maintenance/includes/DeleteLocalPasswords.php

   1 <?php
   2 /**
   3  * Helper for deleting unused local passwords.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup Maintenance
  22  */
  23
  24 use MediaWiki\MediaWikiServices;
  25 use Wikimedia\Rdbms\IDatabase;
  26
  27 require_once __DIR__ . '/../Maintenance.php';
  28
  29 /**
  30  * Delete unused local passwords.
  31  *
  32  * Mainly intended to be used as a base class by authentication extensions to provide maintenance
  33  * scripts which allow deleting local passwords for users who have another way of logging in.
  34  * Such scripts would customize how to locate users who have other login methods and don't need
  35  * local login anymore.
  36  * Make sure to set LocalPasswordPrimaryAuthenticationProvider to loginOnly => true or disable it
  37  * completely before running this, otherwise it might recreate passwords.
  38  *
  39  * This class can also be used directly to just delete all local passwords, or those for a specific
  40  * user. Deleting all passwords is useful when the wiki has used local password login in the past
  41  * but it has been disabled.
  42  */
  43 class DeleteLocalPasswords extends Maintenance {
  44         /** @var string|null User to run on, or null for all. */
  45         protected $user;
  46
  47         /** @var int Number of deleted passwords. */
  48         protected $total;
  49
  50         public function __construct() {
  51                 parent::__construct();
  52                 $this->mDescription = "Deletes local password for users.";
  53                 $this->setBatchSize( 1000 );
  54
  55                 $this->addOption( 'user', 'If specified, only checks the given user', false, true );
  56                 $this->addOption( 'delete', 'Really delete. To prevent accidents, you must provide this flag.' );
  57                 $this->addOption( 'prefix', "Instead of deleting, make passwords invalid by prefixing with "
  58                         . "':null:'. Make sure PasswordConfig has a 'null' entry. This is meant for testing before "
  59                         . "hard delete." );
  60                 $this->addOption( 'unprefix', 'Instead of deleting, undo the effect of --prefix.' );
  61         }
  62
  63         protected function initialize() {
  64                 if (
  65                         $this->hasOption( 'delete' ) + $this->hasOption( 'prefix' )
  66                         + $this->hasOption( 'unprefix' ) !== 1
  67                 ) {
  68                         $this->fatalError( "Exactly one of the 'delete', 'prefix', 'unprefix' options must be used\n" );
  69                 }
  70                 if ( $this->hasOption( 'prefix' ) || $this->hasOption( 'unprefix' ) ) {
  71                         $passwordHashTypes = MediaWikiServices::getInstance()->getPasswordFactory()->getTypes();
  72                         if (
  73                                 !isset( $passwordHashTypes['null'] )
  74                                 || $passwordHashTypes['null']['class'] !== InvalidPassword::class
  75                         ) {
  76                                 $this->fatalError(
  77 <<<'ERROR'
  78 'null' password entry missing. To use password prefixing, add
  79     $wgPasswordConfig['null'] = [ 'class' => InvalidPassword::class ];
  80 to your configuration (and remove once the passwords were deleted).
  81 ERROR
  82                                 );
  83                         }
  84                 }
  85
  86                 $user = $this->getOption( 'user', false );
  87                 if ( $user !== false ) {
  88                         $this->user = User::getCanonicalName( $user );
  89                         if ( $this->user === false ) {
  90                                 $this->fatalError( "Invalid user name\n" );
  91                         }
  92                 }
  93         }
  94
  95         public function execute() {
  96                 $this->initialize();
  97
  98                 foreach ( $this->getUserBatches() as $userBatch ) {
  99                         $this->processUsers( $userBatch, $this->getUserDB() );
 100                 }
 101
 102                 $this->output( "done. (wrote $this->total rows)\n" );
 103         }
 104
 105         /**
 106          * Get the master DB handle for the current user batch. This is provided for the benefit
 107          * of authentication extensions which subclass this and work with wiki farms.
 108          */
 109         protected function getUserDB() {
 110                 return $this->getDB( DB_MASTER );
 111         }
 112
 113         protected function processUsers( array $userBatch, IDatabase $dbw ) {
 114                 if ( !$userBatch ) {
 115                         return;
 116                 }
 117                 if ( $this->getOption( 'delete' ) ) {
 118                         $dbw->update( 'user',
 119                                 [ 'user_password' => PasswordFactory::newInvalidPassword()->toString() ],
 120                                 [ 'user_name' => $userBatch ],
 121                                 __METHOD__
 122                         );
 123                 } elseif ( $this->getOption( 'prefix' ) ) {
 124                         $dbw->update( 'user',
 125                                 [ 'user_password = ' . $dbw->buildConcat( [ $dbw->addQuotes( ':null:' ),
 126                                                 'user_password' ] ) ],
 127                                 [
 128                                         'NOT (user_password ' . $dbw->buildLike( ':null:', $dbw->anyString() ) . ')',
 129                                         "user_password != " . $dbw->addQuotes( PasswordFactory::newInvalidPassword()->toString() ),
 130                                         'user_password IS NOT NULL',
 131                                         'user_name' => $userBatch,
 132                                 ],
 133                                 __METHOD__
 134                         );
 135                 } elseif ( $this->getOption( 'unprefix' ) ) {
 136                         $dbw->update( 'user',
 137                                 [ 'user_password = ' . $dbw->buildSubString( 'user_password', strlen( ':null:' ) + 1 ) ],
 138                                 [
 139                                         'user_password ' . $dbw->buildLike( ':null:', $dbw->anyString() ),
 140                                         'user_name' => $userBatch,
 141                                 ],
 142                                 __METHOD__
 143                         );
 144                 }
 145                 $this->total += $dbw->affectedRows();
 146         }
 147
 148         /**
 149          * This method iterates through the requested users and returns their names in batches of
 150          * self::$mBatchSize.
 151          *
 152          * Subclasses should reimplement this and locate users who use the specific authentication
 153          * method. The default implementation just iterates through all users. Extensions that work
 154          * with wikifarm should also update self::getUserDB() as necessary.
 155          * @return Generator
 156          */
 157         protected function getUserBatches() {
 158                 if ( !is_null( $this->user ) ) {
 159                         $this->output( "\t ... querying '$this->user'\n" );
 160                         yield [ [ $this->user ] ];
 161                         return;
 162                 }
 163
 164                 $lastUsername = '';
 165                 $dbw = $this->getDB( DB_MASTER );
 166                 do {
 167                         $this->output( "\t ... querying from '$lastUsername'\n" );
 168                         $users = $dbw->selectFieldValues(
 169                                 'user',
 170                                 'user_name',
 171                                 [
 172                                         'user_name > ' . $dbw->addQuotes( $lastUsername ),
 173                                 ],
 174                                 __METHOD__,
 175                                 [
 176                                         'LIMIT' => $this->getBatchSize(),
 177                                         'ORDER BY' => 'user_name ASC',
 178                                 ]
 179                         );
 180                         if ( $users ) {
 181                                 yield $users;
 182                                 $lastUsername = end( $users );
 183                         }
 184                 } while ( count( $users ) === $this->getBatchSize() );
 185         }
 186 }