includes/api/ApiChangeAuthenticationData.php

   1 <?php
   2 /**
   3  * Copyright © 2016 Wikimedia Foundation and contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 namespace MediaWiki\Api;
  24
  25 use MediaWiki\Auth\AuthManager;
  26 use MediaWiki\MainConfigNames;
  27
  28 /**
  29  * Change authentication data with AuthManager
  30  *
  31  * @ingroup API
  32  */
  33 class ApiChangeAuthenticationData extends ApiBase {
  34         private AuthManager $authManager;
  35
  36         public function __construct(
  37                 ApiMain $main,
  38                 string $action,
  39                 AuthManager $authManager
  40         ) {
  41                 parent::__construct( $main, $action, 'changeauth' );
  42                 $this->authManager = $authManager;
  43         }
  44
  45         public function execute() {
  46                 if ( !$this->getUser()->isNamed() ) {
  47                         $this->dieWithError( 'apierror-mustbeloggedin-changeauthenticationdata', 'notloggedin' );
  48                 }
  49
  50                 $helper = new ApiAuthManagerHelper( $this, $this->authManager );
  51
  52                 // Check security-sensitive operation status
  53                 $helper->securitySensitiveOperation( 'ChangeCredentials' );
  54
  55                 // Fetch the request
  56                 $reqs = ApiAuthManagerHelper::blacklistAuthenticationRequests(
  57                         $helper->loadAuthenticationRequests( AuthManager::ACTION_CHANGE ),
  58                         $this->getConfig()->get( MainConfigNames::ChangeCredentialsBlacklist )
  59                 );
  60                 if ( count( $reqs ) !== 1 ) {
  61                         $this->dieWithError( 'apierror-changeauth-norequest', 'badrequest' );
  62                 }
  63                 $req = reset( $reqs );
  64
  65                 // Make the change
  66                 $status = $this->authManager->allowsAuthenticationDataChange( $req, true );
  67                 $this->getHookRunner()->onChangeAuthenticationDataAudit( $req, $status );
  68                 if ( !$status->isGood() ) {
  69                         $this->dieStatus( $status );
  70                 }
  71                 $this->authManager->changeAuthenticationData( $req );
  72
  73                 $this->getResult()->addValue( null, 'changeauthenticationdata', [ 'status' => 'success' ] );
  74         }
  75
  76         public function isWriteMode() {
  77                 return true;
  78         }
  79
  80         public function needsToken() {
  81                 return 'csrf';
  82         }
  83
  84         public function getAllowedParams() {
  85                 return ApiAuthManagerHelper::getStandardParams( AuthManager::ACTION_CHANGE,
  86                         'request'
  87                 );
  88         }
  89
  90         public function dynamicParameterDocumentation() {
  91                 return [ 'api-help-authmanagerhelper-additional-params', AuthManager::ACTION_CHANGE ];
  92         }
  93
  94         protected function getExamplesMessages() {
  95                 return [
  96                         'action=changeauthenticationdata' .
  97                                 '&changeauthrequest=MediaWiki%5CAuth%5CPasswordAuthenticationRequest' .
  98                                 '&password=ExamplePassword&retype=ExamplePassword&changeauthtoken=123ABC'
  99                                 => 'apihelp-changeauthenticationdata-example-password',
 100                 ];
 101         }
 102
 103         public function getHelpUrls() {
 104                 return 'https://www.mediawiki.org/wiki/Special:MyLanguage/API:Manage_authentication_data';
 105         }
 106 }
 107
 108 /** @deprecated class alias since 1.43 */
 109 class_alias( ApiChangeAuthenticationData::class, 'ApiChangeAuthenticationData' );