MediaWiki master
AbstractPasswordPrimaryAuthenticationProvider.php
Go to the documentation of this file.
1<?php
22namespace MediaWiki\Auth;
23
28use Password;
30use Wikimedia\Assert\Assert;
31
41{
43 protected $authoritative;
44
45 private $passwordFactory = null;
46
53 public function __construct( array $params = [] ) {
54 $this->authoritative = !isset( $params['authoritative'] ) || (bool)$params['authoritative'];
55 }
56
60 protected function getPasswordFactory() {
61 if ( $this->passwordFactory === null ) {
62 $this->passwordFactory = new PasswordFactory(
63 $this->config->get( MainConfigNames::PasswordConfig ),
64 $this->config->get( MainConfigNames::PasswordDefault )
65 );
66 }
67 return $this->passwordFactory;
68 }
69
75 protected function getPassword( $hash ) {
76 $passwordFactory = $this->getPasswordFactory();
77 try {
78 return $passwordFactory->newFromCiphertext( $hash );
79 } catch ( \PasswordError $e ) {
80 $class = static::class;
81 $this->logger->debug( "Invalid password hash in {$class}::getPassword()" );
82 return $passwordFactory->newFromCiphertext( null );
83 }
84 }
85
91 protected function failResponse( PasswordAuthenticationRequest $req ) {
92 if ( $this->authoritative ) {
94 wfMessage( $req->password === '' ? 'wrongpasswordempty' : 'wrongpassword' )
95 );
96 } else {
98 }
99 }
100
111 protected function checkPasswordValidity( $username, $password ) {
112 return User::newFromName( $username )->checkPasswordValidity( $password );
113 }
114
124 string $username,
125 Status $status
127 Assert::precondition( !$status->isOK(), __METHOD__ . ' expects a fatal Status' );
128 $resetLinkUrl = SpecialPage::getTitleFor( 'PasswordReset' )
129 ->getFullURL( [ 'wpUsername' => $username ] );
130 return AuthenticationResponse::newFail( wfMessage( 'fatalpassworderror',
131 $status->getMessage(), $resetLinkUrl ) );
132 }
133
145 protected function setPasswordResetFlag( $username, Status $status, $data = null ) {
146 $reset = $this->getPasswordResetData( $username, $data );
147
148 if ( !$reset && $this->config->get( MainConfigNames::InvalidPasswordReset ) &&
149 !$status->isGood() ) {
150 $hard = $status->getValue()['forceChange'] ?? false;
151
152 if ( $hard || !empty( $status->getValue()['suggestChangeOnLogin'] ) ) {
153 $reset = (object)[
154 'msg' => $status->getMessage( $hard ? 'resetpass-validity' : 'resetpass-validity-soft' ),
155 'hard' => $hard,
156 ];
157 }
158 }
159
160 if ( $reset ) {
161 $this->manager->setAuthenticationSessionData( 'reset-pass', $reset );
162 }
163 }
164
173 protected function getPasswordResetData( $username, $data ) {
174 return null;
175 }
176
184 protected function getNewPasswordExpiry( $username ) {
185 $days = $this->config->get( MainConfigNames::PasswordExpirationDays );
186 $expires = $days ? wfTimestamp( TS_MW, time() + $days * 86400 ) : null;
187
188 // Give extensions a chance to force an expiration
189 $this->getHookRunner()->onResetPasswordExpiration(
190 User::newFromName( $username ), $expires );
191
192 return $expires;
193 }
194
202 public function getAuthenticationRequests( $action, array $options ) {
203 switch ( $action ) {
208 return [ new PasswordAuthenticationRequest() ];
209 default:
210 return [];
211 }
212 }
213}
wfTimestamp( $outputtype=TS_UNIX, $ts=0)
Get a timestamp string in one of various formats.
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
array $params
The job parameters.
Basic framework for a primary authentication provider that uses passwords.
failResponse(PasswordAuthenticationRequest $req)
Return the appropriate response for failure.
setPasswordResetFlag( $username, Status $status, $data=null)
Check if the password should be reset.
bool $authoritative
Whether this provider should ABSTAIN (false) or FAIL (true) on password failure.
getNewPasswordExpiry( $username)
Get expiration date for a new password, if any.
getFatalPasswordErrorResponse(string $username, Status $status)
Adds user-friendly description to a fatal password validity check error.
A base class that implements some of the boilerplate for a PrimaryAuthenticationProvider.
const ACTION_CHANGE
Change a user's credentials.
const ACTION_REMOVE
Remove a user's credentials.
const ACTION_LOGIN
Log in with an existing (not necessarily local) user.
const ACTION_CREATE
Create a new user.
This is a value object to hold authentication response data.
static newFail(Message $msg, array $failReasons=[])
This is a value object for authentication requests with a username and password.
A class containing constants representing the names of configuration variables.
const PasswordExpirationDays
Name constant for the PasswordExpirationDays setting, for use with Config::get()
const PasswordDefault
Name constant for the PasswordDefault setting, for use with Config::get()
const PasswordConfig
Name constant for the PasswordConfig setting, for use with Config::get()
const InvalidPasswordReset
Name constant for the InvalidPasswordReset setting, for use with Config::get()
Parent class for all special pages.
static getTitleFor( $name, $subpage=false, $fragment='')
Get a localised Title object for a specified special page name If you don't need a full Title object,...
Generic operation result class Has warning/error list, boolean status and arbitrary value.
Definition Status.php:54
getMessage( $shortContext=false, $longContext=false, $lang=null)
Get a bullet list of the errors as a Message object.
Definition Status.php:242
internal since 1.36
Definition User.php:93
Show an error when any operation involving passwords fails to run.
Factory class for creating and checking Password objects.
Represents a password hash for use in authentication.
Definition Password.php:61
isGood()
Returns whether the operation completed and didn't have any error or warnings.