4 * Created on Sep 19, 2006
6 * API for MediaWiki 1.8+
8 * Copyright (C) 2006-2007 Yuri Astrakhan <Firstname><Lastname>@gmail.com,
9 * Daniel Cannon (cannon dot danielc at gmail dot com)
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 * http://www.gnu.org/copyleft/gpl.html
27 if (!defined('MEDIAWIKI')) {
28 // Eclipse helper - will be ignored in production
29 require_once ('ApiBase.php');
33 * Unit to authenticate log-in attempts to the current wiki.
37 class ApiLogin
extends ApiBase
{
39 public function __construct($main, $action) {
40 parent
:: __construct($main, $action, 'lg');
44 * Executes the log-in attempt using the parameters passed. If
45 * the log-in succeeeds, it attaches a cookie to the session
46 * and outputs the user id, username, and session token. If a
47 * log-in fails, as the result of a bad password, a nonexistant
48 * user, or any other reason, the host is cached with an expiry
49 * and no log-in attempts will be accepted until that expiry
50 * is reached. The expiry is $this->mLoginThrottle.
54 public function execute() {
55 $name = $password = $domain = null;
56 extract($this->extractRequestParams());
60 $params = new FauxRequest(array (
62 'wpPassword' => $password,
63 'wpDomain' => $domain,
67 // Init session if necessary
68 if( session_id() == '' ) {
72 $loginForm = new LoginForm($params);
73 switch ($authRes = $loginForm->authenticateUserData()) {
74 case LoginForm
:: SUCCESS
:
75 global $wgUser, $wgCookiePrefix;
77 $wgUser->setOption('rememberpassword', 1);
78 $wgUser->setCookies();
80 // Run hooks. FIXME: split back and frontend from this hook.
81 // FIXME: This hook should be placed in the backend
83 wfRunHooks('UserLoginComplete', array(&$wgUser, &$injected_html));
85 $result['result'] = 'Success';
86 $result['lguserid'] = $wgUser->getId();
87 $result['lgusername'] = $wgUser->getName();
88 $result['lgtoken'] = $wgUser->getToken();
89 $result['cookieprefix'] = $wgCookiePrefix;
90 $result['sessionid'] = session_id();
93 case LoginForm
:: NO_NAME
:
94 $result['result'] = 'NoName';
96 case LoginForm
:: ILLEGAL
:
97 $result['result'] = 'Illegal';
99 case LoginForm
:: WRONG_PLUGIN_PASS
:
100 $result['result'] = 'WrongPluginPass';
102 case LoginForm
:: NOT_EXISTS
:
103 $result['result'] = 'NotExists';
105 case LoginForm
:: WRONG_PASS
:
106 $result['result'] = 'WrongPass';
108 case LoginForm
:: EMPTY_PASS
:
109 $result['result'] = 'EmptyPass';
111 case LoginForm
:: CREATE_BLOCKED
:
112 $result['result'] = 'CreateBlocked';
113 $result['details'] = 'Your IP address is blocked from account creation';
115 case LoginForm
:: THROTTLED
:
116 global $wgPasswordAttemptThrottle;
117 $result['result'] = 'Throttled';
118 $result['wait'] = $wgPasswordAttemptThrottle['seconds'];
121 ApiBase
:: dieDebug(__METHOD__
, "Unhandled case value: {$authRes}");
124 $this->getResult()->addValue(null, 'login', $result);
127 public function mustBePosted() { return true; }
129 public function getAllowedParams() {
137 public function getParamDescription() {
139 'name' => 'User Name',
140 'password' => 'Password',
141 'domain' => 'Domain (optional)'
145 public function getDescription() {
147 'This module is used to login and get the authentication tokens. ',
148 'In the event of a successful log-in, a cookie will be attached',
149 'to your session. In the event of a failed log-in, you will not ',
150 'be able to attempt another log-in through this method for 5 seconds.',
151 'This is to prevent password guessing by automated password crackers.'
155 protected function getExamples() {
157 'api.php?action=login&lgname=user&lgpassword=password'
161 public function getVersion() {
162 return __CLASS__
. ': $Id$';