MediaWiki master
ThrottlePreAuthenticationProvider.php
Go to the documentation of this file.
1<?php
22namespace MediaWiki\Auth;
23
28
42
45 protected BagOStuff $cache;
46
55 public function __construct( $params = [] ) {
56 $this->throttleSettings = array_intersect_key( $params,
57 [ 'accountCreationThrottle' => true, 'passwordAttemptThrottle' => true ] );
59 $this->cache = $params['cache'] ?? $services->getObjectCacheFactory()
60 ->getLocalClusterInstance();
61 }
62
63 protected function postInitSetup() {
65 // Handle old $wgAccountCreationThrottle format (number of attempts per 24 hours)
66 if ( !is_array( $accountCreationThrottle ) ) {
68 'count' => $accountCreationThrottle,
69 'seconds' => 86400,
70 ] ];
71 }
72
73 // @codeCoverageIgnoreStart
74 $this->throttleSettings += [
75 // @codeCoverageIgnoreEnd
76 'accountCreationThrottle' => $accountCreationThrottle,
77 'passwordAttemptThrottle' =>
78 $this->config->get( MainConfigNames::PasswordAttemptThrottle ),
79 ];
80
81 if ( !empty( $this->throttleSettings['accountCreationThrottle'] ) ) {
82 $this->accountCreationThrottle = new Throttler(
83 $this->throttleSettings['accountCreationThrottle'], [
84 'type' => 'acctcreate',
85 'cache' => $this->cache,
86 ]
87 );
88 }
89 if ( !empty( $this->throttleSettings['passwordAttemptThrottle'] ) ) {
90 $this->passwordAttemptThrottle = new Throttler(
91 $this->throttleSettings['passwordAttemptThrottle'], [
92 'type' => 'password',
93 'cache' => $this->cache,
94 ]
95 );
96 }
97 }
98
100 public function testForAccountCreation( $user, $creator, array $reqs ) {
101 if ( !$this->accountCreationThrottle || !$creator->isPingLimitable() ) {
102 return \StatusValue::newGood();
103 }
104
105 $ip = $this->manager->getRequest()->getIP();
106
107 if ( !$this->getHookRunner()->onExemptFromAccountCreationThrottle( $ip ) ) {
108 $this->logger->debug( __METHOD__ . ": a hook allowed account creation w/o throttle" );
109 return \StatusValue::newGood();
110 }
111
112 $result = $this->accountCreationThrottle->increase( null, $ip, __METHOD__ );
113 if ( $result ) {
114 $message = wfMessage( 'acct_creation_throttle_hit' )->params( $result['count'] )
115 ->durationParams( $result['wait'] );
116 return \StatusValue::newFatal( $message );
117 }
118
119 return \StatusValue::newGood();
120 }
121
123 public function testForAuthentication( array $reqs ) {
124 if ( !$this->passwordAttemptThrottle ) {
125 return \StatusValue::newGood();
126 }
127
128 $ip = $this->manager->getRequest()->getIP();
129 try {
131 } catch ( \UnexpectedValueException ) {
132 $username = null;
133 }
134
135 // Get everything this username could normalize to, and throttle each one individually.
136 // If nothing uses usernames, just throttle by IP.
137 if ( $username !== null ) {
138 $usernames = $this->manager->normalizeUsername( $username );
139 } else {
140 $usernames = [ null ];
141 }
142 $result = false;
143 foreach ( $usernames as $name ) {
144 $r = $this->passwordAttemptThrottle->increase( $name, $ip, __METHOD__ );
145 if ( $r && ( !$result || $result['wait'] < $r['wait'] ) ) {
146 $result = $r;
147 }
148 }
149
150 if ( $result ) {
151 $message = wfMessage( 'login-throttled' )->durationParams( $result['wait'] );
152 return \StatusValue::newFatal( $message );
153 } else {
154 $this->manager->setAuthenticationSessionData( 'LoginThrottle',
155 [ 'users' => $usernames, 'ip' => $ip ] );
156 return \StatusValue::newGood();
157 }
158 }
159
164 public function postAuthentication( $user, AuthenticationResponse $response ) {
165 if ( $response->status !== AuthenticationResponse::PASS ) {
166 return;
167 } elseif ( !$this->passwordAttemptThrottle ) {
168 return;
169 }
170
171 $data = $this->manager->getAuthenticationSessionData( 'LoginThrottle' );
172 if ( !$data ) {
173 // this can occur when login is happening via AuthenticationRequest::$loginRequest
174 // so testForAuthentication is skipped
175 $this->logger->info( 'throttler data not found for {user}', [ 'user' => $user->getName() ] );
176 return;
177 }
178
179 foreach ( $data['users'] as $name ) {
180 $this->passwordAttemptThrottle->clear( $name, $data['ip'] );
181 }
182 }
183}
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
A base class that implements some of the boilerplate for a PreAuthenticationProvider.
static getUsernameFromRequests(array $reqs)
Get the username from the set of requests.
This is a value object to hold authentication response data.
const PASS
Indicates that the authentication succeeded.
A pre-authentication provider to throttle authentication actions.
testForAccountCreation( $user, $creator, array $reqs)
Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()No nee...
postInitSetup()
A provider can override this to do any necessary setup after init() is called.
testForAuthentication(array $reqs)
Determine whether an authentication may begin.Called from AuthManager::beginAuthentication()StatusVal...
A class containing constants representing the names of configuration variables.
const AccountCreationThrottle
Name constant for the AccountCreationThrottle setting, for use with Config::get()
const PasswordAttemptThrottle
Name constant for the PasswordAttemptThrottle setting, for use with Config::get()
Service locator for MediaWiki core services.
static getInstance()
Returns the global default instance of the top level service locator.
User class for the MediaWiki software.
Definition User.php:123
Abstract class for any ephemeral data store.
Definition BagOStuff.php:87