This class handle folder web restricted access through .htaccess/.htpassword files. More...

Public Member Functions
	alternc_password_policy ()
	Password kind used in this class (hook for admin class) More...

	hook_menu ()
	hook called by menu class to add a menu to the left panel More...

	CreateDir ($dir)
	Create a protected folder (.htaccess et .htpasswd) More...

	ListDir ()
	Returns the list of all user folder currently protected by a .htpasswd file. More...

	is_protected ($dir)
	Tells if a folder is protected. More...

	get_hta_detail ($dir)
	Returns the list of login for a protected folder. More...

	DelDir ($dir, $skip=false)
	Unprotect a folder. More...

	add_user ($user, $password, $dir)
	Add a user to a protected folder. More...

	del_user ($lst, $dir)
	Delete a user from a protected folder. More...

	change_pass ($user, $newpass, $dir)
	Change the password of a user in a protected folder. More...

Private Member Functions
	_reading_htaccess ($absolute)
	Check that a .htaccess file is valid (for authentication) More...

Detailed Description

This class handle folder web restricted access through .htaccess/.htpassword files.

Copyright: AlternC-Team 2000-2017 https://alternc.com/

Definition at line 27 of file m_hta.php.

Member Function Documentation

◆ _reading_htaccess()

m_hta::_reading_htaccess ( $absolute )

private

Check that a .htaccess file is valid (for authentication)

Parameters

	global	m_messages $msg
type	$absolute
string	$absolute	Folder we want to check (relative to user root)

Returns: boolean TRUE is the .htaccess is protecting this folder, or FALSE else

Definition at line 408 of file m_hta.php.

                                                   {
         global $msg;
         $msg->debug("hta", "_reading_htaccess", $absolute);
         $file = fopen("$absolute/.htaccess", "r+");
         $lignes = array(1, 1, 1);
         $errr = 0;
         if (!$file) {
             return false;
         }
         while (!feof($file) && !$errr) {
             $s = fgets($file, 1024);
             if (substr($s, 0, 12) != "RewriteCond " && substr($s, 0, 14) != "ErrorDocument " && substr($s, 0, 12) != "RewriteRule " && substr($s, 0, 14) != "RewriteEngine " && trim($s) != "") {
                 $errr = 1;
             }
             if (strtolower(trim($s)) == strtolower("authuserfile $absolute/.htpasswd")) {
                 $lignes[0] = 0;
                 $errr = 0;
             } // authuserfile
             if (strtolower(trim($s)) == "require valid-user") {
                 $lignes[1] = 0;
                 $errr = 0;
             } //require
             if (strtolower(trim($s)) == "authtype basic") {
                 $lignes[2] = 0;
                 $errr = 0;
             } //authtype
         } // Reading config file
         fclose($file);
         if ($errr || in_array(0, $lignes)) {
             $msg->raise("ERROR", "hta", _("An incompatible .htaccess file exists in this folder"));
             return false;
         }
         return true;
     }

References $msg.

◆ add_user()

m_hta::add_user	(	$user,
		$password,
		$dir
	)

Add a user to a protected folder.

Parameters

	global	m_messages $msg
	global	m_bro $bro
	global	m_admin $admin
string	$user
string	$password
string	$dir
string	$password	The password to add (cleartext)
string	$dir	The folder we add it to (relative to user root).

Returns: boolean TRUE if the user has been added, or FALSE if an error occurred

Definition at line 259 of file m_hta.php.

                                               {
         global $msg, $bro, $admin;
         $msg->log("hta", "add_user", $user . "/" . $dir);
         if (empty($user)) {
             $msg->raise("ERROR", 'hta', _("Please enter a user"));
             return false;
         }
         if (empty($password)) {
             $msg->raise("ERROR", 'hta', _("Please enter a password"));
             return false;
         }
         $absolute = $bro->convertabsolute($dir, 0);
         if (!file_exists($absolute)) {
             $msg->raise("ERROR", "hta", _("The folder '%s' does not exist"), $dir);
             return false;
         }
         // @todo delete cf!. functions.php checkloginemail definition
         if (checkloginmail($user)) {
             // Check this password against the password policy using common API : 
             if (is_callable(array($admin, "checkPolicy"))) {
                 if (!$admin->checkPolicy("hta", $user, $password)) {
                     return false; // The error has been raised by checkPolicy()
                 }
             }
  
             $file = @fopen("$absolute/.htpasswd", "a+");
             if (!$file) {
                 $msg->raise("ERROR", "hta", _("File already exist"));
                 return false;
             }
             fseek($file, 0);
             while (!feof($file)) {
                 $s = fgets($file, 1024);
                 $t = explode(":", $s);
                 if ($t[0] == $user) {
                     $msg->raise("ERROR", "hta", _("The user '%s' already exist for this folder"), $user);
                     return false;
                 }
             }
             fseek($file, SEEK_END);
             if (empty($t[1]) || substr($t[1], -1) != "\n") {
                 fwrite($file, "\n");
             }
             fwrite($file, "$user:" . _md5cr($password) . "\n");
             fclose($file);
             return true;
         } else {
             $msg->raise("ERROR", "hta", _("Please enter a valid username"));
             return false;
         }
     }

References $bro, $msg, $password, $t, $user, _md5cr(), and checkloginmail().

◆ alternc_password_policy()

m_hta::alternc_password_policy ( )

Password kind used in this class (hook for admin class)

Returns: array

Definition at line 34 of file m_hta.php.

                                        {
         return array("hta" => "Protected folders passwords");
     }

◆ change_pass()

m_hta::change_pass	(	$user,
		$newpass,
		$dir
	)

Change the password of a user in a protected folder.

Parameters

string	$user	The users whose password should be changed
string	$newpass	The new password of this user
string	$dir	The folder, relative to user root, in which we will change a password

Returns: boolean TRUE if the password has been changed, or FALSE if an error occurred

Definition at line 361 of file m_hta.php.

                                                 {
         global $bro, $msg, $admin;
         $msg->log("hta", "change_pass", $user . "/" . $dir);
         $absolute = $bro->convertabsolute($dir, 0);
         if (!file_exists($absolute)) {
             $msg->raise("ERROR", "hta", _("The folder '%s' does not exist"), $dir);
             return false;
         }
  
         // Check this password against the password policy using common API : 
         if (is_callable(array($admin, "checkPolicy"))) {
             if (!$admin->checkPolicy("hta", $user, $newpass)) {
                 return false; // The error has been raised by checkPolicy()
             }
         }
  
         touch("$absolute/.htpasswd.new");
         $file = fopen("$absolute/.htpasswd", "r");
         $newf = fopen("$absolute/.htpasswd.new", "a");
         if (!$file || !$newf) {
             $msg->raise("ERROR", "hta", _("File already exist"));
             return false;
         }
         while (!feof($file)) {
             $s = fgets($file, 1024);
             $t = explode(":", $s);
             if ($t[0] != $user) {
                 fwrite($newf, "$s");
             }
         }
         fwrite($newf, "$user:" . _md5cr($newpass) . "\n");
         fclose($file);
         fclose($newf);
         unlink("$absolute/.htpasswd");
         rename("$absolute/.htpasswd.new", "$absolute/.htpasswd");
         return true;
     }

References $bro, $msg, $t, $user, and _md5cr().

◆ CreateDir()

m_hta::CreateDir ( $dir )

Create a protected folder (.htaccess et .htpasswd)

Parameters

string $dir Folder to protect (relative to user root)

Returns: boolean TRUE if the folder has been protected, or FALSE if an error occurred

Parameters

	global	m_mem $mem
	global	m_bro $bro
	global	m_messages $msg
string	$dir

Returns: boolean

Definition at line 66 of file m_hta.php.

                              {
         global $bro, $msg;
         $msg->log("hta", "createdir", $dir);
         $absolute = $bro->convertabsolute($dir, 0);
         if (!is_dir($absolute)) {
             $msg->raise("ERROR", "hta", _("The folder '%s' does not exist"), $dir);
             return false;
         }
         if (!file_exists("$absolute/.htaccess")) {
             $file = @fopen("$absolute/.htaccess", "w+");
             if (!$file) {
                 $msg->raise("ERROR", "hta", _("Error creating .htaccess file: ") . error_get_last()['message']);
                 return false;
             }
             fseek($file, 0);
             $param = "AuthUserFile \"$absolute/.htpasswd\"\nAuthName \"" . _("Restricted area") . "\"\nAuthType Basic\nrequire valid-user\n";
             fwrite($file, $param);
             fclose($file);
         }
         if (!file_exists("$absolute/.htpasswd")) {
             if (!@touch("$absolute/.htpasswd")) {
                 $msg->raise("ERROR", "hta", _("Error creating .htpasswd file: ") . error_get_last()['message']);
                 return false;
             }
             return true;
         }
         return true;
     }

References $bro, and $msg.

◆ del_user()

m_hta::del_user	(	$lst,
		$dir
	)

Delete a user from a protected folder.

Parameters

	global	m_bro $bro
	global	m_messages $msg
array	$lst	An array with login to delete.
string	$dir	The folder, relative to user root, where we want to delete users.

Returns: boolean TRUE if users has been deleted, or FALSE if an error occurred.

Definition at line 321 of file m_hta.php.

                                   {
         global $bro, $msg;
         $msg->log("hta", "del_user", $lst . "/" . $dir);
         $absolute = $bro->convertabsolute($dir, 0);
         if (!file_exists($absolute)) {
             $msg->raise("ERROR", "hta", _("The folder '%s' does not exist"), $dir);
             return false;
         }
         touch("$absolute/.htpasswd.new");
         $file = fopen("$absolute/.htpasswd", "r");
         $newf = fopen("$absolute/.htpasswd.new", "a");
         if (!$file || !$newf) {
             $msg->raise("ERROR", "hta", _("File already exist"));
             return false;
         }
         reset($lst);
         fseek($file, 0);
         while (!feof($file)) {
             $s = fgets($file, 1024);
             $t = explode(":", $s);
             if (!in_array($t[0], $lst) && ($t[0] != "\n")) {
                 fseek($newf, 0);
                 fwrite($newf, "$s");
             }
         }
         fclose($file);
         fclose($newf);
         unlink("$absolute/.htpasswd");
         rename("$absolute/.htpasswd.new", "$absolute/.htpasswd");
         return true;
     }

References $bro, $msg, and $t.

◆ DelDir()

m_hta::DelDir	(	$dir,
		$skip = `false`
	)

Unprotect a folder.

Parameters

	global	m_mem $mem
	global	m_bro $bro
	global	m_messages $msg
string	$dir	Folder to unprotect, relative to user root
boolean	$skip	For testing purpose mainly, skips the full user path search

Returns: boolean TRUE if the folder has been unprotected, or FALSE if an error occurred

Definition at line 194 of file m_hta.php.

                                          {
         global $bro, $msg;
         $msg->log("hta", "deldir", $dir);
         $dir = $bro->convertabsolute($dir, $skip);
         if (!$dir) {
             $msg->raise("ERROR", "hta", ("The folder '%s' does not exist"), $dir);
             return false;
         }
         $htaccess_file = "$dir/.htaccess";
         if (!is_readable($htaccess_file)) {
             $msg->raise("ERROR", "hta", _("I cannot read the file '%s'"), $htaccess_file);
         }
         $fileLines = file($htaccess_file);
         $patternList = array(
             "AuthUserFile.*$",
             "AuthName.*$",
             "AuthType Basic.*$",
             "require valid-user.*$"
         );
         $count_lines = 0;
         foreach ($fileLines as $key => $line) {
             foreach ($patternList as $pattern) {
                 if (preg_match("/" . $pattern . "/", $line)) {
                     $count_lines++;
                     unset($fileLines[$key]);
                 }
             }
         }
         // If no changes 
         if (!$count_lines) {
             $msg->raise("ALERT", "hta", _("Unexpected: No changes made to '%s'"), $htaccess_file);
         }
         // If file is empty, remove it
         if (!count($fileLines)) {
             if (!unlink($htaccess_file)) {
                 $msg->raise("ERROR", "hta", _("I could not delete the file '%s'"), $htaccess_file);
             }
         } else {
             file_put_contents($htaccess_file, implode("\n", $fileLines));
         }
         $htpasswd_file = "$dir/.htpasswd";
         if (!is_writable($htpasswd_file)) {
             $msg->raise("ERROR", "hta", _("I cannot read the file '%s'"), $htpasswd_file);
         } else if (!unlink($htpasswd_file)) {
             $msg->raise("ERROR", "hta", _("I cannot delete the file '%s/.htpasswd'"), $dir);
             return false;
         }
  
         return true;
     }

References $bro, $key, and $msg.

◆ get_hta_detail()

m_hta::get_hta_detail ( $dir )

Returns the list of login for a protected folder.

Parameters

	global	m_mem $mem
	global	m_messages $msg
string	$dir	The folder to lookup (relative to user root)

Returns: array An array containing the list of logins from the .htpasswd file, or FALSE

Definition at line 154 of file m_hta.php.

                                   {
         global $mem, $msg;
         $msg->debug("hta", "get_hta_detail");
         $absolute = ALTERNC_HTML . "/" . substr($mem->user["login"], 0, 1) . "/" . $mem->user["login"] . "/$dir";
         if (file_exists("$absolute/.htaccess")) {
             /*       if (!_reading_htaccess($absolute)) {
                     return false;
                     }
             */
         }
         $file = @fopen("$absolute/.htpasswd", "r");
         $i = 0;
         $res = array();
         if (!$file) {
             return false;
         }
         // TODO: Test the validity of a .htpasswd
         while (!feof($file)) {
             $s = fgets($file, 1024);
             $t = explode(":", $s);
             if ($t[0] != $s) {
                 $res[$i] = $t[0];
                 $i = $i + 1;
             }
         }
         fclose($file);
         return $res;
     }

References $i, $mem, $msg, $res, $t, and ALTERNC_HTML.

◆ hook_menu()

m_hta::hook_menu ( )

hook called by menu class to add a menu to the left panel

Returns: array

Definition at line 44 of file m_hta.php.

                          {
         $obj = array(
             'title' => _("Protected folders"),
             'link' => 'hta_list.php',
             'pos' => 50,
         );
  
         return $obj;
     }

◆ is_protected()

m_hta::is_protected ( $dir )

Tells if a folder is protected.

Parameters

	global	m_mem $mem
	global	m_messages $msg
string	$dir	Folder to check

Returns: boolean If the folder is protected, or FALSE if it is not

Definition at line 134 of file m_hta.php.

                                 {
         global $mem, $msg;
         $msg->debug("hta", "is_protected", $dir);
         $absolute = ALTERNC_HTML . "/" . substr($mem->user["login"], 0, 1) . "/" . $mem->user["login"] . "/$dir";
         if (file_exists("$absolute/.htpasswd")) {
             return true;
         } else {
             return false;
         }
     }

References $mem, $msg, and ALTERNC_HTML.

◆ ListDir()

m_hta::ListDir ( )

Returns the list of all user folder currently protected by a .htpasswd file.

Parameters

global	m_messages $msg
global	m_mem $mem

Returns: array Array containing user folder list

Definition at line 103 of file m_hta.php.

                        {
         global$msg, $mem;
         $msg->debug("hta", "listdir");
         $sortie = array();
         $absolute = ALTERNC_HTML . "/" . substr($mem->user["login"], 0, 1) . "/" . $mem->user["login"];
         exec("find " . escapeshellarg($absolute) . " -name .htpasswd|sort", $sortie);
         if (!count($sortie)) {
             $msg->raise("INFO", "hta", _("No protected folder"));
             return false;
         }
         $pattern = "/^" . preg_quote(ALTERNC_HTML, "/") . "\/.\/[^\/]*\/(.*)\/\.htpasswd/";
  
         $r = array();
         for ($i = 0; $i < count($sortie); $i++) {
             $matches = array();
             preg_match($pattern, $sortie[$i], $matches);
             $tmpm = isset($matches[1]) ? '/' . $matches[1] : '';
             $r[$i] = $tmpm . "/";
         }
         return $r;
     }

References $i, $mem, $msg, $r, and ALTERNC_HTML.

The documentation for this class was generated from the following file:

bureau/class/m_hta.php

Public Member Functions

Private Member Functions

Detailed Description

Member Function Documentation

◆ _reading_htaccess()

◆ add_user()

◆ alternc_password_policy()

◆ change_pass()

◆ CreateDir()

◆ del_user()

◆ DelDir()

◆ get_hta_detail()

◆ hook_menu()

◆ is_protected()

◆ ListDir()