Bug 1712711: Adding checks to ask for 1.14.16 saml lib upgrade

behatnotneeded

Change-Id: If1e267fb551faff3be2537b14a6b8917b263dddd

Makefile

@@ -62,7 +62,7 @@ ifdef simplesamlphp
 	@echo "SimpleSAMLphp already exists - doing nothing"
 else
 	@echo "Pulling SimpleSAMLphp from download ..."
-	@curl -sSL https://github.com/simplesamlphp/simplesamlphp/releases/download/v1.14.7/simplesamlphp-1.14.7.tar.gz | tar  --transform 's/simplesamlphp-[0-9]+\.[0-9]+\.[0-9]+/simplesamlphp/x1' -C htdocs/auth/saml/extlib -xzf -
+	@curl -sSL https://github.com/simplesamlphp/simplesamlphp/releases/download/v1.14.16/simplesamlphp-1.14.16.tar.gz | tar  --transform 's/simplesamlphp-[0-9]+\.[0-9]+\.[0-9]+/simplesamlphp/x1' -C htdocs/auth/saml/extlib -xzf -
 # SimpleSAMLPHP release tarball already has all composer dependencies.
 #	@php external/composer.phar --working-dir=htdocs/auth/saml/extlib/simplesamlphp update --no-dev
 	@echo "Deleting unneeded files ..."

htdocs/auth/lib.php

@@ -363,6 +363,21 @@ abstract class Auth {
 /******************************************************************************/
     // End of Auth base-class
 /******************************************************************************/
+/*
+* Checks all the available auth types and executes 'install_auth_default' method
+* if they have one
+*/
+function install_auth_default() {
+    $plugins = auth_get_available_auth_types();
+
+    foreach ($plugins as $key => $value) {
+        $classname = 'PluginAuth' . ucfirst(strtolower($value->name));
+        $methodname = 'install_auth_default';
+        if (method_exists($classname, $methodname)) {
+            call_static_method($classname, $methodname);
+        }
+    }
+}
 
 /**
  * Handles authentication by setting up a session for a user if they are logged

htdocs/auth/saml/db/upgrade.php

+<?php
+/**
+ *
+ * @package    mahara
+ * @subpackage core
+ * @author     Catalyst IT Ltd
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL version 3 or later
+ * @copyright  For copyright information on Mahara, please see the README file distributed with this software.
+ *
+ */
+
+function xmldb_auth_saml_upgrade($oldversion=0) {
+
+    $status = true;
+
+    if ($oldversion < 2016062901) {
+        //For legacy installs we default to rsa-sha1 as that was the default previously, although we would
+        //ideally like them to use rsa-256
+        set_config_plugin('auth', 'saml', 'sigalgo', 'http://www.w3.org/2000/09/xmldsig#rsa-sha1');
+
+        // Set library version to download
+        set_config_plugin('auth', 'saml', 'version', '1.14.16');
+    }
+
+    return $status;
+}

htdocs/auth/saml/lang/en.utf8/auth.saml.php

@@ -26,6 +26,7 @@ $string['errorretryexceeded'] = 'Maximum number of retries exceeded (%s): There
 $string['errnosamluser'] = 'No user found';
 $string['errorssphpsetup'] = 'SAML is not set up correctly. You Need to run "make ssphp" from the commandline first.';
 $string['errorbadlib'] = 'The SimpleSAMLPHP library\'s "autoloader" file was not found at %s.<br>Make sure you install SimpleSAMLphp via "make ssphp" and the file is readable.';
+$string['errorupdatelib'] = 'Your current SimpleSAMLPHP library version is out of date. You need to run "make cleanssphp && make ssphp"';
 $string['errornomcrypt'] = 'The PHP library "mcrypt" must be installed for auth/saml. Make sure you install and activate mcrypt, e.g.:<br>sudo apt-get install php5-mcrypt<br>sudo php5enmod mcrypt<br>Then restart your web server.';
 $string['errornomcrypt7php'] = 'The PHP library "mcrypt" must be installed for auth/saml. Make sure you install and activate mcrypt, e.g.:<br>sudo apt-get install php7.0-mcrypt<br>sudo phpenmod mcrypt<br>Then restart your web server.';
 $string['errornomemcache'] = 'A memcache server is needed for auth/saml. Either list the paths to your memcache servers in the $cfg->memcacheservers config variable or install memcache locally.<br>To install the PHP library "memcache" locally:<br>sudo apt-get install php5-memcache<br>sudo php5enmod memcache<br>Then restart you web server.';

htdocs/auth/saml/lib.php

@@ -309,6 +309,11 @@ class PluginAuthSaml extends PluginAuth {
         return true;
     }
 
+    public static function install_auth_default() {
+        // Set library version to download
+        set_config_plugin('auth', 'saml', 'version', '1.14.16');
+    }
+
     private static function create_certificates($numberofdays = 3650) {
         global $CFG;
         // Get the details of the first site admin and use it for setting up the certificate
@@ -461,6 +466,17 @@ class PluginAuthSaml extends PluginAuth {
         if (!file_exists(get_config('docroot') .'auth/saml/extlib/simplesamlphp/vendor/autoload.php')) {
             $libchecks .= '<li>' . get_string('errorbadlib', 'auth.saml', get_config('docroot') .'auth/saml/extlib/simplesamlphp/vendor/autoload.php') . '</li>';
         }
+        else {
+            require(get_config('docroot') .'auth/saml/extlib/simplesamlphp/vendor/autoload.php');
+            $config = SimpleSAML_Configuration::getInstance();
+
+            //simplesaml version we install with 'make ssphp'
+            $libversion = get_config_plugin('auth', 'saml', 'version');
+
+            if (!empty($libversion) && $config->getVersion() != $libversion) {
+                $libchecks .= '<li>' . get_string('errorupdatelib', 'auth.saml') . '</li>';
+            }
+        }
         // Make sure we can use 'memcache' with simplesamlphp as 'phpsession' doesn't work correctly in many situations
         $memcacheservers_config = get_config('memcacheservers');
         if (empty($memcacheservers_config) && !extension_loaded('memcache')) {
@@ -486,8 +502,8 @@ class PluginAuthSaml extends PluginAuth {
     }
 
     public static function save_config_options(Pieform $form, $values) {
-        delete_records('auth_config', 'plugin', 'saml');
-        $configs = array('spentityid');
+        delete_records_select('auth_config', 'plugin = ? AND field NOT LIKE ?', array('saml', 'version'));
+        $configs = array('spentityid', 'sigalgo');
         foreach ($configs as $config) {
             set_config_plugin('auth', 'saml', $config, $values[$config]);
         }

htdocs/auth/saml/version.php

@@ -11,8 +11,8 @@
 defined('INTERNAL') || die();
 
 $config = new StdClass;
-$config->version = 2016062900;
-$config->release = '1.2.0';
+$config->version = 2016062901;
+$config->release = '1.2.1';
 $config->name = 'saml';
 $config->requires_config = 1;
 $config->requires_parent = 0;

htdocs/lib/upgrade.php

@@ -783,6 +783,8 @@ function core_install_lastcoredata_defaults() {
     require_once('skin.php');
     install_skins_default();
 
+    install_auth_default();
+
     // Remove admin privs from root user as it doesn't need it now
     $user->admin = 0;
     update_record('usr', $user, array('id' => 0));
@@ -1519,6 +1521,18 @@ function site_warnings() {
                 $warnings[] = get_string('obsoletesamlinstance', 'auth.saml', get_config('wwwroot') . 'admin/users/addauthority.php?id=' . $saml->id . '&edit=1&i=' . $saml->name . '&p=saml', $saml->instancename, $saml->displayname);
             }
         }
+        // Check if the library is updated to the latest version Mahara supports
+        $autoload = get_config('docroot') .'auth/saml/extlib/simplesamlphp/vendor/autoload.php';
+        if (file_exists($autoload)) {
+            require(get_config('docroot') .'auth/saml/extlib/simplesamlphp/vendor/autoload.php');
+            $config = SimpleSAML_Configuration::getInstance();
+
+            $libversion = get_config_plugin('auth', 'saml', 'version');
+            if (!empty($libversion) && $config->getVersion() != $libversion) {
+                $warnings[] = get_string('errorupdatelib', 'auth.saml');
+            }
+        }
+
     }
 
     // Check that the GD library has support for jpg, png and gif at least