3 * Helper for deleting unused local passwords.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
21 * @ingroup Maintenance
24 use MediaWiki\MediaWikiServices
;
25 use Wikimedia\Rdbms\IDatabase
;
27 require_once __DIR__
. '/../Maintenance.php';
30 * Delete unused local passwords.
32 * Mainly intended to be used as a base class by authentication extensions to provide maintenance
33 * scripts which allow deleting local passwords for users who have another way of logging in.
34 * Such scripts would customize how to locate users who have other login methods and don't need
35 * local login anymore.
36 * Make sure to set LocalPasswordPrimaryAuthenticationProvider to loginOnly => true or disable it
37 * completely before running this, otherwise it might recreate passwords.
39 * This class can also be used directly to just delete all local passwords, or those for a specific
40 * user. Deleting all passwords is useful when the wiki has used local password login in the past
41 * but it has been disabled.
43 class DeleteLocalPasswords
extends Maintenance
{
44 /** @var string|null User to run on, or null for all. */
47 /** @var int Number of deleted passwords. */
50 public function __construct() {
51 parent
::__construct();
52 $this->mDescription
= "Deletes local password for users.";
53 $this->setBatchSize( 1000 );
55 $this->addOption( 'user', 'If specified, only checks the given user', false, true );
56 $this->addOption( 'delete', 'Really delete. To prevent accidents, you must provide this flag.' );
57 $this->addOption( 'prefix', "Instead of deleting, make passwords invalid by prefixing with "
58 . "':null:'. Make sure PasswordConfig has a 'null' entry. This is meant for testing before "
60 $this->addOption( 'unprefix', 'Instead of deleting, undo the effect of --prefix.' );
63 protected function initialize() {
65 $this->hasOption( 'delete' ) +
$this->hasOption( 'prefix' )
66 +
$this->hasOption( 'unprefix' ) !== 1
68 $this->fatalError( "Exactly one of the 'delete', 'prefix', 'unprefix' options must be used\n" );
70 if ( $this->hasOption( 'prefix' ) ||
$this->hasOption( 'unprefix' ) ) {
71 $passwordHashTypes = MediaWikiServices
::getInstance()->getPasswordFactory()->getTypes();
73 !isset( $passwordHashTypes['null'] )
74 ||
$passwordHashTypes['null']['class'] !== InvalidPassword
::class
78 'null' password entry missing. To use password prefixing, add
79 $wgPasswordConfig['null'] = [ 'class' => InvalidPassword::class ];
80 to your configuration (and remove once the passwords were deleted).
86 $user = $this->getOption( 'user', false );
87 if ( $user !== false ) {
88 $this->user
= User
::getCanonicalName( $user );
89 if ( $this->user
=== false ) {
90 $this->fatalError( "Invalid user name\n" );
95 public function execute() {
98 foreach ( $this->getUserBatches() as $userBatch ) {
99 $this->processUsers( $userBatch, $this->getUserDB() );
102 $this->output( "done. (wrote $this->total rows)\n" );
106 * Get the master DB handle for the current user batch. This is provided for the benefit
107 * of authentication extensions which subclass this and work with wiki farms.
109 protected function getUserDB() {
110 return $this->getDB( DB_MASTER
);
113 protected function processUsers( array $userBatch, IDatabase
$dbw ) {
117 if ( $this->getOption( 'delete' ) ) {
118 $dbw->update( 'user',
119 [ 'user_password' => PasswordFactory
::newInvalidPassword()->toString() ],
120 [ 'user_name' => $userBatch ],
123 } elseif ( $this->getOption( 'prefix' ) ) {
124 $dbw->update( 'user',
125 [ 'user_password = ' . $dbw->buildConcat( [ $dbw->addQuotes( ':null:' ),
126 'user_password' ] ) ],
128 'NOT (user_password ' . $dbw->buildLike( ':null:', $dbw->anyString() ) . ')',
129 "user_password != " . $dbw->addQuotes( PasswordFactory
::newInvalidPassword()->toString() ),
130 'user_password IS NOT NULL',
131 'user_name' => $userBatch,
135 } elseif ( $this->getOption( 'unprefix' ) ) {
136 $dbw->update( 'user',
137 [ 'user_password = ' . $dbw->buildSubString( 'user_password', strlen( ':null:' ) +
1 ) ],
139 'user_password ' . $dbw->buildLike( ':null:', $dbw->anyString() ),
140 'user_name' => $userBatch,
145 $this->total +
= $dbw->affectedRows();
149 * This method iterates through the requested users and returns their names in batches of
152 * Subclasses should reimplement this and locate users who use the specific authentication
153 * method. The default implementation just iterates through all users. Extensions that work
154 * with wikifarm should also update self::getUserDB() as necessary.
157 protected function getUserBatches() {
158 if ( !is_null( $this->user
) ) {
159 $this->output( "\t ... querying '$this->user'\n" );
160 yield
[ [ $this->user
] ];
165 $dbw = $this->getDB( DB_MASTER
);
167 $this->output( "\t ... querying from '$lastUsername'\n" );
168 $users = $dbw->selectFieldValues(
172 'user_name > ' .$dbw->addQuotes( $lastUsername ),
176 'LIMIT' => $this->getBatchSize(),
177 'ORDER BY' => 'user_name ASC',
182 $lastUsername = end( $users );
184 } while ( count( $users ) === $this->getBatchSize() );