59 lines
1.7 KiB
PHP
59 lines
1.7 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace App\Http\Controllers;
|
||
|
|
|
||
|
|
use App\Models\Eleve;
|
||
|
|
use Illuminate\Http\Request;
|
||
|
|
use Illuminate\Http\Response;
|
||
|
|
use Illuminate\Support\Facades\Auth;
|
||
|
|
use Illuminate\Support\Facades\RateLimiter;
|
||
|
|
use Illuminate\Support\Facades\Storage;
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Sous-requête interne de Nginx (auth_request, bloc C, WebDAV des élèves) :
|
||
|
|
* mêmes identifiants que la connexion, jamais de session, jamais appelable
|
||
|
|
* directement depuis l'extérieur (location « internal » de Nginx, voir
|
||
|
|
* ansible/roles/portail/templates/nginx-portail.conf.j2). Répond 200 avec
|
||
|
|
* l'id de l'élève en en-tête (le sous-dossier auquel Nginx le limite), ou
|
||
|
|
* 401 sinon.
|
||
|
|
*/
|
||
|
|
class WebdavAuthController extends Controller
|
||
|
|
{
|
||
|
|
public function verifier(Request $request): Response
|
||
|
|
{
|
||
|
|
$identifiant = $request->getUser();
|
||
|
|
$code = $request->getPassword();
|
||
|
|
|
||
|
|
if ($identifiant === null || $code === null) {
|
||
|
|
return $this->refuser();
|
||
|
|
}
|
||
|
|
|
||
|
|
$cle = 'webdav:'.$identifiant.'|'.$request->ip();
|
||
|
|
|
||
|
|
if (RateLimiter::tooManyAttempts($cle, 5)) {
|
||
|
|
return $this->refuser();
|
||
|
|
}
|
||
|
|
|
||
|
|
$succes = Auth::guard('eleve')->once(['identifiant' => $identifiant, 'password' => $code]);
|
||
|
|
|
||
|
|
if (! $succes) {
|
||
|
|
RateLimiter::hit($cle, 300);
|
||
|
|
|
||
|
|
return $this->refuser();
|
||
|
|
}
|
||
|
|
|
||
|
|
RateLimiter::clear($cle);
|
||
|
|
|
||
|
|
/** @var Eleve $eleve */
|
||
|
|
$eleve = Auth::guard('eleve')->user();
|
||
|
|
Storage::disk('webdav')->makeDirectory((string) $eleve->id);
|
||
|
|
|
||
|
|
return response('', 200)->withHeaders(['X-Eleve-Dossier' => (string) $eleve->id]);
|
||
|
|
}
|
||
|
|
|
||
|
|
private function refuser(): Response
|
||
|
|
{
|
||
|
|
return response('', 401);
|
||
|
|
}
|
||
|
|
}
|