error: parameter LOGIN_SESSION_TIMEOUT is not a string or a hashref" if ref $props->{LOGIN_SESSION_TIMEOUT} && ref$props->{LOGIN_SESSION_TIMEOUT} ne 'HASH'; my $options = {}; if (! ref $props->{LOGIN_SESSION_TIMEOUT}) { $options->{IDLE_FOR} = _time_to_seconds( $props->{LOGIN_SESSION_TIMEOUT} ); croak "authen config error: parameter LOGIN_SESSION_TIMEOUT is not a valid time string" unless defined $options->{IDLE_FOR}; } else { if ($props->{LOGIN_SESSION_TIMEOUT}->{IDLE_FOR}) { $options->{IDLE_FOR} = _time_to_seconds( delete $props->{LOGIN_SESSION_TIMEOUT}->{IDLE_FOR} ); croak "authen config error: IDLE_FOR option to LOGIN_SESSION_TIMEOUT is not a valid time string" unless defined $options->{IDLE_FOR}; } if ($props->{LOGIN_SESSION_TIMEOUT}->{EVERY}) { $options->{EVERY} = _time_to_seconds( delete $props->{LOGIN_SESSION_TIMEOUT}->{EVERY} ); croak "authen config error: EVERY option to LOGIN_SESSION_TIMEOUT is not a valid time string" unless defined $options->{EVERY}; } if ($props->{LOGIN_SESSION_TIMEOUT}->{CUSTOM}) { $options->{CUSTOM} = delete $props->{LOGIN_SESSION_TIMEOUT}->{CUSTOM}; croak "authen config error: CUSTOM option to LOGIN_SESSION_TIMEOUT must be a code reference" unless ref $options->{CUSTOM} eq 'CODE'; } croak "authen config error: Invalid option(s) (" . join( ', ', keys %{$props->{LOGIN_SESSION_TIMEOUT}} ) . ") passed to LOGIN_SESSION_TIMEOUT" if %{$props->{LOGIN_SESSION_TIMEOUT}}; } $config->{LOGIN_SESSION_TIMEOUT} = $options; delete $props->{LOGIN_SESSION_TIMEOUT}; } # Check for POST_LOGIN_CALLBACK if ( defined $props->{POST_LOGIN_CALLBACK} ) { croak "authen config error: parameter POST_LOGIN_CALLBACK is not a coderef" unless( ref $props->{POST_LOGIN_CALLBACK} eq 'CODE' ); $config->{POST_LOGIN_CALLBACK} = delete $props->{POST_LOGIN_CALLBACK}; } # Check for RENDER_LOGIN if ( defined $props->{RENDER_LOGIN} ) { croak "authen config error: parameter RENDER_LOGIN is not a coderef" unless( ref $props->{RENDER_LOGIN} eq 'CODE' ); $config->{RENDER_LOGIN} = delete $props->{RENDER_LOGIN}; } # Check for LOGIN_FORM if ( defined $props->{LOGIN_FORM} ) { croak "authen config error: parameter LOGIN_FORM is not a hashref" unless( ref $props->{LOGIN_FORM} eq 'HASH' ); $config->{LOGIN_FORM} = delete $props->{LOGIN_FORM}; } # Check for DETAINT_URL_REGEXP if ( defined $props->{DETAINT_URL_REGEXP} ) { $config->{DETAINT_URL_REGEXP} = delete $props->{DETAINT_URL_REGEXP}; } else { $config->{DETAINT_URL_REGEXP} = '^([\w\_\%\?\&\;\-\/\@\.\+\$\=\#\:\!\*\"\'\(\)\,]+)$'; } # Check for DETAINT_USERNAME_REGEXP if ( defined $props->{DETAINT_USERNAME_REGEXP} ) { $config->{DETAINT_USERNAME_REGEXP} = delete $props->{DETAINT_USERNAME_REGEXP}; } else { $config->{DETAINT_USERNAME_REGEXP} = '^([\w\_]+)$'; } # If there are still entries left in $props then they are invalid croak "Invalid option(s) (" . join( ', ', keys %$props ) . ") passed to config" if %$props; } } =head2 protected_runmodes This method takes a list of runmodes that are to be protected by authentication. If a user tries to access one of these runmodes, then they will be redirected to a login page unless they are properly logged in. The runmode names can be a list of simple strings, regular expressions, or special directives that start with a colon. This method is cumulative, so if it is called multiple times, the new values are added to existing entries. It returns a list of all entries that have been saved so far. Calling this function, will not itself generate cookies or session ids. =over 4 =item :all - All runmodes in this module will require authentication =back # match all runmodes __PACKAGE__->authen->protected_runmodes(':all'); # only protect runmodes one two and three __PACKAGE__->authen->protected_runmodes(qw(one two three)); # protect only runmodes that start with auth_ __PACKAGE__->authen->protected_runmodes(qr/^auth_/); # protect all runmodes that *do not* start with public_ __PACKAGE__->authen->protected_runmodes(qr/^(?!public_)/); =cut sub protected_runmodes { my $self = shift; my $config = $self->_config; $config->{PROTECTED_RUNMODES} ||= []; push @{$config->{PROTECTED_RUNMODES}}, @_ if @_; return @{$config->{PROTECTED_RUNMODES}}; } =head2 is_protected_runmode This method accepts the name of a runmode, and will tell you if that runmode is a protected runmode (i.e. does a user need to be authenticated to access this runmode). Calling this function, will not itself generate cookies or session ids. =cut sub is_protected_runmode { my $self = shift; my $runmode = shift; foreach my $runmode_test ($self->protected_runmodes) { if (overload::StrVal($runmode_test) =~ /^Regexp=/) { # We were passed a regular expression return 1 if $runmode =~ $runmode_test; } elsif (ref $runmode_test && ref $runmode_test eq 'CODE') { # We were passed a code reference return 1 if $runmode_test->($runmode); } elsif ($runmode_test eq ':all') { # all runmodes are protected return 1; } else { # assume we were passed a string return 1 if $runmode eq $runmode_test; } } # See if the user is using attributes my $sub = $self->_cgiapp->can($runmode); return 1 if $sub && $RUNMODES{$sub}; return; } =head2 redirect_after_login This method is be called during the prerun stage to redirect the user to the page that has been configured as the destination after a successful login. The location is determined as follows: =over =item POST_LOGIN_RUNMODE If the POST_LOGIN_RUNMODE config parameter is set, that run mode will be the chosen location. =item POST_LOGIN_URL If the above fails and the POST_LOGIN_URL config parameter is set, then there will be a 302 redirection to that location. =item destination If the above fails and there is a destination query parameter, which must a taint check against the DETAINT_URL_REGEXP config parameter, then there will be a 302 redirection to that location. =item original destination If all the above fail then there the originally requested page will be delivered. =back =cut sub redirect_after_login { my $self = shift; my $cgiapp = $self->_cgiapp; my $config = $self->_config; if ($config->{POST_LOGIN_RUNMODE}) { $cgiapp->prerun_mode($config->{POST_LOGIN_RUNMODE}); } elsif ($config->{POST_LOGIN_URL}) { $cgiapp->header_add(-location => $config->{POST_LOGIN_URL}); $cgiapp->header_type('redirect'); $cgiapp->prerun_mode('authen_dummy_redirect'); } elsif (my $destination = $cgiapp->authen->_detaint_destination()) { $cgiapp->header_add(-location => $destination); $cgiapp->header_type('redirect'); $cgiapp->prerun_mode('authen_dummy_redirect'); } return; } =head2 redirect_to_login This method is be called during the prerun stage if the current user is not logged in, and they are trying to access a protected runmode. It will redirect to the page that has been configured as the login page, based on the value of LOGIN_RUNMODE or LOGIN_URL If nothing is configured a simple login page will be automatically provided. =cut sub redirect_to_login { my $self = shift; my $cgiapp = $self->_cgiapp; my $config = $self->_config; if ($config->{LOGIN_RUNMODE}) { $cgiapp->prerun_mode($config->{LOGIN_RUNMODE}); } elsif ($config->{LOGIN_URL}) { $cgiapp->header_add(-location => $config->{LOGIN_URL}); $cgiapp->header_type('redirect'); $cgiapp->prerun_mode('authen_dummy_redirect'); } else { $cgiapp->prerun_mode('authen_login'); } } =head2 redirect_to_logout This method is called during the prerun stage if the user has requested to be logged out. It will redirect to the page that has been configured as the logout page, based on the value of LOGOUT_RUNMODE or LOGOUT_URL If nothing is configured, the page will redirect to the website homepage. =cut sub redirect_to_logout { my $self = shift; my $cgiapp = $self->_cgiapp; my $config = $self->_config; $self->logout(); if ($config->{LOGOUT_RUNMODE}) { $cgiapp->prerun_mode($config->{LOGOUT_RUNMODE}); } elsif ($config->{LOGOUT_URL}) { $cgiapp->header_add(-location => $config->{LOGOUT_URL}); $cgiapp->header_type('redirect'); $cgiapp->prerun_mode('authen_dummy_redirect'); } else { $cgiapp->header_add(-location => '/'); $cgiapp->header_type('redirect'); $cgiapp->prerun_mode('authen_dummy_redirect'); } } =head2 setup_runmodes This method is called during the prerun stage to register some custom runmodes that the Authentication plugin requires in order to function. Calling this function, will not itself generate cookies or session ids. =cut sub setup_runmodes { my $self = shift; my $config = $self->_config; $self->_cgiapp->run_modes( authen_login => \&authen_login_runmode ) unless $config->{LOGIN_RUNMODE} || $config->{LOGIN_URL}; $self->_cgiapp->run_modes( authen_logout => \&authen_logout_runmode ) unless $config->{LOGOUT_RUNMODE} || $config->{LOGOUT_URL}; $self->_cgiapp->run_modes( authen_dummy_redirect => \&authen_dummy_redirect ); return; } =head2 last_login This will return return the time of the last login for this user my $last_login = $self->authen->last_login; This function will initiate a session or cookie if one has not been created already. =cut sub last_login { my $self = shift; my $new = shift; $self->initialize; return unless $self->username; my $old = $self->store->fetch('last_login'); $self->store->save('last_login' => $new) if $new; return $old; } =head2 last_access This will return return the time of the last access for this user my $last_access = $self->authen->last_access; This function will initiate a session or cookie if one has not been created already. =cut sub last_access { my $self = shift; my $new = shift; $self->initialize; return unless $self->username; my $old = $self->store->fetch('last_access'); $self->store->save('last_access' => $new) if $new; return $old; } =head2 is_login_timeout This will return true or false depending on whether the users login status just timed out $self->add_message('login session timed out') if $self->authen->is_login_timeout; This function will initiate a session or cookie if one has not been created already. =cut sub is_login_timeout { my $self = shift; $self->initialize; return $self->{is_login_timeout} ? 1 : 0; } =head2 is_authenticated This will return true or false depending on the login status of this user assert($self->authen->is_authenticated); # The user should be logged in if we got here This function will initiate a session or cookie if one has not been created already. =cut sub is_authenticated { my $self = shift; $self->initialize; return $self->username ? 1 : 0; } =head2 login_attempts This method will return the number of failed login attempts have been made by this user since the last successful login. This is not a number that can be trusted, as it is dependent on the underlying store to be able to return the correct value for this user. For example, if the store uses a cookie based session, the user trying to login could delete their cookies, and hence get a new session which will not have any login attempts listed. The number will be cleared upon a successful login. This function will initiate a session or cookie if one has not been created already. =cut sub login_attempts { my $self = shift; $self->initialize; my $la = $self->store->fetch('login_attempts'); return $la; } =head2 username This will return the username of the currently logged in user, or undef if no user is currently logged in. my $username = $self->authen->username; This function will initiate a session or cookie if one has not been created already. =cut sub username { my $self = shift; $self->initialize; my $u = $self->store->fetch('username'); return $u; } =head2 is_new_login This will return true or false depending on if this is a fresh login $self->log->info("New Login") if $self->authen->is_new_login; This function will initiate a session or cookie if one has not been created already. =cut sub is_new_login { my $self = shift; $self->initialize; return $self->{is_new_login}; } =head2 credentials This method will return the names of the form parameters that will be looked for during a login. By default they are authen_username and authen_password, but these values can be changed by supplying the CREDENTIALS parameters in the configuration. Calling this function, will not itself generate cookies or session ids. =cut sub credentials { my $self = shift; my $config = $self->_config; return $config->{CREDENTIALS} || [qw(authen_username authen_password)]; } =head2 logout This will attempt to logout the user. If during a request the Authentication module sees a parameter called 'authen_logout', it will automatically call this method to log out the user. $self->authen->logout(); This function will initiate a session or cookie if one has not been created already. =cut sub logout { my $self = shift; $self->initialize; $self->store->clear; } =head2 drivers This method will return a list of driver objects that are used for verifying the login credentials. Calling this function, will not itself generate cookies or session ids. =cut sub drivers { my $self = shift; if ( !$self->{drivers} ) { my $config = $self->_config; # Fetch the configuration parameters for the driver(s) my $driver_configs = defined $config->{DRIVER} ? $config->{DRIVER} : [['Dummy']]; foreach my $driver_config (@$driver_configs) { my ($drivername, @params) = @$driver_config; # add support for Authen::Simple modules if (index($drivername, 'Authen::Simple') == 0) { unshift @params, $drivername; $drivername = 'Authen::Simple'; } # Load the the class for this driver my $driver_class = _find_deligate_class( 'CGI::Application::Plugin::Authentication::Driver::' . $drivername, $drivername ) || die "Driver ".$drivername." can not be found"; # Create the driver object my $driver = $driver_class->new( $self, @params ) || die "Could not create new $driver_class object"; push @{$self->{drivers}}, $driver; } } my $drivers = $self->{drivers}; return @$drivers[0..$#$drivers]; } =head2 store This method will return a store object that is used to store information about the status of the authentication across multiple requests. This function will initiate a session or cookie if one has not been created already. =cut sub store { my $self = shift; if ( !$self->{store} ) { my $config = $self->_config; # Fetch the configuration parameters for the store my ($store_module, @store_config); ($store_module, @store_config) = @{ $config->{STORE} } if $config->{STORE} && ref $config->{STORE} eq 'ARRAY'; if (!$store_module) { # No STORE configuration was provided if ($self->_cgiapp->can('session') && UNIVERSAL::isa($self->_cgiapp->session, 'CGI::Session')) { # The user is already using the Session plugin ($store_module, @store_config) = ( 'Session' ); } else { # Fall back to the Cookie Store ($store_module, @store_config) = ( 'Cookie' ); } } # Load the the class for this store my $store_class = _find_deligate_class( 'CGI::Application::Plugin::Authentication::Store::' . $store_module, $store_module ) || die "Store $store_module can not be found"; # Create the store object $self->{store} = $store_class->new( $self, @store_config ) || die "Could not create new $store_class object"; } return $self->{store}; } =head2 initialize This does most of the heavy lifting for the Authentication plugin. It will check to see if the user is currently attempting to login by looking for the credential form fields in the query object. It will load the required driver objects and authenticate the user. It is OK to call this method multiple times as it checks to see if it has already been executed and will just return without doing anything if called multiple times. This allows us to call initialize as late as possible in the request so that no unnecessary work is done. The user will be logged out by calling the C method if the login session has been idle for too long, if it has been too long since the last login, or if the login has timed out. If you need to know if a user was logged out because of a time out, you can call the C method. If all goes well, a true value will be returned, although it is usually not necessary to check. This function will initiate a session or cookie if one has not been created already. =cut sub initialize { my $self = shift; return 1 if $self->{initialized}; # It would seem to make more sense to do this at the /end/ of the routine # but that causes an infinite loop. $self->{initialized} = 1; if (UNIVERSAL::can($self->_cgiapp, 'devpopup')) { $self->_cgiapp->add_callback( 'devpopup_report', \&_devpopup_report ); } my $config = $self->_config; # See if the user is trying to log in # We do this before checking to see if the user is already logged in, since # a logged in user may want to log in as a different user. my $field_names = $config->{CREDENTIALS} || [qw(authen_username authen_password)]; my $query = $self->_cgiapp->query; my @credentials = map { $query->param($_) } @$field_names; if ($credentials[0]) { # The user is trying to login # make sure if they are already logged in, that we log them out first my $store = $self->store; $store->clear if $store->fetch('username'); foreach my $driver ($self->drivers) { if (my $username = $driver->verify_credentials(@credentials)) { # This user provided the correct credentials # so save this new login in the store my $now = time(); $store->save( username => $username, login_attempts => 0, last_login => $now, last_access => $now ); $self->{is_new_login} = 1; # See if we are remembering the username for this user my $login_config = $config->{LOGIN_FORM} || {}; if ($login_config->{REMEMBERUSER_OPTION} && $query->param('authen_rememberuser')) { my $cookie = $query->cookie( -name => $login_config->{REMEMBERUSER_COOKIENAME} || 'CAPAUTHTOKEN', -value => $username, -expiry => '10y', ); $self->_cgiapp->header_add(-cookie => [$cookie]); } last; } } unless ($self->username) { # password mismatch - increment failed login attempts my $attempts = $store->fetch('login_attempts') || 0; $store->save( login_attempts => $attempts + 1 ); } $config->{POST_LOGIN_CALLBACK}->($self->_cgiapp) if($config->{POST_LOGIN_CALLBACK}); } # Check the user name last of all because only this check might create a session behind the scenes. # In other words if a website works perfectly well without authentication, # then adding a protected run mode should not add session to the unprotected modes. # See 60_parsimony.t for the test. if ($config->{LOGIN_SESSION_TIMEOUT} && !$self->{is_new_login} && $self->username) { # This is not a fresh login, and there are time out rules, so make sure the login is still valid if ($config->{LOGIN_SESSION_TIMEOUT}->{IDLE_FOR} && time() - $self->last_access >= $config->{LOGIN_SESSION_TIMEOUT}->{IDLE_FOR}) { # this login has been idle for too long $self->{is_login_timeout} = 1; $self->logout; } elsif ($config->{LOGIN_SESSION_TIMEOUT}->{EVERY} && time() - $self->last_login >= $config->{LOGIN_SESSION_TIMEOUT}->{EVERY}) { # it has been too long since the last login $self->{is_login_timeout} = 1; $self->logout; } elsif ($config->{LOGIN_SESSION_TIMEOUT}->{CUSTOM} && $config->{LOGIN_SESSION_TIMEOUT}->{CUSTOM}->($self)) { # this login has timed out $self->{is_login_timeout} = 1; $self->logout; } } return 1; } =head2 display This method will return the L object, creating and caching it if necessary. =cut sub display { my $self = shift; return $self->{display} if $self->{display}; my $config = $self->_config->{LOGIN_FORM} || {}; my $class = "CGI::Application::Plugin::Authentication::Display::". ($config->{DISPLAY_CLASS} || 'Classic'); $class->require; $self->{display} = $class->new($self->_cgiapp); return $self->{display}; } =head2 login_box This method will return the HTML for a login box that can be embedded into another page. This is the same login box that is used in the default authen_login runmode that the plugin provides. This function will initiate a session or cookie if one has not been created already. =cut sub login_box { my $self = shift; return $self->display->login_box; } =head2 new This method creates a new CGI::Application::Plugin::Authentication object. It requires as it's only parameter a CGI::Application object. This method should never be called directly, since the 'authen' method that is imported into the CGI::Application module will take care of creating the CGI::Application::Plugin::Authentication object when it is required. Calling this function, will not itself generate cookies or session ids. =cut sub new { my $class = shift; my $cgiapp = shift; my $self = {}; bless $self, $class; $self->{cgiapp} = $cgiapp; Scalar::Util::weaken($self->{cgiapp}); # weaken circular reference return $self; } =head2 instance This method works the same way as 'new', except that it returns the same Authentication object for the duration of the request. This method should never be called directly, since the 'authen' method that is imported into the CGI::Application module will take care of creating the CGI::Application::Plugin::Authentication object when it is required. Calling this function, will not itself generate cookies or session ids. =cut sub instance { my $class = shift; my $cgiapp = shift; die "CGI::Application::Plugin::Authentication->instance must be called with a CGI::Application object" unless defined $cgiapp && UNIVERSAL::isa( $cgiapp, 'CGI::Application' ); $cgiapp->{__CAP_AUTHENTICATION_INSTANCE} = $class->new($cgiapp) unless defined $cgiapp->{__CAP_AUTHENTICATION_INSTANCE}; return $cgiapp->{__CAP_AUTHENTICATION_INSTANCE}; } =head1 CGI::Application CALLBACKS =head2 prerun_callback This method is a CGI::Application prerun callback that will be automatically registered for you if you are using CGI::Application 4.0 or greater. If you are using an older version of CGI::Application you will have to create your own cgiapp_prerun method and make sure you call this method from there. sub cgiapp_prerun { my $self = shift; $self->CGI::Application::Plugin::Authentication::prerun_callback(); } =cut sub prerun_callback { my $self = shift; my $authen = $self->authen; $authen->initialize; # setup the default login and logout runmodes $authen->setup_runmodes; # The user is asking to be logged out if ($self->query->param('authen_logout')) { # The user wants to logout return $self->authen->redirect_to_logout; } # If the user just logged in then we may want to redirect them if ($authen->is_new_login) { # User just logged in, so where to we send them? return $self->authen->redirect_after_login; } # Update any time out info my $config = $authen->_config; if ( $config->{LOGIN_SESSION_TIMEOUT} ) { # update the last access time my $now = time; $authen->last_access($now); } # If a perun mode is set check against that. # This allows cooperation with plugins such as CAP::ActionDispatch # that also have preun hooks. # Note the comments in the CGI::Application docs on the ordering of # callback execution. my $run_mode = $self->prerun_mode; $run_mode ||= $self->get_current_runmode; if ( $authen->is_protected_runmode( $run_mode ) ) { # This runmode requires authentication unless ($authen->is_authenticated) { # This user is NOT logged in return $self->authen->redirect_to_login; } } } =head1 CGI::Application RUNMODES =head2 authen_login_runmode This runmode is provided if you do not want to create your own login runmode. It will display a simple login form for the user, which can be replaced by assigning RENDER_LOGIN a coderef that returns the HTML. =cut sub authen_login_runmode { my $self = shift; my $authen = $self->authen; my $credentials = $authen->credentials; my $username = $credentials->[0]; my $password = $credentials->[1]; my $html; if ( my $sub = $authen->_config->{RENDER_LOGIN} ) { $html = $sub->($self); } else { $html = join( "\n", CGI::start_html( -title => $authen->display->login_title ), $authen->display->login_box, CGI::end_html(), ); } return $html; } =head2 authen_dummy_redirect This runmode is provided for convenience when an external redirect needs to be done. It just returns an empty string. =cut sub authen_dummy_redirect { return ''; } ### ### Detainting helper methods ### sub _detaint_destination { my $self = shift; my $query = $self->_cgiapp->query; my $destination = $query->param('destination'); my $regexp = $self->_config->{DETAINT_URL_REGEXP}; if ($destination && $destination =~ /$regexp/) { $destination = $1; } else { $destination = ""; } return $destination; } sub _detaint_selfurl { my $self = shift; my $query = $self->_cgiapp->query; my $destination = ""; my $regexp = $self->_config->{DETAINT_URL_REGEXP}; if ($query->self_url =~ /$regexp/) { $destination = $1; } return $destination; } sub _detaint_url { my $self = shift; my $query = $self->_cgiapp->query; my $regexp = $self->_config->{DETAINT_URL_REGEXP}; my $url = ""; if ($query->url( -absolute => 1, -path_info => 1 ) =~ /$regexp/) { $url = $1; } return $url; } sub _detaint_username { my $self = shift; my $username = shift; my $cookiename = shift; my $query = $self->_cgiapp->query; my $regexp = $self->_config->{DETAINT_USERNAME_REGEXP}; my $username_value = ""; if (($query->param($username) || $query->cookie($cookiename) || '') =~ /$regexp/) { $username_value = $1; } return $username_value; } ### ### Helper methods ### sub _cgiapp { return $_[0]->{cgiapp}; } sub _find_deligate_class { foreach my $class (@_) { $class->require && return $class; } return; } sub _config { my $self = shift; my $class = ref $self ? ref $self : $self; my $config; if ( ref $self ) { $config = $self->{__CAP_AUTHENTICATION_CONFIG} ||= $__CONFIG{$class} || {}; } else { $__CONFIG{$class} ||= {}; $config = $__CONFIG{$class}; } return $config; } sub _devpopup_report { my $cgiapp = shift; my @list; my $self=$cgiapp->authen; if ($self->username) { push @list,['username',$self->username]; } my $config = $self->_config; my $field_names = $config->{CREDENTIALS} || [qw(authen_username authen_password)]; my $query = $cgiapp->query; foreach my $name (@$field_names) { push @list, [ $name, $query->param($name) || '']; } my $r=0; my $text = join $/, map { $r=1-$r; qq($_->[0]$_->[1]) } @list; $cgiapp->devpopup->add_report( title => 'Authentication', summary => '', report => qq(
$text
ParameterValue
), ); } ### ### Helper functions ### sub _time_to_seconds { my $time = shift; return unless defined $time; # Most of this function is borrowed from CGI::Util v1.4 by Lincoln Stein my (%mult) = ( 's' => 1, 'm' => 60, 'h' => 60 * 60, 'd' => 60 * 60 * 24, 'w' => 60 * 60 * 24 * 7, 'M' => 60 * 60 * 24 * 30, 'y' => 60 * 60 * 24 * 365 ); # format for time can be in any of the forms... # "180" -- in 180 seconds # "180s" -- in 180 seconds # "2m" -- in 2 minutes # "12h" -- in 12 hours # "1d" -- in 1 day # "4w" -- in 4 weeks # "3M" -- in 3 months # "2y" -- in 2 years my $offset; if ( $time =~ /^([+-]?(?:\d+|\d*\.\d*))([smhdwMy]?)$/ ) { return if (!$2 || $2 eq 's') && $1 != int $1; # $offset = int ( ( $mult{$2} || 1 ) * $1 ); } return $offset; } =head1 EXAMPLE In a CGI::Application module: use base qw(CGI::Application); use CGI::Application::Plugin::AutoRunmode; use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123' } ], STORE => 'Session', LOGOUT_RUNMODE => 'start', ); __PACKAGE__->authen->protected_runmodes(qr/^auth_/, 'one'); sub start : RunMode { my $self = shift; } sub one : RunMode { my $self = shift; # The user will only get here if they are logged in } sub auth_two : RunMode { my $self = shift; # This is also protected because of the # regexp call to protected_runmodes above } =head1 COMPATIBILITY WITH L The prerun callback has been modified so that it will check for the presence of a prerun mode. This is for compatibility with L. This change should be considered experimental. It is necessary to load the ActionDispatch module so that the two prerun callbacks will be called in the correct order. =head1 RECOMMENDED USAGE =over =item CSS The best practice nowadays is generally considered to be to not have CSS embedded in HTML. Thus it should be best to set LOGIN_FORM -> DISPLAY_CLASS to 'Basic'. =item Post login destination Of the various means of selecting a post login destination the most secure would seem to be POST_LOGIN_URL. The C parameter could potentially be hijacked by hackers. The POST_LOGIN_RUNMODE parameter requires a hidden parameter that could potentially be hijacked. =item Taint mode Do run your code under taint mode. It should help protect your application against a number of attacks. =item URL and username checking Please set the C and C parameters as tightly as possible. In particular you should prevent the destination parameter being used to redirect authenticated users to external sites; unless of course that is what you want in which case that site should be the only possible external site. =item The login form The HTML currently generated does not seem to be standards compliant as per RT bug 58023. Also the default login form includes hidden forms which could conceivably be hijacked. Set LOGIN_FORM -> DISPLAY_CLASS to 'Basic' to fix this. =back =head1 TODO There are lots of things that can still be done to improve this plugin. If anyone else is interested in helping out feel free to dig right in. Many of these things don't need my input, but if you want to avoid duplicated efforts, send me a note, and I'll let you know of anyone else is working in the same area. =over 4 =item review the code for security bugs and report =item complete the separation of presentation and logic =item write a tutorial =item build more Drivers (Class::DBI, LDAP, Radius, etc...) =item Add support for method attributes to identify runmodes that require authentication =item finish the test suite =item provide more example code =item clean up the documentation =item build a DB driver that builds it's own table structure. This can be used by people that don't have their own user database to work with, and could include a simple user management application. =back =head1 BUGS This is alpha software and as such, the features and interface are subject to change. So please check the Changes file when upgrading. Some of the test scripts appear to be incompatible with versions of L later than 0.65. =head1 SEE ALSO L, perl(1) =head1 AUTHOR Author: Cees Hek ; Co-maintainer: Nicholas Bamber . =head1 CREDITS Thanks to L for funding the development of this plugin and for releasing it to the world. Thanks to Christian Walde for suggesting changes to fix the incompatibility with L and for help with github. Thanks to Alexandr Ciornii for pointing out some typos. =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. Copyright (c) 2010, Nicholas Bamber. (Portions of the code). This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. The background images in the default login forms are used courtesy of L. Those icons are issued under the L. Those icons are copyrighted 2006 by Mark James =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; Authentication000755001750001750 011563746137 31060 5ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/PluginDisplay.pm000444001750001750 1467711563746137 33217 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authenticationpackage CGI::Application::Plugin::Authentication::Display; use 5.006; use strict; use warnings; use Carp; our $VERSION = '0.20'; sub new { my $class = shift; my $self = {}; $self->{cgiapp} = shift; bless $self, $class; return $self; } sub _cgiapp { my $self = shift; return $self->{cgiapp}; } sub login_box { my $self = shift; croak "not implemented in base class"; } sub logout_form { my $self = shift; return 'Logout' if $self->_cgiapp->authen->is_authenticated; return ''; } sub enforce_protection { my $self = shift; croak "Attempt to bypass authentication on protected template" if !$self->_cgiapp->authen->is_authenticated; return "\n"; } sub is_authenticated { my $self = shift; return $self->_cgiapp->authen->is_authenticated; } sub username { my $self = shift; return $self->_cgiapp->authen->username; } sub last_login { my $self = shift; return $self->_cgiapp->authen->last_login; } sub last_access { my $self = shift; return $self->_cgiapp->authen->last_access; } sub is_login_timeout { my $self = shift; return $self->_cgiapp->authen->is_login_timeout; } sub login_attempts { my $self = shift; return $self->_cgiapp->authen->login_attempts; } sub login_title { my $self = shift; my $login_options = $self->_cgiapp->authen->_config->{LOGIN_FORM} || {}; return $login_options->{TITLE} || 'Sign In'; } 1; =head1 NAME CGI::Application::Plugin::Authentication::Display - Generate bits of HTML needed for authentication =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Display version 0.20 =head1 DESCRIPTION The purpose of this code is to keep display code away from the back-end of authentication management. It is an abstract base class and must be used in conjunction with derived classes. Those derived classes can be used in an number of ways: =over =item The subclass L is provided to ensure backwards compatibility with the old code. It has the advantage of working out of the box but still retaining flexibility. =item The subclass L is provided to ensure XHTML compliance and to leave styling to CSS style-sheets. =item You can handle all the HTML side yourself in which case this code is not even loaded. =item You can use derived classes in templates that have dot support, which keeps the display code close to the templates. This has other advantages. For example one can use the C method to mark a template as being only viewable after authentication. A number of other methods can be called from the template that provide information about the authentication status. =back =head1 METHODS =head2 new The constructor must be passed the L object as the first non-object argument. This allows derived modules to access the authentication information. =head2 login_box This method will return the HTML for a login box that can be embedded into another page. This is the same login box that is used in the default authen_login runmode that the plugin provides. This function is not implemented in this module. One must use a derived class with an appropriate implementation of this function. =head2 logout_form This returns the simple bit of HTML need to have a logout button. The form has '/?authen_logout=1' as the action but of course this can be changed in derived modules. =head2 enforce_protection This method is useful when the class is being used in templates to mark a certain template as for authenticated eyes only. So in L one might have and one must set C to one of these objects via the C method. If authenticated it will resolve to a simple string, otherwise it will croak. =head2 login_title This returns the I parameter from the I<LOGIN_FORM> section of the config. =head2 is_authenticated =head2 username =head2 last_login =head2 last_access =head2 is_login_timeout =head2 login_attempts These methods all provide access to the cognate methods on the authentication object. They are provided as templates might find them expressive. =head1 BUGS This is alpha software and as such, the features and interface are subject to change. So please check the Changes file when upgrading. =head1 SEE ALSO L<CGI::Application>, perl(1) =head1 AUTHOR Author: Cees Hek <ceeshek@gmail.com>; Co-maintainer: Nicholas Bamber <nicholas@periapt.co.uk>. =head1 CREDITS Thanks to SiteSuite (http://www.sitesuite.com.au) for funding the development of this plugin and for releasing it to the world. Thanks to Christian Walde for suggesting changes to fix the incompatibility with L<CGI::Application::Plugin::ActionDispatch> and for help with github. =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. Copyright (c) 2010, Nicholas Bamber. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �����������������������������������������������������������������Driver.pm�������������������������������������������������������������������������������������������000444��001750��001750�� 27401�11563746137� 33032� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication�����������������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver; use strict; use warnings; our $VERSION = '0.20'; use UNIVERSAL::require; =head1 NAME CGI::Application::Plugin::Authentication::Driver - Base module for building driver classes for CGI::Application::Plugin::Authentication =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver version 0.20 =head1 SYNOPSIS package CGI::Application::Plugin::Authentication::Driver::MyDriver; use base qw(CGI::Application::Plugin::Authentication::Driver); sub verify_credentials { my $self = shift; my @credentials = @_; if ( >>> Validate Credentials <<< ) { return $credentials[0]; } return; } =head1 DESCRIPTION This module is a base class for all driver classes for the L<CGI::Application::Plugin::Authentication> plugin. Each driver class is required to provide only one method to validate the given credentials. Normally only two credentials will be passed in (username and password), but you can configure the plugin to handle any number of credentials (for example you may require the user to enter a group name, or domain name as well as a username and password). =head1 FIELD FILTERS It is quite common for passwords to be stored using some form of one way encryption. Unix crypt being the old standard in the Unix community, however MD5 or SHA1 hashes are more popular today. In order to simplify the validation routines some methods have been provided to help test these passwords. When configuring a Driver (and if the driver supports it), you can specify which fields are encoded, and which method is used for the encoding by specifying a filter on the field in question. CREDENTIALS => ['authen_username', 'authen_password'], DRIVERS => [ 'DBI', DSN => '...', TABLE => 'users', CONSTRAINTS => { username => '__CREDENTIAL_1__', 'MD5:password' => '__CREDENTIAL_2__', } ], Here we are saying that the password field is encoded using an MD5 hash, and should be checked accordingly. =head2 Filter options Some of the filters may have multiple forms. For example there are three forms of MD5 hashes: binary, base64 and hex. You can specify these extra options by using an underscore to separate it from the filter name. 'MD5_base64:password' =head2 Chained Filters it is possible to chain multiple filters. This can be useful if your MD5 strings are stored in hex format. Hex numbers are case insensitive, so the may be stored in either upper or lower case. To make this consistent, you can MD5 encode the password first, and then upper case the results. The filters are applied from the inside out: 'uc:MD5_hex:password' =head2 Custom Filters If your field is encoded using a custom technique, then you can provide a custom filter function. This can be be done by providing a FILTERS option that contains a hash of filter subroutines that are keyed by their name. You can then use the filter name on any of the fields as if it was a builtin filter. CREDENTIALS => ['authen_username', 'authen_password'], DRIVERS => [ 'DBI', DSN => '...', TABLE => 'users', CONSTRAINTS => { username => '__CREDENTIAL_1__', 'rot13:password' => '__CREDENTIAL_2__', } FILTERS => { rot13 => \&rot13_filter }, ], sub rot13_filter { my $param = shift; my $value = shift; $value =~ tr/A-Za-z/N-ZA-Mn-za-m/; return $value; } Please see the documentation for the driver that you are using to make sure that it supports encoded fields. =head2 Builtin Filters Here is a list of the filters that are provided with this module: =over 4 =item crypt - provided by perl C<crypt> function =item MD5 - requires Digest::MD5 =item SHA1 - requires Digest::SHA1 =item uc - provided by the perl C<uc> function =item lc - provided by the perl C<lc> function =item trim - removed whitespace from the start and end of the field =back =head1 METHODS =head2 new This is a constructor that can create a new Driver object. It requires an Authentication object as its first parameter, and any number of other parameters that will be used as options depending on which Driver object is being created. You shouldn't need to call this as the Authentication plugin takes care of creating Driver objects. =cut sub new { my $class = shift; my $self = {}; my $authen = shift; my @options = @_; bless $self, $class; $self->{authen} = $authen; Scalar::Util::weaken($self->{authen}); # weaken circular reference $self->{options} = \@options; $self->initialize; return $self; } =head2 initialize This method will be called right after a new Driver object is created. So any startup customizations can be dealt with here. =cut sub initialize { my $self = shift; # override this in the subclass if you need it return; } =head2 options This will return a list of options that were provided when this driver was configured by the user. =cut sub options { return (@{$_[0]->{options}}) } =head2 authen This will return the underlying L<CGI::Application::Plugin::Authentication> object. In most cases it will not be necessary to access this. =cut sub authen { return $_[0]->{authen} } =head2 find_option This method will search the Driver options for a specific key and return the value it finds. =cut sub find_option { my $self = shift; my $key = shift; my @options = $self->options; my $marker = 0; foreach my $option (@options) { if ($marker) { return $option; } elsif ($option eq $key) { # We need the next element $marker = 1; } } return; } =head2 verify_credentials This method needs to be provided by the driver class. It needs to be an object method that accepts a list of credentials, and will verify that the credentials are valid, and return a username that will be used to identify this login (usually you will just return the value of the first credential, however you are not bound to that).. =cut sub verify_credentials { die "verify_credentials must be implemented in the subclass"; } =head2 filter This method can be used to filter a field (usually password fields) using a number of standard or custom encoding techniques. See the section on Builtin Filters above to see what filters are available When using a custom filter, you will need to provide a FILTERS option in the configuration of the DRIVER (See the section on FIELD FILTERS above for an example). By default, if no filter is specified, it is returned as is. This means that you can run all fields through this function even if they don't have any filters to simplify the driver code. my $filtered = $self->filter('MD5_hex:password', 'foobar'); - or - # custom filter my $filtered = $self->filter('foobar:password', 'foo'); - or - # effectively a noop my $filtered = $self->filter('username', 'foo'); =cut sub filter { my $self = shift; my $field = shift; my $plain = shift; my @other = shift; return unless defined $plain; my @filters = split /\:/, $field; my $fieldname = pop @filters; my $filtered = $plain; foreach my $filter (reverse @filters) { my ($filter_name, $param) = split /_/, $filter; my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::' . lc $filter_name; if ( $class->require ) { # found a filter $filtered = $class->filter( $param, $filtered, @other ); } else { # see if the configuration has a custom filter defined my $custom_filters = $self->find_option('FILTERS'); if ( $custom_filters ) { die "the FILTERS configuration option must be a hashref" unless ref( $custom_filters ) eq 'HASH'; if ( $custom_filters->{$filter_name} ) { die "the '$filter' filter listed in FILTERS must be a subroutine reference" unless ref( $custom_filters->{$filter_name} ) eq 'CODE'; $filtered = $custom_filters->{$filter_name}->( $param, $filtered, @other ); } else { die "No filter found for '$filter_name'"; } } else { die "No filters found for '$filter'"; } } } return $filtered; } =head2 check_filtered This method can be used to test filtered fields (usually password fields) against a number of standard or custom encoding techniques. The following encoding techniques are provided: plain, MD5, SHA1, crypt. When using a custom encoder, you will need to provide it in the configuration of the DRIVERS (See the section on ENCODED PASSWORDS above for an example). By default, if no encoding is specified, it is assumed to be 'plain'. This means that you can run all fields through this function even if they don't have any encoding to simplify the driver code. my $verified = $self->check_filtered('MD5:password', 'foobar', 'OFj2IjCsPJFfMAxmQxLGPw'); - or - # custom encoder my $verified = $self->check_filtered('foobar:password', 'foo', 'bar'); - or - # a field that isn't filtered (effectively just checks for equality on second and third args) my $verified = $self->check_filtered('username', 'foobar', 'foobar'); my $verified = $self->check_filtered('plain:username', 'foobar', 'foobar'); =cut sub check_filtered { my $self = shift; my $field = shift; my $plain = shift; my $filtered = shift; return ($self->filter($field, $plain, $filtered) eq $filtered) ? 1 : 0; } =head2 strip_field_names This method will take a field name (or list of names) and strip off the leading encoding type. For example if you passed in 'MD5:password' the method would return 'password'. my $fieldname = $self->strip_field_names('MD5:password'); =cut sub strip_field_names { my $self = shift; my @fields = @_; foreach (@fields) { s/^.*://; } if (wantarray()) { return @fields; } else { return $fields[0]; } } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; ���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Store.pm��������������������������������������������������������������������������������������������000444��001750��001750�� 12435�11563746137� 32674� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication�����������������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Store; use strict; use warnings; our $VERSION = '0.20'; =head1 NAME CGI::Application::Plugin::Authentication::Store - Base module for building storage classes for the CGI::Application::Plugin::Authentication plugin =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Store version 0.20 =head1 SYNOPSIS package CGI::Application::Plugin::Authentication::Store::MyStore; use base qw(CGI::Application::Plugin::Authentication::Store); sub fetch { my $self = shift; my @params = @_; ... } sub save { my $self = shift; my %params = @_; ... } sub delete { my $self = shift; my @params = @_; ... } =head1 DESCRIPTION This module is a base class for all storage classes for the L<CGI::Application::Plugin::Authentication> plugin. Each storage class is required to provide three methods that fetch, save and delete data from the store. The information that is saved will be text based, so there is no need to flatten any of the data that is to be stored. =head1 METHODS TO OVERRIDE The following three (and one optional) methods should be provided by the subclass. =head2 fetch This method accepts a list of parameters and will return a list of values from the store matching those parameters. =cut sub fetch { my $self = shift; my $class = ref $self; die "fetch must be implemented in the $class subclass"; } =head2 save This method accepts a hash of parameters and values and will save those parameters in the store. =cut sub save { my $self = shift; my $class = ref $self; die "save must be implemented in the $class subclass"; } =head2 delete This method accepts a list of parameters and will delete those parameters from the store. =cut sub delete { my $self = shift; my $class = ref $self; die "delete must be implemented in the $class subclass"; } =head2 clear A call to this method will remove all information about the current user out of the store (should be provided by the subclass, but is not required to be). =cut sub clear { my $self = shift; $self->delete('username', 'login_attempts', 'last_access', 'last_login'); } =head1 OTHER METHODS The following methods are also provided by the L<CGI::Application::Plugin::Authentication::Store> base class. =head2 new This is a constructor that can create a new Store object. It requires an Authentication object as its first parameter, and any number of other parameters that will be used as options depending on which Store object is being created. You shouldn't need to call this as the Authentication plugin takes care of creating Store objects. =cut sub new { my $class = shift; my $self = {}; my $authen = shift; my @options = @_; bless $self, $class; $self->{authen} = $authen; Scalar::Util::weaken( $self->{authen} ); # weaken circular reference $self->{options} = \@options; $self->initialize; return $self; } =head2 initialize This method will be called right after a new Store object is created. So any startup customizations can be dealt with here. =cut sub initialize { my $self = shift; # override this in the subclass if you need it return; } =head2 options This will return a list of options that were provided when this store was configured by the user. =cut sub options { my $self = shift; my @options = @{$self->{options}}; return @options[0..$#options]; } =head2 authen This will return the underlying L<CGI::Application::Plugin::Authentication> object. In most cases it will not be necessary to access this. =cut sub authen { my $self = shift; $self->{authen}; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Store>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Display���������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 32465� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication�����������������������������������������������������������������������������������Basic.pm��������������������������������������������������������������������������������������������000444��001750��001750�� 21614�11563746137� 34225� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Display���������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Display::Basic; use base qw(CGI::Application::Plugin::Authentication::Display); use 5.006; use strict; use warnings; use Carp; our $VERSION = '0.20'; sub new { my $class = shift; my $cgiapp = shift; my $self = CGI::Application::Plugin::Authentication::Display->new($cgiapp); bless $self, $class; return $self; } sub login_box { my $self = shift; croak "already authenticated" if $self->_cgiapp->authen->is_authenticated; my $credentials = $self->_cgiapp->authen->credentials; my $runmode = $self->_cgiapp->get_current_runmode; my $destination = $self->_cgiapp->authen->_detaint_destination || $self->_cgiapp->authen->_detaint_selfurl; my $action = $self->_cgiapp->authen->_detaint_url; my $username = $credentials->[0]; my $password = $credentials->[1]; my $login_form = $self->_cgiapp->authen->_config->{LOGIN_FORM}; my %options = ( TITLE => 'Sign In', USERNAME_LABEL => 'User Name', PASSWORD_LABEL => 'Password', SUBMIT_LABEL => 'Sign In', COMMENT => 'Please enter your username and password in the fields below.', REMEMBERUSER_OPTION => 1, REMEMBERUSER_LABEL => 'Remember User Name', REMEMBERUSER_COOKIENAME => 'CAPAUTHTOKEN', REGISTER_URL => '', REGISTER_LABEL => 'Register Now!', FORGOTPASSWORD_URL => '', FORGOTPASSWORD_LABEL => 'Forgot Password?', INVALIDPASSWORD_MESSAGE => 'Invalid username or password<br />(login attempt %d)', FORM_SUBMIT_METHOD => 'post', %$login_form, ); my $messages = ''; if ( my $attempts = $self->_cgiapp->authen->login_attempts ) { $messages .= '<li class="warning">' . sprintf($options{INVALIDPASSWORD_MESSAGE}, $attempts) . '</li>'; } else { $messages .= "<li>$options{COMMENT}</li>"; } my $tabindex = 3; my ($rememberuser, $username_value, $register, $forgotpassword) = ('','','',''); if ($options{REMEMBERUSER_OPTION}) { $rememberuser = <<END; <label for="authen_rememberuserfield" id="authen_rememberuserfield_label" class="authen_label">$options{REMEMBERUSER_LABEL} <input id="authen_rememberuserfield" class="authen_input" tabindex="$tabindex" type="checkbox" name="authen_rememberuser" value="1" /> </label> END $tabindex++; $username_value = $self->_cgiapp->authen->_detaint_username($username, $options{REMEMBERUSER_COOKIENAME}); } my $submit_tabindex = $tabindex++; if ($options{REGISTER_URL}) { $register = qq[<a href="$options{REGISTER_URL}" id="authen_registerlink" tabindex="$tabindex">$options{REGISTER_LABEL}</a>]; $tabindex++; } if ($options{FORGOTPASSWORD_URL}) { $forgotpassword = qq[<a href="$options{FORGOTPASSWORD_URL}" id="authen_forgotpasswordlink" tabindex="$tabindex">$options{FORGOTPASSWORD_LABEL}</a>]; $tabindex++; } my $html .= <<END; <form id="loginform" method="$options{FORM_SUBMIT_METHOD}" action="${action}"> <div class="login"> <div class="login_header"> $options{TITLE} </div> <div class="login_content"> <ul class="message"> ${messages} </ul> <fieldset> <label for="authen_loginfield" id="authen_loginfield_label" class="authen_label">$options{USERNAME_LABEL} <input id="authen_loginfield" class="authen_input" tabindex="1" type="text" name="${username}" size="20" value="$username_value" /> </label> <label for="authen_passwordfield" id="authen_passwordfield_label" class="authen_label">$options{PASSWORD_LABEL} <input id="authen_passwordfield" class="authen_input" tabindex="2" type="password" name="${password}" size="20" /> </label> ${rememberuser} </fieldset> </div> <div class="login_footer"> <div class="buttons"> <input id="authen_loginbutton" tabindex="${submit_tabindex}" type="submit" name="authen_loginbutton" value="$options{SUBMIT_LABEL}" class="button" /> ${register} ${forgotpassword} </div> </div> </div> <input type="hidden" name="destination" value="${destination}" /> <input type="hidden" name="rm" value="${runmode}" /> </form> END return $html; } =head1 NAME CGI::Application::Plugin::Authentication::Display::Basic - XHTML compliant no frills login display driver =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Display::Basic version 0.20 =head1 DESCRIPTION This module provides a login box that works out of the box but which can be configured to modify the styling. =head1 METHODS =head2 new The constructor must be passed the L<CGI::Application> object as the first non-object argument. =head2 login_box This method will return the HTML for a login box that can be embedded into another page. This is the same login box that is used in the default authen_login runmode that the plugin provides. Note that if somehow this method is run, whilst the user is authenticated, it will croak. You can set this option to customize the login form that is created when a user needs to be authenticated. If you wish to replace the entire login form with a completely custom version, then just set LOGIN_RUNMODE to point to your custom runmode. All of the parameters listed below are optional, and a reasonable default will be used if left blank: =over 4 =item TITLE (default: Sign In) the heading at the top of the login box =item USERNAME_LABEL (default: User Name) the label for the user name input =item PASSWORD_LABEL (default: Password) the label for the password input =item SUBMIT_LABEL (default: Sign In) the label for the submit button =item COMMENT (default: Please enter your username and password in the fields below.) a message provided on the first login attempt =item REMEMBERUSER_OPTION (default: 1) provide a checkbox to offer to remember the users name in a cookie so that their user name will be pre-filled the next time they log in =item REMEMBERUSER_LABEL (default: Remember User Name) the label for the remember user name checkbox =item REMEMBERUSER_COOKIENAME (default: CAPAUTHTOKEN) the name of the cookie where the user name will be saved =item REGISTER_URL (default: <none>) the URL for the register new account link =item REGISTER_LABEL (default: Register Now!) the label for the register new account link =item FORGOTPASSWORD_URL (default: <none>) the URL for the forgot password link =item FORGOTPASSWORD_LABEL (default: Forgot Password?) the label for the forgot password link =item INVALIDPASSWORD_MESSAGE (default: Invalid username or password<br />(login attempt %d) a message given when a login failed =item FORM_SUBMIT_METHOD (default: post) use this to get the form to submit using 'get' instead of 'post' =back =head1 BUGS This is alpha software and as such, the features and interface are subject to change. So please check the Changes file when upgrading. =head1 SEE ALSO L<CGI::Application>, perl(1) =head1 AUTHOR Author: Cees Hek <ceeshek@gmail.com>; Co-maintainer: Nicholas Bamber <nicholas@periapt.co.uk>. =head1 CREDITS Thanks to SiteSuite (http://www.sitesuite.com.au) for funding the development of this plugin and for releasing it to the world. Thanks to Christian Walde for suggesting changes to fix the incompatibility with L<CGI::Application::Plugin::ActionDispatch> and for help with github. =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. Copyright (c) 2010, Nicholas Bamber. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; ��������������������������������������������������������������������������������������������������������������������Classic.pm������������������������������������������������������������������������������������������000444��001750��001750�� 44040�11563746137� 34563� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Display���������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Display::Classic; use base qw(CGI::Application::Plugin::Authentication::Display); use 5.006; use strict; use warnings; use Carp; our $VERSION = '0.20'; sub new { my $class = shift; my $cgiapp = shift; my $self = CGI::Application::Plugin::Authentication::Display->new($cgiapp); bless $self, $class; return $self; } sub login_box { my $self = shift; my $credentials = $self->_cgiapp->authen->credentials; my $runmode = $self->_cgiapp->get_current_runmode; my $destination = $self->_cgiapp->authen->_detaint_destination || $self->_cgiapp->authen->_detaint_selfurl; my $action = $self->_cgiapp->authen->_detaint_url; my $username = $credentials->[0]; my $password = $credentials->[1]; my $login_form = $self->_cgiapp->authen->_config->{LOGIN_FORM} || {}; my %options = ( TITLE => 'Sign In', USERNAME_LABEL => 'User Name', PASSWORD_LABEL => 'Password', SUBMIT_LABEL => 'Sign In', COMMENT => 'Please enter your username and password in the fields below.', REMEMBERUSER_OPTION => 1, REMEMBERUSER_LABEL => 'Remember User Name', REMEMBERUSER_COOKIENAME => 'CAPAUTHTOKEN', REGISTER_URL => '', REGISTER_LABEL => 'Register Now!', FORGOTPASSWORD_URL => '', FORGOTPASSWORD_LABEL => 'Forgot Password?', INVALIDPASSWORD_MESSAGE => 'Invalid username or password<br />(login attempt %d)', INCLUDE_STYLESHEET => 1, FORM_SUBMIT_METHOD => 'post', %$login_form, ); my $messages = ''; if ( my $attempts = $self->_cgiapp->authen->login_attempts ) { $messages .= '<li class="warning">' . sprintf($options{INVALIDPASSWORD_MESSAGE}, $attempts) . '</li>'; } elsif ($options{COMMENT}) { $messages .= "<li>$options{COMMENT}</li>"; } my $tabindex = 3; my ($rememberuser, $username_value, $register, $forgotpassword, $javascript, $style) = ('','','','','',''); if ($options{FOCUS_FORM_ONLOAD}) { $javascript .= "document.loginform.${username}.focus();\n"; } if ($options{REMEMBERUSER_OPTION}) { $rememberuser = qq[<input id="authen_rememberuserfield" tabindex="$tabindex" type="checkbox" name="authen_rememberuser" value="1" />$options{REMEMBERUSER_LABEL}<br />]; $tabindex++; $username_value = $self->_cgiapp->authen->_detaint_username($username, $options{REMEMBERUSER_COOKIENAME}); $javascript .= "document.loginform.${username}.select();\n" if $username_value; } my $submit_tabindex = $tabindex++; if ($options{REGISTER_URL}) { $register = qq[<a href="$options{REGISTER_URL}" id="authen_registerlink" tabindex="$tabindex">$options{REGISTER_LABEL}</a>]; $tabindex++; } if ($options{FORGOTPASSWORD_URL}) { $forgotpassword = qq[<a href="$options{FORGOTPASSWORD_URL}" id="authen_forgotpasswordlink" tabindex="$tabindex">$options{FORGOTPASSWORD_LABEL}</a>]; $tabindex++; } if ($options{INCLUDE_STYLESHEET}) { my $login_styles = $self->_login_styles; $style = <<EOS; <style type="text/css"> <!--/* <![CDATA[ */ $login_styles /* ]]> */--> </style> EOS } if ($javascript) { $javascript = qq[<script type="text/javascript" language="JavaScript">$javascript</script>]; } my $html .= <<END; $style <form name="loginform" method="$options{FORM_SUBMIT_METHOD}" action="${action}"> <div class="login"> <div class="login_header"> $options{TITLE} </div> <div class="login_content"> <ul class="message"> ${messages} </ul> <fieldset> <label for="${username}">$options{USERNAME_LABEL}</label> <input id="authen_loginfield" tabindex="1" type="text" name="${username}" size="20" value="$username_value" /><br /> <label for="${password}">$options{PASSWORD_LABEL}</label> <input id="authen_passwordfield" tabindex="2" type="password" name="${password}" size="20" /><br /> ${rememberuser} </fieldset> </div> <div class="login_footer"> <div class="buttons"> <input id="authen_loginbutton" tabindex="${submit_tabindex}" type="submit" name="authen_loginbutton" value="$options{SUBMIT_LABEL}" class="button" /> ${register} ${forgotpassword} </div> </div> </div> <input type="hidden" name="destination" value="${destination}" /> <input type="hidden" name="rm" value="${runmode}" /> </form> $javascript END return $html; } sub _login_styles { my $self = shift; my $login_form = $self->_cgiapp->authen->_config->{LOGIN_FORM} || {}; my %colour = (); $colour{base} = $login_form->{BASE_COLOUR} || '#445588'; $colour{lighter} = $login_form->{LIGHTER_COLOUR} if $login_form->{LIGHTER_COLOUR}; $colour{light} = $login_form->{LIGHT_COLOUR} if $login_form->{LIGHT_COLOUR}; $colour{dark} = $login_form->{DARK_COLOUR} if $login_form->{DARK_COLOUR}; $colour{darker} = $login_form->{DARKER_COLOUR} if $login_form->{DARKER_COLOUR}; $colour{grey} = $login_form->{GREY_COLOUR} if $login_form->{GREY_COLOUR}; my @undefined_colours = grep { ! defined $colour{$_} || index($colour{$_}, '%') >= 0 } qw(lighter light dark darker); if (@undefined_colours) { eval { require Color::Calc }; if ($@ && $login_form->{BASE_COLOUR}) { warn "Color::Calc is required when specifying a custom BASE_COLOUR, and leaving LIGHTER_COLOUR, LIGHT_COLOUR, DARK_COLOUR or DARKER_COLOUR blank or when providing percentage based colour"; } if ($@) { $colour{base} = '#445588'; $colour{lighter} = '#d0d5e1'; $colour{light} = '#a2aac4'; $colour{dark} = '#303c5f'; $colour{darker} = '#1b2236'; $colour{grey} = '#565656'; } else { $colour{lighter} = !$colour{lighter} ? Color::Calc::light_html($colour{base}, 0.75) : $colour{lighter} =~ m#(\d{2})%# ? Color::Calc::light_html($colour{base}, $1 / 100) : $colour{lighter}; $colour{light} = !$colour{light} ? Color::Calc::light_html($colour{base}, 0.5) : $colour{light} =~ m#(\d{2})%# ? Color::Calc::light_html($colour{base}, $1 / 100) : $colour{light}; $colour{dark} = !$colour{dark} ? Color::Calc::dark_html($colour{base}, 0.3) : $colour{dark} =~ m#(\d{2})%# ? Color::Calc::dark_html($colour{base}, $1 / 100) : $colour{dark}; $colour{darker} = !$colour{darker} ? Color::Calc::dark_html($colour{base}, 0.6) : $colour{darker} =~ m#(\d{2})%# ? Color::Calc::dark_html($colour{base}, $1 / 100) : $colour{darker}; #$colour{grey} ||= Color::Calc::bw_html($colour{base}); if (!$colour{grey}) { $colour{grey} = Color::Calc::bw_html($colour{base}); } } } $colour{grey} ||= '#565656'; return <<END; div.login { width: 25em; margin: auto; padding: 3px; font-weight: bold; border: 2px solid $colour{base}; color: $colour{dark}; font-family: sans-serif; } div.login div { margin: 0; padding: 0; border: none; } div.login .login_header { background: $colour{base}; border-bottom: 1px solid $colour{darker}; height: 1.5em; padding: 0.45em; text-align: left; color: #fff; font-size: 100%; font-weight: bold; } div.login .login_content { background: $colour{lighter}; padding: 0.8em; border-top: 1px solid white; border-bottom: 1px solid $colour{grey}; font-size: 80%; } div.login .login_footer { background: $colour{light}; border-top: 1px solid white; border-bottom: 1px solid white; text-align: left; padding: 0; margin: 0; min-height: 2.8em; } div.login fieldset { margin: 0; padding: 0; border: none; width: 100%; } div.login label { clear: left; float: left; padding: 0.6em 1em 0.6em 0; width: 8em; text-align: right; } /* image courtesy of http://www.famfamfam.com/lab/icons/silk/ */ #authen_loginfield { background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAG5SURBVHjaYvz//z8DJQAggFiIVfh0twHn9w8KD9+/ZBT+9/cfExfvwwc87GxWAAFEtAFf3yl++/9XikHXL56BkYmJ4dKmcoUPT99PBQggRmK8ALT9v4BUBQMLrxxQMztY7N+PjwyXtk76BxBATMRoFjGewsDCx8jw9Oxyht9vboIxCDAxs/wCCCC8LoBrZv/A8PPpVoZ/39gZ7p57xcDLJ8Xw5tkdBrO8DYwAAcRElOYXaxn+/73DwC4vzyAmzsLw58kJsGaQOoAAYiJK868nDGwSXgxvjp1n+Hz7HoNawRFGmFqAAMIw4MBEDaI1gwBAAKEYsKtL/b9x2HSiNYMAQACBA3FmiqKCohrbfQ2nLobn97Yz6Br/JEozCAAEEDgh/eb6d98yYhEDBxsnw5VNZxnOffjLIKltw/D52B6GH89fMVjUnGbEFdgAAQRPiexMzAyfDk9gMJbmYbh17irDueMrGbjExBi8Oy8z4ksnAAEENuDY1S8MjjsnMSgaezJ8Z2Bm+P95PgPX6ycENYMAQACBwyDSUeQ/GzB926kLMEjwsjOwifKvcy05EkxMHgEIIEZKszNAgAEA+j3MEVmacXUAAAAASUVORK5CYII=') no-repeat 0 1px; background-color: #fff; border-top: solid 1px $colour{grey}; border-left: solid 1px $colour{grey}; border-bottom: solid 1px $colour{light}; border-right: solid 1px $colour{light}; padding: 2px 0 2px 18px; margin: 0.3em 0; width: 12em; } /* image courtesy of http://www.famfamfam.com/lab/icons/silk/ */ #authen_passwordfield { background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKbSURBVHjaYvz//z8DPvBko+s0IJUJ5U6X8d+dhSwPEEAMIANw4ccbXKYB8f8/P+6BMYgNEkNWAxBAhDV/Pff/5+t5/39/2gcU/gc25P5qpzkwdQABxIjNCzBnS7p2Mfz5tJ+BkVWE4dWRxWA5oBcYHiyyYnj5heGAedYxR4AAwmXAf0mPWQx/3q9n+P/3I9AAMaCoBsPr4x0MDH/+MUgHrGG4P8eF4fVf9gMAAcSEK/D+/3oA1gxm/3kLJG8wSDhWMAjoeTJ8fxjNoJDQzyD0+7sDQACx4DKAkVWcgZGZG2jIV6AJfxn+/37F8OfPO6BhRxl+f/nIwC7xluHPm58MAAHEhMX5ILHp787OYvj/7zvDr7f7Gf59vw804DUwPM4x/P3+loFb0ZfhVlc1wxMu7psAAcSCEd9MjAzswoYMAppmDD9e9DKwcIkwMHFyMPx+dZnh7+9vDDxqwQx3Ji1jeMrJc9W1/JQOQAAheyFT2mctw9+vpxh+fz7A8O1JDQMrEz/QK2YMb47uZpD0SmEAmsRwu7eJ4QUX1wWXklOGIE0AAcQIim9YShOzSmf49W4xw5+PdxlYeIUYWLh9GS6vXPH+3U/Gd3K/vikzcTAzvOTkOmNXeNIUZitAALFAbF4D9N8Bhl+vJjP8/vCUgY1fkoGZ24PhysoV7178Y9vmW3M8FqZBHS3MAAIIZMDnP59P835/3Mnw98t7Bg5xNQZGNnOgzSvfv2ZgX+dbfiwVX14BCCCQAbyMrNwMDKxcDOxi/Az/WU0YLi1b8/E9K8cqr6JjGQwEAEAAMf378+/cn+//GFi5bRiYuMOBzt7w4RMH50IPIjSDAEAAsbz8+Gfdh9VFEr9//WX7//s/009uzlmuWUcqGYgEAAEGAIZWUhP4bjW1AAAAAElFTkSuQmCC') no-repeat 0 1px; background-color: #fff; border-top: solid 1px $colour{grey}; border-left: solid 1px $colour{grey}; border-bottom: solid 1px $colour{light}; border-right: solid 1px $colour{light}; padding: 2px 0 2px 18px; margin: 0.3em 0; width: 12em; } #authen_rememberuserfield { clear: left; margin-left: 8em; } #authen_loginfield:focus { background-color: #ffc; color: #000; } #authen_passwordfield:focus { background-color: #ffc; color: #000; } div.login a { font-size: 80%; color: $colour{dark}; } div.login div.buttons input { border-top: solid 2px $colour{light}; border-left: solid 2px $colour{light}; border-bottom: solid 2px $colour{grey}; border-right: solid 2px $colour{grey}; background-color: $colour{lighter}; padding: .2em 1em ; font-size: 80%; font-weight: bold; color: $colour{dark}; } div.login div.buttons { display: block; margin: 8px 4px; width: 100%; } #authen_loginbutton { float: right; margin-right: 1em; } #authen_registerlink { display: block; } #authen_forgotpasswordlink { display: block; } ul.message { margin-top: 0; margin-bottom: 0; list-style: none; } ul.message li { text-indent: -2em; padding: 0px; margin: 0px; font-style: italic; } ul.message li.warning { color: red; } END } =head1 NAME CGI::Application::Plugin::Authentication::Display::Classic - login box that works out of the box =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Display::Classic version 0.20 =head1 DESCRIPTION This module provides a login box that works out of the box but which can be configured to modify the styling. =head1 METHODS =head2 new The constructor must be passed the L<CGI::Application> object as the first non-object argument. =head2 login_box This method will return the HTML for a login box that can be embedded into another page. This is the same login box that is used in the default authen_login runmode that the plugin provides. You can set this option to customize the login form that is created when a user needs to be authenticated. If you wish to replace the entire login form with a completely custom version, then just set LOGIN_RUNMODE to point to your custom runmode. All of the parameters listed below are optional, and a reasonable default will be used if left blank: =over 4 =item TITLE (default: Sign In) the heading at the top of the login box =item USERNAME_LABEL (default: User Name) the label for the user name input =item PASSWORD_LABEL (default: Password) the label for the password input =item SUBMIT_LABEL (default: Sign In) the label for the submit button =item COMMENT (default: Please enter your username and password in the fields below.) a message provided on the first login attempt =item REMEMBERUSER_OPTION (default: 1) provide a checkbox to offer to remember the users name in a cookie so that their user name will be pre-filled the next time they log in =item REMEMBERUSER_LABEL (default: Remember User Name) the label for the remember user name checkbox =item REMEMBERUSER_COOKIENAME (default: CAPAUTHTOKEN) the name of the cookie where the user name will be saved =item REGISTER_URL (default: <none>) the URL for the register new account link =item REGISTER_LABEL (default: Register Now!) the label for the register new account link =item FORGOTPASSWORD_URL (default: <none>) the URL for the forgot password link =item FORGOTPASSWORD_LABEL (default: Forgot Password?) the label for the forgot password link =item INVALIDPASSWORD_MESSAGE (default: Invalid username or password<br />(login attempt %d) a message given when a login failed =item INCLUDE_STYLESHEET (default: 1) use this to disable the built in style-sheet for the login box so you can provide your own custom styles =item FORM_SUBMIT_METHOD (default: post) use this to get the form to submit using 'get' instead of 'post' =item FOCUS_FORM_ONLOAD (default: 1) use this to automatically focus the login form when the page loads so a user can start typing right away. =item BASE_COLOUR (default: #445588) This is the base colour that will be used in the included login box. All other colours are automatically calculated based on this colour (unless you hardcode the colour values). In order to calculate other colours, you will need the Color::Calc module. If you do not have the Color::Calc module, then you will need to use fixed values for all of the colour options. All colour values besides the BASE_COLOUR can be simple percentage values (including the % sign). For example if you set the LIGHTER_COLOUR option to 80%, then the calculated colour will be 80% lighter than the BASE_COLOUR. =item LIGHT_COLOUR (default: 50% or #a2aac4) A colour that is lighter than the base colour. =item LIGHTER_COLOUR (default: 75% or #d0d5e1) A colour that is another step lighter than the light colour. =item DARK_COLOUR (default: 30% or #303c5f) A colour that is darker than the base colour. =item DARKER_COLOUR (default: 60% or #1b2236) A colour that is another step darker than the dark colour. =item GREY_COLOUR (default: #565656) A grey colour that is calculated by desaturating the base colour. =back LOGIN_FORM => { TITLE => 'Login', SUBMIT_LABEL => 'Login', REMEMBERUSER_LABEL => 1, BASE_COLOUR => '#0099FF', LIGHTER_COLOUR => '#AAFFFF', DARK_COLOUR => '50%', } =head1 BUGS This is alpha software and as such, the features and interface are subject to change. So please check the Changes file when upgrading. =head1 SEE ALSO L<CGI::Application>, perl(1) =head1 AUTHOR Author: Cees Hek <ceeshek@gmail.com>; Co-maintainer: Nicholas Bamber <nicholas@periapt.co.uk>. =head1 CREDITS Thanks to SiteSuite (http://www.sitesuite.com.au) for funding the development of this plugin and for releasing it to the world. Thanks to Christian Walde for suggesting changes to fix the incompatibility with L<CGI::Application::Plugin::ActionDispatch> and for help with github. =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. Copyright (c) 2010, Nicholas Bamber. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Store�����������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 32154� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication�����������������������������������������������������������������������������������Cookie.pm�������������������������������������������������������������������������������������������000444��001750��001750�� 21333�11563746137� 34102� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Store�����������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Store::Cookie; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Store); use MIME::Base64 (); use Digest::SHA (); use CGI::Cookie (); # CONFIGURABLE OPTIONS # # - SECRET # # If this value is defined, it will be used to protect # the Cookie values from tampering. To generate a good # secret, run the following perl script and cut and paste # the value it generates into this variable. # # perl -MDigest::MD5=md5_base64 -l -e 'print md5_base64($$,time(),rand(9999))' # our $SECRET = ''; =head1 NAME CGI::Application::Plugin::Authentication::Store::Cookie - Cookie based Store =head1 VERSION This document describes CGI::Application::Plugin::Authentication version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( STORE => ['Cookie', SECRET => "Shhh, don't tell anyone", NAME => 'CAPAUTH_DATA', EXPIRY => '+1y'], ); =head1 DESCRIPTION This module uses a cookie to store authentication information across multiple requests. It works by creating a cookie that contains the information we would like to store (like the name of the user that is currently authenticated), and then base64 encoding the data. In order to ensure that the information is not manipulated by the end-user, we include a CRC checksum that is generated along with our secret. Since the user does not know the value of the secret, they will not be able to recreate the checksum if they change some of the values, so we will be able to tell if the information in the cookie has been manipulated. =head1 THE SECRET =head2 Choosing a good secret An easy way to generate a relatively good secret is to run the following perl snippet: perl -MDigest::MD5=md5_base64 -l -e 'print md5_base64($$,time(),rand(9999))' Just use the resulting string as your secret. =head2 Configuring the secret There are three ways that you can provide a secret to the module: =over 4 =item Hardcode the secret You can hardcode a secret right in the CGI::Application::Plugin::Authentication::Store::Cookie module, so that you don't have to remember to provide one every time you use the module. Just open the source in a text editor and look at the top of the file where it defines 'our $SECRET' and follow the instruction listed there. =item Provide the SECRET option when using the module You can also just provide the secret as an option when using the module using the SECRET parameter. __PACKAGE__->authen->config( STORE => ['Cookie', SECRET => "Shhh, don't tell anyone"], ); =item Let the module choose a secret for you And lastly, if you forget to do either of these, the module will use the name of your application as the secret, but that is not a very good value to use, so a warning will be spit out everytime it uses this. This is the least desirable choice, and is only included as a last resort. =back =head1 DEPENDENCIES This module requires the following modules to be available. =over 4 =item MIME::Base64 =item Digest::SHA =item CGI::Cookie =back =head1 METHODS =head2 fetch This method accepts a list of parameters and fetches them from the cookie data. =cut sub fetch { my $self = shift; my @items = map { $self->{cookie}->{data}->{$_} } @_; return @items[0..$#items]; } =head2 save This method accepts a hash of parameters and values and stores them in the cookie data. =cut sub save { my $self = shift; my %items = @_; while (my ($param, $value) = each %items) { $self->{cookie}->{data}->{$param} = $value; } $self->_register_postrun_callback; return 1; } =head2 delete This method accepts a list of parameters and deletes them from the cookie data. =cut sub delete { my $self = shift; foreach my $param (@_) { delete $self->{cookie}->{data}->{$param}; } $self->_register_postrun_callback; return 1; } =head2 initialize This method will check for an existing cookie, and decode the contents for later retrieval. =cut sub initialize { my $self = shift; my @options = $self->options; die "Invalid Store Configuration for the Cookie store - options section must contain a hash of values" if @options % 2; my %options = @options; $self->{cookie}->{options} = \%options; my %cookies = CGI::Cookie->fetch; if ($cookies{$self->cookie_name}) { my $rawdata = $cookies{$self->cookie_name}->value; $self->{cookie}->{data} = $self->_decode($rawdata); } # $self->_register_postrun_callback; return; } =head2 cookie_name This method will return the name of the cookie =cut sub cookie_name { my $self = shift; return $self->{cookie}->{options}->{NAME} || 'CAPAUTH_DATA'; } ### ### Helper methods ### # _register_postrun_callback # # We only register the postrun callback once a change has been made to the data # so that we don't unecesarily send out a cookie. sub _register_postrun_callback { my $self = shift; return if $self->{cookie}->{postrun_registered}++; $self->authen->_cgiapp->add_callback('postrun', \&_postrun_callback); return; } # _postrun_callback # # This callback will add a cookie to the outgoing headers at the postrun stage sub _postrun_callback { my $self = shift; my $store = $self->authen->store; my $rawdata = $store->_encode($store->{cookie}->{data}); my %cookie_params = ( -name => $store->cookie_name, -value => $rawdata, ); $cookie_params{'-expires'} = $store->{cookie}->{options}->{EXPIRY} if $store->{cookie}->{options}->{EXPIRY}; my $cookie = new CGI::Cookie(%cookie_params); $self->header_add(-cookie => [$cookie]); return; } # _decode # # Take a raw cookie value, and decode and verify the data sub _decode { my $self = shift; my $rawdata = MIME::Base64::decode(shift); return if not $rawdata; my %hash = map { split /\=/, $_, 2 } split /\0/, $rawdata; my $checksum = delete $hash{c}; # verify checksum if ($checksum eq Digest::SHA::sha1_base64(join("\0", $self->_secret, sort values %hash))) { # Checksum verifies so the data is clean return \%hash; } else { # The data could not be verified, so we trash it all return; } } # _encode # # Take the data we want to store and encode the data into a cookie sub _encode { my $self = shift; my $hash = shift; my %hash = %$hash; my $checksum = Digest::SHA::sha1_base64(join("\0", $self->_secret, sort values %hash)); $hash{c} = $checksum; my $rawdata = join("\0", map { join('=', $_, $hash{$_}) } keys %hash); return MIME::Base64::encode($rawdata, ""); } # _secret # # A unique value for this application that is used to secure the Cookies sub _secret { my $self = shift; my $secret = $self->{cookie}->{options}->{SECRET} || $SECRET; unless ($secret) { $secret = Digest::SHA::sha1_base64( ref $self->authen->_cgiapp ); warn "using default SECRET! Please provide a proper SECRET when using the Cookie store (See CGI::Application::Plugin::Authentication::Store::Cookie for details)"; } return $secret; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Store>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Session.pm������������������������������������������������������������������������������������������000444��001750��001750�� 7231�11563746137� 34275� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Store�����������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Store::Session; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Store); =head1 NAME CGI::Application::Plugin::Authentication::Store::Session - Session based Store =head1 VERSION This document describes CGI::Application::Plugin::Authenticatio::Store::Session version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( STORE => 'Session', ); =head1 DESCRIPTION This module uses a session to store authentication information across multiple requests. It depends on the L<CGI::Application::Plugin::Session> plugin being present. Actually, it only requires that there be a 'session' method in the CGI::Application module that will return a valid CGI::Session object. =head1 METHODS =head2 fetch This method accepts a list of parameters and fetches them from the session. =cut sub fetch { my $self = shift; my @params = @_; my @items; foreach my $param (@params) { my $key = &_names_to_keys($param); push @items, $self->_session->param($key); } return @items[0..$#items]; } =head2 save This method accepts a hash of parameters and values and saves them into the session. =cut sub save { my $self = shift; my %items = @_; my $session = $self->_session; while (my ($param, $value) = each %items) { my $key = _names_to_keys($param); $session->param( $key => $value ); } return 1; } =head2 delete This method accepts a list of parameters and deletes them from the session. =cut sub delete { my $self = shift; my @items = &_names_to_keys(@_); $self->_session->clear(\@items); } # # Return the session object # sub _session { return $_[0]->authen->_cgiapp->session; } # # We want all parameters in the session to have a common prefix # sub _names_to_keys { my @names = @_; my @keys = map { 'AUTH_'.uc($_) } @names; return @keys[0..$#keys]; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Store>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Driver����������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 32313� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication�����������������������������������������������������������������������������������HTPasswd.pm�����������������������������������������������������������������������������������������000444��001750��001750�� 6150�11563746137� 34505� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver����������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::HTPasswd; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Driver); use Apache::Htpasswd; =head1 NAME CGI::Application::Plugin::Authentication::Driver::HTPasswd - HTPasswd Authentication driver =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::HTPasswd version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => ['HTPasswd', '/etc/apache/htpasswd', '/etc/apache/otherhtpasswd'] ); =head1 DESCRIPTION This Driver allows you to authenticate against an htpasswd file. For information on the format of the htpasswd file, see the documentation for the Apache webserver. This driver requires that the L<Apache::Htpasswd> module is installed. =head1 METHODS =head2 verify_credentials This method will test the provided credentials against the htpasswd file(s) defined in the DRIVER config. =cut sub verify_credentials { my $self = shift; my ( $username, $password ) = @_; # verify that all the options are OK my @files = $self->options; die "The HTPasswd driver requires at least one htpasswd file" unless @files; foreach my $file (@files) { my $htpasswd = Apache::Htpasswd->new( { passwdFile => $file, ReadOnly => 1, } ); return $username if $htpasswd->htCheckPassword( $username, $password ); } return; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������DBI.pm����������������������������������������������������������������������������������������������000444��001750��001750�� 37121�11563746137� 33430� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver����������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::DBI; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Driver); =head1 NAME CGI::Application::Plugin::Authentication::Driver::DBI - DBI Authentication driver =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::DBI version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'DBI', DBH => $self->dbh, TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'MD5:user.password' => '__CREDENTIAL_2__' }, ], ); =head1 DESCRIPTION This Authentication driver uses the DBI module to allow you to authenticate against any database for which there is a DBD module. You can either provide an active database handle, or provide the parameters necessary to connect to the database. When describing the database structure, you need to specify some or all of the following parameters: TABLE(S), JOIN_ON, COLUMNS, CONSTRAINTS, ORDER_BY and LIMIT. =head2 DBH The DBI database handle to use. Defaults to C<$self->dbh()>, which is provided and configured through L<CGI::Application::Plugin::DBH|CGI::Application::Plugin::DBH> =head2 TABLE(S) (required) Provide either a single table name, or an array of table names. You can give the table names aliases which can be referenced in later columns. TABLE => 'users', - or - TABLES => ['users U', 'domains D'], =head2 JOIN_ON (conditionally required) If you have specified multiple tables, then you need to provide an SQL expression that can be used to join those tables. JOIN_ON => 'user.domainid = domain.id', - or - JOIN_ON => 'U.domainid = D.id', =head2 COLUMNS (optional) This is a hash of columns/values that should be pulled out of the database and validated locally in perl. Most credentials can be checked right in the database (example username = ?), but some parameters may need to be tested locally in perl, so they must be listed in the COLUMNS option. One example of a value that needs to be tested in perl is a crypted password. In order to test a crypted password, you need to take the entered password, and crypt it with the salt of the already crypted password. But until we actually see the password that is in the database, we will not know the value of the salt that was used to encrypt the password. So we pull the value out using COLUMNS, and the test will be performed automatically in perl. Any value that matches __CREDENTIAL_n__ (where n is a number) will be replaced with the corresponding credential that was entered by the user. For an explanation of what the credentials are and where they come from, see the section headed with CREDENTIALS in L<CGI::Application::Plugin::Authentication>. COLUMNS => { 'crypt:password' => '__CREDENTIAL_2__' }, =head2 CONSTRAINTS (optional) You will most likely always have some constraints to use. These constraints will be added to the WHERE clause of the SQL query, and will ideally reduce the number of returned rows to one. Any value that matches __CREDENTIAL_n__ (where n is a number) will be replaced with the corresponding credential that was entered by the user. For an explanation of what the credentials are and where they come from, see the section headed with CREDENTIALS in L<CGI::Application::Plugin::Authentication>. CONSTRAINTS => { 'users.email' => '__CREDENTIAL_1__', 'MD5:users.passphrase' => '__CREDENTIAL_2__', 'users.active' => 1, } =head2 ORDER_BY (optional) This option allows you to order the result set, in case the query returns multiple rows. ORDER_BY => 'created DESC' Note: This option is only useful if you also specify the COLUMNS option. =head2 LIMIT (optional) In some situations your query may return multiple rows when you only want it to return one. For example if you insert and date a new row instead of updating the existing row when the details for an account change. In this case you want the newest record from the result set, so it will be important to order the result set and limit it to return only one row. LIMIT => 1 Note: This option is only useful if you also specify the COLUMNS option. =head1 ENCODED PASSWORDS It is quite common to store passwords in a database in some form that makes them hard (or virtually impossible) to guess. Most of the time one way encryption techniques like Unix crypt or MD5 hashes are used to store the password securely (I would recommend using MD5 or SHA1 over Unix crypt). If you look at the examples listed above, you can see that you can mark your columns with an encoding type. Here is another example: CONSTRAINTS => { username => '__CREDENTIAL_1__', 'MD5:password' => '__CREDENTIAL_2__', } Here the password field is expected to be stored in the database in MD5 format. In order for the MD5 check to work for all databases, the password will be encoded using perl, and then checked against the value in the database. So in effect, the following will be done: $username = 'test'; $password = '123'; $encoded_password = 'ICy5YqxZB1uWSwcVLSNLcA'; $sth = $dbh->prepare('SELECT count(*) FROM users WHERE username = ? AND password = ?'; $sth->execute($username, $encoded_password); # I we found a row, then the user credentials are valid and the user is logged in This is all automatically performed behind the scenes when you specify that a certain field in the database is encoded. We have to handle this slightly different when working with Unix crypt. In order to crypt a password, you need to provide the crypt function with a 2 character salt value. These are usually just generated randomly, and when the value is crypted, the first two characters of the resulting string will be the 2 salt characters. The problem comes into play when you want to check a password against a crypted password. You need to know the salt in order to properly test the password. But in our case, the crypted password is in the DB. This means we can not generate the crypted test password before we run the query against the database. So instead we pull the value of the crypted password out of the database, and then perform the tests after the query, instead of before. Here is an example: CONSTRAINTS => { 'username' => '__CREDENTIAL_1__' }, COLUMNS => { 'crypt:password' => '__CREDENTIAL_2__' }, And here is what will happen behind the scenes: $username = 'test'; $password = '123'; $sth = $dbh->prepare('SELECT password FROM users WHERE username = ?'; $sth->execute($username); ($encoded_password) = $sth->fetchrow_array; if ($encoded_password eq crypt($password, $encoded_password)) { # The credentials are valid and the user is logged in } Again, this is all done automatically behind the scenes, but I've included it here to illustrate how the queries are performed, and how the comparisons are handled. For more information see the section labelled ENCODED PASSWORDS in the L<CGI::Application::Plugin::Authentication::Driver> docs. =head1 EXAMPLE # using multiple tables # Here we check three credentials (user, password and domain) across # two separate tables. __PACKAGE__->authen->config( DRIVER => [ 'DBI', # the handle comes from $self->dbh, via the "DBH" plugin. TABLES => ['user', 'domain'], JOIN_ON => 'user.domainid = domain.id', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__', 'domain.name' => '__CREDENTIAL_3__' } ], ); - or - # using filtered fields # Here the password column contains values that are encoded using unix crypt # and since we need to know the salt in order to encrypt the password # properly, we need to pull out the password, and check it locally __PACKAGE__->authen->config( DRIVER => [ 'DBI', DBH => $dbh, # provide your own DBI handle TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__' } COLUMNS => { 'crypt:password' => '__CREDENTIAL_2__' }, ], ); - or - # extra constraints # Here we only check users where the 'active' column is true __PACKAGE__->authen->config( DRIVER => [ 'DBI', TABLE => 'user', CONSTRAINTS => { 'user.name' => '__CREDENTIAL_1__', 'user.password' => '__CREDENTIAL_2__', 'user.active' => 't' }, ], ); - or - # all of them combined # Here the user is required to enter a username and password (which is # crypted), and a daily code that changes every day (which is encoded using # an MD5 hash hex format and stored in upper case). __PACKAGE__->authen->config( DRIVER => [ 'DBI', TABLES => ['user U', 'dailycode D'], JOIN_ON => 'U.userid = D.userid', CONSTRAINTS => { 'U.name' => '__CREDENTIAL_1__', 'uc:md5_hex:D.code' => '__CREDENTIAL_3__', 'D.date' => 'now' }, COLUMNS => { 'crypt:U.password' => '__CREDENTIAL_2__' }, ], ); =head1 METHODS =head2 verify_credentials This method will test the provided credentials against the values found in the database, according to the Driver configuration. =cut sub verify_credentials { my $self = shift; my @creds = @_; # verify that all the options are OK my @_options = $self->options; die "The DBI driver requires a hash of options" if @_options % 2; my %options = @_options; # Get a database handle - either one that is given to us, or see if there # is a ->dbh method in the CGIApp module (This is provided by the # CGI::Application::Plugin::DBH module, so use it if it is there). my $dbh; if ( $options{DBH} ) { $dbh = $options{DBH}; } elsif ( $self->authen->_cgiapp->can('dbh') ) { $dbh = $self->authen->_cgiapp->dbh; } else { die "No DBH handle passed to the DBI Driver, and no dbh() method detected"; } # Grab the database table names (TABLE and TABLES are synonymous) my $tables = $options{TABLES} || $options{TABLE}; die "No TABLE parameter defined" unless defined($tables); $tables = [$tables] unless ref $tables eq 'ARRAY'; # See if we need to order the result set my $order_by = $options{ORDER_BY} ? ' ORDER BY '.$options{ORDER_BY} : ''; # See if we need to limit the result set my $limit = $options{LIMIT} ? ' LIMIT '.$options{LIMIT} : ''; # Grab all the columns that we need to pull out. We also grab a list of # columns that are stripped of any encoding information. # If no columns are provided we just select count(*) for efficiency. my @columns; my @stripped_columns; if ( $options{COLUMNS} ) { die "COLUMNS must be a hashref" unless ref $options{COLUMNS} eq 'HASH'; @columns = keys %{ $options{COLUMNS} }; @stripped_columns = $self->strip_field_names(@columns); } else { @columns = ('count(*)'); @stripped_columns = @columns; } # Process the constraints. # We need to check for values indicate they should be replaced by # a credential (__CREDENTIAL_\d+__), and we need to filter any values # that are configured to be filtered my %constraints; if ( $options{CONSTRAINTS} ) { die "CONSTRAINTS must be a hashref" unless ref $options{CONSTRAINTS} eq 'HASH'; while ( my ( $column, $value ) = each %{ $options{CONSTRAINTS} } ) { if ( $value =~ /^__CREDENTIAL_(\d+)__$/ ) { $value = $creds[ $1 - 1 ]; } $value = $self->filter( $column, $value ); $column = $self->strip_field_names($column); $constraints{$column} = $value; } } # If we have multiple tables, then we need a join constraint my $join_on = $options{JOIN_ON}; # Build the SQL statement my $sql = 'SELECT ' . join( ', ', @stripped_columns ) . ' FROM ' . join( ', ', @$tables ) . ' WHERE '; my @where; push @where, $join_on if $join_on; push @where, map { $_ . ' = ?' } keys %constraints; $sql .= join( ' AND ', @where ); my @params = values %constraints; $sql .= $order_by; $sql .= $limit; # prepare and execute the SQL my $sth = $dbh->prepare_cached($sql) || die "Failed to prepare SQL statement: " . $dbh->errstr; $sth->execute(@params) or die $dbh->errstr; # Figure out what to do with the results if ( $options{COLUMNS} ) { # Since we pulled out some columns, we assume that these columns were not checked # in the constraints section, and we test them here. # It is possible that we could have multiple rows, so keep checking until we # find a row where all comparisons are successful. while ( my @array = $sth->fetchrow_array ) { my $match = 1; foreach my $index ( 0 .. $#columns ) { my $value = $options{COLUMNS}->{ $columns[$index] }; if ( $value =~ /^__CREDENTIAL_(\d+)__$/ ) { $value = $creds[ $1 - 1 ]; } if ( !$self->check_filtered( $columns[$index], $value, $array[$index] ) ) { # This test failed, so there is no sense checking the rest of the values # in this row so we bail out early $match = 0; last; } } if ($match) { # we found a match so clean up and return the first credential $sth->finish; return $creds[0]; } } } else { # Since we are not pulling specific columns we just check # to see if we matched at least one row my ($count) = $sth->fetchrow_array; $sth->finish; return $creds[0] if $count; } return; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Dummy.pm��������������������������������������������������������������������������������������������000444��001750��001750�� 5323�11563746137� 34104� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver����������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Dummy; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Driver); =head1 NAME CGI::Application::Plugin::Authentication::Driver::Dummy - Dummy Authentication driver which lets anyone authenticate regardless of the password they provide =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Dummy version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => 'Dummy', ); =head1 DESCRIPTION This Driver is the anti-authentication driver, since it doesn't check the credentials at all, and just accepts whatever the user has entered. It can be useful in development, or if you want a guest based system without passwords. =head1 EXAMPLE __PACKAGE__->authen->config( DRIVER => 'Dummy', ); =head1 METHODS =head2 verify_credentials This method will automatically return the first credential as the username without checking anything else. =cut sub verify_credentials { my $self = shift; return shift; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Generic.pm������������������������������������������������������������������������������������������000444��001750��001750�� 10127�11563746137� 34403� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver����������������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Generic; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Driver); =head1 NAME CGI::Application::Plugin::Authentication::Driver::Generic - Generic Authentication driver =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Generic version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Generic', { user1 => '123', user2 => '123' } ], ); =head1 DESCRIPTION This Driver offers a simple way to provide a user database to the L<CGI::Application::Plugin::Authentication> plugin. It offers three ways to provide a list of users to the plugin by providing a hash of username/password pairs, an array of arrays containing the username and password pairs, or a code reference that returns back the username, or undef on success or failure. =head1 EXAMPLE my %users = ( user1 => '123', user2 => '123', ); __PACKAGE__->authen->config( DRIVER => [ 'Generic', \%users ], ); - or - my @users = ( ['example.com', 'user1', '123'], ['example.com', 'user2', '123'], ['foobar.com', 'user1', '123'], ); __PACKAGE__->authen->config( DRIVER => [ 'Generic', \@users ], CREDENTIALS => [ 'authen_domain', 'authen_username', 'authen_password' ] ); - or - sub check_password { my @credentials = @_; if ($credentials[0] eq 'test' && $credentials[1] eq 'secret') { return 'testuser'; } return; } __PACKAGE__->authen->config( DRIVER => [ 'Generic', \&check_password ], ); =head1 METHODS =head2 verify_credentials This method will test the provided credentials against either the hash ref, array ref or code ref that the driver was configured with. =cut sub verify_credentials { my $self = shift; my @creds = @_; my @options = $self->options; my $data = $options[0]; if ( ref $data eq 'HASH' ) { return undef unless( defined( $creds[0] ) && defined( $creds[1] ) ); return ( defined $data->{ $creds[0] } && $data->{ $creds[0] } eq $creds[1] ) ? $creds[0] : undef; } elsif ( ref $data eq 'ARRAY' ) { foreach my $row (@$data) { return $creds[0] unless grep { !defined $creds[$_] || $creds[$_] ne $row->[$_] } 0..$#$row; } return undef; } elsif ( ref $data eq 'CODE' ) { return $data->(@creds); } die "Unknown options for Generic Driver"; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Authen����������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 33537� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver����������������������������������������������������������������������������Simple.pm�������������������������������������������������������������������������������������������000444��001750��001750�� 6242�11563746137� 35467� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Authen���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Authen::Simple; use strict; use warnings; our $VERSION = '0.20'; use base qw(CGI::Application::Plugin::Authentication::Driver); use Carp; use UNIVERSAL::require; =head1 NAME CGI::Application::Plugin::Authentication::Driver::Authen::Simple - Authen::Simple Authentication driver =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Authen::Simple version 0.20 =head1 SYNOPSIS use base qw(CGI::Application); use CGI::Application::Plugin::Authentication; __PACKAGE__->authen->config( DRIVER => [ 'Authen::Simple::Kerberos', realm => 'REALM.COMPANY.COM' ], ); =head1 DESCRIPTION This driver allows you to use any modules that following the Authen::Simple API. All options that you provide will be passed on to the given Authen::Simple module. =head1 EXAMPLE __PACKAGE__->authen->config( DRIVER => [ 'Authen::Simple::CDBI', class => 'MyApp::Model::User' ], ); =head1 METHODS =head2 verify_credentials This method will test the provided credentials against the Authen::Simple module that was configured. =cut sub verify_credentials { my $self = shift; my @creds = @_; my @options = $self->options; my $authen_class = shift @options; return undef unless defined $creds[0] && defined $creds[1]; $authen_class->require || Carp::croak("The $authen_class module is not installed"); my $authen_obj = $authen_class->new(@options); croak("Failed to create $authen_class instance") if !defined $authen_obj; return $authen_obj->authenticate(@creds) ? $creds[0] : undef; } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<CGI::Application::Plugin::Authentication>, perl(1) =head1 LICENCE AND COPYRIGHT Copyright (c) 2006, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =head1 DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. =cut 1; ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Filter����������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 33540� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver����������������������������������������������������������������������������sha1.pm���������������������������������������������������������������������������������������������000444��001750��001750�� 4613�11563746137� 35073� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Filter���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Filter::sha1; use strict; use warnings; our $VERSION = '0.20'; use UNIVERSAL::require; sub check { my $class = shift; my $param = shift; my $plain = shift; my $filtered = shift; if ($param) { return ( $class->filter( $param, $plain ) eq $filtered ) ? 1 : 0; } elsif ( length($filtered) == 20 ) { return ( $class->filter( 'binary', $plain ) eq $filtered ) ? 1 : 0; } elsif ( length($filtered) == 27 ) { return ( $class->filter( 'base64', $plain ) eq $filtered ) ? 1 : 0; } else { return ( $class->filter( undef, $plain ) eq $filtered ) ? 1 : 0; } } sub filter { my $class = shift; my $param = lc shift || 'hex'; my $plain = shift; Digest::SHA->require || die "Digest::SHA is required to check SHA1 passwords"; if ( $param eq 'hex' ) { return Digest::SHA::sha1_hex($plain); } elsif ( $param eq 'base64' ) { return Digest::SHA::sha1_base64($plain); } elsif ( $param eq 'binary' ) { return Digest::SHA::sha1($plain); } die "Unknown SHA1 format $param"; } 1; __END__ =head1 NAME CGI::Application::Plugin::Authentication::Driver::Filter::sha1 - SHA1 Password filter =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Filter::sha1 version 0.20 =head1 METHODS =head2 filter ( (hex base64 binary), $string ) This will generate an SHA1 hash of the string in the requested format. By default, hex encoding is used. my $filtered = $class->filter('base64', 'foobar'); # iEPX+SQWIR3p67lj/0zigSWTKHg -or- my $filtered = $class->filter(undef, 'foobar'); # 8843d7f92416211de9ebb963ff4ce28125932878 =head2 check ( (hex base64 binary), $string, $sha1 ) This will generate an SHA1 hash of the string, and compare it against the provided SHA1 string. If no encoding type is specified, the length of the SHA1 string will be tested to see what format it is in. if ($class->check(undef, 'foobar', '8843d7f92416211de9ebb963ff4ce28125932878')) { # they match } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<Digest::SHA>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut ���������������������������������������������������������������������������������������������������������������������uc.pm�����������������������������������������������������������������������������������������������000444��001750��001750�� 2163�11563746137� 34644� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Filter���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Filter::uc; use strict; use warnings; our $VERSION = '0.20'; sub check { return ( uc $_[2] eq $_[3] ) ? 1 : 0; } sub filter { return uc $_[2]; } 1; __END__ =head1 NAME CGI::Application::Plugin::Authentication::Driver::Filter::uc - Uppercase Filter =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Filter::uc version 0.20 =head1 METHODS =head2 filter ( undef, $string ) This simply uppercases the string and returns it my $filtered = $class->filter(undef, 'foobar'); # FOOBAR =head2 check ( undef, $string, $compare ) This will uppercase the string and compare it against the comparison string and return true or false. if ($class->check(undef, 'foobar', 'FOOBAR')) { # they match } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut �������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������strip.pm��������������������������������������������������������������������������������������������000444��001750��001750�� 2526�11563746137� 35401� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Filter���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Filter::strip; use strict; use warnings; our $VERSION = '0.20'; sub check { return ( _strip( $_[2] ) eq $_[3] ) ? 1 : 0; } sub filter { return _strip( $_[2] ); } sub _strip { my $str = shift; $str =~ s/^\s+//; $str =~ s/\s+$//; return $str; } 1; __END__ =head1 NAME CGI::Application::Plugin::Authentication::Driver::Filter::strip - Filter that strips whitespace from the beginning and end of the string =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Filter::strip version 0.20 =head1 METHODS =head2 filter ( undef, $string ) This strips whitespace from the beginning and end of the string and returns the result my $filtered = $class->filter(undef, " foobar\t\n"); # 'foobar' =head2 check ( undef, $string, $compare ) This will lowercase the string and compare it against the comparison string and return true or false. if ($class->check(undef, " foobar\t\n", 'foobar')) { # they match } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������lc.pm�����������������������������������������������������������������������������������������������000444��001750��001750�� 2154�11563746137� 34633� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Filter���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Filter::lc; use strict; use warnings; our $VERSION = '0.20'; sub check { return ( lc $_[2] eq $_[3] ) ? 1 : 0; } sub filter { return lc( $_[2] ); } 1; __END__ =head1 NAME CGI::Application::Plugin::Authentication::Driver::Filter::lc - Lowercase Filter =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Filter::lc version 0.20 =head1 METHODS =head2 filter ( undef, $string ) This simply lowercases the string and returns it my $filtered = $class->filter(undef, 'FOOBAR'); # foobar =head2 check ( undef, $string, $compare ) This will lowercase C<$string> and compare it against C<$compare> and return true or false. if ($class->check(undef, 'FOOBAR', 'foobar')) { # they match } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������md5.pm����������������������������������������������������������������������������������������������000444��001750��001750�� 4536�11563746137� 34730� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Filter���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Filter::md5; use strict; use warnings; our $VERSION = '0.20'; use UNIVERSAL::require; sub check { my $class = shift; my $param = shift; my $plain = shift; my $filtered = shift; if ($param) { return ( $class->filter( $param, $plain ) eq $filtered ) ? 1 : 0; } elsif ( length($filtered) == 16 ) { return ( $class->filter( 'binary', $plain ) eq $filtered ) ? 1 : 0; } elsif ( length($filtered) == 22 ) { return ( $class->filter( 'base64', $plain ) eq $filtered ) ? 1 : 0; } else { return ( $class->filter( undef, $plain ) eq $filtered ) ? 1 : 0; } } sub filter { my $class = shift; my $param = lc shift || 'hex'; my $plain = shift; Digest::MD5->require || die "Digest::MD5 is required to check MD5 passwords"; if ( $param eq 'hex' ) { return Digest::MD5::md5_hex($plain); } elsif ( $param eq 'base64' ) { return Digest::MD5::md5_base64($plain); } elsif ( $param eq 'binary' ) { return Digest::MD5::md5($plain); } die "Unknown MD5 format $param"; } 1; __END__ =head1 NAME CGI::Application::Plugin::Authentication::Driver::Filter::md5 - MD5 filter =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Filter::md5 version 0.20 =head1 METHODS =head2 filter ( (hex base64 binary), $string ) This will generate an MD5 hash of the string in the requested format. By default, hex encoding is used. my $filtered = $class->filter('base64', 'foobar'); # OFj2IjCsPJFfMAxmQxLGPw -or- my $filtered = $class->filter(undef, 'foobar'); # 3858f62230ac3c915f300c664312c63f =head2 check ( (hex base64 binary), $string, $md5 ) This will generate an MD5 hash of the string, and compare it against the provided MD5 string. If no encoding type is specified, the length of the MD5 string will be tested to see what format it is in. if ($class->check(undef, 'foobar', '3858f62230ac3c915f300c664312c63f')) { # they match } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, L<Digest::MD5>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut ������������������������������������������������������������������������������������������������������������������������������������������������������������������crypt.pm��������������������������������������������������������������������������������������������000444��001750��001750�� 3520�11563746137� 35374� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/lib/CGI/Application/Plugin/Authentication/Driver/Filter���������������������������������������������������������������������package CGI::Application::Plugin::Authentication::Driver::Filter::crypt; use strict; use warnings; our $VERSION = '0.20'; sub check { my $class = shift; my $param = shift; my $plain = shift; my $filtered = shift; return ( $class->filter( $param, $plain, $filtered ) eq $filtered ) ? 1 : 0; } sub filter { my $class = shift; my $param = lc shift; # not used my $plain = shift; my $salt = shift; if (!$salt) { my @alphabet = ( '.', '/', 0 .. 9, 'A' .. 'Z', 'a' .. 'z' ); $salt = join '', @alphabet[ rand 64, rand 64 ]; } return crypt( $plain, $salt ); } 1; __END__ =head1 NAME CGI::Application::Plugin::Authentication::Driver::Filter::crypt - crypt Filter =head1 VERSION This document describes CGI::Application::Plugin::Authentication::Driver::Filter::crypt version 0.20 =head1 METHODS =head2 filter ( undef, $string [, salt ] ) This will generate a crypted string. The first parameter is always ignored, since there is only one way to use the crypt function. You can pass in an extra parameter to act as the salt. my $filtered = $class->filter(undef, 'foobar'); # mQvbWI43eDCAk -or- my $filtered = $class->filter(undef, 'foobar', 'AA'); # AAZk9Aj5/Ue0E =head2 check ( undef, $string, $crypted ) This will crypt the string, and compare it against the provided crypted string. The first parameter is always ignored, since there is only one way to use the crypt function. if ($class->check(undef, 'foobar', 'mQvbWI43eDCAk')) { # they match } =head1 SEE ALSO L<CGI::Application::Plugin::Authentication::Driver>, perl(1) =head1 AUTHOR Cees Hek <ceeshek@gmail.com> =head1 LICENCE AND COPYRIGHT Copyright (c) 2005, SiteSuite. All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������example���������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 22663� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20�����������������������������������������������������������������������������������������������������������������������������template.cgi����������������������������������������������������������������������������������������000555��001750��001750�� 4220�11563746137� 25320� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example���������������������������������������������������������������������������������������������������������������������#!/usr/bin/perl # # Sample application [Templates] # # This example is a bit more realistic than the sample.cgi and basic.cgi. # It is intended to show how you can control the style of the Basic login form. # You need to copy the templates and the contents of the httpdocs # to their appropriate places for you server. # Unless you change the .cgi script to use a local copy, # you will also need access to the internet so the script can load # some javascript files from YUI. # # The only valid username/password # combination is 'test' and '123'. # use strict; use warnings; use Readonly; # This bit needs to be modified for the local system. Readonly my $TEMPLATE_DIR => 'example/templates'; { package SampleLogin; use base ("CGI::Application::Plugin::HTDot", "CGI::Application"); use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; use CGI::Application::Plugin::AutoRunmode; use CGI::Application::Plugin::Authentication::Display::Basic; use CGI::Carp qw(fatalsToBrowser); my %config = ( DRIVER => [ 'Generic', { test => '123' } ], STORE => 'Cookie', LOGOUT_RUNMODE => 'one', LOGIN_RUNMODE => 'login', ); SampleLogin->authen->config(%config); SampleLogin->authen->protected_runmodes('two'); sub setup { my $self = shift; $self->start_mode('one'); } sub one : Runmode { my $self = shift; my $tmpl_obj = $self->load_tmpl('one.tmpl'); return $tmpl_obj->output; } sub login : Runmode { my $self = shift; my $tmpl_obj = $self->load_tmpl('login.tmpl'); my $display = CGI::Application::Plugin::Authentication::Display::Basic->new($self); $tmpl_obj->param(login => $display); return $tmpl_obj->output; } sub two : Runmode { my $self = shift; my $tmpl_obj = $self->load_tmpl('two.tmpl'); my $display = CGI::Application::Plugin::Authentication::Display::Basic->new($self); $tmpl_obj->param(login => $display); return $tmpl_obj->output; } } SampleLogin->new(TMPL_PATH=>$TEMPLATE_DIR)->run; ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������basic.cgi�������������������������������������������������������������������������������������������000555��001750��001750�� 3020�11563746137� 24563� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example���������������������������������������������������������������������������������������������������������������������#!/usr/bin/perl # # Sample application [Using Basic display] # # Just place this file in a CGI enabled part of your website, and # load it up in your browser. The only valid username/password # combination is 'test' and '123'. # use strict; use warnings; { package SampleLogin; use base qw(CGI::Application); use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; use CGI::Application::Plugin::AutoRunmode; use CGI::Carp qw(fatalsToBrowser); my %config = ( DRIVER => [ 'Generic', { test => '123' } ], STORE => 'Cookie', LOGOUT_RUNMODE => 'one', LOGIN_FORM=>{ DISPLAY_CLASS=>'Basic', }, ); SampleLogin->authen->config(%config); SampleLogin->authen->protected_runmodes('two'); sub setup { my $self = shift; $self->start_mode('one'); } sub one : Runmode { my $self = shift; return CGI::start_html() . CGI::h2('This page is NOT protected') . CGI::a( { -href => '?rm=two' }, 'Protected Runmode' ) . CGI::end_html(); } sub two : Runmode { my $self = shift; return CGI::start_html() . CGI::h2('This page is protected') . CGI::h2( 'username: ' . $self->authen->username ) . CGI::a( { -href => '?rm=one' }, 'Un-Protected Runmode' ) . CGI::br() . CGI::a( { -href => '?authen_logout=1' }, 'Logout' ) . CGI::end_html(); } } SampleLogin->new->run; ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������sample.cgi������������������������������������������������������������������������������������������000555��001750��001750�� 3040�11563746137� 24765� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example���������������������������������������������������������������������������������������������������������������������#!/usr/bin/perl -T # # Sample application # # Just place this file in a CGI enabled part of your website, and # load it up in your browser. The only valid username/password # combination is 'test' and '123'. # use strict; use warnings; { package SampleLogin; use base qw(CGI::Application); use CGI::Application::Plugin::Session; use CGI::Application::Plugin::Authentication; use CGI::Application::Plugin::AutoRunmode; use CGI::Carp qw(fatalsToBrowser); my %config = ( DRIVER => [ 'Generic', { test => '123' } ], STORE => 'Cookie', LOGOUT_RUNMODE => 'one', ); SampleLogin->authen->config(%config); SampleLogin->authen->protected_runmodes('two'); sub setup { my $self = shift; $self->start_mode('one'); } sub one : Runmode { my $self = shift; return CGI::start_html( -style => { -code => $self->authen->login_styles } ) . CGI::h2('This page is NOT protected') . CGI::a( { -href => '?rm=two' }, 'Protected Runmode' ) . CGI::end_html(); } sub two : Runmode { my $self = shift; return CGI::start_html( -style => { -code => $self->authen->login_styles } ) . CGI::h2('This page is protected') . CGI::h2( 'username: ' . $self->authen->username ) . CGI::a( { -href => '?rm=one' }, 'Un-Protected Runmode' ) . CGI::br() . CGI::a( { -href => '?authen_logout=1' }, 'Logout' ) . CGI::end_html(); } } SampleLogin->new->run; ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������httpdocs��������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 24513� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example���������������������������������������������������������������������������������������������������������������������js��������������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 25127� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/httpdocs������������������������������������������������������������������������������������������������������������focus.js��������������������������������������������������������������������������������������������000444��001750��001750�� 377�11563746137� 26730� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/httpdocs/js���������������������������������������������������������������������������������������������������������YAHOO.util.Event.onAvailable('authen_loginfield', function(o) { YAHOO.util.Dom.get('authen_loginfield').focus(); }, this); YAHOO.util.Event.onAvailable('authen_rememberuserfield', function(o) { YAHOO.util.Dom.get('authen_loginfield').select(); }, this);�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������css�������������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 25303� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/httpdocs������������������������������������������������������������������������������������������������������������ieonly.css������������������������������������������������������������������������������������������000444��001750��001750�� 71�11563746137� 27407� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/httpdocs/css��������������������������������������������������������������������������������������������������������div.login label .authen_input { margin-top: -1em; } �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������template.css����������������������������������������������������������������������������������������000444��001750��001750�� 10413�11563746137� 30004� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/httpdocs/css��������������������������������������������������������������������������������������������������������div.login { width: 25em; margin: auto; padding: 3px; font-weight: bold; border: 2px solid #445588; color: #303c5f; font-family: sans-serif; } div.login div { margin: 0; padding: 0; border: none; } div.login .login_header { background: #445588; border-bottom: 1px solid #1b2236; height: 1.5em; padding: 0.45em; text-align: left; color: #fff; font-size: 100%; font-weight: bold; } div.login .login_content { background: #d0d5e1; padding: 0.8em; border-top: 1px solid white; border-bottom: 1px solid #565656; font-size: 80%; } div.login .login_footer { background: #a2aac4; border-top: 1px solid white; border-bottom: 1px solid white; text-align: left; padding: 0; margin: 0; min-height: 2.8em; } div.login fieldset { margin: 0; padding: 0; border: none; width: 95%; } div.login label { clear: left; float: left; padding: 0.6em 0 0.6em 0; margin-right: 1em; width: 100%; text-align: left; } div.login label .authen_input { float: right; margin: 0 1em 0 0; padding: 0 0 0 18px; } /* image courtesy of http://www.famfamfam.com/lab/icons/silk/ */ #authen_loginfield { background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAG5SURBVHjaYvz//z8DJQAggFiIVfh0twHn9w8KD9+/ZBT+9/cfExfvwwc87GxWAAFEtAFf3yl++/9XikHXL56BkYmJ4dKmcoUPT99PBQggRmK8ALT9v4BUBQMLrxxQMztY7N+PjwyXtk76BxBATMRoFjGewsDCx8jw9Oxyht9vboIxCDAxs/wCCCC8LoBrZv/A8PPpVoZ/39gZ7p57xcDLJ8Xw5tkdBrO8DYwAAcRElOYXaxn+/73DwC4vzyAmzsLw58kJsGaQOoAAYiJK868nDGwSXgxvjp1n+Hz7HoNawRFGmFqAAMIw4MBEDaI1gwBAAKEYsKtL/b9x2HSiNYMAQACBA3FmiqKCohrbfQ2nLobn97Yz6Br/JEozCAAEEDgh/eb6d98yYhEDBxsnw5VNZxnOffjLIKltw/D52B6GH89fMVjUnGbEFdgAAQRPiexMzAyfDk9gMJbmYbh17irDueMrGbjExBi8Oy8z4ksnAAEENuDY1S8MjjsnMSgaezJ8Z2Bm+P95PgPX6ycENYMAQACBwyDSUeQ/GzB926kLMEjwsjOwifKvcy05EkxMHgEIIEZKszNAgAEA+j3MEVmacXUAAAAASUVORK5CYII=') no-repeat 0 1px; background-color: #fff; width: 12em; border-top: solid 1px #565656; border-left: solid 1px #565656; border-bottom: solid 1px #a2aac4; border-right: solid 1px #a2aac4; } /* image courtesy of http://www.famfamfam.com/lab/icons/silk/ */ #authen_passwordfield { background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAKbSURBVHjaYvz//z8DPvBko+s0IJUJ5U6X8d+dhSwPEEAMIANw4ccbXKYB8f8/P+6BMYgNEkNWAxBAhDV/Pff/5+t5/39/2gcU/gc25P5qpzkwdQABxIjNCzBnS7p2Mfz5tJ+BkVWE4dWRxWA5oBcYHiyyYnj5heGAedYxR4AAwmXAf0mPWQx/3q9n+P/3I9AAMaCoBsPr4x0MDH/+MUgHrGG4P8eF4fVf9gMAAcSEK/D+/3oA1gxm/3kLJG8wSDhWMAjoeTJ8fxjNoJDQzyD0+7sDQACx4DKAkVWcgZGZG2jIV6AJfxn+/37F8OfPO6BhRxl+f/nIwC7xluHPm58MAAHEhMX5ILHp787OYvj/7zvDr7f7Gf59vw804DUwPM4x/P3+loFb0ZfhVlc1wxMu7psAAcSCEd9MjAzswoYMAppmDD9e9DKwcIkwMHFyMPx+dZnh7+9vDDxqwQx3Ji1jeMrJc9W1/JQOQAAheyFT2mctw9+vpxh+fz7A8O1JDQMrEz/QK2YMb47uZpD0SmEAmsRwu7eJ4QUX1wWXklOGIE0AAcQIim9YShOzSmf49W4xw5+PdxlYeIUYWLh9GS6vXPH+3U/Gd3K/vikzcTAzvOTkOmNXeNIUZitAALFAbF4D9N8Bhl+vJjP8/vCUgY1fkoGZ24PhysoV7178Y9vmW3M8FqZBHS3MAAIIZMDnP59P835/3Mnw98t7Bg5xNQZGNnOgzSvfv2ZgX+dbfiwVX14BCCCQAbyMrNwMDKxcDOxi/Az/WU0YLi1b8/E9K8cqr6JjGQwEAEAAMf378+/cn+//GFi5bRiYuMOBzt7w4RMH50IPIjSDAEAAsbz8+Gfdh9VFEr9//WX7//s/009uzlmuWUcqGYgEAAEGAIZWUhP4bjW1AAAAAElFTkSuQmCC') no-repeat 0 1px; background-color: #fff; width: 12em; border-top: solid 1px #565656; border-left: solid 1px #565656; border-bottom: solid 1px #a2aac4; border-right: solid 1px #a2aac4; } #authen_loginfield:focus, #authen_passwordfield:focus { background-color: #ffc; color: #000; } div.login a { font-size: 80%; color: #303c5f; } div.login div.buttons input { border-top: solid 2px #a2aac4; border-left: solid 2px #a2aac4; border-bottom: solid 2px #565656; border-right: solid 2px #565656; background-color: #d0d5e1; padding: 0.2em 1em ; font-size: 80%; font-weight: bold; color: #303c5f; } div.login div.buttons { display: block; margin: 8px 4px; width: 100%; } #authen_loginbutton { float: right; margin-right: 1em; } #authen_registerlink { display: block; } #authen_forgotpasswordlink { display: block; } ul.message { margin-top: 0; margin-bottom: 0; list-style: none; } ul.message li { text-indent: -2em; padding: 0px; margin: 0px; font-style: italic; } ul.message li.warning { color: red; } �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ieonly6.css�����������������������������������������������������������������������������������������000444��001750��001750�� 70�11563746137� 27474� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/httpdocs/css��������������������������������������������������������������������������������������������������������div.login .login_footer { margin-bottom: -0.5em; } ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������templates�������������������������������������������������������������������������������������������000755��001750��001750�� 0�11563746137� 24661� 5����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example���������������������������������������������������������������������������������������������������������������������login.tmpl������������������������������������������������������������������������������������������000444��001750��001750�� 2013�11563746137� 27020� 0����������������������������������������������������������������������������������������������������ustar�00nicholas������������������������nicholas������������������������000000��000000��CGI-Application-Plugin-Authentication-0.20/example/templates�����������������������������������������������������������������������������������������������������������<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US"> <head> <link rel="stylesheet" type="text/css" href="/css/template.css"/> <!--[if lt IE 8]> <link rel="stylesheet" type="text/css" href="/css/ieonly.css" /> <![endif]--> <!--[if lt IE 7]> <link rel="stylesheet" type="text/css" href="/css/ieonly6.css" /> <![endif]--> <title><TMPL_VAR NAME="login.login_title"> one.tmpl000444001750001750 64311563746137 26460 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/example/templates Untitled Document

This page is NOT protected

Protected Runmode two.tmpl000444001750001750 101711563746137 26524 0ustar00nicholasnicholas000000000000CGI-Application-Plugin-Authentication-0.20/example/templates Untitled Document

This page is protected

username: test


Un-Protected Runmode