3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, write to the Free Software Foundation, Inc.,
15 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 * http://www.gnu.org/copyleft/gpl.html
22 namespace MediaWiki\Auth
;
27 * A primary authentication provider that uses the password field in the 'user' table.
31 class LocalPasswordPrimaryAuthenticationProvider
32 extends AbstractPasswordPrimaryAuthenticationProvider
35 /** @var bool If true, this instance is for legacy logins only. */
36 protected $loginOnly = false;
39 * @param array $params Settings
40 * - loginOnly: If true, the local passwords are for legacy logins only:
41 * the local password will be invalidated when authentication is changed
42 * and new users will not have a valid local password set.
44 public function __construct( $params = [] ) {
45 parent
::__construct( $params );
46 $this->loginOnly
= !empty( $params['loginOnly'] );
49 protected function getPasswordResetData( $username, $row ) {
51 $expiration = wfTimestampOrNull( TS_UNIX
, $row->user_password_expires
);
52 if ( $expiration === null ||
$expiration >= $now ) {
56 $grace = $this->config
->get( 'PasswordExpireGrace' );
57 if ( $expiration +
$grace < $now ) {
60 'msg' => \Status
::newFatal( 'resetpass-expired' )->getMessage(),
65 'msg' => \Status
::newFatal( 'resetpass-expired-soft' )->getMessage(),
72 public function beginPrimaryAuthentication( array $reqs ) {
73 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
75 return AuthenticationResponse
::newAbstain();
78 if ( $req->username
=== null ||
$req->password
=== null ) {
79 return AuthenticationResponse
::newAbstain();
82 $username = User
::getCanonicalName( $req->username
, 'usable' );
83 if ( $username === false ) {
84 return AuthenticationResponse
::newAbstain();
88 'user_id', 'user_password', 'user_password_expires',
91 $dbr = wfGetDB( DB_REPLICA
);
92 $row = $dbr->selectRow(
95 [ 'user_name' => $username ],
99 // Do not reveal whether its bad username or
100 // bad password to prevent username enumeration
101 // on private wikis. (T134100)
102 return $this->failResponse( $req );
105 $oldRow = clone $row;
106 // Check for *really* old password hashes that don't even have a type
107 // The old hash format was just an md5 hex hash, with no type information
108 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password
) ) {
109 if ( $this->config
->get( 'PasswordSalt' ) ) {
110 $row->user_password
= ":B:{$row->user_id}:{$row->user_password}";
112 $row->user_password
= ":A:{$row->user_password}";
116 $status = $this->checkPasswordValidity( $username, $req->password
);
117 if ( !$status->isOK() ) {
118 // Fatal, can't log in
119 return AuthenticationResponse
::newFail( $status->getMessage() );
122 $pwhash = $this->getPassword( $row->user_password
);
123 if ( !$pwhash->equals( $req->password
) ) {
124 if ( $this->config
->get( 'LegacyEncoding' ) ) {
125 // Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
126 // Check for this with iconv
127 $cp1252Password = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $req->password
);
128 if ( $cp1252Password === $req->password ||
!$pwhash->equals( $cp1252Password ) ) {
129 return $this->failResponse( $req );
132 return $this->failResponse( $req );
136 // @codeCoverageIgnoreStart
137 if ( $this->getPasswordFactory()->needsUpdate( $pwhash ) ) {
138 $newHash = $this->getPasswordFactory()->newFromPlaintext( $req->password
);
139 \DeferredUpdates
::addCallableUpdate( function () use ( $newHash, $oldRow ) {
140 $dbw = wfGetDB( DB_MASTER
);
143 [ 'user_password' => $newHash->toString() ],
145 'user_id' => $oldRow->user_id
,
146 'user_password' => $oldRow->user_password
152 // @codeCoverageIgnoreEnd
154 $this->setPasswordResetFlag( $username, $status, $row );
156 return AuthenticationResponse
::newPass( $username );
159 public function testUserCanAuthenticate( $username ) {
160 $username = User
::getCanonicalName( $username, 'usable' );
161 if ( $username === false ) {
165 $dbr = wfGetDB( DB_REPLICA
);
166 $row = $dbr->selectRow(
169 [ 'user_name' => $username ],
176 // Check for *really* old password hashes that don't even have a type
177 // The old hash format was just an md5 hex hash, with no type information
178 if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password
) ) {
182 return !$this->getPassword( $row->user_password
) instanceof \InvalidPassword
;
185 public function testUserExists( $username, $flags = User
::READ_NORMAL
) {
186 $username = User
::getCanonicalName( $username, 'usable' );
187 if ( $username === false ) {
191 list( $db, $options ) = \DBAccessObjectUtils
::getDBOptions( $flags );
192 return (bool)wfGetDB( $db )->selectField(
195 [ 'user_name' => $username ],
201 public function providerAllowsAuthenticationDataChange(
202 AuthenticationRequest
$req, $checkData = true
204 // We only want to blank the password if something else will accept the
205 // new authentication data, so return 'ignore' here.
206 if ( $this->loginOnly
) {
207 return \StatusValue
::newGood( 'ignored' );
210 if ( get_class( $req ) === PasswordAuthenticationRequest
::class ) {
212 return \StatusValue
::newGood();
215 $username = User
::getCanonicalName( $req->username
, 'usable' );
216 if ( $username !== false ) {
217 $row = wfGetDB( DB_MASTER
)->selectRow(
220 [ 'user_name' => $username ],
224 $sv = \StatusValue
::newGood();
225 if ( $req->password
!== null ) {
226 if ( $req->password
!== $req->retype
) {
227 $sv->fatal( 'badretype' );
229 $sv->merge( $this->checkPasswordValidity( $username, $req->password
) );
237 return \StatusValue
::newGood( 'ignored' );
240 public function providerChangeAuthenticationData( AuthenticationRequest
$req ) {
241 $username = $req->username
!== null ? User
::getCanonicalName( $req->username
, 'usable' ) : false;
242 if ( $username === false ) {
248 if ( get_class( $req ) === PasswordAuthenticationRequest
::class ) {
249 if ( $this->loginOnly
) {
250 $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
253 $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password
);
254 $expiry = $this->getNewPasswordExpiry( $username );
259 $dbw = wfGetDB( DB_MASTER
);
263 'user_password' => $pwhash->toString(),
264 'user_password_expires' => $dbw->timestampOrNull( $expiry ),
266 [ 'user_name' => $username ],
272 public function accountCreationType() {
273 return $this->loginOnly ? self
::TYPE_NONE
: self
::TYPE_CREATE
;
276 public function testForAccountCreation( $user, $creator, array $reqs ) {
277 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
279 $ret = \StatusValue
::newGood();
280 if ( !$this->loginOnly
&& $req && $req->username
!== null && $req->password
!== null ) {
281 if ( $req->password
!== $req->retype
) {
282 $ret->fatal( 'badretype' );
285 $this->checkPasswordValidity( $user->getName(), $req->password
)
292 public function beginPrimaryAccountCreation( $user, $creator, array $reqs ) {
293 if ( $this->accountCreationType() === self
::TYPE_NONE
) {
294 throw new \
BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
297 $req = AuthenticationRequest
::getRequestByClass( $reqs, PasswordAuthenticationRequest
::class );
299 if ( $req->username
!== null && $req->password
!== null ) {
300 // Nothing we can do besides claim it, because the user isn't in
302 if ( $req->username
!== $user->getName() ) {
304 $req->username
= $user->getName();
306 $ret = AuthenticationResponse
::newPass( $req->username
);
307 $ret->createRequest
= $req;
311 return AuthenticationResponse
::newAbstain();
314 public function finishAccountCreation( $user, $creator, AuthenticationResponse
$res ) {
315 if ( $this->accountCreationType() === self
::TYPE_NONE
) {
316 throw new \
BadMethodCallException( 'Shouldn\'t call this when accountCreationType() is NONE' );
319 // Now that the user is in the DB, set the password on it.
320 $this->providerChangeAuthenticationData( $res->createRequest
);