includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 use User;
  25
  26 /**
  27  * A primary authentication provider that uses the temporary password field in
  28  * the 'user' table.
  29  *
  30  * A successful login will force a password reset.
  31  *
  32  * @note For proper operation, this should generally come before any other
  33  *  password-based authentication providers.
  34  * @ingroup Auth
  35  * @since 1.27
  36  */
  37 class TemporaryPasswordPrimaryAuthenticationProvider
  38         extends AbstractPasswordPrimaryAuthenticationProvider
  39 {
  40         /** @var bool */
  41         protected $emailEnabled = null;
  42
  43         /** @var int */
  44         protected $newPasswordExpiry = null;
  45
  46         /** @var int */
  47         protected $passwordReminderResendTime = null;
  48
  49         /**
  50          * @param array $params
  51          *  - emailEnabled: (bool) must be true for the option to email passwords to be present
  52          *  - newPasswordExpiry: (int) expiraton time of temporary passwords, in seconds
  53          *  - passwordReminderResendTime: (int) cooldown period in hours until a password reminder can
  54          *    be sent to the same user again,
  55          */
  56         public function __construct( $params = [] ) {
  57                 parent::__construct( $params );
  58
  59                 if ( isset( $params['emailEnabled'] ) ) {
  60                         $this->emailEnabled = (bool)$params['emailEnabled'];
  61                 }
  62                 if ( isset( $params['newPasswordExpiry'] ) ) {
  63                         $this->newPasswordExpiry = (int)$params['newPasswordExpiry'];
  64                 }
  65                 if ( isset( $params['passwordReminderResendTime'] ) ) {
  66                         $this->passwordReminderResendTime = $params['passwordReminderResendTime'];
  67                 }
  68         }
  69
  70         public function setConfig( \Config $config ) {
  71                 parent::setConfig( $config );
  72
  73                 if ( $this->emailEnabled === null ) {
  74                         $this->emailEnabled = $this->config->get( 'EnableEmail' );
  75                 }
  76                 if ( $this->newPasswordExpiry === null ) {
  77                         $this->newPasswordExpiry = $this->config->get( 'NewPasswordExpiry' );
  78                 }
  79                 if ( $this->passwordReminderResendTime === null ) {
  80                         $this->passwordReminderResendTime = $this->config->get( 'PasswordReminderResendTime' );
  81                 }
  82         }
  83
  84         protected function getPasswordResetData( $username, $data ) {
  85                 // Always reset
  86                 return (object)[
  87                         'msg' => wfMessage( 'resetpass-temp-emailed' ),
  88                         'hard' => true,
  89                 ];
  90         }
  91
  92         public function getAuthenticationRequests( $action, array $options ) {
  93                 switch ( $action ) {
  94                         case AuthManager::ACTION_LOGIN:
  95                                 return [ new PasswordAuthenticationRequest() ];
  96
  97                         case AuthManager::ACTION_CHANGE:
  98                                 return [ TemporaryPasswordAuthenticationRequest::newRandom() ];
  99
 100                         case AuthManager::ACTION_CREATE:
 101                                 if ( isset( $options['username'] ) && $this->emailEnabled ) {
 102                                         // Creating an account for someone else
 103                                         return [ TemporaryPasswordAuthenticationRequest::newRandom() ];
 104                                 } else {
 105                                         // It's not terribly likely that an anonymous user will
 106                                         // be creating an account for someone else.
 107                                         return [];
 108                                 }
 109
 110                         case AuthManager::ACTION_REMOVE:
 111                                 return [ new TemporaryPasswordAuthenticationRequest ];
 112
 113                         default:
 114                                 return [];
 115                 }
 116         }
 117
 118         public function beginPrimaryAuthentication( array $reqs ) {
 119                 $req = AuthenticationRequest::getRequestByClass( $reqs, PasswordAuthenticationRequest::class );
 120                 if ( !$req || $req->username === null || $req->password === null ) {
 121                         return AuthenticationResponse::newAbstain();
 122                 }
 123
 124                 $username = User::getCanonicalName( $req->username, 'usable' );
 125                 if ( $username === false ) {
 126                         return AuthenticationResponse::newAbstain();
 127                 }
 128
 129                 $dbr = wfGetDB( DB_REPLICA );
 130                 $row = $dbr->selectRow(
 131                         'user',
 132                         [
 133                                 'user_id', 'user_newpassword', 'user_newpass_time',
 134                         ],
 135                         [ 'user_name' => $username ],
 136                         __METHOD__
 137                 );
 138                 if ( !$row ) {
 139                         return AuthenticationResponse::newAbstain();
 140                 }
 141
 142                 $status = $this->checkPasswordValidity( $username, $req->password );
 143                 if ( !$status->isOk() ) {
 144                         // Fatal, can't log in
 145                         return AuthenticationResponse::newFail( $status->getMessage() );
 146                 }
 147
 148                 $pwhash = $this->getPassword( $row->user_newpassword );
 149                 if ( !$pwhash->equals( $req->password ) ) {
 150                         return $this->failResponse( $req );
 151                 }
 152
 153                 if ( !$this->isTimestampValid( $row->user_newpass_time ) ) {
 154                         return $this->failResponse( $req );
 155                 }
 156
 157                 $this->setPasswordResetFlag( $username, $status );
 158
 159                 return AuthenticationResponse::newPass( $username );
 160         }
 161
 162         public function testUserCanAuthenticate( $username ) {
 163                 $username = User::getCanonicalName( $username, 'usable' );
 164                 if ( $username === false ) {
 165                         return false;
 166                 }
 167
 168                 $dbr = wfGetDB( DB_REPLICA );
 169                 $row = $dbr->selectRow(
 170                         'user',
 171                         [ 'user_newpassword', 'user_newpass_time' ],
 172                         [ 'user_name' => $username ],
 173                         __METHOD__
 174                 );
 175                 if ( !$row ) {
 176                         return false;
 177                 }
 178
 179                 if ( $this->getPassword( $row->user_newpassword ) instanceof \InvalidPassword ) {
 180                         return false;
 181                 }
 182
 183                 if ( !$this->isTimestampValid( $row->user_newpass_time ) ) {
 184                         return false;
 185                 }
 186
 187                 return true;
 188         }
 189
 190         public function testUserExists( $username, $flags = User::READ_NORMAL ) {
 191                 $username = User::getCanonicalName( $username, 'usable' );
 192                 if ( $username === false ) {
 193                         return false;
 194                 }
 195
 196                 list( $db, $options ) = \DBAccessObjectUtils::getDBOptions( $flags );
 197                 return (bool)wfGetDB( $db )->selectField(
 198                         [ 'user' ],
 199                         [ 'user_id' ],
 200                         [ 'user_name' => $username ],
 201                         __METHOD__,
 202                         $options
 203                 );
 204         }
 205
 206         public function providerAllowsAuthenticationDataChange(
 207                 AuthenticationRequest $req, $checkData = true
 208         ) {
 209                 if ( get_class( $req ) !== TemporaryPasswordAuthenticationRequest::class ) {
 210                         // We don't really ignore it, but this is what the caller expects.
 211                         return \StatusValue::newGood( 'ignored' );
 212                 }
 213
 214                 if ( !$checkData ) {
 215                         return \StatusValue::newGood();
 216                 }
 217
 218                 $username = User::getCanonicalName( $req->username, 'usable' );
 219                 if ( $username === false ) {
 220                         return \StatusValue::newGood( 'ignored' );
 221                 }
 222
 223                 $row = wfGetDB( DB_MASTER )->selectRow(
 224                         'user',
 225                         [ 'user_id', 'user_newpass_time' ],
 226                         [ 'user_name' => $username ],
 227                         __METHOD__
 228                 );
 229
 230                 if ( !$row ) {
 231                         return \StatusValue::newGood( 'ignored' );
 232                 }
 233
 234                 $sv = \StatusValue::newGood();
 235                 if ( $req->password !== null ) {
 236                         $sv->merge( $this->checkPasswordValidity( $username, $req->password ) );
 237
 238                         if ( $req->mailpassword ) {
 239                                 if ( !$this->emailEnabled && !$req->hasBackchannel ) {
 240                                         return \StatusValue::newFatal( 'passwordreset-emaildisabled' );
 241                                 }
 242
 243                                 // We don't check whether the user has an email address;
 244                                 // that information should not be exposed to the caller.
 245
 246                                 // do not allow temporary password creation within
 247                                 // $wgPasswordReminderResendTime from the last attempt
 248                                 if (
 249                                         $this->passwordReminderResendTime
 250                                         && $row->user_newpass_time
 251                                         && time() < wfTimestamp( TS_UNIX, $row->user_newpass_time )
 252                                                 + $this->passwordReminderResendTime * 3600
 253                                 ) {
 254                                         // Round the time in hours to 3 d.p., in case someone is specifying
 255                                         // minutes or seconds.
 256                                         return \StatusValue::newFatal( 'throttled-mailpassword',
 257                                                 round( $this->passwordReminderResendTime, 3 ) );
 258                                 }
 259
 260                                 if ( !$req->caller ) {
 261                                         return \StatusValue::newFatal( 'passwordreset-nocaller' );
 262                                 }
 263                                 if ( !\IP::isValid( $req->caller ) ) {
 264                                         $caller = User::newFromName( $req->caller );
 265                                         if ( !$caller ) {
 266                                                 return \StatusValue::newFatal( 'passwordreset-nosuchcaller', $req->caller );
 267                                         }
 268                                 }
 269                         }
 270                 }
 271                 return $sv;
 272         }
 273
 274         public function providerChangeAuthenticationData( AuthenticationRequest $req ) {
 275                 $username = $req->username !== null ? User::getCanonicalName( $req->username, 'usable' ) : false;
 276                 if ( $username === false ) {
 277                         return;
 278                 }
 279
 280                 $dbw = wfGetDB( DB_MASTER );
 281
 282                 $sendMail = false;
 283                 if ( $req->action !== AuthManager::ACTION_REMOVE &&
 284                         get_class( $req ) === TemporaryPasswordAuthenticationRequest::class
 285                 ) {
 286                         $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 287                         $newpassTime = $dbw->timestamp();
 288                         $sendMail = $req->mailpassword;
 289                 } else {
 290                         // Invalidate the temporary password when any other auth is reset, or when removing
 291                         $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
 292                         $newpassTime = null;
 293                 }
 294
 295                 $dbw->update(
 296                         'user',
 297                         [
 298                                 'user_newpassword' => $pwhash->toString(),
 299                                 'user_newpass_time' => $newpassTime,
 300                         ],
 301                         [ 'user_name' => $username ],
 302                         __METHOD__
 303                 );
 304
 305                 if ( $sendMail ) {
 306                         // Send email after DB commit
 307                         $dbw->onTransactionIdle( function () use ( $req ) {
 308                                 /** @var TemporaryPasswordAuthenticationRequest $req */
 309                                 $this->sendPasswordResetEmail( $req );
 310                         } );
 311                 }
 312         }
 313
 314         public function accountCreationType() {
 315                 return self::TYPE_CREATE;
 316         }
 317
 318         public function testForAccountCreation( $user, $creator, array $reqs ) {
 319                 /** @var TemporaryPasswordAuthenticationRequest $req */
 320                 $req = AuthenticationRequest::getRequestByClass(
 321                         $reqs, TemporaryPasswordAuthenticationRequest::class
 322                 );
 323
 324                 $ret = \StatusValue::newGood();
 325                 if ( $req ) {
 326                         if ( $req->mailpassword && !$req->hasBackchannel ) {
 327                                 if ( !$this->emailEnabled ) {
 328                                         $ret->merge( \StatusValue::newFatal( 'emaildisabled' ) );
 329                                 } elseif ( !$user->getEmail() ) {
 330                                         $ret->merge( \StatusValue::newFatal( 'noemailcreate' ) );
 331                                 }
 332                         }
 333
 334                         $ret->merge(
 335                                 $this->checkPasswordValidity( $user->getName(), $req->password )
 336                         );
 337                 }
 338                 return $ret;
 339         }
 340
 341         public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
 342                 /** @var TemporaryPasswordAuthenticationRequest $req */
 343                 $req = AuthenticationRequest::getRequestByClass(
 344                         $reqs, TemporaryPasswordAuthenticationRequest::class
 345                 );
 346                 if ( $req ) {
 347                         if ( $req->username !== null && $req->password !== null ) {
 348                                 // Nothing we can do yet, because the user isn't in the DB yet
 349                                 if ( $req->username !== $user->getName() ) {
 350                                         $req = clone( $req );
 351                                         $req->username = $user->getName();
 352                                 }
 353
 354                                 if ( $req->mailpassword ) {
 355                                         // prevent EmailNotificationSecondaryAuthenticationProvider from sending another mail
 356                                         $this->manager->setAuthenticationSessionData( 'no-email', true );
 357                                 }
 358
 359                                 $ret = AuthenticationResponse::newPass( $req->username );
 360                                 $ret->createRequest = $req;
 361                                 return $ret;
 362                         }
 363                 }
 364                 return AuthenticationResponse::newAbstain();
 365         }
 366
 367         public function finishAccountCreation( $user, $creator, AuthenticationResponse $res ) {
 368                 /** @var TemporaryPasswordAuthenticationRequest $req */
 369                 $req = $res->createRequest;
 370                 $mailpassword = $req->mailpassword;
 371                 $req->mailpassword = false; // providerChangeAuthenticationData would send the wrong email
 372
 373                 // Now that the user is in the DB, set the password on it.
 374                 $this->providerChangeAuthenticationData( $req );
 375
 376                 if ( $mailpassword ) {
 377                         // Send email after DB commit
 378                         wfGetDB( DB_MASTER )->onTransactionIdle( function () use ( $user, $creator, $req ) {
 379                                 $this->sendNewAccountEmail( $user, $creator, $req->password );
 380                         } );
 381                 }
 382
 383                 return $mailpassword ? 'byemail' : null;
 384         }
 385
 386         /**
 387          * Check that a temporary password is still valid (hasn't expired).
 388          * @param string $timestamp A timestamp in MediaWiki (TS_MW) format
 389          * @return bool
 390          */
 391         protected function isTimestampValid( $timestamp ) {
 392                 $time = wfTimestampOrNull( TS_MW, $timestamp );
 393                 if ( $time !== null ) {
 394                         $expiry = wfTimestamp( TS_UNIX, $time ) + $this->newPasswordExpiry;
 395                         if ( time() >= $expiry ) {
 396                                 return false;
 397                         }
 398                 }
 399                 return true;
 400         }
 401
 402         /**
 403          * Send an email about the new account creation and the temporary password.
 404          * @param User $user The new user account
 405          * @param User $creatingUser The user who created the account (can be anonymous)
 406          * @param string $password The temporary password
 407          * @return \Status
 408          */
 409         protected function sendNewAccountEmail( User $user, User $creatingUser, $password ) {
 410                 $ip = $creatingUser->getRequest()->getIP();
 411                 // @codeCoverageIgnoreStart
 412                 if ( !$ip ) {
 413                         return \Status::newFatal( 'badipaddress' );
 414                 }
 415                 // @codeCoverageIgnoreEnd
 416
 417                 \Hooks::run( 'User::mailPasswordInternal', [ &$creatingUser, &$ip, &$user ] );
 418
 419                 $mainPageUrl = \Title::newMainPage()->getCanonicalURL();
 420                 $userLanguage = $user->getOption( 'language' );
 421                 $subjectMessage = wfMessage( 'createaccount-title' )->inLanguage( $userLanguage );
 422                 $bodyMessage = wfMessage( 'createaccount-text', $ip, $user->getName(), $password,
 423                         '<' . $mainPageUrl . '>', round( $this->newPasswordExpiry / 86400 ) )
 424                         ->inLanguage( $userLanguage );
 425
 426                 $status = $user->sendMail( $subjectMessage->text(), $bodyMessage->text() );
 427
 428                 // TODO show 'mailerror' message on error, 'accmailtext' success message otherwise?
 429                 // @codeCoverageIgnoreStart
 430                 if ( !$status->isGood() ) {
 431                         $this->logger->warning( 'Could not send account creation email: ' .
 432                                 $status->getWikiText( false, false, 'en' ) );
 433                 }
 434                 // @codeCoverageIgnoreEnd
 435
 436                 return $status;
 437         }
 438
 439         /**
 440          * @param TemporaryPasswordAuthenticationRequest $req
 441          * @return \Status
 442          */
 443         protected function sendPasswordResetEmail( TemporaryPasswordAuthenticationRequest $req ) {
 444                         $user = User::newFromName( $req->username );
 445                         if ( !$user ) {
 446                                 return \Status::newFatal( 'noname' );
 447                         }
 448                         $userLanguage = $user->getOption( 'language' );
 449                         $callerIsAnon = \IP::isValid( $req->caller );
 450                         $callerName = $callerIsAnon ? $req->caller : User::newFromName( $req->caller )->getName();
 451                         $passwordMessage = wfMessage( 'passwordreset-emailelement', $user->getName(),
 452                                 $req->password )->inLanguage( $userLanguage );
 453                         $emailMessage = wfMessage( $callerIsAnon ? 'passwordreset-emailtext-ip'
 454                                 : 'passwordreset-emailtext-user' )->inLanguage( $userLanguage );
 455                         $emailMessage->params( $callerName, $passwordMessage->text(), 1,
 456                                 '<' . \Title::newMainPage()->getCanonicalURL() . '>',
 457                                 round( $this->newPasswordExpiry / 86400 ) );
 458                         $emailTitle = wfMessage( 'passwordreset-emailtitle' )->inLanguage( $userLanguage );
 459                         return $user->sendMail( $emailTitle->text(), $emailMessage->text() );
 460         }
 461 }