includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 use User;
  25
  26 /**
  27  * A primary authentication provider that uses the temporary password field in
  28  * the 'user' table.
  29  *
  30  * A successful login will force a password reset.
  31  *
  32  * @note For proper operation, this should generally come before any other
  33  *  password-based authentication providers.
  34  * @ingroup Auth
  35  * @since 1.27
  36  */
  37 class TemporaryPasswordPrimaryAuthenticationProvider
  38         extends AbstractPasswordPrimaryAuthenticationProvider
  39 {
  40         /** @var bool */
  41         protected $emailEnabled = null;
  42
  43         /** @var int */
  44         protected $newPasswordExpiry = null;
  45
  46         /** @var int */
  47         protected $passwordReminderResendTime = null;
  48
  49         /**
  50          * @param array $params
  51          *  - emailEnabled: (bool) must be true for the option to email passwords to be present
  52          *  - newPasswordExpiry: (int) expiraton time of temporary passwords, in seconds
  53          *  - passwordReminderResendTime: (int) cooldown period in hours until a password reminder can
  54          *    be sent to the same user again,
  55          */
  56         public function __construct( $params = [] ) {
  57                 parent::__construct( $params );
  58
  59                 if ( isset( $params['emailEnabled'] ) ) {
  60                         $this->emailEnabled = (bool)$params['emailEnabled'];
  61                 }
  62                 if ( isset( $params['newPasswordExpiry'] ) ) {
  63                         $this->newPasswordExpiry = (int)$params['newPasswordExpiry'];
  64                 }
  65                 if ( isset( $params['passwordReminderResendTime'] ) ) {
  66                         $this->passwordReminderResendTime = $params['passwordReminderResendTime'];
  67                 }
  68         }
  69
  70         public function setConfig( \Config $config ) {
  71                 parent::setConfig( $config );
  72
  73                 if ( $this->emailEnabled === null ) {
  74                         $this->emailEnabled = $this->config->get( 'EnableEmail' );
  75                 }
  76                 if ( $this->newPasswordExpiry === null ) {
  77                         $this->newPasswordExpiry = $this->config->get( 'NewPasswordExpiry' );
  78                 }
  79                 if ( $this->passwordReminderResendTime === null ) {
  80                         $this->passwordReminderResendTime = $this->config->get( 'PasswordReminderResendTime' );
  81                 }
  82         }
  83
  84         protected function getPasswordResetData( $username, $data ) {
  85                 // Always reset
  86                 return (object)[
  87                         'msg' => wfMessage( 'resetpass-temp-emailed' ),
  88                         'hard' => true,
  89                 ];
  90         }
  91
  92         public function getAuthenticationRequests( $action, array $options ) {
  93                 switch ( $action ) {
  94                         case AuthManager::ACTION_LOGIN:
  95                                 return [ new PasswordAuthenticationRequest() ];
  96
  97                         case AuthManager::ACTION_CHANGE:
  98                                 return [ TemporaryPasswordAuthenticationRequest::newRandom() ];
  99
 100                         case AuthManager::ACTION_CREATE:
 101                                 if ( isset( $options['username'] ) && $this->emailEnabled ) {
 102                                         // Creating an account for someone else
 103                                         return [ TemporaryPasswordAuthenticationRequest::newRandom() ];
 104                                 } else {
 105                                         // It's not terribly likely that an anonymous user will
 106                                         // be creating an account for someone else.
 107                                         return [];
 108                                 }
 109
 110                         case AuthManager::ACTION_REMOVE:
 111                                 return [ new TemporaryPasswordAuthenticationRequest ];
 112
 113                         default:
 114                                 return [];
 115                 }
 116         }
 117
 118         public function beginPrimaryAuthentication( array $reqs ) {
 119                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
 120                 if ( !$req || $req->username === null || $req->password === null ) {
 121                         return AuthenticationResponse::newAbstain();
 122                 }
 123
 124                 $username = User::getCanonicalName( $req->username, 'usable' );
 125                 if ( $username === false ) {
 126                         return AuthenticationResponse::newAbstain();
 127                 }
 128
 129                 $dbr = wfGetDB( DB_REPLICA );
 130                 $row = $dbr->selectRow(
 131                         'user',
 132                         [
 133                                 'user_id', 'user_newpassword', 'user_newpass_time',
 134                         ],
 135                         [ 'user_name' => $username ],
 136                         __METHOD__
 137                 );
 138                 if ( !$row ) {
 139                         return AuthenticationResponse::newAbstain();
 140                 }
 141
 142                 $status = $this->checkPasswordValidity( $username, $req->password );
 143                 if ( !$status->isOK() ) {
 144                         // Fatal, can't log in
 145                         return AuthenticationResponse::newFail( $status->getMessage() );
 146                 }
 147
 148                 $pwhash = $this->getPassword( $row->user_newpassword );
 149                 if ( !$pwhash->equals( $req->password ) ) {
 150                         return $this->failResponse( $req );
 151                 }
 152
 153                 if ( !$this->isTimestampValid( $row->user_newpass_time ) ) {
 154                         return $this->failResponse( $req );
 155                 }
 156
 157                 // Add an extra log entry since a temporary password is
 158                 // an unusual way to log in, so its important to keep track
 159                 // of in case of abuse.
 160                 $this->logger->info( "{user} successfully logged in using temp password",
 161                         [
 162                                 'user' => $username,
 163                                 'requestIP' => $this->manager->getRequest()->getIP()
 164                         ]
 165                 );
 166
 167                 $this->setPasswordResetFlag( $username, $status );
 168
 169                 return AuthenticationResponse::newPass( $username );
 170         }
 171
 172         public function testUserCanAuthenticate( $username ) {
 173                 $username = User::getCanonicalName( $username, 'usable' );
 174                 if ( $username === false ) {
 175                         return false;
 176                 }
 177
 178                 $dbr = wfGetDB( DB_REPLICA );
 179                 $row = $dbr->selectRow(
 180                         'user',
 181                         [ 'user_newpassword', 'user_newpass_time' ],
 182                         [ 'user_name' => $username ],
 183                         __METHOD__
 184                 );
 185                 if ( !$row ) {
 186                         return false;
 187                 }
 188
 189                 if ( $this->getPassword( $row->user_newpassword ) instanceof \InvalidPassword ) {
 190                         return false;
 191                 }
 192
 193                 if ( !$this->isTimestampValid( $row->user_newpass_time ) ) {
 194                         return false;
 195                 }
 196
 197                 return true;
 198         }
 199
 200         public function testUserExists( $username, $flags = User::READ_NORMAL ) {
 201                 $username = User::getCanonicalName( $username, 'usable' );
 202                 if ( $username === false ) {
 203                         return false;
 204                 }
 205
 206                 list( $db, $options ) = \DBAccessObjectUtils::getDBOptions( $flags );
 207                 return (bool)wfGetDB( $db )->selectField(
 208                         [ 'user' ],
 209                         [ 'user_id' ],
 210                         [ 'user_name' => $username ],
 211                         __METHOD__,
 212                         $options
 213                 );
 214         }
 215
 216         public function providerAllowsAuthenticationDataChange(
 217                 AuthenticationRequest $req, $checkData = true
 218         ) {
 219                 if ( get_class( $req ) !== TemporaryPasswordAuthenticationRequest::class ) {
 220                         // We don't really ignore it, but this is what the caller expects.
 221                         return \StatusValue::newGood( 'ignored' );
 222                 }
 223
 224                 if ( !$checkData ) {
 225                         return \StatusValue::newGood();
 226                 }
 227
 228                 $username = User::getCanonicalName( $req->username, 'usable' );
 229                 if ( $username === false ) {
 230                         return \StatusValue::newGood( 'ignored' );
 231                 }
 232
 233                 $row = wfGetDB( DB_MASTER )->selectRow(
 234                         'user',
 235                         [ 'user_id', 'user_newpass_time' ],
 236                         [ 'user_name' => $username ],
 237                         __METHOD__
 238                 );
 239
 240                 if ( !$row ) {
 241                         return \StatusValue::newGood( 'ignored' );
 242                 }
 243
 244                 $sv = \StatusValue::newGood();
 245                 if ( $req->password !== null ) {
 246                         $sv->merge( $this->checkPasswordValidity( $username, $req->password ) );
 247
 248                         if ( $req->mailpassword ) {
 249                                 if ( !$this->emailEnabled ) {
 250                                         return \StatusValue::newFatal( 'passwordreset-emaildisabled' );
 251                                 }
 252
 253                                 // We don't check whether the user has an email address;
 254                                 // that information should not be exposed to the caller.
 255
 256                                 // do not allow temporary password creation within
 257                                 // $wgPasswordReminderResendTime from the last attempt
 258                                 if (
 259                                         $this->passwordReminderResendTime
 260                                         && $row->user_newpass_time
 261                                         && time() < wfTimestamp( TS_UNIX, $row->user_newpass_time )
 262                                                 + $this->passwordReminderResendTime * 3600
 263                                 ) {
 264                                         // Round the time in hours to 3 d.p., in case someone is specifying
 265                                         // minutes or seconds.
 266                                         return \StatusValue::newFatal( 'throttled-mailpassword',
 267                                                 round( $this->passwordReminderResendTime, 3 ) );
 268                                 }
 269
 270                                 if ( !$req->caller ) {
 271                                         return \StatusValue::newFatal( 'passwordreset-nocaller' );
 272                                 }
 273                                 if ( !\IP::isValid( $req->caller ) ) {
 274                                         $caller = User::newFromName( $req->caller );
 275                                         if ( !$caller ) {
 276                                                 return \StatusValue::newFatal( 'passwordreset-nosuchcaller', $req->caller );
 277                                         }
 278                                 }
 279                         }
 280                 }
 281                 return $sv;
 282         }
 283
 284         public function providerChangeAuthenticationData( AuthenticationRequest $req ) {
 285                 $username = $req->username !== null ? User::getCanonicalName( $req->username, 'usable' ) : false;
 286                 if ( $username === false ) {
 287                         return;
 288                 }
 289
 290                 $dbw = wfGetDB( DB_MASTER );
 291
 292                 $sendMail = false;
 293                 if ( $req->action !== AuthManager::ACTION_REMOVE &&
 294                         get_class( $req ) === TemporaryPasswordAuthenticationRequest::class
 295                 ) {
 296                         $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 297                         $newpassTime = $dbw->timestamp();
 298                         $sendMail = $req->mailpassword;
 299                 } else {
 300                         // Invalidate the temporary password when any other auth is reset, or when removing
 301                         $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
 302                         $newpassTime = null;
 303                 }
 304
 305                 $dbw->update(
 306                         'user',
 307                         [
 308                                 'user_newpassword' => $pwhash->toString(),
 309                                 'user_newpass_time' => $newpassTime,
 310                         ],
 311                         [ 'user_name' => $username ],
 312                         __METHOD__
 313                 );
 314
 315                 if ( $sendMail ) {
 316                         // Send email after DB commit
 317                         $dbw->onTransactionIdle(
 318                                 function () use ( $req ) {
 319                                         /** @var TemporaryPasswordAuthenticationRequest $req */
 320                                         $this->sendPasswordResetEmail( $req );
 321                                 },
 322                                 __METHOD__
 323                         );
 324                 }
 325         }
 326
 327         public function accountCreationType() {
 328                 return self::TYPE_CREATE;
 329         }
 330
 331         public function testForAccountCreation( $user, $creator, array $reqs ) {
 332                 /** @var TemporaryPasswordAuthenticationRequest $req */
 333                 $req = AuthenticationRequest::getRequestByClass(
 334                         $reqs, TemporaryPasswordAuthenticationRequest::class
 335                 );
 336
 337                 $ret = \StatusValue::newGood();
 338                 if ( $req ) {
 339                         if ( $req->mailpassword ) {
 340                                 if ( !$this->emailEnabled ) {
 341                                         $ret->merge( \StatusValue::newFatal( 'emaildisabled' ) );
 342                                 } elseif ( !$user->getEmail() ) {
 343                                         $ret->merge( \StatusValue::newFatal( 'noemailcreate' ) );
 344                                 }
 345                         }
 346
 347                         $ret->merge(
 348                                 $this->checkPasswordValidity( $user->getName(), $req->password )
 349                         );
 350                 }
 351                 return $ret;
 352         }
 353
 354         public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
 355                 /** @var TemporaryPasswordAuthenticationRequest $req */
 356                 $req = AuthenticationRequest::getRequestByClass(
 357                         $reqs, TemporaryPasswordAuthenticationRequest::class
 358                 );
 359                 if ( $req ) {
 360                         if ( $req->username !== null && $req->password !== null ) {
 361                                 // Nothing we can do yet, because the user isn't in the DB yet
 362                                 if ( $req->username !== $user->getName() ) {
 363                                         $req = clone $req;
 364                                         $req->username = $user->getName();
 365                                 }
 366
 367                                 if ( $req->mailpassword ) {
 368                                         // prevent EmailNotificationSecondaryAuthenticationProvider from sending another mail
 369                                         $this->manager->setAuthenticationSessionData( 'no-email', true );
 370                                 }
 371
 372                                 $ret = AuthenticationResponse::newPass( $req->username );
 373                                 $ret->createRequest = $req;
 374                                 return $ret;
 375                         }
 376                 }
 377                 return AuthenticationResponse::newAbstain();
 378         }
 379
 380         public function finishAccountCreation( $user, $creator, AuthenticationResponse $res ) {
 381                 /** @var TemporaryPasswordAuthenticationRequest $req */
 382                 $req = $res->createRequest;
 383                 $mailpassword = $req->mailpassword;
 384                 $req->mailpassword = false; // providerChangeAuthenticationData would send the wrong email
 385
 386                 // Now that the user is in the DB, set the password on it.
 387                 $this->providerChangeAuthenticationData( $req );
 388
 389                 if ( $mailpassword ) {
 390                         // Send email after DB commit
 391                         wfGetDB( DB_MASTER )->onTransactionIdle(
 392                                 function () use ( $user, $creator, $req ) {
 393                                         $this->sendNewAccountEmail( $user, $creator, $req->password );
 394                                 },
 395                                 __METHOD__
 396                         );
 397                 }
 398
 399                 return $mailpassword ? 'byemail' : null;
 400         }
 401
 402         /**
 403          * Check that a temporary password is still valid (hasn't expired).
 404          * @param string $timestamp A timestamp in MediaWiki (TS_MW) format
 405          * @return bool
 406          */
 407         protected function isTimestampValid( $timestamp ) {
 408                 $time = wfTimestampOrNull( TS_MW, $timestamp );
 409                 if ( $time !== null ) {
 410                         $expiry = wfTimestamp( TS_UNIX, $time ) + $this->newPasswordExpiry;
 411                         if ( time() >= $expiry ) {
 412                                 return false;
 413                         }
 414                 }
 415                 return true;
 416         }
 417
 418         /**
 419          * Send an email about the new account creation and the temporary password.
 420          * @param User $user The new user account
 421          * @param User $creatingUser The user who created the account (can be anonymous)
 422          * @param string $password The temporary password
 423          * @return \Status
 424          */
 425         protected function sendNewAccountEmail( User $user, User $creatingUser, $password ) {
 426                 $ip = $creatingUser->getRequest()->getIP();
 427                 // @codeCoverageIgnoreStart
 428                 if ( !$ip ) {
 429                         return \Status::newFatal( 'badipaddress' );
 430                 }
 431                 // @codeCoverageIgnoreEnd
 432
 433                 \Hooks::run( 'User::mailPasswordInternal', [ &$creatingUser, &$ip, &$user ] );
 434
 435                 $mainPageUrl = \Title::newMainPage()->getCanonicalURL();
 436                 $userLanguage = $user->getOption( 'language' );
 437                 $subjectMessage = wfMessage( 'createaccount-title' )->inLanguage( $userLanguage );
 438                 $bodyMessage = wfMessage( 'createaccount-text', $ip, $user->getName(), $password,
 439                         '<' . $mainPageUrl . '>', round( $this->newPasswordExpiry / 86400 ) )
 440                         ->inLanguage( $userLanguage );
 441
 442                 $status = $user->sendMail( $subjectMessage->text(), $bodyMessage->text() );
 443
 444                 // TODO show 'mailerror' message on error, 'accmailtext' success message otherwise?
 445                 // @codeCoverageIgnoreStart
 446                 if ( !$status->isGood() ) {
 447                         $this->logger->warning( 'Could not send account creation email: ' .
 448                                 $status->getWikiText( false, false, 'en' ) );
 449                 }
 450                 // @codeCoverageIgnoreEnd
 451
 452                 return $status;
 453         }
 454
 455         /**
 456          * @param TemporaryPasswordAuthenticationRequest $req
 457          * @return \Status
 458          */
 459         protected function sendPasswordResetEmail( TemporaryPasswordAuthenticationRequest $req ) {
 460                         $user = User::newFromName( $req->username );
 461                         if ( !$user ) {
 462                                 return \Status::newFatal( 'noname' );
 463                         }
 464                         $userLanguage = $user->getOption( 'language' );
 465                         $callerIsAnon = \IP::isValid( $req->caller );
 466                         $callerName = $callerIsAnon ? $req->caller : User::newFromName( $req->caller )->getName();
 467                         $passwordMessage = wfMessage( 'passwordreset-emailelement', $user->getName(),
 468                                 $req->password )->inLanguage( $userLanguage );
 469                         $emailMessage = wfMessage( $callerIsAnon ? 'passwordreset-emailtext-ip'
 470                                 : 'passwordreset-emailtext-user' )->inLanguage( $userLanguage );
 471                         $emailMessage->params( $callerName, $passwordMessage->text(), 1,
 472                                 '<' . \Title::newMainPage()->getCanonicalURL() . '>',
 473                                 round( $this->newPasswordExpiry / 86400 ) );
 474                         $emailTitle = wfMessage( 'passwordreset-emailtitle' )->inLanguage( $userLanguage );
 475                         return $user->sendMail( $emailTitle->text(), $emailMessage->text() );
 476         }
 477 }