ElevatedSecurityAuthenticationRequest.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Auth;
 
use LogicException;
use MediaWiki\Session\Session;
use StatusValue;
 
class ElevatedSecurityAuthenticationRequest extends AuthenticationRequest {
 
    public const int MAX_AGE = 300;
 
    public int $userId;
 
    public string $securityLevel;
 
    private string $token;
 
    private StatusValue $validationStatus;
 
    private ?Session $session = null;
 
    private function __construct() {
    }
 
    public static function create( Session $session, $securityLevel ) {
        if ( $session->getUser()->isAnon() ) {
            throw new LogicException( 'Cannot create an ElevatedSecurityAuthenticationRequest for anon' );
        }
 
        $req = new self();
        $req->userId = $session->getUser()->getId();
        $req->securityLevel = $securityLevel;
        $req->session = $session;
        $req->validationStatus = StatusValue::newFatal( 'authmanager-elevatedsecurity-not-validated' );
 
        $token = $session->getToken( [ (string)$req->userId, $req->securityLevel ], 'reauth' );
        $session->persist(); // sanity, in case the caller somehow forgets
        $req->token = $token->toString();
 
        return $req;
    }
 
    public function __sleep() {
        // Don't try to serialize the session. Without a session validate() will fail,
        // but that's OK, this request can only come from getAuthenticationRequests() so
        // it will only be validated at the beginning of the begin/continue* methods when
        // it has not gone through session storage yet.
        return [ 'userId', 'securityLevel', 'token', 'validationStatus' ];
    }
 
    public function getFieldInfo() {
        return [
            'elevatedSecurityToken' => [
                'type' => 'hidden',
                'value' => $this->token,
                'label' => wfMessage( 'authmanager-elevatedsecurity-token-label' ),
                'help' => wfMessage( 'authmanager-elevatedsecurity-token-help' ),
                'sensitive' => true,
                'skippable' => true,
            ],
        ];
    }
 
    public function loadFromSubmission( array $data ) {
        $this->validationStatus = StatusValue::newGood();
 
        $dataToken = $data['elevatedSecurityToken'] ?? null;
        if ( !$this->session ) {
            // loadFromSubmission() was called after serialize+unserialize. This should not happen.
            throw new LogicException( __METHOD__ . ' called on incomplete object' );
        }
        $sessionToken = $this->session->getToken( [ (string)$this->userId, $this->securityLevel ], 'reauth' );
        if ( !$dataToken ) {
            // Normally we handle missing fields by returning false but ElevatedSecurityAuthRequest
            // has a special meaning; if it was present in the initial set of requests, it should not
            // disappear during loading the data. So here we just record what's present, and will
            // deal with errors in validate().
            $this->validationStatus->fatal( 'authmanager-elevatedsecurity-missing-token' );
        } elseif ( !$sessionToken->match( $dataToken, self::MAX_AGE ) ) {
            $this->validationStatus->fatal( 'authmanager-elevatedsecurity-invalid-token' );
        }
 
        return true;
    }
 
    public function validate() {
        return $this->validationStatus;
    }
 
    public static function __set_state( $data ) {
        $ret = new static();
        foreach ( $data as $k => $v ) {
            $ret->$k = $v;
        }
        return $ret;
    }
 
}