3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, write to the Free Software Foundation, Inc.,
15 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 * http://www.gnu.org/copyleft/gpl.html
22 namespace MediaWiki\Auth
;
27 * A primary authentication provider that uses the password field in the 'user' table.
31 class LocalPasswordPrimaryAuthenticationProvider
32 extends AbstractPasswordPrimaryAuthenticationProvider
35 /** @var bool If true, this instance is for legacy logins only. */
36 protected $loginOnly = false;
39 * @param array $params Settings
40 * - loginOnly: If true, the local passwords are for legacy logins only:
41 * the local password will be invalidated when authentication is changed
42 * and new users will not have a valid local password set.
44 public function __construct( $params = [] ) {
45 parent
::__construct( $params );
46 $this->loginOnly
= !empty( $params['loginOnly'] );
50 * Check if the password has expired and needs a reset
52 * @param string $username
53 * @param \stdClass $row A row from the user table
54 * @return \stdClass|null
56 protected function getPasswordResetData( $username, $row ) {
58 $expiration = wfTimestampOrNull( TS_UNIX
, $row->user_password_expires
);
59 if ( $expiration === null ||
$expiration >= $now ) {
63 $grace = $this->config
->get( 'PasswordExpireGrace' );
64 if ( $expiration +
$grace < $now ) {
67 'msg' => \Status
::newFatal( 'resetpass-expired' )->getMessage(),
72 'msg' => \Status
::newFatal( 'resetpass-expired-soft' )->getMessage(),
79 public function beginPrimaryAuthentication( array $reqs ) {
80 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
82 return AuthenticationResponse
::newAbstain();
85 if ( $req->username
=== null ||
$req->password
=== null ) {
86 return AuthenticationResponse
::newAbstain();
89 $username = User
::getCanonicalName( $req->username
, 'usable' );
90 if ( $username === false ) {
91 return AuthenticationResponse
::newAbstain();
95 'user_id', 'user_password', 'user_password_expires',
98 $dbr = wfGetDB( DB_REPLICA
);
99 $row = $dbr->selectRow(
102 [ 'user_name' => $username ],
106 // Do not reveal whether its bad username or
107 // bad password to prevent username enumeration
108 // on private wikis. (T134100)
109 return $this->failResponse( $req );
112 $oldRow = clone $row;
113 // Check for *really* old password hashes that don't even have a type
114 // The old hash format was just an md5 hex hash, with no type information
115 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password
) ) {
116 $row->user_password
= ":B:{$row->user_id}:{$row->user_password}";
119 $status = $this->checkPasswordValidity( $username, $req->password
);
120 if ( !$status->isOK() ) {
121 // Fatal, can't log in
122 return AuthenticationResponse
::newFail( $status->getMessage() );
125 $pwhash = $this->getPassword( $row->user_password
);
126 if ( !$pwhash->verify( $req->password
) ) {
127 if ( $this->config
->get( 'LegacyEncoding' ) ) {
128 // Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
129 // Check for this with iconv
130 $cp1252Password = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $req->password
);
131 if ( $cp1252Password === $req->password ||
!$pwhash->verify( $cp1252Password ) ) {
132 return $this->failResponse( $req );
135 return $this->failResponse( $req );
139 // @codeCoverageIgnoreStart
140 if ( $this->getPasswordFactory()->needsUpdate( $pwhash ) ) {
141 $newHash = $this->getPasswordFactory()->newFromPlaintext( $req->password
);
143 \DeferredUpdates
::addCallableUpdate( function () use ( $newHash, $oldRow, $fname ) {
144 $dbw = wfGetDB( DB_MASTER
);
147 [ 'user_password' => $newHash->toString() ],
149 'user_id' => $oldRow->user_id
,
150 'user_password' => $oldRow->user_password
156 // @codeCoverageIgnoreEnd
158 $this->setPasswordResetFlag( $username, $status, $row );
160 return AuthenticationResponse
::newPass( $username );
163 public function testUserCanAuthenticate( $username ) {
164 $username = User
::getCanonicalName( $username, 'usable' );
165 if ( $username === false ) {
169 $dbr = wfGetDB( DB_REPLICA
);
170 $row = $dbr->selectRow(
173 [ 'user_name' => $username ],
180 // Check for *really* old password hashes that don't even have a type
181 // The old hash format was just an md5 hex hash, with no type information
182 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password
) ) {
186 return !$this->getPassword( $row->user_password
) instanceof \InvalidPassword
;
189 public function testUserExists( $username, $flags = User
::READ_NORMAL
) {
190 $username = User
::getCanonicalName( $username, 'usable' );
191 if ( $username === false ) {
195 list( $db, $options ) = \DBAccessObjectUtils
::getDBOptions( $flags );
196 return (bool)wfGetDB( $db )->selectField(
199 [ 'user_name' => $username ],
205 public function providerAllowsAuthenticationDataChange(
206 AuthenticationRequest
$req, $checkData = true
208 // We only want to blank the password if something else will accept the
209 // new authentication data, so return 'ignore' here.
210 if ( $this->loginOnly
) {
211 return \StatusValue
::newGood( 'ignored' );
214 if ( get_class( $req ) === PasswordAuthenticationRequest
::class ) {
216 return \StatusValue
::newGood();
219 $username = User
::getCanonicalName( $req->username
, 'usable' );
220 if ( $username !== false ) {
221 $row = wfGetDB( DB_MASTER
)->selectRow(
224 [ 'user_name' => $username ],
228 $sv = \StatusValue
::newGood();
229 if ( $req->password
!== null ) {
230 if ( $req->password
!== $req->retype
) {
231 $sv->fatal( 'badretype' );
233 $sv->merge( $this->checkPasswordValidity( $username, $req->password
) );
241 return \StatusValue
::newGood( 'ignored' );
244 public function providerChangeAuthenticationData( AuthenticationRequest
$req ) {
245 $username = $req->username
!== null ? User
::getCanonicalName( $req->username
, 'usable' ) : false;
246 if ( $username === false ) {
252 if ( get_class( $req ) === PasswordAuthenticationRequest
::class ) {
253 if ( $this->loginOnly
) {
254 $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
257 $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password
);
258 $expiry = $this->getNewPasswordExpiry( $username );
263 $dbw = wfGetDB( DB_MASTER
);
267 'user_password' => $pwhash->toString(),
268 'user_password_expires' => $dbw->timestampOrNull( $expiry ),
270 [ 'user_name' => $username ],
276 public function accountCreationType() {
277 return $this->loginOnly ? self
::TYPE_NONE
: self
::TYPE_CREATE
;
280 public function testForAccountCreation( $user, $creator, array $reqs ) {
281 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
283 $ret = \StatusValue
::newGood();
284 if ( !$this->loginOnly
&& $req && $req->username
!== null && $req->password
!== null ) {
285 if ( $req->password
!== $req->retype
) {
286 $ret->fatal( 'badretype' );
289 $this->checkPasswordValidity( $user->getName(), $req->password
)
296 public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
297 if ( $this->accountCreationType() === self
::TYPE_NONE
) {
298 throw new \
BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
301 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
302 if ( $req && $req->username
!== null && $req->password
!== null ) {
303 // Nothing we can do besides claim it, because the user isn't in
305 if ( $req->username
!== $user->getName() ) {
307 $req->username
= $user->getName();
309 $ret = AuthenticationResponse
::newPass( $req->username
);
310 $ret->createRequest
= $req;
313 return AuthenticationResponse
::newAbstain();
316 public function finishAccountCreation( $user, $creator, AuthenticationResponse
$res ) {
317 if ( $this->accountCreationType() === self
::TYPE_NONE
) {
318 throw new \
BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
321 // Now that the user is in the DB, set the password on it.
322 $this->providerChangeAuthenticationData( $res->createRequest
);