MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、JS空集合保护、
会话过期体验优化（403 JSON）、display_errors 关闭、
固定 key 根治 Integrity check failed 等全部改动

注意：config.inc.php/.htaccess/.user.ini 含敏感信息，
通过 .gitignore 排除，勿推送到公开仓库。

lib/MRBS/Auth/AuthSaml.php

@@ -0,0 +1,162 @@
+<?php
+namespace MRBS\Auth;
+
+use MRBS\User;
+
+
+/**
+ * Authentication management scheme that delegates everything to a ready
+ * configured SimpleSamlPhp instance.  You should use this scheme, along with
+ * the session scheme with the same name, if you want your users to
+ * authenticate using SAML Single Sign-on.
+ *
+ * See the session management scheme with the same name for information on
+ * how to configure SAML authentication.  This authentication module on its
+ * own doesn't work.
+ */
+class AuthSaml extends Auth
+{
+  public function __construct()
+  {
+    $this->checkSessionMatchesType();
+  }
+
+
+  public function validateUser(
+    #[\SensitiveParameter]
+    ?string $user,
+    #[\SensitiveParameter]
+    ?string $pass)
+  {
+    $current_username = \MRBS\session()->getUsername();
+
+    if (isset($current_username) && $current_username === $user)
+    {
+      return $user;
+    }
+
+    return false;
+  }
+
+
+  protected function getUserFresh(string $username) : ?User
+  {
+    $user = new User($username);
+    $user->level = $this->getLevel($username);
+    $user->email = $this->getEmail($username);
+    $user->display_name = $this->getUserDisplayName($username);
+
+    return $user;
+  }
+
+
+  /* getLevel($username)
+   *
+   * Determines the user's access level
+   *
+   * It does this by comparing SAML attributes with $auth['saml']['admin']
+   * If any attribute matches, the user is considered admin and 2 is returned.
+   *
+   * If the user is not logged in, or the provided username doesn't match our
+   * SAML session, 0 is returned.
+   *
+   * Otherwise, 1 is returned.
+   *
+   * $username - The user name
+   *
+   * Returns:
+   *   The user's access level
+   */
+  private function getLevel(string $username) : int
+  {
+    global $auth;
+
+    if (!isset($auth['saml']['admin']))
+    {
+      return $this->getDefaultLevel($username);
+    }
+
+    $userData = \MRBS\session()->ssp->getAttributes();
+    $current_username = \MRBS\session()->getUsername();
+
+    if (isset($current_username) && $current_username === $username)
+    {
+      foreach ($auth['saml']['admin'] as $attr => $values)
+      {
+        if (array_key_exists($attr, $userData))
+        {
+          foreach ($values as $value)
+          {
+            if (in_array($value, $userData[$attr]))
+            {
+              return 2;
+            }
+          }
+        }
+      }
+
+      if (isset($auth['saml']['user']))
+      {
+        foreach ($auth['saml']['user'] as $attr => $values)
+        {
+          if (array_key_exists($attr, $userData))
+          {
+            foreach ($values as $value)
+            {
+              if (in_array($value, $userData[$attr]))
+              {
+                return 1;
+              }
+            }
+          }
+        }
+        return  0;
+      }
+
+      return 1;
+    }
+
+    return 0;
+  }
+
+
+  // Gets the users e-mail from the SAML attributes.
+  // Returns an empty string if no e-mail address was found
+  private function getEmail(string $username) : string
+  {
+    global $auth;
+
+    $mailAttr = $auth['saml']['attr']['mail'];
+    $userData = \MRBS\session()->ssp->getAttributes();
+    $current_username = \MRBS\session()->getUsername();
+
+    if (isset($current_username) && $current_username === $username)
+    {
+      return array_key_exists($mailAttr, $userData) ? $userData[$mailAttr][0] : '';
+    }
+
+    return '';
+  }
+
+  // Gets the users displayname from the SAML attributes.
+  // Returns an empty string if no givenName and surname was found
+  private function getUserDisplayName(string $username) : string
+  {
+    global $auth;
+
+    $givenNameAttr = $auth['saml']['attr']['givenName'];
+    $surnameAttr = $auth['saml']['attr']['surname'];
+    $userData = \MRBS\session()->ssp->getAttributes();
+    $current_username = \MRBS\session()->getUsername();
+
+    if (isset($current_username) && $current_username === $username)
+    {
+      $givenName = array_key_exists($givenNameAttr, $userData) ? $userData[$givenNameAttr][0] : '';
+      $surname = array_key_exists($surnameAttr, $userData) ? $userData[$surnameAttr][0] : '';
+      return trim($givenName . ' ' . $surname);
+    }
+
+    return '';
+  }
+
+}