ThrottlePreAuthenticationProvider.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Auth;
 
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use MediaWiki\User\User;
use Wikimedia\ObjectCache\BagOStuff;
 
class ThrottlePreAuthenticationProvider extends AbstractPreAuthenticationProvider {
    protected $throttleSettings;
 
    protected ?Throttler $accountCreationThrottle = null;
    protected ?Throttler $passwordAttemptThrottle = null;
    protected BagOStuff $cache;
 
    public function __construct( $params = [] ) {
        $this->throttleSettings = array_intersect_key( $params,
            [ 'accountCreationThrottle' => true, 'passwordAttemptThrottle' => true ] );
        $services = MediaWikiServices::getInstance();
        $this->cache = $params['cache'] ?? $services->getObjectCacheFactory()
            ->getLocalClusterInstance();
    }
 
    protected function postInitSetup() {
        $accountCreationThrottle = $this->config->get( MainConfigNames::AccountCreationThrottle );
        // Handle old $wgAccountCreationThrottle format (number of attempts per 24 hours)
        if ( !is_array( $accountCreationThrottle ) ) {
            $accountCreationThrottle = [ [
                'count' => $accountCreationThrottle,
                'seconds' => 86400,
            ] ];
        }
 
        // @codeCoverageIgnoreStart
        $this->throttleSettings += [
        // @codeCoverageIgnoreEnd
            'accountCreationThrottle' => $accountCreationThrottle,
            'passwordAttemptThrottle' =>
                $this->config->get( MainConfigNames::PasswordAttemptThrottle ),
        ];
 
        if ( !empty( $this->throttleSettings['accountCreationThrottle'] ) ) {
            $this->accountCreationThrottle = new Throttler(
                $this->throttleSettings['accountCreationThrottle'], [
                    'type' => 'acctcreate',
                    'cache' => $this->cache,
                ]
            );
        }
        if ( !empty( $this->throttleSettings['passwordAttemptThrottle'] ) ) {
            $this->passwordAttemptThrottle = new Throttler(
                $this->throttleSettings['passwordAttemptThrottle'], [
                    'type' => 'password',
                    'cache' => $this->cache,
                ]
            );
        }
    }
 
    public function testForAccountCreation( $user, $creator, array $reqs ) {
        if ( !$this->accountCreationThrottle || !$creator->isPingLimitable() ) {
            return \StatusValue::newGood();
        }
 
        $ip = $this->manager->getRequest()->getIP();
 
        if ( !$this->getHookRunner()->onExemptFromAccountCreationThrottle( $ip ) ) {
            $this->logger->debug( __METHOD__ . ": a hook allowed account creation w/o throttle" );
            return \StatusValue::newGood();
        }
 
        $result = $this->accountCreationThrottle->increase( null, $ip, __METHOD__ );
        if ( $result ) {
            $message = wfMessage( 'acct_creation_throttle_hit' )->params( $result['count'] )
                ->durationParams( $result['wait'] );
            return \StatusValue::newFatal( $message );
        }
 
        return \StatusValue::newGood();
    }
 
    public function testForAuthentication( array $reqs ) {
        if ( !$this->passwordAttemptThrottle ) {
            return \StatusValue::newGood();
        }
 
        $ip = $this->manager->getRequest()->getIP();
        try {
            $username = AuthenticationRequest::getUsernameFromRequests( $reqs );
        } catch ( \UnexpectedValueException $e ) {
            $username = null;
        }
 
        // Get everything this username could normalize to, and throttle each one individually.
        // If nothing uses usernames, just throttle by IP.
        if ( $username !== null ) {
            $usernames = $this->manager->normalizeUsername( $username );
        } else {
            $usernames = [ null ];
        }
        $result = false;
        foreach ( $usernames as $name ) {
            $r = $this->passwordAttemptThrottle->increase( $name, $ip, __METHOD__ );
            if ( $r && ( !$result || $result['wait'] < $r['wait'] ) ) {
                $result = $r;
            }
        }
 
        if ( $result ) {
            $message = wfMessage( 'login-throttled' )->durationParams( $result['wait'] );
            return \StatusValue::newFatal( $message );
        } else {
            $this->manager->setAuthenticationSessionData( 'LoginThrottle',
                [ 'users' => $usernames, 'ip' => $ip ] );
            return \StatusValue::newGood();
        }
    }
 
    public function postAuthentication( $user, AuthenticationResponse $response ) {
        if ( $response->status !== AuthenticationResponse::PASS ) {
            return;
        } elseif ( !$this->passwordAttemptThrottle ) {
            return;
        }
 
        $data = $this->manager->getAuthenticationSessionData( 'LoginThrottle' );
        if ( !$data ) {
            // this can occur when login is happening via AuthenticationRequest::$loginRequest
            // so testForAuthentication is skipped
            $this->logger->info( 'throttler data not found for {user}', [ 'user' => $user->getName() ] );
            return;
        }
 
        foreach ( $data['users'] as $name ) {
            $this->passwordAttemptThrottle->clear( $name, $data['ip'] );
        }
    }
}