MediaWiki master
ThrottlePreAuthenticationProvider.php
Go to the documentation of this file.
1<?php
22namespace MediaWiki\Auth;
23
24use BagOStuff;
27
41
44
47
49 protected $cache;
50
59 public function __construct( $params = [] ) {
60 $this->throttleSettings = array_intersect_key( $params,
61 [ 'accountCreationThrottle' => true, 'passwordAttemptThrottle' => true ] );
62 $this->cache = $params['cache'] ?? \ObjectCache::getLocalClusterInstance();
63 }
64
65 protected function postInitSetup() {
67 // Handle old $wgAccountCreationThrottle format (number of attempts per 24 hours)
68 if ( !is_array( $accountCreationThrottle ) ) {
70 'count' => $accountCreationThrottle,
71 'seconds' => 86400,
72 ] ];
73 }
74
75 // @codeCoverageIgnoreStart
76 $this->throttleSettings += [
77 // @codeCoverageIgnoreEnd
78 'accountCreationThrottle' => $accountCreationThrottle,
79 'passwordAttemptThrottle' =>
80 $this->config->get( MainConfigNames::PasswordAttemptThrottle ),
81 ];
82
83 if ( !empty( $this->throttleSettings['accountCreationThrottle'] ) ) {
84 $this->accountCreationThrottle = new Throttler(
85 $this->throttleSettings['accountCreationThrottle'], [
86 'type' => 'acctcreate',
87 'cache' => $this->cache,
88 ]
89 );
90 }
91 if ( !empty( $this->throttleSettings['passwordAttemptThrottle'] ) ) {
92 $this->passwordAttemptThrottle = new Throttler(
93 $this->throttleSettings['passwordAttemptThrottle'], [
94 'type' => 'password',
95 'cache' => $this->cache,
96 ]
97 );
98 }
99 }
100
101 public function testForAccountCreation( $user, $creator, array $reqs ) {
102 if ( !$this->accountCreationThrottle || !$creator->isPingLimitable() ) {
103 return \StatusValue::newGood();
104 }
105
106 $ip = $this->manager->getRequest()->getIP();
107
108 if ( !$this->getHookRunner()->onExemptFromAccountCreationThrottle( $ip ) ) {
109 $this->logger->debug( __METHOD__ . ": a hook allowed account creation w/o throttle" );
110 return \StatusValue::newGood();
111 }
112
113 $result = $this->accountCreationThrottle->increase( null, $ip, __METHOD__ );
114 if ( $result ) {
115 $message = wfMessage( 'acct_creation_throttle_hit' )->params( $result['count'] )
116 ->durationParams( $result['wait'] );
117 return \StatusValue::newFatal( $message );
118 }
119
120 return \StatusValue::newGood();
121 }
122
123 public function testForAuthentication( array $reqs ) {
124 if ( !$this->passwordAttemptThrottle ) {
125 return \StatusValue::newGood();
126 }
127
128 $ip = $this->manager->getRequest()->getIP();
129 try {
131 } catch ( \UnexpectedValueException $e ) {
132 $username = null;
133 }
134
135 // Get everything this username could normalize to, and throttle each one individually.
136 // If nothing uses usernames, just throttle by IP.
137 if ( $username !== null ) {
138 $usernames = $this->manager->normalizeUsername( $username );
139 } else {
140 $usernames = [ null ];
141 }
142 $result = false;
143 foreach ( $usernames as $name ) {
144 $r = $this->passwordAttemptThrottle->increase( $name, $ip, __METHOD__ );
145 if ( $r && ( !$result || $result['wait'] < $r['wait'] ) ) {
146 $result = $r;
147 }
148 }
149
150 if ( $result ) {
151 $message = wfMessage( 'login-throttled' )->durationParams( $result['wait'] );
152 return \StatusValue::newFatal( $message );
153 } else {
154 $this->manager->setAuthenticationSessionData( 'LoginThrottle',
155 [ 'users' => $usernames, 'ip' => $ip ] );
156 return \StatusValue::newGood();
157 }
158 }
159
164 public function postAuthentication( $user, AuthenticationResponse $response ) {
165 if ( $response->status !== AuthenticationResponse::PASS ) {
166 return;
167 } elseif ( !$this->passwordAttemptThrottle ) {
168 return;
169 }
170
171 $data = $this->manager->getAuthenticationSessionData( 'LoginThrottle' );
172 if ( !$data ) {
173 // this can occur when login is happening via AuthenticationRequest::$loginRequest
174 // so testForAuthentication is skipped
175 $this->logger->info( 'throttler data not found for {user}', [ 'user' => $user->getName() ] );
176 return;
177 }
178
179 foreach ( $data['users'] as $name ) {
180 $this->passwordAttemptThrottle->clear( $name, $data['ip'] );
181 }
182 }
183}
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
Class representing a cache/ephemeral data store.
Definition BagOStuff.php:85
A base class that implements some of the boilerplate for a PreAuthenticationProvider.
static getUsernameFromRequests(array $reqs)
Get the username from the set of requests.
This is a value object to hold authentication response data.
const PASS
Indicates that the authentication succeeded.
A pre-authentication provider to throttle authentication actions.
testForAccountCreation( $user, $creator, array $reqs)
Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()No nee...
postInitSetup()
A provider can override this to do any necessary setup after init() is called.
testForAuthentication(array $reqs)
Determine whether an authentication may begin.Called from AuthManager::beginAuthentication()StatusVal...
A class containing constants representing the names of configuration variables.
const AccountCreationThrottle
Name constant for the AccountCreationThrottle setting, for use with Config::get()
const PasswordAttemptThrottle
Name constant for the PasswordAttemptThrottle setting, for use with Config::get()
internal since 1.36
Definition User.php:93