MediaWiki  master
TemporaryPasswordPrimaryAuthenticationProvider.php
Go to the documentation of this file.
1 <?php
22 namespace MediaWiki\Auth;
23 
24 use User;
25 
39 {
41  protected $emailEnabled = null;
42 
44  protected $newPasswordExpiry = null;
45 
47  protected $passwordReminderResendTime = null;
48 
56  public function __construct( $params = [] ) {
57  parent::__construct( $params );
58 
59  if ( isset( $params['emailEnabled'] ) ) {
60  $this->emailEnabled = (bool)$params['emailEnabled'];
61  }
62  if ( isset( $params['newPasswordExpiry'] ) ) {
63  $this->newPasswordExpiry = (int)$params['newPasswordExpiry'];
64  }
65  if ( isset( $params['passwordReminderResendTime'] ) ) {
66  $this->passwordReminderResendTime = $params['passwordReminderResendTime'];
67  }
68  }
69 
70  public function setConfig( \Config $config ) {
71  parent::setConfig( $config );
72 
73  if ( $this->emailEnabled === null ) {
74  $this->emailEnabled = $this->config->get( 'EnableEmail' );
75  }
76  if ( $this->newPasswordExpiry === null ) {
77  $this->newPasswordExpiry = $this->config->get( 'NewPasswordExpiry' );
78  }
79  if ( $this->passwordReminderResendTime === null ) {
80  $this->passwordReminderResendTime = $this->config->get( 'PasswordReminderResendTime' );
81  }
82  }
83 
84  protected function getPasswordResetData( $username, $data ) {
85  // Always reset
86  return (object)[
87  'msg' => wfMessage( 'resetpass-temp-emailed' ),
88  'hard' => true,
89  ];
90  }
91 
92  public function getAuthenticationRequests( $action, array $options ) {
93  switch ( $action ) {
95  return [ new PasswordAuthenticationRequest() ];
96 
99 
101  if ( isset( $options['username'] ) && $this->emailEnabled ) {
102  // Creating an account for someone else
104  } else {
105  // It's not terribly likely that an anonymous user will
106  // be creating an account for someone else.
107  return [];
108  }
109 
112 
113  default:
114  return [];
115  }
116  }
117 
118  public function beginPrimaryAuthentication( array $reqs ) {
119  $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
120  if ( !$req || $req->username === null || $req->password === null ) {
122  }
123 
124  $username = User::getCanonicalName( $req->username, 'usable' );
125  if ( $username === false ) {
127  }
128 
129  $dbr = wfGetDB( DB_REPLICA );
130  $row = $dbr->selectRow(
131  'user',
132  [
133  'user_id', 'user_newpassword', 'user_newpass_time',
134  ],
135  [ 'user_name' => $username ],
136  __METHOD__
137  );
138  if ( !$row ) {
140  }
141 
142  $status = $this->checkPasswordValidity( $username, $req->password );
143  if ( !$status->isOK() ) {
144  // Fatal, can't log in
145  return AuthenticationResponse::newFail( $status->getMessage() );
146  }
147 
148  $pwhash = $this->getPassword( $row->user_newpassword );
149  if ( !$pwhash->verify( $req->password ) ) {
150  return $this->failResponse( $req );
151  }
152 
153  if ( !$this->isTimestampValid( $row->user_newpass_time ) ) {
154  return $this->failResponse( $req );
155  }
156 
157  // Add an extra log entry since a temporary password is
158  // an unusual way to log in, so its important to keep track
159  // of in case of abuse.
160  $this->logger->info( "{user} successfully logged in using temp password",
161  [
162  'user' => $username,
163  'requestIP' => $this->manager->getRequest()->getIP()
164  ]
165  );
166 
167  $this->setPasswordResetFlag( $username, $status );
168 
169  return AuthenticationResponse::newPass( $username );
170  }
171 
172  public function testUserCanAuthenticate( $username ) {
173  $username = User::getCanonicalName( $username, 'usable' );
174  if ( $username === false ) {
175  return false;
176  }
177 
178  $dbr = wfGetDB( DB_REPLICA );
179  $row = $dbr->selectRow(
180  'user',
181  [ 'user_newpassword', 'user_newpass_time' ],
182  [ 'user_name' => $username ],
183  __METHOD__
184  );
185  if ( !$row ) {
186  return false;
187  }
188 
189  if ( $this->getPassword( $row->user_newpassword ) instanceof \InvalidPassword ) {
190  return false;
191  }
192 
193  if ( !$this->isTimestampValid( $row->user_newpass_time ) ) {
194  return false;
195  }
196 
197  return true;
198  }
199 
200  public function testUserExists( $username, $flags = User::READ_NORMAL ) {
201  $username = User::getCanonicalName( $username, 'usable' );
202  if ( $username === false ) {
203  return false;
204  }
205 
206  list( $db, $options ) = \DBAccessObjectUtils::getDBOptions( $flags );
207  return (bool)wfGetDB( $db )->selectField(
208  [ 'user' ],
209  'user_id',
210  [ 'user_name' => $username ],
211  __METHOD__,
212  $options
213  );
214  }
215 
217  AuthenticationRequest $req, $checkData = true
218  ) {
219  if ( get_class( $req ) !== TemporaryPasswordAuthenticationRequest::class ) {
220  // We don't really ignore it, but this is what the caller expects.
221  return \StatusValue::newGood( 'ignored' );
222  }
223 
224  if ( !$checkData ) {
225  return \StatusValue::newGood();
226  }
227 
228  $username = User::getCanonicalName( $req->username, 'usable' );
229  if ( $username === false ) {
230  return \StatusValue::newGood( 'ignored' );
231  }
232 
233  $row = wfGetDB( DB_MASTER )->selectRow(
234  'user',
235  [ 'user_id', 'user_newpass_time' ],
236  [ 'user_name' => $username ],
237  __METHOD__
238  );
239 
240  if ( !$row ) {
241  return \StatusValue::newGood( 'ignored' );
242  }
243 
244  $sv = \StatusValue::newGood();
245  if ( $req->password !== null ) {
246  $sv->merge( $this->checkPasswordValidity( $username, $req->password ) );
247 
248  if ( $req->mailpassword ) {
249  if ( !$this->emailEnabled ) {
250  return \StatusValue::newFatal( 'passwordreset-emaildisabled' );
251  }
252 
253  // We don't check whether the user has an email address;
254  // that information should not be exposed to the caller.
255 
256  // do not allow temporary password creation within
257  // $wgPasswordReminderResendTime from the last attempt
258  if (
259  $this->passwordReminderResendTime
260  && $row->user_newpass_time
261  && time() < wfTimestamp( TS_UNIX, $row->user_newpass_time )
262  + $this->passwordReminderResendTime * 3600
263  ) {
264  // Round the time in hours to 3 d.p., in case someone is specifying
265  // minutes or seconds.
266  return \StatusValue::newFatal( 'throttled-mailpassword',
267  round( $this->passwordReminderResendTime, 3 ) );
268  }
269 
270  if ( !$req->caller ) {
271  return \StatusValue::newFatal( 'passwordreset-nocaller' );
272  }
273  if ( !\IP::isValid( $req->caller ) ) {
274  $caller = User::newFromName( $req->caller );
275  if ( !$caller ) {
276  return \StatusValue::newFatal( 'passwordreset-nosuchcaller', $req->caller );
277  }
278  }
279  }
280  }
281  return $sv;
282  }
283 
285  $username = $req->username !== null ? User::getCanonicalName( $req->username, 'usable' ) : false;
286  if ( $username === false ) {
287  return;
288  }
289 
290  $dbw = wfGetDB( DB_MASTER );
291 
292  $sendMail = false;
293  if ( $req->action !== AuthManager::ACTION_REMOVE &&
294  get_class( $req ) === TemporaryPasswordAuthenticationRequest::class
295  ) {
296  $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
297  $newpassTime = $dbw->timestamp();
298  $sendMail = $req->mailpassword;
299  } else {
300  // Invalidate the temporary password when any other auth is reset, or when removing
301  $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
302  $newpassTime = null;
303  }
304 
305  $dbw->update(
306  'user',
307  [
308  'user_newpassword' => $pwhash->toString(),
309  'user_newpass_time' => $newpassTime,
310  ],
311  [ 'user_name' => $username ],
312  __METHOD__
313  );
314 
315  if ( $sendMail ) {
316  // Send email after DB commit
317  $dbw->onTransactionCommitOrIdle(
318  function () use ( $req ) {
320  $this->sendPasswordResetEmail( $req );
321  },
322  __METHOD__
323  );
324  }
325  }
326 
327  public function accountCreationType() {
328  return self::TYPE_CREATE;
329  }
330 
331  public function testForAccountCreation( $user, $creator, array $reqs ) {
334  $reqs, TemporaryPasswordAuthenticationRequest::class
335  );
336 
337  $ret = \StatusValue::newGood();
338  if ( $req ) {
339  if ( $req->mailpassword ) {
340  if ( !$this->emailEnabled ) {
341  $ret->merge( \StatusValue::newFatal( 'emaildisabled' ) );
342  } elseif ( !$user->getEmail() ) {
343  $ret->merge( \StatusValue::newFatal( 'noemailcreate' ) );
344  }
345  }
346 
347  $ret->merge(
348  $this->checkPasswordValidity( $user->getName(), $req->password )
349  );
350  }
351  return $ret;
352  }
353 
354  public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
357  $reqs, TemporaryPasswordAuthenticationRequest::class
358  );
359  if ( $req && $req->username !== null && $req->password !== null ) {
360  // Nothing we can do yet, because the user isn't in the DB yet
361  if ( $req->username !== $user->getName() ) {
362  $req = clone $req;
363  $req->username = $user->getName();
364  }
365 
366  if ( $req->mailpassword ) {
367  // prevent EmailNotificationSecondaryAuthenticationProvider from sending another mail
368  $this->manager->setAuthenticationSessionData( 'no-email', true );
369  }
370 
371  $ret = AuthenticationResponse::newPass( $req->username );
372  $ret->createRequest = $req;
373  return $ret;
374  }
376  }
377 
378  public function finishAccountCreation( $user, $creator, AuthenticationResponse $res ) {
380  $req = $res->createRequest;
381  $mailpassword = $req->mailpassword;
382  $req->mailpassword = false; // providerChangeAuthenticationData would send the wrong email
383 
384  // Now that the user is in the DB, set the password on it.
385  $this->providerChangeAuthenticationData( $req );
386 
387  if ( $mailpassword ) {
388  // Send email after DB commit
389  wfGetDB( DB_MASTER )->onTransactionCommitOrIdle(
390  function () use ( $user, $creator, $req ) {
391  $this->sendNewAccountEmail( $user, $creator, $req->password );
392  },
393  __METHOD__
394  );
395  }
396 
397  return $mailpassword ? 'byemail' : null;
398  }
399 
405  protected function isTimestampValid( $timestamp ) {
406  $time = wfTimestampOrNull( TS_MW, $timestamp );
407  if ( $time !== null ) {
408  $expiry = wfTimestamp( TS_UNIX, $time ) + $this->newPasswordExpiry;
409  if ( time() >= $expiry ) {
410  return false;
411  }
412  }
413  return true;
414  }
415 
423  protected function sendNewAccountEmail( User $user, User $creatingUser, $password ) {
424  $ip = $creatingUser->getRequest()->getIP();
425  // @codeCoverageIgnoreStart
426  if ( !$ip ) {
427  return \Status::newFatal( 'badipaddress' );
428  }
429  // @codeCoverageIgnoreEnd
430 
431  \Hooks::run( 'User::mailPasswordInternal', [ &$creatingUser, &$ip, &$user ] );
432 
433  $mainPageUrl = \Title::newMainPage()->getCanonicalURL();
434  $userLanguage = $user->getOption( 'language' );
435  $subjectMessage = wfMessage( 'createaccount-title' )->inLanguage( $userLanguage );
436  $bodyMessage = wfMessage( 'createaccount-text', $ip, $user->getName(), $password,
437  '<' . $mainPageUrl . '>', round( $this->newPasswordExpiry / 86400 ) )
438  ->inLanguage( $userLanguage );
439 
440  $status = $user->sendMail( $subjectMessage->text(), $bodyMessage->text() );
441 
442  // TODO show 'mailerror' message on error, 'accmailtext' success message otherwise?
443  // @codeCoverageIgnoreStart
444  if ( !$status->isGood() ) {
445  $this->logger->warning( 'Could not send account creation email: ' .
446  $status->getWikiText( false, false, 'en' ) );
447  }
448  // @codeCoverageIgnoreEnd
449 
450  return $status;
451  }
452 
458  $user = User::newFromName( $req->username );
459  if ( !$user ) {
460  return \Status::newFatal( 'noname' );
461  }
462  $userLanguage = $user->getOption( 'language' );
463  $callerIsAnon = \IP::isValid( $req->caller );
464  $callerName = $callerIsAnon ? $req->caller : User::newFromName( $req->caller )->getName();
465  $passwordMessage = wfMessage( 'passwordreset-emailelement', $user->getName(),
466  $req->password )->inLanguage( $userLanguage );
467  $emailMessage = wfMessage( $callerIsAnon ? 'passwordreset-emailtext-ip'
468  : 'passwordreset-emailtext-user' )->inLanguage( $userLanguage );
469  $emailMessage->params( $callerName, $passwordMessage->text(), 1,
470  '<' . \Title::newMainPage()->getCanonicalURL() . '>',
471  round( $this->newPasswordExpiry / 86400 ) );
472  $emailTitle = wfMessage( 'passwordreset-emailtitle' )->inLanguage( $userLanguage );
473  return $user->sendMail( $emailTitle->text(), $emailMessage->text() );
474  }
475 }
static newFatal( $message,... $parameters)
Factory function for fatal errors.
Definition: StatusValue.php:69
checkPasswordValidity( $username, $password)
Check that the password is valid.
static newMainPage(MessageLocalizer $localizer=null)
Create a new Title for the Main Page.
Definition: Title.php:648
providerChangeAuthenticationData(AuthenticationRequest $req)
Change or remove authentication data (e.g.
getOption( $oname, $defaultOverride=null, $ignoreHidden=false)
Get the user&#39;s current setting for a given option.
Definition: User.php:2915
wfGetDB( $db, $groups=[], $wiki=false)
Get a Database object.
sendMail( $subject, $body, $from=null, $replyto=null)
Send an e-mail to this user&#39;s account.
Definition: User.php:4474
Represents an invalid password hash.
string $action
Cache what action this request is.
Definition: MediaWiki.php:42
This is a value object to hold authentication response data.
sendNewAccountEmail(User $user, User $creatingUser, $password)
Send an email about the new account creation and the temporary password.
testForAccountCreation( $user, $creator, array $reqs)
Determine whether an account creation may begin.
wfTimestampOrNull( $outputtype=TS_UNIX, $ts=null)
Return a formatted timestamp, or null if input is null.
finishAccountCreation( $user, $creator, AuthenticationResponse $res)
Post-creation callback.
const DB_MASTER
Definition: defines.php:26
static getDBOptions( $bitfield)
Get an appropriate DB index, options, and fallback DB index for a query.
getName()
Get the user name, or the IP of an anonymous user.
Definition: User.php:2229
setPasswordResetFlag( $username, Status $status, $data=null)
Check if the password should be reset.
The User object encapsulates all of the user-specific settings (user_id, name, rights, email address, options, last login time).
Definition: User.php:51
static getCanonicalName( $name, $validate='valid')
Given unvalidated user input, return a canonical username, or false if the username is invalid...
Definition: User.php:1139
wfTimestamp( $outputtype=TS_UNIX, $ts=0)
Get a timestamp string in one of various formats.
testUserExists( $username, $flags=User::READ_NORMAL)
Test whether the named user exists.
Interface for configuration instances.
Definition: Config.php:28
static newGood( $value=null)
Factory function for good results.
Definition: StatusValue.php:81
static isValid( $ip)
Validate an IP address.
Definition: IP.php:111
const ACTION_CHANGE
Change a user&#39;s credentials.
A primary authentication provider that uses the temporary password field in the &#39;user&#39; table...
Basic framework for a primary authentication provider that uses passwords.
This represents the intention to set a temporary password for the user.
This is a value object for authentication requests with a username and password.
providerAllowsAuthenticationDataChange(AuthenticationRequest $req, $checkData=true)
Validate a change of authentication data (e.g.
getRequest()
Get the WebRequest object to use with this object.
Definition: User.php:3628
getAuthenticationRequests( $action, array $options)
Return the applicable list of AuthenticationRequests.Possible values for $action depend on whether th...
static newRandom()
Return an instance with a new, random password.
const ACTION_REMOVE
Remove a user&#39;s credentials.
beginPrimaryAccountCreation( $user, $creator, array $reqs)
Start an account creation flow.
testUserCanAuthenticate( $username)
Test whether the named user can authenticate with this provider.
static getRequestByClass(array $reqs, $class, $allowSubclasses=false)
Select a request by class name.
const ACTION_CREATE
Create a new user.
Definition: AuthManager.php:93
const DB_REPLICA
Definition: defines.php:25
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
failResponse(PasswordAuthenticationRequest $req)
Return the appropriate response for failure.
static newFromName( $name, $validate='valid')
Static factory method for creation from username.
Definition: User.php:515
const ACTION_LOGIN
Log in with an existing (not necessarily local) user.
Definition: AuthManager.php:87
isTimestampValid( $timestamp)
Check that a temporary password is still valid (hasn&#39;t expired).
This is a value object for authentication requests.
static run( $event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:200