includes/specials/SpecialChangeCredentials.php

   1 <?php
   2
   3 namespace MediaWiki\Specials;
   4
   5 use LogicException;
   6 use MediaWiki\Auth\AuthenticationRequest;
   7 use MediaWiki\Auth\AuthenticationResponse;
   8 use MediaWiki\Auth\AuthManager;
   9 use MediaWiki\Auth\PasswordAuthenticationRequest;
  10 use MediaWiki\Html\Html;
  11 use MediaWiki\MainConfigNames;
  12 use MediaWiki\Message\Message;
  13 use MediaWiki\Session\SessionManager;
  14 use MediaWiki\SpecialPage\AuthManagerSpecialPage;
  15 use MediaWiki\Status\Status;
  16 use MediaWiki\Title\Title;
  17
  18 /**
  19  * Change user credentials, such as the password.
  20  *
  21  * This is also powers most of the SpecialRemoveCredentials subclass.
  22  *
  23  * @see SpecialChangePassword
  24  * @ingroup SpecialPage
  25  * @ingroup Auth
  26  */
  27 class SpecialChangeCredentials extends AuthManagerSpecialPage {
  28         /** @inheritDoc */
  29         protected static $allowedActions = [ AuthManager::ACTION_CHANGE ];
  30
  31         /** @var string */
  32         protected static $messagePrefix = 'changecredentials';
  33
  34         /** @var bool Change action needs user data; remove action does not */
  35         protected static $loadUserData = true;
  36
  37         /**
  38          * @param AuthManager $authManager
  39          */
  40         public function __construct( AuthManager $authManager ) {
  41                 parent::__construct( 'ChangeCredentials', 'editmyprivateinfo' );
  42                 $this->setAuthManager( $authManager );
  43         }
  44
  45         protected function getGroupName() {
  46                 return 'login';
  47         }
  48
  49         public function isListed() {
  50                 $this->loadAuth( '' );
  51                 return (bool)$this->authRequests;
  52         }
  53
  54         public function doesWrites() {
  55                 return true;
  56         }
  57
  58         protected function getDefaultAction( $subPage ) {
  59                 return AuthManager::ACTION_CHANGE;
  60         }
  61
  62         public function execute( $subPage ) {
  63                 $this->setHeaders();
  64                 $this->outputHeader();
  65
  66                 $this->loadAuth( $subPage );
  67
  68                 if ( !$subPage ) {
  69                         $this->showSubpageList();
  70                         return;
  71                 }
  72
  73                 if ( !$this->authRequests ) {
  74                         // messages used: changecredentials-invalidsubpage, removecredentials-invalidsubpage
  75                         $this->showSubpageList( $this->msg( static::$messagePrefix . '-invalidsubpage', $subPage ) );
  76                         return;
  77                 }
  78
  79                 $out = $this->getOutput();
  80                 $out->addModules( 'mediawiki.special.changecredentials' );
  81                 $out->addBacklinkSubtitle( $this->getPageTitle() );
  82                 $status = $this->trySubmit();
  83
  84                 if ( $status === false || !$status->isOK() ) {
  85                         $this->displayForm( $status );
  86                         return;
  87                 }
  88
  89                 $response = $status->getValue();
  90
  91                 switch ( $response->status ) {
  92                         case AuthenticationResponse::PASS:
  93                                 $this->success();
  94                                 break;
  95                         case AuthenticationResponse::FAIL:
  96                                 $this->displayForm( Status::newFatal( $response->message ) );
  97                                 break;
  98                         default:
  99                                 throw new LogicException( 'invalid AuthenticationResponse' );
 100                 }
 101         }
 102
 103         protected function loadAuth( $subPage, $authAction = null, $reset = false ) {
 104                 parent::loadAuth( $subPage, $authAction );
 105                 if ( $subPage ) {
 106                         $foundReqs = [];
 107                         foreach ( $this->authRequests as $req ) {
 108                                 if ( $req->getUniqueId() === $subPage ) {
 109                                         $foundReqs[] = $req;
 110                                 }
 111                         }
 112                         if ( count( $foundReqs ) > 1 ) {
 113                                 throw new LogicException( 'Multiple AuthenticationRequest objects with same ID!' );
 114                         }
 115                         $this->authRequests = $foundReqs;
 116                 }
 117         }
 118
 119         /** @inheritDoc */
 120         public function onAuthChangeFormFields(
 121                 array $requests, array $fieldInfo, array &$formDescriptor, $action
 122         ) {
 123                 parent::onAuthChangeFormFields( $requests, $fieldInfo, $formDescriptor, $action );
 124
 125                 // Add some UI flair for password changes, the most common use case for this page.
 126                 if ( AuthenticationRequest::getRequestByClass( $this->authRequests,
 127                         PasswordAuthenticationRequest::class )
 128                 ) {
 129                         $formDescriptor = self::mergeDefaultFormDescriptor( $fieldInfo, $formDescriptor, [
 130                                 'password' => [
 131                                         'autocomplete' => 'new-password',
 132                                         'placeholder-message' => 'createacct-yourpassword-ph',
 133                                         'help-message' => 'createacct-useuniquepass',
 134                                 ],
 135                                 'retype' => [
 136                                         'autocomplete' => 'new-password',
 137                                         'placeholder-message' => 'createacct-yourpasswordagain-ph',
 138                                 ],
 139                                 // T263927 - the Chromium password form guide recommends always having a username field
 140                                 'username' => [
 141                                         'type' => 'text',
 142                                         'baseField' => 'password',
 143                                         'autocomplete' => 'username',
 144                                         'nodata' => true,
 145                                         'readonly' => true,
 146                                         'cssclass' => 'mw-htmlform-hidden-field',
 147                                         'label-message' => 'userlogin-yourname',
 148                                         'placeholder-message' => 'userlogin-yourname-ph',
 149                                 ],
 150                         ] );
 151                 }
 152         }
 153
 154         protected function getAuthFormDescriptor( $requests, $action ) {
 155                 if ( !static::$loadUserData ) {
 156                         return [];
 157                 }
 158
 159                 $descriptor = parent::getAuthFormDescriptor( $requests, $action );
 160
 161                 $any = false;
 162                 foreach ( $descriptor as &$field ) {
 163                         if ( $field['type'] === 'password' && $field['name'] !== 'retype' ) {
 164                                 $any = true;
 165                                 if ( isset( $field['cssclass'] ) ) {
 166                                         $field['cssclass'] .= ' mw-changecredentials-validate-password';
 167                                 } else {
 168                                         $field['cssclass'] = 'mw-changecredentials-validate-password';
 169                                 }
 170                         }
 171                 }
 172                 unset( $field );
 173
 174                 if ( $any ) {
 175                         $this->getOutput()->addModules( 'mediawiki.misc-authed-ooui' );
 176                 }
 177
 178                 return $descriptor;
 179         }
 180
 181         protected function getAuthForm( array $requests, $action ) {
 182                 $form = parent::getAuthForm( $requests, $action );
 183                 $req = reset( $requests );
 184                 $info = $req->describeCredentials();
 185
 186                 $form->addPreHtml(
 187                         Html::openElement( 'dl' )
 188                         . Html::element( 'dt', [], $this->msg( 'credentialsform-provider' )->text() )
 189                         . Html::element( 'dd', [], $info['provider']->text() )
 190                         . Html::element( 'dt', [], $this->msg( 'credentialsform-account' )->text() )
 191                         . Html::element( 'dd', [], $info['account']->text() )
 192                         . Html::closeElement( 'dl' )
 193                 );
 194
 195                 // messages used: changecredentials-submit removecredentials-submit
 196                 $form->setSubmitTextMsg( static::$messagePrefix . '-submit' );
 197                 $form->showCancel()->setCancelTarget( $this->getReturnUrl() ?: Title::newMainPage() );
 198                 $form->setSubmitID( 'change_credentials_submit' );
 199                 return $form;
 200         }
 201
 202         protected function needsSubmitButton( array $requests ) {
 203                 // Change/remove forms show are built from a single AuthenticationRequest and do not allow
 204                 // for redirect flow; they always need a submit button.
 205                 return true;
 206         }
 207
 208         public function handleFormSubmit( $data ) {
 209                 // remove requests do not accept user input
 210                 $requests = $this->authRequests;
 211                 if ( static::$loadUserData ) {
 212                         $requests = AuthenticationRequest::loadRequestsFromSubmission( $this->authRequests, $data );
 213                 }
 214
 215                 $response = $this->performAuthenticationStep( $this->authAction, $requests );
 216
 217                 // we can't handle FAIL or similar as failure here since it might require changing the form
 218                 return Status::newGood( $response );
 219         }
 220
 221         /**
 222          * @param Message|null $error
 223          */
 224         protected function showSubpageList( $error = null ) {
 225                 $out = $this->getOutput();
 226
 227                 if ( $error ) {
 228                         $out->addHTML( $error->parse() );
 229                 }
 230
 231                 $groupedRequests = [];
 232                 foreach ( $this->authRequests as $req ) {
 233                         $info = $req->describeCredentials();
 234                         $groupedRequests[$info['provider']->text()][] = $req;
 235                 }
 236
 237                 $linkRenderer = $this->getLinkRenderer();
 238                 $out->addHTML( Html::openElement( 'dl' ) );
 239                 foreach ( $groupedRequests as $group => $members ) {
 240                         $out->addHTML( Html::element( 'dt', [], $group ) );
 241                         foreach ( $members as $req ) {
 242                                 /** @var AuthenticationRequest $req */
 243                                 $info = $req->describeCredentials();
 244                                 $out->addHTML( Html::rawElement( 'dd', [],
 245                                         $linkRenderer->makeLink(
 246                                                 $this->getPageTitle( $req->getUniqueId() ),
 247                                                 $info['account']->text()
 248                                         )
 249                                 ) );
 250                         }
 251                 }
 252                 $out->addHTML( Html::closeElement( 'dl' ) );
 253         }
 254
 255         protected function success() {
 256                 $session = $this->getRequest()->getSession();
 257                 $user = $this->getUser();
 258                 $out = $this->getOutput();
 259                 $returnUrl = $this->getReturnUrl();
 260
 261                 // change user token and update the session
 262                 SessionManager::singleton()->invalidateSessionsForUser( $user );
 263                 $session->setUser( $user );
 264                 $session->resetId();
 265
 266                 if ( $returnUrl ) {
 267                         $out->redirect( $returnUrl );
 268                 } else {
 269                         // messages used: changecredentials-success removecredentials-success
 270                         $out->addHTML(
 271                                 Html::successBox(
 272                                         $out->msg( static::$messagePrefix . '-success' )->parse()
 273                                 )
 274                         );
 275                         $out->returnToMain();
 276                 }
 277         }
 278
 279         /**
 280          * @return string|null
 281          */
 282         protected function getReturnUrl() {
 283                 $request = $this->getRequest();
 284                 $returnTo = $request->getText( 'returnto' );
 285                 $returnToQuery = $request->getText( 'returntoquery', '' );
 286
 287                 if ( !$returnTo ) {
 288                         return null;
 289                 }
 290
 291                 return Title::newFromText( $returnTo )->getFullUrlForRedirect( $returnToQuery );
 292         }
 293
 294         protected function getRequestBlacklist() {
 295                 return $this->getConfig()->get( MainConfigNames::ChangeCredentialsBlacklist );
 296         }
 297 }
 298
 299 /** @deprecated class alias since 1.41 */
 300 class_alias( SpecialChangeCredentials::class, 'SpecialChangeCredentials' );