MediaWiki  master
AbstractPasswordPrimaryAuthenticationProvider.php
Go to the documentation of this file.
1 <?php
22 namespace MediaWiki\Auth;
23 
24 use Password;
25 use PasswordFactory;
26 use Status;
27 
37 {
39  protected $authoritative;
40 
41  private $passwordFactory = null;
42 
49  public function __construct( array $params = [] ) {
50  $this->authoritative = !isset( $params['authoritative'] ) || (bool)$params['authoritative'];
51  }
52 
57  protected function getPasswordFactory() {
58  if ( $this->passwordFactory === null ) {
59  $this->passwordFactory = new PasswordFactory(
60  $this->config->get( 'PasswordConfig' ),
61  $this->config->get( 'PasswordDefault' )
62  );
63  }
65  }
66 
72  protected function getPassword( $hash ) {
74  try {
75  return $passwordFactory->newFromCiphertext( $hash );
76  } catch ( \PasswordError $e ) {
77  $class = static::class;
78  $this->logger->debug( "Invalid password hash in {$class}::getPassword()" );
79  return $passwordFactory->newFromCiphertext( null );
80  }
81  }
82 
88  protected function failResponse( PasswordAuthenticationRequest $req ) {
89  if ( $this->authoritative ) {
91  wfMessage( $req->password === '' ? 'wrongpasswordempty' : 'wrongpassword' )
92  );
93  } else {
95  }
96  }
97 
108  protected function checkPasswordValidity( $username, $password ) {
109  return \User::newFromName( $username )->checkPasswordValidity( $password );
110  }
111 
123  protected function setPasswordResetFlag( $username, Status $status, $data = null ) {
124  $reset = $this->getPasswordResetData( $username, $data );
125 
126  if ( !$reset && $this->config->get( 'InvalidPasswordReset' ) && !$status->isGood() ) {
127  $hard = $status->getValue()['forceChange'] ?? false;
128 
129  if ( $hard || !empty( $status->getValue()['suggestChangeOnLogin'] ) ) {
130  $reset = (object)[
131  'msg' => $status->getMessage( $hard ? 'resetpass-validity' : 'resetpass-validity-soft' ),
132  'hard' => $hard,
133  ];
134  }
135  }
136 
137  if ( $reset ) {
138  $this->manager->setAuthenticationSessionData( 'reset-pass', $reset );
139  }
140  }
141 
150  protected function getPasswordResetData( $username, $data ) {
151  return null;
152  }
153 
161  protected function getNewPasswordExpiry( $username ) {
162  $days = $this->config->get( 'PasswordExpirationDays' );
163  $expires = $days ? wfTimestamp( TS_MW, time() + $days * 86400 ) : null;
164 
165  // Give extensions a chance to force an expiration
166  $this->getHookRunner()->onResetPasswordExpiration(
167  \User::newFromName( $username ), $expires );
168 
169  return $expires;
170  }
171 
179  public function getAuthenticationRequests( $action, array $options ) {
180  switch ( $action ) {
185  return [ new PasswordAuthenticationRequest() ];
186  default:
187  return [];
188  }
189  }
190 }
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\__construct
__construct(array $params=[])
Stable to call.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:49
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\$authoritative
bool $authoritative
Whether this provider should ABSTAIN (false) or FAIL (true) on password failure.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:39
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword
getPassword( $hash)
Get a Password object from the hash.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:72
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\failResponse
failResponse(PasswordAuthenticationRequest $req)
Return the appropriate response for failure.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:88
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
Basic framework for a primary authentication provider that uses passwords.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:37
wfTimestamp
wfTimestamp( $outputtype=TS_UNIX, $ts=0)
Get a timestamp string in one of various formats.
Definition: GlobalFunctions.php:1808
Status\getMessage
getMessage( $shortContext=false, $longContext=false, $lang=null)
Get a bullet list of the errors as a Message object.
Definition: Status.php:243
PasswordError
Show an error when any operation involving passwords fails to run.
Definition: PasswordError.php:29
User\newFromName
static newFromName( $name, $validate='valid')
Static factory method for creation from username.
Definition: User.php:539
wfMessage
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
Definition: GlobalFunctions.php:1219
Status
Generic operation result class Has warning/error list, boolean status and arbitrary value.
Definition: Status.php:44
StatusValue\getValue
getValue()
Definition: StatusValue.php:138
MediaWiki\Auth\AuthenticationResponse\newAbstain
static newAbstain()
Definition: AuthenticationResponse.php:170
MediaWiki\Auth\PasswordAuthenticationRequest
This is a value object for authentication requests with a username and password Stable to extend.
Definition: PasswordAuthenticationRequest.php:30
StatusValue\isGood
isGood()
Returns whether the operation completed and didn't have any error or warnings.
Definition: StatusValue.php:122
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getNewPasswordExpiry
getNewPasswordExpiry( $username)
Get expiration date for a new password, if any.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:161
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\$passwordFactory
$passwordFactory
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:41
MediaWiki\Auth\AuthManager\ACTION_CREATE
const ACTION_CREATE
Create a new user.
Definition: AuthManager.php:96
MediaWiki\Auth\AuthManager\ACTION_CHANGE
const ACTION_CHANGE
Change a user's credentials.
Definition: AuthManager.php:108
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\setPasswordResetFlag
setPasswordResetFlag( $username, Status $status, $data=null)
Check if the password should be reset.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:123
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity
checkPasswordValidity( $username, $password)
Check that the password is valid.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:108
MediaWiki\Auth\AuthManager\ACTION_REMOVE
const ACTION_REMOVE
Remove a user's credentials.
Definition: AuthManager.php:110
MediaWiki\$action
string $action
Cache what action this request is.
Definition: MediaWiki.php:45
MediaWiki\Auth\AuthenticationResponse\newFail
static newFail(Message $msg)
Definition: AuthenticationResponse.php:146
MediaWiki\Auth\AuthManager\ACTION_LOGIN
const ACTION_LOGIN
Log in with an existing (not necessarily local) user.
Definition: AuthManager.php:90
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory
getPasswordFactory()
Get the PasswordFactory.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:57
MediaWiki\Auth\AbstractPrimaryAuthenticationProvider
A base class that implements some of the boilerplate for a PrimaryAuthenticationProvider.
Definition: AbstractPrimaryAuthenticationProvider.php:35
PasswordFactory
Factory class for creating and checking Password objects.
Definition: PasswordFactory.php:30
Password
Represents a password hash for use in authentication.
Definition: Password.php:61
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordResetData
getPasswordResetData( $username, $data)
Get password reset data, if any.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:150
MediaWiki\Auth
Definition: AbstractAuthenticationProvider.php:22
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests
getAuthenticationRequests( $action, array $options)
Stable to override.
Definition: AbstractPasswordPrimaryAuthenticationProvider.php:179
MediaWiki\Auth\AbstractAuthenticationProvider\getHookRunner
getHookRunner()
Definition: AbstractAuthenticationProvider.php:90