X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=FS%2FFS%2Fsvc_acct.pm;h=3af41bac6def176e3ce5ab55a074f2314ddae617;hb=051abf85ce0cad902a6c2b0d24a6f90d4e7c5147;hp=e2f79291f7b760a0d281340524e06d21719c04bc;hpb=9225a3b647c95313ea9f152b1255cd2c794ce3fd;p=freeside.git

diff --git a/FS/FS/svc_acct.pm b/FS/FS/svc_acct.pm
index e2f79291f..3af41bac6 100644
--- a/FS/FS/svc_acct.pm
+++ b/FS/FS/svc_acct.pm
@@ -20,6 +20,8 @@ use Carp;
 use Fcntl qw(:flock);
 use Date::Format;
 use Crypt::PasswdMD5 1.2;
+use Digest::SHA1 'sha1_base64';
+use Digest::MD5 'md5_base64';
 use Data::Dumper;
 use Text::Template;
 use Authen::Passphrase;
@@ -56,7 +58,11 @@ FS::UID->install_callback( sub {
   @shells = $conf->config('shells');
   $usernamemin = $conf->config('usernamemin') || 2;
   $usernamemax = $conf->config('usernamemax');
-  $passwordmin = $conf->config('passwordmin') || 6;
+  $passwordmin = $conf->config('passwordmin'); # || 6;
+  #blank->6, keep 0
+  $passwordmin = ( defined($passwordmin) && $passwordmin =~ /\d+/ )
+                   ? $passwordmin
+                   : 6;
   $passwordmax = $conf->config('passwordmax') || 8;
   $username_letter = $conf->exists('username-letter');
   $username_letterfirst = $conf->exists('username-letterfirst');
@@ -524,42 +530,8 @@ sub insert {
   local $FS::UID::AutoCommit = 0;
   my $dbh = dbh;
 
-  my $error = $self->check;
-  return $error if $error;
-
-  if ( $self->svcnum && qsearchs('cust_svc',{'svcnum'=>$self->svcnum}) ) {
-    my $cust_svc = qsearchs('cust_svc',{'svcnum'=>$self->svcnum});
-    unless ( $cust_svc ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "no cust_svc record found for svcnum ". $self->svcnum;
-    }
-    $self->pkgnum($cust_svc->pkgnum);
-    $self->svcpart($cust_svc->svcpart);
-  }
-
-  # set usage fields and thresholds if unset but set in a package def
-  if ( $self->pkgnum ) {
-    my $cust_pkg = qsearchs( 'cust_pkg', { 'pkgnum' => $self->pkgnum } );
-    my $part_pkg = $cust_pkg->part_pkg if $cust_pkg;
-    if ( $part_pkg && $part_pkg->can('usage_valuehash') ) {
-
-      my %values = $part_pkg->usage_valuehash;
-      my $multiplier = $conf->exists('svc_acct-usage_threshold') 
-                         ? 1 - $conf->config('svc_acct-usage_threshold')/100
-                         : 0.20; #doesn't matter
-
-      foreach ( keys %values ) {
-        next if $self->getfield($_);
-        $self->setfield( $_, $values{$_} );
-        $self->setfield( $_. '_threshold', int( $values{$_} * $multiplier ) )
-          if $conf->exists('svc_acct-usage_threshold');
-      }
-
-    }
-  }
-
   my @jobnums;
-  $error = $self->SUPER::insert(
+  my $error = $self->SUPER::insert(
     'jobnums'       => \@jobnums,
     'child_objects' => $self->child_objects,
     %options,
@@ -688,6 +660,31 @@ sub insert {
   ''; #no error
 }
 
+# set usage fields and thresholds if unset but set in a package def
+sub preinsert_hook_first {
+  my $self = shift;
+
+  return '' unless $self->pkgnum;
+
+  my $cust_pkg = qsearchs( 'cust_pkg', { 'pkgnum' => $self->pkgnum } );
+  my $part_pkg = $cust_pkg->part_pkg if $cust_pkg;
+  return '' unless $part_pkg && $part_pkg->can('usage_valuehash');
+
+  my %values = $part_pkg->usage_valuehash;
+  my $multiplier = $conf->exists('svc_acct-usage_threshold') 
+                     ? 1 - $conf->config('svc_acct-usage_threshold')/100
+                     : 0.20; #doesn't matter
+
+  foreach ( keys %values ) {
+    next if $self->getfield($_);
+    $self->setfield( $_, $values{$_} );
+    $self->setfield( $_. '_threshold', int( $values{$_} * $multiplier ) )
+      if $conf->exists('svc_acct-usage_threshold');
+  }
+
+  ''; #no error
+}
+
 =item delete
 
 Deletes this account from the database.  If there is an error, returns the
@@ -1184,6 +1181,17 @@ sub check {
     $self->ut_textn($_);
   }
 
+  # First, if _password is blank, generate one and set default encoding.
+  if ( ! $recref->{_password} ) {
+    $self->set_password('');
+  }
+  # But if there's a _password but no encoding, assume it's plaintext and 
+  # set it to default encoding.
+  elsif ( ! $recref->{_password_encoding} ) {
+    $self->set_password($recref->{_password});
+  }
+
+  # Next, check _password to ensure compliance with the encoding.
   if ( $recref->{_password_encoding} eq 'ldap' ) {
 
     if ( $recref->{_password} =~ /^(\{[\w\-]+\})(!?.{0,64})$/ ) {
@@ -1206,11 +1214,8 @@ sub check {
     }
 
   } elsif ( $recref->{_password_encoding} eq 'plain' ) { 
-
-    #generate a password if it is blank
-    $recref->{_password} = join('',map($pw_set[ int(rand $#pw_set) ], (0..7) ) )
-      unless length( $recref->{_password} );
-
+    # Password randomization is now in set_password.
+    # Strip whitespace characters, check length requirements, etc.
     if ( $recref->{_password} =~ /^([^\t\n]{$passwordmin,$passwordmax})$/ ) {
       $recref->{_password} = $1;
     } else {
@@ -1225,51 +1230,148 @@ sub check {
     if ( $password_noexclamation ) {
       $recref->{_password} =~ /\!/ and return gettext('illegal_password');
     }
+  }
+  elsif ( $recref->{_password_encoding} eq 'legacy' ) {
+    # this happens when set_password fails
+    return gettext('illegal_password'). " $passwordmin-$passwordmax ".
+           FS::Msgcat::_gettext('illegal_password_characters').
+           ": ". $recref->{_password};
+  }
+  $self->SUPER::check;
 
-  } else {
+}
 
-    #carp "warning: _password_encoding unspecified\n";
 
-    #generate a password if it is blank
-    unless ( length( $recref->{_password} ) ) {
+sub _password_encryption {
+  my $self = shift;
+  my $encoding = lc($self->_password_encoding);
+  return if !$encoding;
+  return 'plain' if $encoding eq 'plain';
+  if($encoding eq 'crypt') {
+    my $pass = $self->_password;
+    $pass =~ s/^\*SUSPENDED\* //;
+    $pass =~ s/^!!?//;
+    return 'md5' if $pass =~ /^\$1\$/;
+    #return 'blowfish' if $self->_password =~ /^\$2\$/;
+    return 'des' if length($pass) == 13;
+    return;
+  }
+  if($encoding eq 'ldap') {
+    uc($self->_password) =~ /^\{([\w-]+)\}/;
+    return 'crypt' if $1 eq 'CRYPT' or $1 eq 'DES';
+    return 'plain' if $1 eq 'PLAIN' or $1 eq 'CLEARTEXT';
+    return 'md5' if $1 eq 'MD5';
+    return 'sha1' if $1 eq 'SHA' or $1 eq 'SHA-1';
+
+    return;
+  }
+  return;
+}
+
+sub get_cleartext_password {
+  my $self = shift;
+  if($self->_password_encryption eq 'plain') {
+    if($self->_password_encoding eq 'ldap') {
+      $self->_password =~ /\{\w+\}(.*)$/;
+      return $1;
+    }
+    else {
+      return $self->_password;
+    }
+  }
+  return;
+}
 
-      $recref->{_password} =
-        join('',map($pw_set[ int(rand $#pw_set) ], (0..7) ) );
-      $recref->{_password_encoding} = 'plain';
+ 
+=item set_password
 
-    } else {
-  
-      #if ( $recref->{_password} =~ /^((\*SUSPENDED\* )?)([^\t\n]{4,16})$/ ) {
-      if ( $recref->{_password} =~ /^((\*SUSPENDED\* |!!?)?)([^\t\n]{$passwordmin,$passwordmax})$/ ) {
-        $recref->{_password} = $1.$3;
-        $recref->{_password_encoding} = 'plain';
-      } elsif ( $recref->{_password} =~
-                  /^((\*SUSPENDED\* |!!?)?)([\w\.\/\$\;\+]{13,64})$/
-              ) {
-        $recref->{_password} = $1.$3;
-        $recref->{_password_encoding} = 'crypt';
-      } elsif ( $recref->{_password} eq '*' ) {
-        $recref->{_password} = '*';
-        $recref->{_password_encoding} = 'crypt';
-      } elsif ( $recref->{_password} eq '!' ) {
-        $recref->{_password_encoding} = 'crypt';
-        $recref->{_password} = '!';
-      } elsif ( $recref->{_password} eq '!!' ) {
-        $recref->{_password} = '!!';
-        $recref->{_password_encoding} = 'crypt';
-      } else {
-        #return "Illegal password";
-        return gettext('illegal_password'). " $passwordmin-$passwordmax ".
-               FS::Msgcat::_gettext('illegal_password_characters').
-               ": ". $recref->{_password};
-      }
+Set the cleartext password for the account.  If _password_encoding is set, the 
+new password will be encoded according to the existing method (including 
+encryption mode, if it can be determined).  Otherwise, 
+config('default-password-encoding') is used.
 
+If no password is supplied (or a zero-length password when minimum password length 
+is >0), one will be generated randomly.
+
+=cut
+
+sub set_password {
+  my $self = shift;
+  my $pass = shift;
+  my ($encoding, $encryption);
+
+
+  if($self->_password_encoding) {
+    $encoding = $self->_password_encoding;
+    # identify existing encryption method, try to use it.
+    $encryption = $self->_password_encryption;
+    if(!$encryption) {
+      # use the system default
+      undef $encoding;
     }
+  }
 
+  if(!$encoding) {
+    # set encoding to system default
+    ($encoding, $encryption) = split(/-/, lc($conf->config('default-password-encoding')));
+    $encoding ||= 'legacy';
+    $self->_password_encoding($encoding);
   }
 
-  $self->SUPER::check;
+  if($encoding eq 'legacy') {
+    # The legacy behavior from check():
+    # If the password is blank, randomize it and set encoding to 'plain'.
+    if(!defined($pass) or (length($pass) == 0 and $passwordmin)) {
+      $pass = join('',map($pw_set[ int(rand $#pw_set) ], (0..7) ) );
+      $self->_password_encoding('plain');
+    }
+    else {
+      # Prefix + valid-length password
+      if ( $pass =~ /^((\*SUSPENDED\* |!!?)?)([^\t\n]{$passwordmin,$passwordmax})$/ ) {
+        $pass = $1.$3;
+        $self->_password_encoding('plain');
+      }
+      # Prefix + crypt string
+      elsif ( $pass =~ /^((\*SUSPENDED\* |!!?)?)([\w\.\/\$\;\+]{13,64})$/ ) {
+        $pass = $1.$3;
+        $self->_password_encoding('crypt');
+      }
+      # Various disabled crypt passwords
+      elsif ( $pass eq '*' or
+              $pass eq '!' or
+              $pass eq '!!' ) {
+        $self->_password_encoding('crypt');
+      }
+      else {
+        # do nothing; check() will recognize this as an error
+      }
+   }
+  }
+  elsif($encoding eq 'crypt') {
+    if($encryption eq 'md5') {
+      $pass = unix_md5_crypt($pass);
+    }
+    elsif($encryption eq 'des') {
+      $pass = crypt($pass, $saltset[int(rand(64))].$saltset[int(rand(64))]);
+    }
+  }
+  elsif($encoding eq 'ldap') {
+    if($encryption eq 'md5') {
+      $pass = md5_base64($pass);
+    }
+    elsif($encryption eq 'sha1') {
+      $pass = sha1_base64($pass);
+    }
+    elsif($encryption eq 'crypt') {
+      $pass = crypt($pass, $saltset[int(rand(64))].$saltset[int(rand(64))]);
+    }
+    # else $encryption eq 'plain', do nothing
+    $pass = '{'.uc($encryption).'}'.$pass;
+  }
+  # else encoding eq 'plain'
 
+  $self->_password($pass);
+  return;
 }
 
 =item _check_system