includes/auth/LocalPasswordPrimaryAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 use User;
  25
  26 /**
  27  * A primary authentication provider that uses the password field in the 'user' table.
  28  * @ingroup Auth
  29  * @since 1.27
  30  */
  31 class LocalPasswordPrimaryAuthenticationProvider
  32         extends AbstractPasswordPrimaryAuthenticationProvider
  33 {
  34
  35         /** @var bool If true, this instance is for legacy logins only. */
  36         protected $loginOnly = false;
  37
  38         /**
  39          * @param array $params Settings
  40          *  - loginOnly: If true, the local passwords are for legacy logins only:
  41          *    the local password will be invalidated when authentication is changed
  42          *    and new users will not have a valid local password set.
  43          */
  44         public function __construct( $params = [] ) {
  45                 parent::__construct( $params );
  46                 $this->loginOnly = !empty( $params['loginOnly'] );
  47         }
  48
  49         protected function getPasswordResetData( $username, $row ) {
  50                 $now = wfTimestamp();
  51                 $expiration = wfTimestampOrNull( TS_UNIX, $row->user_password_expires );
  52                 if ( $expiration === null || $expiration >= $now ) {
  53                         return null;
  54                 }
  55
  56                 $grace = $this->config->get( 'PasswordExpireGrace' );
  57                 if ( $expiration + $grace < $now ) {
  58                         $data = [
  59                                 'hard' => true,
  60                                 'msg' => \Status::newFatal( 'resetpass-expired' )->getMessage(),
  61                         ];
  62                 } else {
  63                         $data = [
  64                                 'hard' => false,
  65                                 'msg' => \Status::newFatal( 'resetpass-expired-soft' )->getMessage(),
  66                         ];
  67                 }
  68
  69                 return (object)$data;
  70         }
  71
  72         public function beginPrimaryAuthentication( array $reqs ) {
  73                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
  74                 if ( !$req ) {
  75                         return AuthenticationResponse::newAbstain();
  76                 }
  77
  78                 if ( $req->username === null || $req->password === null ) {
  79                         return AuthenticationResponse::newAbstain();
  80                 }
  81
  82                 $username = User::getCanonicalName( $req->username, 'usable' );
  83                 if ( $username === false ) {
  84                         return AuthenticationResponse::newAbstain();
  85                 }
  86
  87                 $fields = [
  88                         'user_id', 'user_password', 'user_password_expires',
  89                 ];
  90
  91                 $dbw = wfGetDB( DB_MASTER );
  92                 $row = $dbw->selectRow(
  93                         'user',
  94                         $fields,
  95                         [ 'user_name' => $username ],
  96                         __METHOD__
  97                 );
  98                 if ( !$row ) {
  99                         return AuthenticationResponse::newAbstain();
 100                 }
 101
 102                 // Check for *really* old password hashes that don't even have a type
 103                 // The old hash format was just an md5 hex hash, with no type information
 104                 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
 105                         if ( $this->config->get( 'PasswordSalt' ) ) {
 106                                 $row->user_password = ":A:{$row->user_id}:{$row->user_password}";
 107                         } else {
 108                                 $row->user_password = ":A:{$row->user_password}";
 109                         }
 110                 }
 111
 112                 $status = $this->checkPasswordValidity( $username, $req->password );
 113                 if ( !$status->isOk() ) {
 114                         // Fatal, can't log in
 115                         return AuthenticationResponse::newFail( $status->getMessage() );
 116                 }
 117
 118                 $pwhash = $this->getPassword( $row->user_password );
 119                 if ( !$pwhash->equals( $req->password ) ) {
 120                         if ( $this->config->get( 'LegacyEncoding' ) ) {
 121                                 // Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
 122                                 // Check for this with iconv
 123                                 $cp1252Password = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $req->password );
 124                                 if ( $cp1252Password === $req->password || !$pwhash->equals( $cp1252Password ) ) {
 125                                         return $this->failResponse( $req );
 126                                 }
 127                         } else {
 128                                 return $this->failResponse( $req );
 129                         }
 130                 }
 131
 132                 // @codeCoverageIgnoreStart
 133                 if ( $this->getPasswordFactory()->needsUpdate( $pwhash ) ) {
 134                         $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 135                         $dbw->update(
 136                                 'user',
 137                                 [ 'user_password' => $pwhash->toString() ],
 138                                 [ 'user_id' => $row->user_id ],
 139                                 __METHOD__
 140                         );
 141                 }
 142                 // @codeCoverageIgnoreEnd
 143
 144                 $this->setPasswordResetFlag( $username, $status, $row );
 145
 146                 return AuthenticationResponse::newPass( $username );
 147         }
 148
 149         public function testUserCanAuthenticate( $username ) {
 150                 $username = User::getCanonicalName( $username, 'usable' );
 151                 if ( $username === false ) {
 152                         return false;
 153                 }
 154
 155                 $dbw = wfGetDB( DB_MASTER );
 156                 $row = $dbw->selectRow(
 157                         'user',
 158                         [ 'user_password' ],
 159                         [ 'user_name' => $username ],
 160                         __METHOD__
 161                 );
 162                 if ( !$row ) {
 163                         return false;
 164                 }
 165
 166                 // Check for *really* old password hashes that don't even have a type
 167                 // The old hash format was just an md5 hex hash, with no type information
 168                 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
 169                         return true;
 170                 }
 171
 172                 return !$this->getPassword( $row->user_password ) instanceof \InvalidPassword;
 173         }
 174
 175         public function testUserExists( $username, $flags = User::READ_NORMAL ) {
 176                 $username = User::getCanonicalName( $username, 'usable' );
 177                 if ( $username === false ) {
 178                         return false;
 179                 }
 180
 181                 list( $db, $options ) = \DBAccessObjectUtils::getDBOptions( $flags );
 182                 return (bool)wfGetDB( $db )->selectField(
 183                         [ 'user' ],
 184                         [ 'user_id' ],
 185                         [ 'user_name' => $username ],
 186                         __METHOD__,
 187                         $options
 188                 );
 189         }
 190
 191         public function providerAllowsAuthenticationDataChange(
 192                 AuthenticationRequest $req, $checkData = true
 193         ) {
 194                 // We only want to blank the password if something else will accept the
 195                 // new authentication data, so return 'ignore' here.
 196                 if ( $this->loginOnly ) {
 197                         return \StatusValue::newGood( 'ignored' );
 198                 }
 199
 200                 if ( get_class( $req ) === PasswordAuthenticationRequest::class ) {
 201                         if ( !$checkData ) {
 202                                 return \StatusValue::newGood();
 203                         }
 204
 205                         $username = User::getCanonicalName( $req->username, 'usable' );
 206                         if ( $username !== false ) {
 207                                 $row = wfGetDB( DB_MASTER )->selectRow(
 208                                         'user',
 209                                         [ 'user_id' ],
 210                                         [ 'user_name' => $username ],
 211                                         __METHOD__
 212                                 );
 213                                 if ( $row ) {
 214                                         $sv = \StatusValue::newGood();
 215                                         if ( $req->password !== null ) {
 216                                                 if ( $req->password !== $req->retype ) {
 217                                                         $sv->fatal( 'badretype' );
 218                                                 } else {
 219                                                         $sv->merge( $this->checkPasswordValidity( $username, $req->password ) );
 220                                                 }
 221                                         }
 222                                         return $sv;
 223                                 }
 224                         }
 225                 }
 226
 227                 return \StatusValue::newGood( 'ignored' );
 228         }
 229
 230         public function providerChangeAuthenticationData( AuthenticationRequest $req ) {
 231                 $username = $req->username !== null ? User::getCanonicalName( $req->username, 'usable' ) : false;
 232                 if ( $username === false ) {
 233                         return;
 234                 }
 235
 236                 $pwhash = null;
 237
 238                 if ( $this->loginOnly ) {
 239                         $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
 240                         $expiry = null;
 241                         // @codeCoverageIgnoreStart
 242                 } elseif ( get_class( $req ) === PasswordAuthenticationRequest::class ) {
 243                         // @codeCoverageIgnoreEnd
 244                         $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 245                         $expiry = $this->getNewPasswordExpiry( $username );
 246                 }
 247
 248                 if ( $pwhash ) {
 249                         $dbw = wfGetDB( DB_MASTER );
 250                         $dbw->update(
 251                                 'user',
 252                                 [
 253                                         'user_password' => $pwhash->toString(),
 254                                         'user_password_expires' => $dbw->timestampOrNull( $expiry ),
 255                                 ],
 256                                 [ 'user_name' => $username ],
 257                                 __METHOD__
 258                         );
 259                 }
 260         }
 261
 262         public function accountCreationType() {
 263                 return $this->loginOnly ? self::TYPE_NONE : self::TYPE_CREATE;
 264         }
 265
 266         public function testForAccountCreation( $user, $creator, array $reqs ) {
 267                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
 268
 269                 $ret = \StatusValue::newGood();
 270                 if ( !$this->loginOnly && $req && $req->username !== null && $req->password !== null ) {
 271                         if ( $req->password !== $req->retype ) {
 272                                 $ret->fatal( 'badretype' );
 273                         } else {
 274                                 $ret->merge(
 275                                         $this->checkPasswordValidity( $user->getName(), $req->password )
 276                                 );
 277                         }
 278                 }
 279                 return $ret;
 280         }
 281
 282         public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
 283                 if ( $this->accountCreationType() === self::TYPE_NONE ) {
 284                         throw new \BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
 285                 }
 286
 287                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
 288                 if ( $req ) {
 289                         if ( $req->username !== null && $req->password !== null ) {
 290                                 // Nothing we can do besides claim it, because the user isn't in
 291                                 // the DB yet
 292                                 if ( $req->username !== $user->getName() ) {
 293                                         $req = clone( $req );
 294                                         $req->username = $user->getName();
 295                                 }
 296                                 $ret = AuthenticationResponse::newPass( $req->username );
 297                                 $ret->createRequest = $req;
 298                                 return $ret;
 299                         }
 300                 }
 301                 return AuthenticationResponse::newAbstain();
 302         }
 303
 304         public function finishAccountCreation( $user, $creator, AuthenticationResponse $res ) {
 305                 if ( $this->accountCreationType() === self::TYPE_NONE ) {
 306                         throw new \BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
 307                 }
 308
 309                 // Now that the user is in the DB, set the password on it.
 310                 $this->providerChangeAuthenticationData( $res->createRequest );
 311
 312                 return null;
 313         }
 314 }