MediaWiki
master
|
A primary authentication provider that uses the temporary password field in the 'user' table. More...
Public Member Functions | ||||||||||
__construct (IConnectionProvider $dbProvider, UserOptionsLookup $userOptionsLookup, $params=[]) | ||||||||||
accountCreationType () | ||||||||||
Fetch the account-creation type. More... | ||||||||||
beginPrimaryAccountCreation ( $user, $creator, array $reqs) | ||||||||||
Start an account creation flow. More... | ||||||||||
beginPrimaryAuthentication (array $reqs) | ||||||||||
Start an authentication flow. More... | ||||||||||
finishAccountCreation ( $user, $creator, AuthenticationResponse $res) | ||||||||||
Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.
| ||||||||||
getAuthenticationRequests ( $action, array $options) | ||||||||||
providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true) | ||||||||||
Validate a change of authentication data (e.g. More... | ||||||||||
providerChangeAuthenticationData (AuthenticationRequest $req) | ||||||||||
Change or remove authentication data (e.g. More... | ||||||||||
testForAccountCreation ( $user, $creator, array $reqs) | ||||||||||
Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()
| ||||||||||
testUserCanAuthenticate ( $username) | ||||||||||
Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.
| ||||||||||
testUserExists ( $username, $flags=User::READ_NORMAL) | ||||||||||
Test whether the named user exists. More... | ||||||||||
![]() | ||||||||||
__construct (array $params=[]) | ||||||||||
![]() | ||||||||||
autoCreatedAccount ( $user, $source) | ||||||||||
Post-auto-creation callback.
| ||||||||||
beginPrimaryAccountLink ( $user, array $reqs) | ||||||||||
Start linking an account to an existing user.
| ||||||||||
continuePrimaryAccountCreation ( $user, $creator, array $reqs) | ||||||||||
Continue an account creation flow.
| ||||||||||
continuePrimaryAccountLink ( $user, array $reqs) | ||||||||||
Continue linking an account to an existing user.
| ||||||||||
continuePrimaryAuthentication (array $reqs) | ||||||||||
postAccountCreation ( $user, $creator, AuthenticationResponse $response) | ||||||||||
Post-creation callback.This will be called at the end of any account creation attempt, regardless of whether this provider was the one that handled it. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).
| ||||||||||
postAccountLink ( $user, AuthenticationResponse $response) | ||||||||||
Post-link callback.This will be called at the end of any account linking attempt, regardless of whether this provider was the one that handled it.
| ||||||||||
postAuthentication ( $user, AuthenticationResponse $response) | ||||||||||
Post-login callback.This will be called at the end of any login attempt, regardless of whether this provider was the one that handled it. It will not be called for unfinished login attempts that fail by the session timing out.
| ||||||||||
providerAllowsPropertyChange ( $property) | ||||||||||
Determine whether a property can change.
| ||||||||||
providerNormalizeUsername ( $username) | ||||||||||
Normalize the username for authentication.Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.
| ||||||||||
providerRevokeAccessForUser ( $username) | ||||||||||
Revoke the user's credentials.This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).
| ||||||||||
testUserForCreation ( $user, $autocreate, array $options=[]) | ||||||||||
Determine whether an account may be created.
| ||||||||||
![]() | ||||||||||
getUniqueId () | ||||||||||
Return a unique identifier for this instance.This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.
| ||||||||||
init (LoggerInterface $logger, AuthManager $manager, HookContainer $hookContainer, Config $config, UserNameUtils $userNameUtils) | ||||||||||
Initialise with dependencies of an AuthenticationProvider. More... | ||||||||||
Protected Member Functions | |
getPasswordResetData ( $username, $data) | |
Get password reset data, if any. More... | |
isTimestampValid ( $timestamp) | |
Check that a temporary password is still valid (hasn't expired). More... | |
postInitSetup () | |
A provider can override this to do any necessary setup after init() is called. More... | |
sendNewAccountEmail (User $user, User $creatingUser, $password) | |
Send an email about the new account creation and the temporary password. More... | |
sendPasswordResetEmail (TemporaryPasswordAuthenticationRequest $req) | |
![]() | |
checkPasswordValidity ( $username, $password) | |
Check that the password is valid. More... | |
failResponse (PasswordAuthenticationRequest $req) | |
Return the appropriate response for failure. More... | |
getFatalPasswordErrorResponse (string $username, Status $status) | |
Adds user-friendly description to a fatal password validity check error. More... | |
getNewPasswordExpiry ( $username) | |
Get expiration date for a new password, if any. More... | |
getPassword ( $hash) | |
Get a Password object from the hash. More... | |
getPasswordFactory () | |
setPasswordResetFlag ( $username, Status $status, $data=null) | |
Check if the password should be reset. More... | |
![]() | |
getHookContainer () | |
getHookRunner () | |
Protected Attributes | |
bool | $allowRequiringEmail = null |
bool | $emailEnabled = null |
int | $newPasswordExpiry = null |
int | $passwordReminderResendTime = null |
![]() | |
bool | $authoritative |
Whether this provider should ABSTAIN (false) or FAIL (true) on password failure. More... | |
![]() | |
Config | $config |
LoggerInterface | $logger |
AuthManager | $manager |
UserNameUtils | $userNameUtils |
Additional Inherited Members | |
![]() | |
const | TYPE_CREATE = 'create' |
Provider can create accounts. More... | |
const | TYPE_LINK = 'link' |
Provider can link to existing accounts elsewhere. More... | |
const | TYPE_NONE = 'none' |
Provider cannot create or link to accounts. More... | |
A primary authentication provider that uses the temporary password field in the 'user' table.
A successful login will force a password reset.
Definition at line 44 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::__construct | ( | IConnectionProvider | $dbProvider, |
UserOptionsLookup | $userOptionsLookup, | ||
$params = [] |
|||
) |
IConnectionProvider | $dbProvider | |
UserOptionsLookup | $userOptionsLookup | |
array | $params |
|
Definition at line 74 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::accountCreationType | ( | ) |
Fetch the account-creation type.
Implements MediaWiki\Auth\PrimaryAuthenticationProvider.
Definition at line 330 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_CREATE.
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::beginPrimaryAccountCreation | ( | $user, | |
$creator, | |||
array | $reqs | ||
) |
Start an account creation flow.
User | $user | User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Implements MediaWiki\Auth\PrimaryAuthenticationProvider.
Definition at line 357 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), and MediaWiki\Auth\AuthenticationResponse\newPass().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::beginPrimaryAuthentication | ( | array | $reqs | ) |
Start an authentication flow.
AuthenticationRequest[] | $reqs |
Implements MediaWiki\Auth\PrimaryAuthenticationProvider.
Definition at line 140 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\failResponse(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getFatalPasswordErrorResponse(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), MediaWiki\Auth\AuthenticationResponse\newPass(), and MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\setPasswordResetFlag().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::finishAccountCreation | ( | $user, | |
$creator, | |||
AuthenticationResponse | $response | ||
) |
Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.
User | $user | User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationResponse | $response | PASS response returned earlier |
Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
Definition at line 381 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData(), and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\sendNewAccountEmail().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::getAuthenticationRequests | ( | $action, | |
array | $options | ||
) |
string | $action | |
array | $options |
Reimplemented from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider.
Definition at line 114 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AuthManager\ACTION_CHANGE, MediaWiki\Auth\AuthManager\ACTION_CREATE, MediaWiki\Auth\AuthManager\ACTION_LOGIN, MediaWiki\Auth\AuthManager\ACTION_REMOVE, and MediaWiki\Auth\TemporaryPasswordAuthenticationRequest\newRandom().
|
protected |
Get password reset data, if any.
string | $username | |
\\stdClass | null | $data |
Reimplemented from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider.
Definition at line 106 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References wfMessage().
|
protected |
Check that a temporary password is still valid (hasn't expired).
string | $timestamp | A timestamp in MediaWiki (TS_MW) format |
Definition at line 408 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\$newPasswordExpiry, wfTimestamp(), and wfTimestampOrNull().
Referenced by MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\testUserCanAuthenticate().
|
protected |
A provider can override this to do any necessary setup after init() is called.
Reimplemented from MediaWiki\Auth\AbstractAuthenticationProvider.
Definition at line 97 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\MainConfigNames\AllowRequiringEmailForResets, MediaWiki\MainConfigNames\EnableEmail, MediaWiki\MainConfigNames\NewPasswordExpiry, and MediaWiki\MainConfigNames\PasswordReminderResendTime.
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::providerAllowsAuthenticationDataChange | ( | AuthenticationRequest | $req, |
$checkData = true |
|||
) |
Validate a change of authentication data (e.g.
passwords)
Return StatusValue::newGood( 'ignored' ) if you don't support this AuthenticationRequest type.
AuthenticationRequest | $req | |
bool | $checkData | If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission. |
Implements MediaWiki\Auth\PrimaryAuthenticationProvider.
Definition at line 220 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), MediaWiki\User\User\newFromName(), StatusValue\newGood(), and wfTimestamp().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::providerChangeAuthenticationData | ( | AuthenticationRequest | $req | ) |
Change or remove authentication data (e.g.
passwords)
If $req was returned for AuthManager::ACTION_CHANGE, the corresponding credentials should result in a successful login in the future.
If $req was returned for AuthManager::ACTION_REMOVE, the corresponding credentials should no longer result in a successful login.
It can be assumed that providerAllowsAuthenticationDataChange with $checkData === true was called before this, and passed. This method should never fail (other than throwing an exception).
AuthenticationRequest | $req |
Implements MediaWiki\Auth\PrimaryAuthenticationProvider.
Definition at line 287 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AuthManager\ACTION_REMOVE, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory(), and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\sendPasswordResetEmail().
Referenced by MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\finishAccountCreation().
|
protected |
Send an email about the new account creation and the temporary password.
User | $user | The new user account |
User | $creatingUser | The user who created the account (can be anonymous) |
string | $password | The temporary password |
Definition at line 426 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AbstractAuthenticationProvider\getHookRunner(), MediaWiki\User\User\getName(), MediaWiki\User\User\getRequest(), MediaWiki\Title\Title\newMainPage(), MediaWiki\User\User\sendMail(), and wfMessage().
Referenced by MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\finishAccountCreation().
|
protected |
TemporaryPasswordAuthenticationRequest | $req |
Definition at line 460 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\SpecialPage\SpecialPage\getTitleFor(), MediaWiki\User\User\newFromName(), MediaWiki\Title\Title\newMainPage(), and wfMessage().
Referenced by MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::testForAccountCreation | ( | $user, | |
$creator, | |||
array | $reqs | ||
) |
Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()
User | $user | User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
Definition at line 334 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), StatusValue\newFatal(), and StatusValue\newGood().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::testUserCanAuthenticate | ( | $username | ) |
Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.
string | $username | MediaWiki username |
Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
Definition at line 188 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword(), and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\isTimestampValid().
MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider::testUserExists | ( | $username, | |
$flags = User::READ_NORMAL |
|||
) |
Test whether the named user exists.
Single-sign-on providers can use this to reserve a username for autocreation.
Implements MediaWiki\Auth\PrimaryAuthenticationProvider.
Definition at line 204 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
References DBAccessObjectUtils\getDBFromIndex(), and DBAccessObjectUtils\getDBOptions().
|
protected |
Definition at line 57 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
|
protected |
Definition at line 48 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
|
protected |
Definition at line 51 of file TemporaryPasswordPrimaryAuthenticationProvider.php.
Referenced by MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\isTimestampValid().
|
protected |
Definition at line 54 of file TemporaryPasswordPrimaryAuthenticationProvider.php.