includes/auth/ResetPasswordSecondaryAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 /**
  25  * Reset the local password, if signalled via $this->manager->setAuthenticationSessionData()
  26  *
  27  * The authentication data key is 'reset-pass'; the data is an object with the
  28  * following properties:
  29  * - msg: Message object to display to the user
  30  * - hard: Boolean, if true the reset cannot be skipped.
  31  * - req: Optional PasswordAuthenticationRequest to use to actually reset the
  32  *   password. Won't be displayed to the user.
  33  *
  34  * @ingroup Auth
  35  * @since 1.27
  36  */
  37 class ResetPasswordSecondaryAuthenticationProvider extends AbstractSecondaryAuthenticationProvider {
  38
  39         public function getAuthenticationRequests( $action, array $options ) {
  40                 return [];
  41         }
  42
  43         public function beginSecondaryAuthentication( $user, array $reqs ) {
  44                 return $this->tryReset( $user, $reqs );
  45         }
  46
  47         public function continueSecondaryAuthentication( $user, array $reqs ) {
  48                 return $this->tryReset( $user, $reqs );
  49         }
  50
  51         public function beginSecondaryAccountCreation( $user, $creator, array $reqs ) {
  52                 return $this->tryReset( $user, $reqs );
  53         }
  54
  55         public function continueSecondaryAccountCreation( $user, $creator, array $reqs ) {
  56                 return $this->tryReset( $user, $reqs );
  57         }
  58
  59         /**
  60          * Try to reset the password
  61          * @param AuthenticationRequest[] $reqs
  62          * @return AuthenticationResponse
  63          */
  64         protected function tryReset( \User $user, array $reqs ) {
  65                 $data = $this->manager->getAuthenticationSessionData( 'reset-pass' );
  66                 if ( !$data ) {
  67                         return AuthenticationResponse::newAbstain();
  68                 }
  69
  70                 if ( is_array( $data ) ) {
  71                         $data = (object)$data;
  72                 }
  73                 if ( !is_object( $data ) ) {
  74                         throw new \UnexpectedValueException( 'reset-pass is not valid' );
  75                 }
  76
  77                 if ( !isset( $data->msg ) ) {
  78                         throw new \UnexpectedValueException( 'reset-pass msg is missing' );
  79                 } elseif ( !$data->msg instanceof \Message ) {
  80                         throw new \UnexpectedValueException( 'reset-pass msg is not valid' );
  81                 } elseif ( !isset( $data->hard ) ) {
  82                         throw new \UnexpectedValueException( 'reset-pass hard is missing' );
  83                 } elseif ( isset( $data->req ) && (
  84                         !$data->req instanceof PasswordAuthenticationRequest ||
  85                         !array_key_exists( 'retype', $data->req->getFieldInfo() )
  86                 ) ) {
  87                         throw new \UnexpectedValueException( 'reset-pass req is not valid' );
  88                 }
  89
  90                 if ( !$data->hard ) {
  91                         $req = ButtonAuthenticationRequest::getRequestByName( $reqs, 'skipReset' );
  92                         if ( $req ) {
  93                                 $this->manager->removeAuthenticationSessionData( 'reset-pass' );
  94                                 return AuthenticationResponse::newPass();
  95                         }
  96                 }
  97
  98                 $needReq = isset( $data->req ) ? $data->req : new PasswordAuthenticationRequest();
  99                 if ( !$needReq->action ) {
 100                         $needReq->action = AuthManager::ACTION_CHANGE;
 101                 }
 102                 $needReq->required = $data->hard ? AuthenticationRequest::REQUIRED
 103                         : AuthenticationRequest::OPTIONAL;
 104                 $needReqs = [ $needReq ];
 105                 if ( !$data->hard ) {
 106                         $needReqs[] = new ButtonAuthenticationRequest(
 107                                 'skipReset',
 108                                 wfMessage( 'authprovider-resetpass-skip-label' ),
 109                                 wfMessage( 'authprovider-resetpass-skip-help' )
 110                         );
 111                 }
 112
 113                 $req = AuthenticationRequest::getRequestByClass( $reqs, get_class( $needReq ) );
 114                 if ( !$req || !array_key_exists( 'retype', $req->getFieldInfo() ) ) {
 115                         return AuthenticationResponse::newUI( $needReqs, $data->msg );
 116                 }
 117
 118                 if ( $req->password !== $req->retype ) {
 119                         return AuthenticationResponse::newUI( $needReqs, new \Message( 'badretype' ) );
 120                 }
 121
 122                 $req->username = $user->getName();
 123                 $status = $this->manager->allowsAuthenticationDataChange( $req );
 124                 if ( !$status->isGood() ) {
 125                         return AuthenticationResponse::newUI( $needReqs, $status->getMessage() );
 126                 }
 127                 $this->manager->changeAuthenticationData( $req );
 128
 129                 $this->manager->removeAuthenticationSessionData( 'reset-pass' );
 130                 return AuthenticationResponse::newPass();
 131         }
 132 }