1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
|
//------------------------------------------------------------------------------
// <copyright file="UrlAuthorizationModule.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
//------------------------------------------------------------------------------
/*
* UrlAuthorizationModule class
*
* Copyright (c) 1999 Microsoft Corporation
*/
namespace System.Web.Security {
using System.Runtime.Serialization;
using System.Web;
using System.Web.Util;
using System.Collections;
using System.Web.Configuration;
using System.IO;
using System.Security.Principal;
using System.Security.Permissions;
using System.Web.Management;
using System.Web.Hosting;
using System.Collections.Generic;
/// <devdoc>
/// This module provides URL based
/// authorization services for allowing or denying access to specified resources
/// </devdoc>
public sealed class UrlAuthorizationModule : IHttpModule {
/// <devdoc>
/// <para>
/// Initializes a new instance of the <see cref='System.Web.Security.UrlAuthorizationModule'/>
/// class.
/// </para>
/// </devdoc>
[SecurityPermission(SecurityAction.Demand, Unrestricted=true)]
public UrlAuthorizationModule() {
}
/// <devdoc>
/// <para>[To be supplied.]</para>
/// </devdoc>
public void Init(HttpApplication app) {
app.AuthorizeRequest += new EventHandler(this.OnEnter);
}
/// <devdoc>
/// <para>[To be supplied.]</para>
/// </devdoc>
public void Dispose() {
}
private static bool s_EnabledDetermined;
private static bool s_Enabled;
[SecurityPermission(SecurityAction.Demand, Unrestricted=true)]
public static bool CheckUrlAccessForPrincipal(String virtualPath, IPrincipal user, string verb) {
if (virtualPath == null)
throw new ArgumentNullException("virtualPath");
if (user == null)
throw new ArgumentNullException("user");
if (verb == null)
throw new ArgumentNullException("verb");
verb = verb.Trim();
VirtualPath vPath = VirtualPath.Create(virtualPath);
if (!vPath.IsWithinAppRoot)
throw new ArgumentException(SR.GetString(SR.Virtual_path_outside_application_not_supported), "virtualPath");
if (!s_EnabledDetermined) {
if( !HttpRuntime.UseIntegratedPipeline) {
HttpModulesSection modulesSection = RuntimeConfig.GetConfig().HttpModules;
int len = modulesSection.Modules.Count;
for (int iter = 0; iter < len; iter++) {
HttpModuleAction module = modulesSection.Modules[iter];
if (Type.GetType(module.Type, false) == typeof(UrlAuthorizationModule)) {
s_Enabled = true;
break;
}
}
}
else {
List<ModuleConfigurationInfo> modules = HttpApplication.IntegratedModuleList;
foreach (ModuleConfigurationInfo mod in modules) {
if (Type.GetType(mod.Type, false) == typeof(UrlAuthorizationModule)) {
s_Enabled = true;
break;
}
}
}
s_EnabledDetermined = true;
}
if (!s_Enabled)
return true;
AuthorizationSection settings = RuntimeConfig.GetConfig(vPath).Authorization;
// Check if the user is allowed, or the request is for the login page
return settings.EveryoneAllowed || settings.IsUserAllowed(user, verb);
}
internal static void ReportUrlAuthorizationFailure(HttpContext context, object webEventSource) {
// Deny access
context.Response.StatusCode = 401;
WriteErrorMessage(context);
if (context.User != null && context.User.Identity.IsAuthenticated) {
// We don't raise failure audit event for anonymous user
WebBaseEvent.RaiseSystemEvent(webEventSource, WebEventCodes.AuditUrlAuthorizationFailure);
}
context.ApplicationInstance.CompleteRequest();
}
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
// Module Enter: Get the authorization configuration section
// and see if this user is allowed or not
void OnEnter(Object source, EventArgs eventArgs) {
HttpApplication app;
HttpContext context;
app = (HttpApplication)source;
context = app.Context;
if (context.SkipAuthorization)
{
if (context.User == null || !context.User.Identity.IsAuthenticated)
PerfCounters.IncrementCounter(AppPerfCounter.ANONYMOUS_REQUESTS);
return;
}
// Get the authorization config object
AuthorizationSection settings = RuntimeConfig.GetConfig(context).Authorization;
// Check if the user is allowed, or the request is for the login page
if (!settings.EveryoneAllowed && !settings.IsUserAllowed(context.User, context.Request.RequestType))
{
ReportUrlAuthorizationFailure(context, this);
}
else
{
if (context.User == null || !context.User.Identity.IsAuthenticated)
PerfCounters.IncrementCounter(AppPerfCounter.ANONYMOUS_REQUESTS);
WebBaseEvent.RaiseSystemEvent(this, WebEventCodes.AuditUrlAuthorizationSuccess);
}
}
/////////////////////////////////////////////////////////////////////////////
static void WriteErrorMessage(HttpContext context) {
context.Response.Write(UrlAuthFailedErrorFormatter.GetErrorText());
// In Integrated pipeline, ask for handler headers to be generated. This would be unnecessary
// if we just threw an access denied exception, and used the standard error mechanism
context.Response.GenerateResponseHeadersForHandler();
}
static internal bool RequestRequiresAuthorization(HttpContext context) {
if (context.SkipAuthorization)
return false;
AuthorizationSection settings = RuntimeConfig.GetConfig(context).Authorization;
// Check if the anonymous user is allowed
if (_AnonUser == null)
_AnonUser = new GenericPrincipal(new GenericIdentity(String.Empty, String.Empty), new String[0]);
return !settings.IsUserAllowed(_AnonUser, context.Request.RequestType);
}
internal static bool IsUserAllowedToPath(HttpContext context, VirtualPath virtualPath)
{
AuthorizationSection settings = RuntimeConfig.GetConfig(context, virtualPath).Authorization;
return settings.EveryoneAllowed || settings.IsUserAllowed(context.User, context.Request.RequestType);
}
static GenericPrincipal _AnonUser;
}
}
|
