1 files changed, 128 insertions, 53 deletions

diff --git a/include/auth.php b/include/auth.php
index 8e02b7b4f..c4bbaf546 100644
--- a/include/auth.php
+++ b/include/auth.php
@@ -1,11 +1,23 @@
-<?php /** @file */
-
+<?php
+/**
+ * @file include/auth.php
+ * @brief Functions and inline functionality for authentication.
+ *
+ * This file provides some functions for authentication handling and inline
+ * functionality. Look for auth parameters or re-validate an existing session
+ * also handles logout.
+ * Also provides a function for OpenID identiy matching.
+ */
 
 require_once('include/security.php');
 
+/**
+ * @brief Resets the current session.
+ *
+ * @return void
+ */
 function nuke_session() {
-
-	new_cookie(0);
+	new_cookie(0); // 0 means delete on browser exit
 
 	unset($_SESSION['authenticated']);
 	unset($_SESSION['account_id']);
@@ -27,21 +39,27 @@ function nuke_session() {
 }
 
 /**
- * Verify login credentials
+ * @brief Verify login credentials.
  *
- * Returns account record on success, null on failure
+ * If system <i>authlog</i> is set a log entry will be added for failed login
+ * attempts.
  *
+ * @param string $email
+ *  The email address to verify.
+ * @param string $pass
+ *  The provided password to verify.
+ * @return array|null
+ *  Returns account record on success, null on failure.
  */
+function account_verify_password($email, $pass) {
 
-function account_verify_password($email,$pass) {
-
-	$email_verify = get_config('system','verify_email');
-	$register_policy = get_config('system','register_policy');
+	$email_verify = get_config('system', 'verify_email');
+	$register_policy = get_config('system', 'register_policy');
 
 	// Currently we only verify email address if there is an open registration policy.
 	// This isn't because of any policy - it's because the workflow gets too complicated if 
 	// you have to verify the email and then go through the account approval workflow before
-	// letting them login.  
+	// letting them login.
 
 	if(($email_verify) && ($register_policy == REGISTER_OPEN) && ($record['account_flags'] & ACCOUNT_UNVERIFIED))
 		return null;
@@ -51,23 +69,47 @@ function account_verify_password($email,$pass) {
 	);
 	if(! ($r && count($r)))
 		return null;
+
 	foreach($r as $record) {
 		if(($record['account_flags'] == ACCOUNT_OK)
-			&& (hash('whirlpool',$record['account_salt'] . $pass) === $record['account_password'])) {
+			&& (hash('whirlpool', $record['account_salt'] . $pass) === $record['account_password'])) {
 			logger('password verified for ' . $email);
 			return $record;
 		}
 	}
 	$error = 'password failed for ' . $email;
 	logger($error);
-	// Also log failed logins to a separate auth log to reduce overhead for server side intrusion prevention
-	$authlog = get_config('system', 'authlog');
-	if ($authlog)
-		@file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
+
+	if($record['account_flags'] & ACCOUNT_UNVERIFIED)
+		logger('Account is unverified. account_flags = ' . $record['account_flags']);
+	if($record['account_flags'] & ACCOUNT_BLOCKED)
+		logger('Account is blocked. account_flags = ' . $record['account_flags']);
+	if($record['account_flags'] & ACCOUNT_EXPIRED)
+		logger('Account is expired. account_flags = ' . $record['account_flags']);
+	if($record['account_flags'] & ACCOUNT_REMOVED)
+		logger('Account is removed. account_flags = ' . $record['account_flags']);
+	if($record['account_flags'] & ACCOUNT_PENDING)
+		logger('Account is pending. account_flags = ' . $record['account_flags']);
+
+	log_failed_login($error);
 
 	return null;
 }
 
+/**
+ * @brief Log failed logins to a separate auth log.
+ *
+ * Can be used to reduce overhead for server side intrusion prevention, like
+ * parse the authlog file with something like fail2ban, OSSEC, etc.
+ *
+ * @param string $errormsg
+ *  Error message to display for failed login.
+ */
+function log_failed_login($errormsg) {
+	$authlog = get_config('system', 'authlog');
+	if ($authlog)
+		@file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $errormsg . PHP_EOL, FILE_APPEND);
+}
 
 /**
  * Inline - not a function
@@ -75,14 +117,12 @@ function account_verify_password($email,$pass) {
  * also handles logout
  */
 
-
-if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
-
+if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
+	((! (x($_POST, 'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
 
 	// process a logout request
 
-	if(((x($_POST,'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
-	
+	if(((x($_POST, 'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
 		// process logout request
 		$args = array('channel_id' => local_user());
 		call_hooks('logging_out', $args);
@@ -93,16 +133,16 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
 
 	// re-validate a visitor, optionally invoke "su" if permitted to do so
 
-	if(x($_SESSION,'visitor_id') && (! x($_SESSION,'uid'))) {
+	if(x($_SESSION, 'visitor_id') && (! x($_SESSION, 'uid'))) {
 		// if our authenticated guest is allowed to take control of the admin channel, make it so.
-		$admins = get_config('system','remote_admin');
-		if($admins && is_array($admins) && in_array($_SESSION['visitor_id'],$admins)) {
-			$x = q("select * from account where account_email = '%s' and account_email != '' and ( account_flags & %d ) limit 1",
-				dbesc(get_config('system','admin_email')),
+		$admins = get_config('system', 'remote_admin');
+		if($admins && is_array($admins) && in_array($_SESSION['visitor_id'], $admins)) {
+			$x = q("select * from account where account_email = '%s' and account_email != '' and ( account_flags & %d )>0 limit 1",
+				dbesc(get_config('system', 'admin_email')),
 				intval(ACCOUNT_ROLE_ADMIN)
 			);
 			if($x) {
-				new_cookie(60*60*24); // one day
+				new_cookie(60 * 60 * 24); // one day
 				$_SESSION['last_login_date'] = datetime_convert();
 				unset($_SESSION['visitor_id']); // no longer a visitor
 				authenticate_success($x[0], true, true);
@@ -124,17 +164,42 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
 
 	// already logged in user returning
 
-	if(x($_SESSION,'uid') || x($_SESSION,'account_id')) {
+	if(x($_SESSION, 'uid') || x($_SESSION, 'account_id')) {
 
 		// first check if we're enforcing that sessions can't change IP address
-
-		if($_SESSION['addr'] != $_SERVER['REMOTE_ADDR']) {
+		// @todo what to do with IPv6 addresses
+		if($_SESSION['addr'] && $_SESSION['addr'] != $_SERVER['REMOTE_ADDR']) {
 			logger('SECURITY: Session IP address changed: ' . $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
-			if(get_config('system','paranoia')) {
-				logger('Session address changed. Paranoid setting in effect, blocking session. ' 
+
+			$partial1 = substr($_SESSION['addr'], 0, strrpos($_SESSION['addr'], '.')); 
+			$partial2 = substr($_SERVER['REMOTE_ADDR'], 0, strrpos($_SERVER['REMOTE_ADDR'], '.')); 
+
+			$paranoia = intval(get_pconfig($_SESSION['uid'], 'system', 'paranoia'));
+			if(! $paranoia)
+				$paranoia = intval(get_config('system', 'paranoia'));
+
+			switch($paranoia) {
+				case 0:
+					// no IP checking
+					break;
+				case 2:
+					// check 2 octets
+					$partial1 = substr($partial1, 0, strrpos($partial1, '.'));
+					$partial2 = substr($partial2, 0, strrpos($partial2, '.'));
+					if($partial1 == $partial2)
+						break;
+				case 1:
+					// check 3 octets
+					if($partial1 == $partial2)
+						break;
+				case 3:
+				default:
+					// check any difference at all
+					logger('Session address changed. Paranoid setting in effect, blocking session. '
 					. $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
-				nuke_session();
-				goaway(z_root());
+					nuke_session();
+					goaway(z_root());
+					break;
 			}
 		}
 
@@ -151,17 +216,15 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
 			if(strcmp(datetime_convert('UTC','UTC','now - 12 hours'), $_SESSION['last_login_date']) > 0 ) {
 				$_SESSION['last_login_date'] = datetime_convert();
 				$login_refresh = true;
-        	}
-        	authenticate_success($r[0], false, false, false, $login_refresh);
+			}
+			authenticate_success($r[0], false, false, false, $login_refresh);
 		}
 		else {
 			$_SESSION['account_id'] = 0;
 			nuke_session();
 			goaway(z_root());
 		}
-
-	}
-
+	} // end logged in user returning
 }
 else {
 
@@ -171,10 +234,10 @@ else {
 
 	// handle a fresh login request
 
-	if((x($_POST,'password')) && strlen($_POST['password']))
-		$encrypted = hash('whirlpool',trim($_POST['password']));
+	if((x($_POST, 'password')) && strlen($_POST['password']))
+		$encrypted = hash('whirlpool', trim($_POST['password']));
 
-	if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') {
+	if((x($_POST, 'auth-params')) && $_POST['auth-params'] === 'login') {
 
 		$record = null;
 
@@ -199,8 +262,7 @@ else {
 			$record = $addon_auth['user_record'];
 		}
 		else {
-
-			$record = get_app()->account = account_verify_password($_POST['username'],$_POST['password']);
+			$record = get_app()->account = account_verify_password($_POST['username'], $_POST['password']);
 
 			if(get_app()->account) {
 				$_SESSION['account_id'] = get_app()->account['account_id'];
@@ -209,21 +271,20 @@ else {
 				notice( t('Failed authentication') . EOL);
 			}
 
-			logger('authenticate: ' . print_r(get_app()->account,true), LOGGER_DEBUG);
-
+			logger('authenticate: ' . print_r(get_app()->account, true), LOGGER_DEBUG);
 		}
 
 		if((! $record) || (! count($record))) {
 			$error = 'authenticate: failed login attempt: ' . notags(trim($_POST['username'])) . ' from IP ' . $_SERVER['REMOTE_ADDR'];
 			logger($error); 
 			// Also log failed logins to a separate auth log to reduce overhead for server side intrusion prevention
-		        $authlog = get_config('system', 'authlog');
-		        if ($authlog)
-		        @file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
+			$authlog = get_config('system', 'authlog');
+			if ($authlog)
+				@file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
 
 			notice( t('Login failed.') . EOL );
-			goaway(z_root());
-  		}
+			goaway(z_root() . '/login');
+		}
 
 		// If the user specified to remember the authentication, then change the cookie
 		// to expire after one year (the default is when the browser is closed).
@@ -253,11 +314,25 @@ else {
 }
 
 
+/**
+ * @brief Returns the channel_id for a given openid_identity.
+ *
+ * Queries the values from pconfig configuration for the given openid_identity
+ * and returns the corresponding channel_id.
+ *
+ * @fixme How do we prevent that an OpenID identity is used more than once?
+ * 
+ * @param string $authid
+ *  The given openid_identity
+ * @return int|bool
+ *  Return channel_id from pconfig or false.
+ */
 function match_openid($authid) {
-	$r = q("select * from pconfig where cat = 'system' and k = 'openid' and v = '%s' limit 1",
+	// Query the uid/channel_id from pconfig for a given value.
+	$r = q("SELECT uid FROM pconfig WHERE cat = 'system' AND k = 'openid' AND v = '%s' LIMIT 1",
 		dbesc($authid)
 	);
 	if($r)
 		return $r[0]['uid'];
 	return false;
-}					
+}