MediaWiki  master
ThrottlePreAuthenticationProvider.php
Go to the documentation of this file.
1 <?php
22 namespace MediaWiki\Auth;
23 
24 use BagOStuff;
27 
40  protected $throttleSettings;
41 
44 
47 
49  protected $cache;
50 
59  public function __construct( $params = [] ) {
60  $this->throttleSettings = array_intersect_key( $params,
61  [ 'accountCreationThrottle' => true, 'passwordAttemptThrottle' => true ] );
62  $this->cache = $params['cache'] ?? \ObjectCache::getLocalClusterInstance();
63  }
64 
65  protected function postInitSetup() {
67  // Handle old $wgAccountCreationThrottle format (number of attempts per 24 hours)
68  if ( !is_array( $accountCreationThrottle ) ) {
70  'count' => $accountCreationThrottle,
71  'seconds' => 86400,
72  ] ];
73  }
74 
75  // @codeCoverageIgnoreStart
76  $this->throttleSettings += [
77  // @codeCoverageIgnoreEnd
78  'accountCreationThrottle' => $accountCreationThrottle,
79  'passwordAttemptThrottle' =>
80  $this->config->get( MainConfigNames::PasswordAttemptThrottle ),
81  ];
82 
83  if ( !empty( $this->throttleSettings['accountCreationThrottle'] ) ) {
84  $this->accountCreationThrottle = new Throttler(
85  $this->throttleSettings['accountCreationThrottle'], [
86  'type' => 'acctcreate',
87  'cache' => $this->cache,
88  ]
89  );
90  }
91  if ( !empty( $this->throttleSettings['passwordAttemptThrottle'] ) ) {
92  $this->passwordAttemptThrottle = new Throttler(
93  $this->throttleSettings['passwordAttemptThrottle'], [
94  'type' => 'password',
95  'cache' => $this->cache,
96  ]
97  );
98  }
99  }
100 
101  public function testForAccountCreation( $user, $creator, array $reqs ) {
102  if ( !$this->accountCreationThrottle || !$creator->isPingLimitable() ) {
103  return \StatusValue::newGood();
104  }
105 
106  $ip = $this->manager->getRequest()->getIP();
107 
108  if ( !$this->getHookRunner()->onExemptFromAccountCreationThrottle( $ip ) ) {
109  $this->logger->debug( __METHOD__ . ": a hook allowed account creation w/o throttle" );
110  return \StatusValue::newGood();
111  }
112 
113  $result = $this->accountCreationThrottle->increase( null, $ip, __METHOD__ );
114  if ( $result ) {
115  $message = wfMessage( 'acct_creation_throttle_hit' )->params( $result['count'] )
116  ->durationParams( $result['wait'] );
117  return \StatusValue::newFatal( $message );
118  }
119 
120  return \StatusValue::newGood();
121  }
122 
123  public function testForAuthentication( array $reqs ) {
124  if ( !$this->passwordAttemptThrottle ) {
125  return \StatusValue::newGood();
126  }
127 
128  $ip = $this->manager->getRequest()->getIP();
129  try {
131  } catch ( \UnexpectedValueException $e ) {
132  $username = null;
133  }
134 
135  // Get everything this username could normalize to, and throttle each one individually.
136  // If nothing uses usernames, just throttle by IP.
137  if ( $username !== null ) {
138  $usernames = $this->manager->normalizeUsername( $username );
139  } else {
140  $usernames = [ null ];
141  }
142  $result = false;
143  foreach ( $usernames as $name ) {
144  $r = $this->passwordAttemptThrottle->increase( $name, $ip, __METHOD__ );
145  if ( $r && ( !$result || $result['wait'] < $r['wait'] ) ) {
146  $result = $r;
147  }
148  }
149 
150  if ( $result ) {
151  $message = wfMessage( 'login-throttled' )->durationParams( $result['wait'] );
152  return \StatusValue::newFatal( $message );
153  } else {
154  $this->manager->setAuthenticationSessionData( 'LoginThrottle',
155  [ 'users' => $usernames, 'ip' => $ip ] );
156  return \StatusValue::newGood();
157  }
158  }
159 
164  public function postAuthentication( $user, AuthenticationResponse $response ) {
165  if ( $response->status !== AuthenticationResponse::PASS ) {
166  return;
167  } elseif ( !$this->passwordAttemptThrottle ) {
168  return;
169  }
170 
171  $data = $this->manager->getAuthenticationSessionData( 'LoginThrottle' );
172  if ( !$data ) {
173  // this can occur when login is happening via AuthenticationRequest::$loginRequest
174  // so testForAuthentication is skipped
175  $this->logger->info( 'throttler data not found for {user}', [ 'user' => $user->getName() ] );
176  return;
177  }
178 
179  foreach ( $data['users'] as $name ) {
180  $this->passwordAttemptThrottle->clear( $name, $data['ip'] );
181  }
182  }
183 }
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
Class representing a cache/ephemeral data store.
Definition: BagOStuff.php:85
A base class that implements some of the boilerplate for a PreAuthenticationProvider.
static getUsernameFromRequests(array $reqs)
Get the username from the set of requests.
This is a value object to hold authentication response data.
const PASS
Indicates that the authentication succeeded.
A pre-authentication provider to throttle authentication actions.
testForAccountCreation( $user, $creator, array $reqs)
Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()No nee...
postInitSetup()
A provider can override this to do any necessary setup after init() is called.
postAuthentication( $user, AuthenticationResponse $response)
testForAuthentication(array $reqs)
Determine whether an authentication may begin.Called from AuthManager::beginAuthentication()StatusVal...
A class containing constants representing the names of configuration variables.
const AccountCreationThrottle
Name constant for the AccountCreationThrottle setting, for use with Config::get()
const PasswordAttemptThrottle
Name constant for the PasswordAttemptThrottle setting, for use with Config::get()
internal since 1.36
Definition: User.php:98
static getLocalClusterInstance()
Get the main cluster-local cache object.