sudo mode by SebSept · Pull Request #23447 · glpi-project/glpi

SebSept · 2026-03-11T10:56:22Z

still a wip. no review needed.

https://outline.teclib.com/doc/sudo-mode-reauth-dev-doc-XfUBa9nO8A

SebSept · 2026-03-12T08:29:02Z

lots of files changed because of a method signature change. important files to review : User.php CommonX.php Security/ReAuthxxx ReAuth controller.
Atm, the redirection after reauth doesn't work but that not important, we are validatating the code design

cedric-anne · 2026-04-01T07:10:56Z

+    {
+        global $CFG_GLPI;
+
+        $this->setSuccessRedirectURL(\Html::getRefererUrl() ?? $CFG_GLPI['url_base']);


I think the target URL should be the current URL instead of the referer. Indeed, if you display a form with the /Software/DoSomething (current URL) action from the Computer/X (referer URL) page, then after the reauth you need to submit the form data on the /Software/DoSomething to make the form submission processed.

trasher · 2026-04-29T08:44:51Z

There is a conflict to solve

cedric-anne · 2026-04-30T12:14:53Z


        Html::back();
    } else {
+        $user->check((int) $_GET['id'], READ, $input);


The CommonDBTM::displayFullPageForItem() already perform a $item->can($id, READ). This may be replaced by a call to the check() method.
Anyway, I think we should find a way to not have to alter all legacy controllers that call CommonDBTM::displayFullPageForItem().

cedric-anne · 2026-04-30T12:37:07Z

+        methods: ['GET']
+    )]
+    #[SecurityStrategy(Firewall::STRATEGY_AUTHENTICATED)]
+    public function prompt(Request $request, string $error = ''): Response


Please ensure the presence of the string $error parameter cannot be used to force a specifi message throught the URL parameters. It could be used by an attacker to display a custom message during a prompt authentication, and I guess it could be used to encourage users to take an unexpected action, such as contacting a fictitious support team.

A solution could be to mutualize the template rendering in a private function getPromptResponse(?string $error = null).

cedric-anne · 2026-04-30T12:41:08Z

+        return [
+            'redirect'      => $this->reAuthManager->getRedirectURL(),
+            'cancel_url'    => $this->reAuthManager->getCancelURL(),
+            'action'        => $this->router->generate('reauth_verify'),


Please verify that the generated URL is correct when GLPI is served under an Alias (e.g. http://example.org/glpi). We did not used the URL generator for the moment because we did not checked it is fully working the GLPI context.

cedric-anne · 2026-04-30T12:42:45Z

+            // catched in RedirectPostExceptionListener
+            throw new ReauthRedirectException(
+                $this->reAuthManager->getRedirectURL(),
+                $this->reAuthManager->getRedirectData(),
+                $this->reAuthManager->getRedirectMethod(),
+            );


The response could be built here directly, since this is the only place where this exception is thrown.

cedric-anne · 2026-04-30T12:45:05Z

+        if ($this->http_method === 'POST' && isset($this->data['id'])) {
+            return $this->url . '?id=' . $this->data['id'];
+        }


IMHO, this could lead to unexpected issues. I guess this parameter was present in the initial request URL. Maybe $_GET parameters should be preserved in the URL.

cedric-anne · 2026-04-30T13:05:41Z

+enum ReAuthStrategyEnum: string
 {
-    public function __construct(
-        string $date,
-        string $author,
-    ) {
-        parent::__construct(
-            label: __("Current version"),
-            description: __("Updated by"),
-            date: $date,
-            author: $author,
-        );
+    case TOTP = 'totp';
+    case PASSWORD = 'password';
+
+    public function createStrategy(): ReAuthStrategyInterface
+    {
+        return match ($this) {
+            self::TOTP => new TOTPReAuthStrategy(),
+            self::PASSWORD => new PasswordReAuthStrategy(),
+        };
    }
 }


You could instanciate the ReAuthManager directly from the dependency injection logic, to not have to maintain this enum.

We have sucessfully done it for the Glpi\Application\ViewTemplateRendererclass. The constructor is initialized by the DI system, and thegetInstance()` method can be used where it is not possible to une the DI system.

cedric-anne · 2026-04-30T13:16:42Z

There are no changes in this class except some code reorganization. This add 10% more lines changes to this PR, increasing the review complexity. Please try to not do too much refactoring. We have thousand lines of code in GLPI that are indeed pretty hard to understand, but since our code is far from being entirely covered by tests and since we still do not use strict types everywhere, this kind of changes can result in unexpected side effects and should be avoid when it is not necessary.

# Conflicts: # src/CommonDBTM.php

no code change, just move the else. - may be reverted # Conflicts: # src/Session.php

# Conflicts: # src/CommonDBTM.php # src/CommonGLPI.php # src/Glpi/Controller/Security/ReAuthController.php # src/Glpi/Security/ReAuth/ReAuthManager.php

…OrRedirect()

- autosubmit totp on last char typed - remove useless array handling

GLPI_REAUTH to false for tests

- ReauthRedirecException handle $_GET requests - move rights checks form \CommonDBTM::displayFullPageForItem() to front/user.form.php - refacto ReAuthManager.php - just redirect to previous url (not to form on form submit) - fix \Glpi\Security\ReAuth\ReAuthManager::isReAuthenticated() constant usage - reauth can be done on all rights (not only UPADTE). - simplify \CommonDBTM::check()

just a fallback, should never happen

SebSept mentioned this pull request Mar 11, 2026

Sudo mode (poc to review) #23221

Closed

SebSept force-pushed the fork/SebSept/sudo-mode branch from 4b15d22 to 4c5f567 Compare March 11, 2026 10:59

SebSept changed the base branch from 11.0/bugfixes to main March 11, 2026 11:00

SebSept requested a review from cedric-anne March 11, 2026 11:18

cedric-anne reviewed Mar 12, 2026

View reviewed changes

Comment thread src/CommonGLPI.php Outdated

cedric-anne reviewed Mar 18, 2026

View reviewed changes

Comment thread src/CommonDBTM.php Outdated

Comment thread src/CommonGLPI.php Outdated

SebSept force-pushed the fork/SebSept/sudo-mode branch from ad4c71e to e255a00 Compare March 19, 2026 16:50

SebSept closed this Mar 26, 2026

SebSept reopened this Mar 26, 2026

SebSept force-pushed the fork/SebSept/sudo-mode branch from 743f71b to 0e80332 Compare March 30, 2026 10:08

cedric-anne reviewed Apr 1, 2026

View reviewed changes

SebSept force-pushed the fork/SebSept/sudo-mode branch from 8413e75 to 14502be Compare April 29, 2026 08:20

SebSept force-pushed the fork/SebSept/sudo-mode branch from 14502be to 197c4e8 Compare April 29, 2026 14:55

cedric-anne reviewed Apr 30, 2026

View reviewed changes

orthagh linked an issue May 4, 2026 that may be closed by this pull request

Sudo mode glpi-project/roadmap#284

Open

SebSept added 13 commits May 27, 2026 14:20

base implementation

89f9793

# Conflicts: # src/CommonDBTM.php

refacto Session

ac408db

no code change, just move the else. - may be reverted # Conflicts: # src/Session.php

redirection after reauth success

f113a0b

fix canXX static replaced by $this->can()

3ea10ab

csfix

f5ef51c

base implementation

56d85f2

# Conflicts: # src/CommonDBTM.php # src/CommonGLPI.php # src/Glpi/Controller/Security/ReAuthController.php # src/Glpi/Security/ReAuth/ReAuthManager.php

redirection after reauth success

a9a2d7f

fix previous merge

f8380a3

reenable autoredirect after successful reauth

6a08cdf

security strategy for reauth controllers

622dc0e

add entity param in isAvailable, just in case, future proof.

de9fef8

refacto add redirectToReauthPrompt() instead of checkReAuthentication…

9882e17

…OrRedirect()

improve totp form

ba3207a

- autosubmit totp on last char typed - remove useless array handling

SebSept added 14 commits May 27, 2026 14:30

reauth on canGlobal

30db28d

rename const GLPI_DISABLE_REAUTH to GLPI_REAUTH

cbb2235

GLPI_REAUTH to false for tests

fix Session::init refactoring

6b266ea

fix canGlobal

b58e0e8

Redirect Exception can be GET, not only POST.

f0d9fd5

reauth cannot be disabled by config

15da163

fix post rebase & cleanup

4534df0

fix bad closure call

2690b9e

post rebase fix

8ba7501

reauth on massive action actions

d5883f7

cleanup

b3f7d04

cleanup

09e647b

fix massive action reauth (was triggered on all itemtypes)

c6976eb

SebSept force-pushed the fork/SebSept/sudo-mode branch from 197c4e8 to c6976eb Compare May 27, 2026 15:16

SebSept changed the title ~~sudo mode poc 2~~ sudo mode May 28, 2026

SebSept added 14 commits May 28, 2026 11:07

@todo versionning - will be squashed / removed

a42d25b

refacto CommonDBTM::can

e57c405

cleanup

7bd6865

can() : apply reauth to CREATE/PURGE/DELETE

02b1e32

fix problems reported by phpstan

18d9f8b

ReAuthController rename 'Redirect' methods and session variables

03b823a

correct target url for MassiveActions

a1e2df4

rename ReAuthManager::redirect to ReAuthManager::redirectToReauth()

eda3c67

process massive actions like purge etc : correct final redirection

d20a759

redirect to glpi root in case no cancel url is set

b12bbdd

just a fallback, should never happen

revert useless changes

8837d6b

re-uglify Session.php ¯\_(ツ)_/¯

9019991

remove Exception Listener to display reauth form.

c509794

Reauth enabled for form access (read right).

f2e8963

Uh oh!

Conversation

SebSept commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SebSept commented Mar 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

trasher commented Apr 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SebSept commented Mar 11, 2026 •

edited

Loading