MediaWiki  1.29.1
Throttler.php
Go to the documentation of this file.
1 <?php
22 namespace MediaWiki\Auth;
23 
27 use Psr\Log\LoggerAwareInterface;
28 use Psr\Log\LoggerInterface;
29 use Psr\Log\LogLevel;
30 
37 class Throttler implements LoggerAwareInterface {
39  protected $type;
46  protected $conditions;
48  protected $cache;
50  protected $logger;
52  protected $warningLimit;
53 
63  public function __construct( array $conditions = null, array $params = [] ) {
64  $invalidParams = array_diff_key( $params,
65  array_fill_keys( [ 'type', 'cache', 'warningLimit' ], true ) );
66  if ( $invalidParams ) {
67  throw new \InvalidArgumentException( 'unrecognized parameters: '
68  . implode( ', ', array_keys( $invalidParams ) ) );
69  }
70 
71  if ( $conditions === null ) {
72  $config = MediaWikiServices::getInstance()->getMainConfig();
73  $conditions = $config->get( 'PasswordAttemptThrottle' );
74  $params += [
75  'type' => 'password',
77  'warningLimit' => 50,
78  ];
79  } else {
80  $params += [
81  'type' => 'custom',
83  'warningLimit' => INF,
84  ];
85  }
86 
87  $this->type = $params['type'];
88  $this->conditions = static::normalizeThrottleConditions( $conditions );
89  $this->cache = $params['cache'];
90  $this->warningLimit = $params['warningLimit'];
91 
92  $this->setLogger( LoggerFactory::getInstance( 'throttler' ) );
93  }
94 
95  public function setLogger( LoggerInterface $logger ) {
96  $this->logger = $logger;
97  }
98 
113  public function increase( $username = null, $ip = null, $caller = null ) {
114  if ( $username === null && $ip === null ) {
115  throw new \InvalidArgumentException( 'Either username or IP must be set for throttling' );
116  }
117 
118  $userKey = $username ? md5( $username ) : null;
119  foreach ( $this->conditions as $index => $throttleCondition ) {
120  $ipKey = isset( $throttleCondition['allIPs'] ) ? null : $ip;
121  $count = $throttleCondition['count'];
122  $expiry = $throttleCondition['seconds'];
123 
124  // a limit of 0 is used as a disable flag in some throttling configuration settings
125  // throttling the whole world is probably a bad idea
126  if ( !$count || $userKey === null && $ipKey === null ) {
127  continue;
128  }
129 
130  $throttleKey = wfGlobalCacheKey( 'throttler', $this->type, $index, $ipKey, $userKey );
131  $throttleCount = $this->cache->get( $throttleKey );
132 
133  if ( !$throttleCount ) { // counter not started yet
134  $this->cache->add( $throttleKey, 1, $expiry );
135  } elseif ( $throttleCount < $count ) { // throttle limited not yet reached
136  $this->cache->incr( $throttleKey );
137  } else { // throttled
138  $this->logRejection( [
139  'throttle' => $this->type,
140  'index' => $index,
141  'ip' => $ipKey,
142  'username' => $username,
143  'count' => $count,
144  'expiry' => $expiry,
145  // @codeCoverageIgnoreStart
146  'method' => $caller ?: __METHOD__,
147  // @codeCoverageIgnoreEnd
148  ] );
149 
150  return [
151  'throttleIndex' => $index,
152  'count' => $count,
153  'wait' => $expiry,
154  ];
155  }
156  }
157  return false;
158  }
159 
169  public function clear( $username = null, $ip = null ) {
170  $userKey = $username ? md5( $username ) : null;
171  foreach ( $this->conditions as $index => $specificThrottle ) {
172  $ipKey = isset( $specificThrottle['allIPs'] ) ? null : $ip;
173  $throttleKey = wfGlobalCacheKey( 'throttler', $this->type, $index, $ipKey, $userKey );
174  $this->cache->delete( $throttleKey );
175  }
176  }
177 
184  protected static function normalizeThrottleConditions( $throttleConditions ) {
185  if ( !is_array( $throttleConditions ) ) {
186  return [];
187  }
188  if ( isset( $throttleConditions['count'] ) ) { // old style
189  $throttleConditions = [ $throttleConditions ];
190  }
191  return $throttleConditions;
192  }
193 
194  protected function logRejection( array $context ) {
195  $logMsg = 'Throttle {throttle} hit, throttled for {expiry} seconds due to {count} attempts '
196  . 'from username {username} and IP {ip}';
197 
198  // If we are hitting a throttle for >= warningLimit attempts, it is much more likely to be
199  // an attack than someone simply forgetting their password, so log it at a higher level.
200  $level = $context['count'] >= $this->warningLimit ? LogLevel::WARNING : LogLevel::INFO;
201 
202  // It should be noted that once the throttle is hit, every attempt to login will
203  // generate the log message until the throttle expires, not just the attempt that
204  // puts the throttle over the top.
205  $this->logger->log( $level, $logMsg, $context );
206  }
207 
208 }
ObjectCache\getLocalClusterInstance
static getLocalClusterInstance()
Get the main cluster-local cache object.
Definition: ObjectCache.php:357
MediaWiki\Auth\Throttler\logRejection
logRejection(array $context)
Definition: Throttler.php:194
conditions
and give any other recipients of the Program a copy of this License along with the Program You may charge a fee for the physical act of transferring a and you may at your option offer warranty protection in exchange for a fee You may modify your copy or copies of the Program or any portion of thus forming a work based on the and copy and distribute such modifications or work under the terms of Section provided that you also meet all of these conditions
Definition: COPYING.txt:87
MediaWiki\Logger\LoggerFactory\getInstance
static getInstance( $channel)
Get a named logger instance from the currently configured logger factory.
Definition: LoggerFactory.php:93
MediaWiki\Auth\Throttler\clear
clear( $username=null, $ip=null)
Clear the throttle counter.
Definition: Throttler.php:169
use
as see the revision history and available at free of to any person obtaining a copy of this software and associated documentation to deal in the Software without including without limitation the rights to use
Definition: MIT-LICENSE.txt:10
$params
$params
Definition: styleTest.css.php:40
MediaWiki\Auth\Throttler\__construct
__construct(array $conditions=null, array $params=[])
Definition: Throttler.php:63
BagOStuff
interface is intended to be more or less compatible with the PHP memcached client.
Definition: BagOStuff.php:47
MediaWiki\Auth\Throttler
Definition: Throttler.php:37
cache
you have access to all of the normal MediaWiki so you can get a DB use the cache
Definition: maintenance.txt:52
php
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
MediaWiki\Auth\Throttler\increase
increase( $username=null, $ip=null, $caller=null)
Increase the throttle counter and return whether the attempt should be throttled.
Definition: Throttler.php:113
wfGlobalCacheKey
wfGlobalCacheKey()
Make a cache key with database-agnostic prefix.
Definition: GlobalFunctions.php:2998
MediaWiki\Auth\Throttler\$warningLimit
int float $warningLimit
Definition: Throttler.php:52
MediaWiki\Auth\Throttler\normalizeThrottleConditions
static normalizeThrottleConditions( $throttleConditions)
Handles B/C for $wgPasswordAttemptThrottle.
Definition: Throttler.php:184
MediaWiki\Auth\Throttler\$logger
LoggerInterface $logger
Definition: Throttler.php:50
MediaWiki\MediaWikiServices\getInstance
static getInstance()
Returns the global default instance of the top level service locator.
Definition: MediaWikiServices.php:97
type
This document describes the state of Postgres support in and is fairly well maintained The main code is very well while extensions are very hit and miss it is probably the most supported database after MySQL Much of the work in making MediaWiki database agnostic came about through the work of creating Postgres as and are nearing end of but without copying over all the usage comments General notes on the but these can almost always be programmed around *Although Postgres has a true BOOLEAN type
Definition: postgres.txt:22
MediaWiki\$config
Config $config
Definition: MediaWiki.php:42
as
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
MediaWiki\Auth\Throttler\$conditions
array $conditions
See documentation of $wgPasswordAttemptThrottle for format.
Definition: Throttler.php:46
LoggerFactory
MediaWiki Logger LoggerFactory implements a PSR[0] compatible message logging system Named Psr Log LoggerInterface instances can be obtained from the MediaWiki Logger LoggerFactory::getInstance() static method. MediaWiki\Logger\LoggerFactory expects a class implementing the MediaWiki\Logger\Spi interface to act as a factory for new Psr\Log\LoggerInterface instances. The "Spi" in MediaWiki\Logger\Spi stands for "service provider interface". An SPI is an API intended to be implemented or extended by a third party. This software design pattern is intended to enable framework extension and replaceable components. It is specifically used in the MediaWiki\Logger\LoggerFactory service to allow alternate PSR-3 logging implementations to be easily integrated with MediaWiki. The service provider interface allows the backend logging library to be implemented in multiple ways. The $wgMWLoggerDefaultSpi global provides the classname of the default MediaWiki\Logger\Spi implementation to be loaded at runtime. This can either be the name of a class implementing the MediaWiki\Logger\Spi with a zero argument const ructor or a callable that will return an MediaWiki\Logger\Spi instance. Alternately the MediaWiki\Logger\LoggerFactory MediaWiki Logger LoggerFactory
Definition: logger.txt:5
MediaWiki\Auth\Throttler\$type
string $type
Definition: Throttler.php:39
MediaWikiServices
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency MediaWikiServices
Definition: injection.txt:23
MediaWiki\$context
IContextSource $context
Definition: MediaWiki.php:37
MediaWiki\Auth\Throttler\setLogger
setLogger(LoggerInterface $logger)
Definition: Throttler.php:95
$username
this hook is for auditing only or null if authentication failed before getting that far $username
Definition: hooks.txt:783
MediaWiki\Auth
Definition: AbstractAuthenticationProvider.php:22
MediaWiki\Auth\Throttler\$cache
BagOStuff $cache
Definition: Throttler.php:48
array
the array() calling protocol came about after MediaWiki 1.4rc1.