includes/auth/LocalPasswordPrimaryAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 use User;
  25
  26 /**
  27  * A primary authentication provider that uses the password field in the 'user' table.
  28  * @ingroup Auth
  29  * @since 1.27
  30  */
  31 class LocalPasswordPrimaryAuthenticationProvider
  32         extends AbstractPasswordPrimaryAuthenticationProvider
  33 {
  34
  35         /** @var bool If true, this instance is for legacy logins only. */
  36         protected $loginOnly = false;
  37
  38         /**
  39          * @param array $params Settings
  40          *  - loginOnly: If true, the local passwords are for legacy logins only:
  41          *    the local password will be invalidated when authentication is changed
  42          *    and new users will not have a valid local password set.
  43          */
  44         public function __construct( $params = [] ) {
  45                 parent::__construct( $params );
  46                 $this->loginOnly = !empty( $params['loginOnly'] );
  47         }
  48
  49         protected function getPasswordResetData( $username, $row ) {
  50                 $now = wfTimestamp();
  51                 $expiration = wfTimestampOrNull( TS_UNIX, $row->user_password_expires );
  52                 if ( $expiration === null || $expiration >= $now ) {
  53                         return null;
  54                 }
  55
  56                 $grace = $this->config->get( 'PasswordExpireGrace' );
  57                 if ( $expiration + $grace < $now ) {
  58                         $data = [
  59                                 'hard' => true,
  60                                 'msg' => \Status::newFatal( 'resetpass-expired' )->getMessage(),
  61                         ];
  62                 } else {
  63                         $data = [
  64                                 'hard' => false,
  65                                 'msg' => \Status::newFatal( 'resetpass-expired-soft' )->getMessage(),
  66                         ];
  67                 }
  68
  69                 return (object)$data;
  70         }
  71
  72         public function beginPrimaryAuthentication( array $reqs ) {
  73                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
  74                 if ( !$req ) {
  75                         return AuthenticationResponse::newAbstain();
  76                 }
  77
  78                 if ( $req->username === null || $req->password === null ) {
  79                         return AuthenticationResponse::newAbstain();
  80                 }
  81
  82                 $username = User::getCanonicalName( $req->username, 'usable' );
  83                 if ( $username === false ) {
  84                         return AuthenticationResponse::newAbstain();
  85                 }
  86
  87                 $fields = [
  88                         'user_id', 'user_password', 'user_password_expires',
  89                 ];
  90
  91                 $dbr = wfGetDB( DB_REPLICA );
  92                 $row = $dbr->selectRow(
  93                         'user',
  94                         $fields,
  95                         [ 'user_name' => $username ],
  96                         __METHOD__
  97                 );
  98                 if ( !$row ) {
  99                         // Do not reveal whether its bad username or
 100                         // bad password to prevent username enumeration
 101                         // on private wikis. (T134100)
 102                         return $this->failResponse( $req );
 103                 }
 104
 105                 $oldRow = clone $row;
 106                 // Check for *really* old password hashes that don't even have a type
 107                 // The old hash format was just an md5 hex hash, with no type information
 108                 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
 109                         if ( $this->config->get( 'PasswordSalt' ) ) {
 110                                 $row->user_password = ":B:{$row->user_id}:{$row->user_password}";
 111                         } else {
 112                                 $row->user_password = ":A:{$row->user_password}";
 113                         }
 114                 }
 115
 116                 $status = $this->checkPasswordValidity( $username, $req->password );
 117                 if ( !$status->isOK() ) {
 118                         // Fatal, can't log in
 119                         return AuthenticationResponse::newFail( $status->getMessage() );
 120                 }
 121
 122                 $pwhash = $this->getPassword( $row->user_password );
 123                 if ( !$pwhash->equals( $req->password ) ) {
 124                         if ( $this->config->get( 'LegacyEncoding' ) ) {
 125                                 // Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
 126                                 // Check for this with iconv
 127                                 $cp1252Password = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $req->password );
 128                                 if ( $cp1252Password === $req->password || !$pwhash->equals( $cp1252Password ) ) {
 129                                         return $this->failResponse( $req );
 130                                 }
 131                         } else {
 132                                 return $this->failResponse( $req );
 133                         }
 134                 }
 135
 136                 // @codeCoverageIgnoreStart
 137                 if ( $this->getPasswordFactory()->needsUpdate( $pwhash ) ) {
 138                         $newHash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 139                         \DeferredUpdates::addCallableUpdate( function () use ( $newHash, $oldRow ) {
 140                                 $dbw = wfGetDB( DB_MASTER );
 141                                 $dbw->update(
 142                                         'user',
 143                                         [ 'user_password' => $newHash->toString() ],
 144                                         [
 145                                                 'user_id' => $oldRow->user_id,
 146                                                 'user_password' => $oldRow->user_password
 147                                         ],
 148                                         __METHOD__
 149                                 );
 150                         } );
 151                 }
 152                 // @codeCoverageIgnoreEnd
 153
 154                 $this->setPasswordResetFlag( $username, $status, $row );
 155
 156                 return AuthenticationResponse::newPass( $username );
 157         }
 158
 159         public function testUserCanAuthenticate( $username ) {
 160                 $username = User::getCanonicalName( $username, 'usable' );
 161                 if ( $username === false ) {
 162                         return false;
 163                 }
 164
 165                 $dbr = wfGetDB( DB_REPLICA );
 166                 $row = $dbr->selectRow(
 167                         'user',
 168                         [ 'user_password' ],
 169                         [ 'user_name' => $username ],
 170                         __METHOD__
 171                 );
 172                 if ( !$row ) {
 173                         return false;
 174                 }
 175
 176                 // Check for *really* old password hashes that don't even have a type
 177                 // The old hash format was just an md5 hex hash, with no type information
 178                 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
 179                         return true;
 180                 }
 181
 182                 return !$this->getPassword( $row->user_password ) instanceof \InvalidPassword;
 183         }
 184
 185         public function testUserExists( $username, $flags = User::READ_NORMAL ) {
 186                 $username = User::getCanonicalName( $username, 'usable' );
 187                 if ( $username === false ) {
 188                         return false;
 189                 }
 190
 191                 list( $db, $options ) = \DBAccessObjectUtils::getDBOptions( $flags );
 192                 return (bool)wfGetDB( $db )->selectField(
 193                         [ 'user' ],
 194                         [ 'user_id' ],
 195                         [ 'user_name' => $username ],
 196                         __METHOD__,
 197                         $options
 198                 );
 199         }
 200
 201         public function providerAllowsAuthenticationDataChange(
 202                 AuthenticationRequest $req, $checkData = true
 203         ) {
 204                 // We only want to blank the password if something else will accept the
 205                 // new authentication data, so return 'ignore' here.
 206                 if ( $this->loginOnly ) {
 207                         return \StatusValue::newGood( 'ignored' );
 208                 }
 209
 210                 if ( get_class( $req ) === PasswordAuthenticationRequest::class ) {
 211                         if ( !$checkData ) {
 212                                 return \StatusValue::newGood();
 213                         }
 214
 215                         $username = User::getCanonicalName( $req->username, 'usable' );
 216                         if ( $username !== false ) {
 217                                 $row = wfGetDB( DB_MASTER )->selectRow(
 218                                         'user',
 219                                         [ 'user_id' ],
 220                                         [ 'user_name' => $username ],
 221                                         __METHOD__
 222                                 );
 223                                 if ( $row ) {
 224                                         $sv = \StatusValue::newGood();
 225                                         if ( $req->password !== null ) {
 226                                                 if ( $req->password !== $req->retype ) {
 227                                                         $sv->fatal( 'badretype' );
 228                                                 } else {
 229                                                         $sv->merge( $this->checkPasswordValidity( $username, $req->password ) );
 230                                                 }
 231                                         }
 232                                         return $sv;
 233                                 }
 234                         }
 235                 }
 236
 237                 return \StatusValue::newGood( 'ignored' );
 238         }
 239
 240         public function providerChangeAuthenticationData( AuthenticationRequest $req ) {
 241                 $username = $req->username !== null ? User::getCanonicalName( $req->username, 'usable' ) : false;
 242                 if ( $username === false ) {
 243                         return;
 244                 }
 245
 246                 $pwhash = null;
 247
 248                 if ( get_class( $req ) === PasswordAuthenticationRequest::class ) {
 249                         if ( $this->loginOnly ) {
 250                                 $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
 251                                 $expiry = null;
 252                         } else {
 253                                 $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 254                                 $expiry = $this->getNewPasswordExpiry( $username );
 255                         }
 256                 }
 257
 258                 if ( $pwhash ) {
 259                         $dbw = wfGetDB( DB_MASTER );
 260                         $dbw->update(
 261                                 'user',
 262                                 [
 263                                         'user_password' => $pwhash->toString(),
 264                                         'user_password_expires' => $dbw->timestampOrNull( $expiry ),
 265                                 ],
 266                                 [ 'user_name' => $username ],
 267                                 __METHOD__
 268                         );
 269                 }
 270         }
 271
 272         public function accountCreationType() {
 273                 return $this->loginOnly ? self::TYPE_NONE : self::TYPE_CREATE;
 274         }
 275
 276         public function testForAccountCreation( $user, $creator, array $reqs ) {
 277                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
 278
 279                 $ret = \StatusValue::newGood();
 280                 if ( !$this->loginOnly && $req && $req->username !== null && $req->password !== null ) {
 281                         if ( $req->password !== $req->retype ) {
 282                                 $ret->fatal( 'badretype' );
 283                         } else {
 284                                 $ret->merge(
 285                                         $this->checkPasswordValidity( $user->getName(), $req->password )
 286                                 );
 287                         }
 288                 }
 289                 return $ret;
 290         }
 291
 292         public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
 293                 if ( $this->accountCreationType() === self::TYPE_NONE ) {
 294                         throw new \BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
 295                 }
 296
 297                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
 298                 if ( $req ) {
 299                         if ( $req->username !== null && $req->password !== null ) {
 300                                 // Nothing we can do besides claim it, because the user isn't in
 301                                 // the DB yet
 302                                 if ( $req->username !== $user->getName() ) {
 303                                         $req = clone $req;
 304                                         $req->username = $user->getName();
 305                                 }
 306                                 $ret = AuthenticationResponse::newPass( $req->username );
 307                                 $ret->createRequest = $req;
 308                                 return $ret;
 309                         }
 310                 }
 311                 return AuthenticationResponse::newAbstain();
 312         }
 313
 314         public function finishAccountCreation( $user, $creator, AuthenticationResponse $res ) {
 315                 if ( $this->accountCreationType() === self::TYPE_NONE ) {
 316                         throw new \BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
 317                 }
 318
 319                 // Now that the user is in the DB, set the password on it.
 320                 $this->providerChangeAuthenticationData( $res->createRequest );
 321
 322                 return null;
 323         }
 324 }