人事系统开发
1ba6efd8ed
包含：登录失败锁定、90天密码有效期、30分钟会话超时、 强制改密、登录审计日志、屏幕水印、企业背景图、 备案信息固定底部、favicon、JS空集合保护、 会话过期体验优化（403 JSON）、display_errors 关闭、 固定 key 根治 Integrity check failed 等全部改动 注意：config.inc.php/.htaccess/.user.ini 含敏感信息， 通过 .gitignore 排除，勿推送到公开仓库。
92 lines
2.1 KiB
PHP
92 lines
2.1 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace MRBS\Session;
|
|
|
|
use MRBS\Form\Form;
|
|
use MRBS\User;
|
|
use phpCAS;
|
|
use function MRBS\auth;
|
|
use function MRBS\location_header;
|
|
use function MRBS\this_page;
|
|
|
|
|
|
class SessionCas extends SessionWithLogin
|
|
{
|
|
|
|
public function __construct()
|
|
{
|
|
$this->checkTypeMatchesSession();
|
|
$this->samesite = self::SAMESITE_LAX;
|
|
auth()->init(); // Initialise CAS
|
|
parent::__construct();
|
|
}
|
|
|
|
|
|
public function init(int $lifetime) : void
|
|
{
|
|
// phpCAS does its own session initialisation and handling
|
|
}
|
|
|
|
|
|
public function authGet(?string $target_url=null, ?string $returl=null, ?string $error=null, bool $raw=false) : void
|
|
{
|
|
if (!phpCAS::isAuthenticated())
|
|
{
|
|
phpCAS::forceAuthentication();
|
|
}
|
|
}
|
|
|
|
|
|
public function getCurrentUser() : ?User
|
|
{
|
|
return (phpCAS::isAuthenticated()) ? auth()->getUser(phpCAS::getUser()) : parent::getCurrentUser();
|
|
}
|
|
|
|
|
|
public function getLogonFormParams() : ?array
|
|
{
|
|
$target_url = this_page(true);
|
|
|
|
return array(
|
|
'action' => $target_url,
|
|
'method' => Form::METHOD_POST,
|
|
'hidden_inputs' => array('target_url' => $target_url,
|
|
'action' => 'QueryName')
|
|
);
|
|
}
|
|
|
|
|
|
public function processForm() : void
|
|
{
|
|
if (isset($this->form['action']))
|
|
{
|
|
// Target of the form with sets the URL argument "action=QueryName".
|
|
if ($this->form['action'] == 'QueryName')
|
|
{
|
|
phpCAS::forceAuthentication();
|
|
}
|
|
|
|
// Target of the form with sets the URL argument "action=SetName".
|
|
// Will eventually return to URL argument "target_url=whatever".
|
|
if ($this->form['action'] == 'SetName')
|
|
{
|
|
// If we're going to do something then check the CSRF token first
|
|
Form::checkToken();
|
|
|
|
// You should only get here using CAS authentication after clicking the logoff
|
|
// link, no matter what the value of the form parameters.
|
|
$this->logoffUser();
|
|
|
|
location_header($this->form['target_url']); // Redirect browser to initial page
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
public function logoffUser() : void
|
|
{
|
|
phpCAS::logout();
|
|
}
|
|
|
|
}
|