3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, write to the Free Software Foundation, Inc.,
15 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 * http://www.gnu.org/copyleft/gpl.html
22 namespace MediaWiki\Auth
;
27 * A primary authentication provider that uses the password field in the 'user' table.
31 class LocalPasswordPrimaryAuthenticationProvider
32 extends AbstractPasswordPrimaryAuthenticationProvider
35 /** @var bool If true, this instance is for legacy logins only. */
36 protected $loginOnly = false;
39 * @param array $params Settings
40 * - loginOnly: If true, the local passwords are for legacy logins only:
41 * the local password will be invalidated when authentication is changed
42 * and new users will not have a valid local password set.
44 public function __construct( $params = [] ) {
45 parent
::__construct( $params );
46 $this->loginOnly
= !empty( $params['loginOnly'] );
50 * Check if the password has expired and needs a reset
52 * @param string $username
53 * @param \stdClass $row A row from the user table
54 * @return \stdClass|null
56 protected function getPasswordResetData( $username, $row ) {
58 $expiration = wfTimestampOrNull( TS_UNIX
, $row->user_password_expires
);
59 if ( $expiration === null ||
$expiration >= $now ) {
63 $grace = $this->config
->get( 'PasswordExpireGrace' );
64 if ( $expiration +
$grace < $now ) {
67 'msg' => \Status
::newFatal( 'resetpass-expired' )->getMessage(),
72 'msg' => \Status
::newFatal( 'resetpass-expired-soft' )->getMessage(),
79 public function beginPrimaryAuthentication( array $reqs ) {
80 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
82 return AuthenticationResponse
::newAbstain();
85 if ( $req->username
=== null ||
$req->password
=== null ) {
86 return AuthenticationResponse
::newAbstain();
89 $username = User
::getCanonicalName( $req->username
, 'usable' );
90 if ( $username === false ) {
91 return AuthenticationResponse
::newAbstain();
95 'user_id', 'user_password', 'user_password_expires',
98 $dbr = wfGetDB( DB_REPLICA
);
99 $row = $dbr->selectRow(
102 [ 'user_name' => $username ],
106 // Do not reveal whether its bad username or
107 // bad password to prevent username enumeration
108 // on private wikis. (T134100)
109 return $this->failResponse( $req );
112 $oldRow = clone $row;
113 // Check for *really* old password hashes that don't even have a type
114 // The old hash format was just an md5 hex hash, with no type information
115 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password
) ) {
116 if ( $this->config
->get( 'PasswordSalt' ) ) {
117 $row->user_password
= ":B:{$row->user_id}:{$row->user_password}";
119 $row->user_password
= ":A:{$row->user_password}";
123 $status = $this->checkPasswordValidity( $username, $req->password
);
124 if ( !$status->isOK() ) {
125 // Fatal, can't log in
126 return AuthenticationResponse
::newFail( $status->getMessage() );
129 $pwhash = $this->getPassword( $row->user_password
);
130 if ( !$pwhash->verify( $req->password
) ) {
131 if ( $this->config
->get( 'LegacyEncoding' ) ) {
132 // Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
133 // Check for this with iconv
134 $cp1252Password = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $req->password
);
135 if ( $cp1252Password === $req->password ||
!$pwhash->verify( $cp1252Password ) ) {
136 return $this->failResponse( $req );
139 return $this->failResponse( $req );
143 // @codeCoverageIgnoreStart
144 if ( $this->getPasswordFactory()->needsUpdate( $pwhash ) ) {
145 $newHash = $this->getPasswordFactory()->newFromPlaintext( $req->password
);
147 \DeferredUpdates
::addCallableUpdate( function () use ( $newHash, $oldRow, $fname ) {
148 $dbw = wfGetDB( DB_MASTER
);
151 [ 'user_password' => $newHash->toString() ],
153 'user_id' => $oldRow->user_id
,
154 'user_password' => $oldRow->user_password
160 // @codeCoverageIgnoreEnd
162 $this->setPasswordResetFlag( $username, $status, $row );
164 return AuthenticationResponse
::newPass( $username );
167 public function testUserCanAuthenticate( $username ) {
168 $username = User
::getCanonicalName( $username, 'usable' );
169 if ( $username === false ) {
173 $dbr = wfGetDB( DB_REPLICA
);
174 $row = $dbr->selectRow(
177 [ 'user_name' => $username ],
184 // Check for *really* old password hashes that don't even have a type
185 // The old hash format was just an md5 hex hash, with no type information
186 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password
) ) {
190 return !$this->getPassword( $row->user_password
) instanceof \InvalidPassword
;
193 public function testUserExists( $username, $flags = User
::READ_NORMAL
) {
194 $username = User
::getCanonicalName( $username, 'usable' );
195 if ( $username === false ) {
199 list( $db, $options ) = \DBAccessObjectUtils
::getDBOptions( $flags );
200 return (bool)wfGetDB( $db )->selectField(
203 [ 'user_name' => $username ],
209 public function providerAllowsAuthenticationDataChange(
210 AuthenticationRequest
$req, $checkData = true
212 // We only want to blank the password if something else will accept the
213 // new authentication data, so return 'ignore' here.
214 if ( $this->loginOnly
) {
215 return \StatusValue
::newGood( 'ignored' );
218 if ( get_class( $req ) === PasswordAuthenticationRequest
::class ) {
220 return \StatusValue
::newGood();
223 $username = User
::getCanonicalName( $req->username
, 'usable' );
224 if ( $username !== false ) {
225 $row = wfGetDB( DB_MASTER
)->selectRow(
228 [ 'user_name' => $username ],
232 $sv = \StatusValue
::newGood();
233 if ( $req->password
!== null ) {
234 if ( $req->password
!== $req->retype
) {
235 $sv->fatal( 'badretype' );
237 $sv->merge( $this->checkPasswordValidity( $username, $req->password
) );
245 return \StatusValue
::newGood( 'ignored' );
248 public function providerChangeAuthenticationData( AuthenticationRequest
$req ) {
249 $username = $req->username
!== null ? User
::getCanonicalName( $req->username
, 'usable' ) : false;
250 if ( $username === false ) {
256 if ( get_class( $req ) === PasswordAuthenticationRequest
::class ) {
257 if ( $this->loginOnly
) {
258 $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
261 $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password
);
262 $expiry = $this->getNewPasswordExpiry( $username );
267 $dbw = wfGetDB( DB_MASTER
);
271 'user_password' => $pwhash->toString(),
272 'user_password_expires' => $dbw->timestampOrNull( $expiry ),
274 [ 'user_name' => $username ],
280 public function accountCreationType() {
281 return $this->loginOnly ? self
::TYPE_NONE
: self
::TYPE_CREATE
;
284 public function testForAccountCreation( $user, $creator, array $reqs ) {
285 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
287 $ret = \StatusValue
::newGood();
288 if ( !$this->loginOnly
&& $req && $req->username
!== null && $req->password
!== null ) {
289 if ( $req->password
!== $req->retype
) {
290 $ret->fatal( 'badretype' );
293 $this->checkPasswordValidity( $user->getName(), $req->password
)
300 public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
301 if ( $this->accountCreationType() === self
::TYPE_NONE
) {
302 throw new \
BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
305 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
307 if ( $req->username
!== null && $req->password
!== null ) {
308 // Nothing we can do besides claim it, because the user isn't in
310 if ( $req->username
!== $user->getName() ) {
312 $req->username
= $user->getName();
314 $ret = AuthenticationResponse
::newPass( $req->username
);
315 $ret->createRequest
= $req;
319 return AuthenticationResponse
::newAbstain();
322 public function finishAccountCreation( $user, $creator, AuthenticationResponse
$res ) {
323 if ( $this->accountCreationType() === self
::TYPE_NONE
) {
324 throw new \
BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
327 // Now that the user is in the DB, set the password on it.
328 $this->providerChangeAuthenticationData( $res->createRequest
);