aboutsummaryrefslogtreecommitdiffstats
path: root/include/auth.php
diff options
context:
space:
mode:
Diffstat (limited to 'include/auth.php')
-rw-r--r--include/auth.php159
1 files changed, 110 insertions, 49 deletions
diff --git a/include/auth.php b/include/auth.php
index 9643da8eb..f3592cee3 100644
--- a/include/auth.php
+++ b/include/auth.php
@@ -16,55 +16,97 @@ require_once('include/security.php');
/**
* @brief Verify login credentials.
*
- * If system <i>authlog</i> is set a log entry will be added for failed login
+ * If system.authlog is set a log entry will be added for failed login
* attempts.
*
- * @param string $email
- * The email address to verify.
+ * @param string $login
+ * The login to verify (channel address, account email or guest login token).
* @param string $pass
* The provided password to verify.
* @return array|null
* Returns account record on success, null on failure.
+ * The return array is dependent on the login mechanism.
+ * $ret['account'] will be set if either an email or channel address validation was successful (local login).
+ * $ret['channel'] will be set if a channel address validation was successful.
+ * $ret['xchan'] will be set if a guest access token validation was successful.
+ * Keys will exist for invalid return arrays but will be set to null.
+ * This function does not perform a login. It merely validates systems passwords and tokens.
+ *
*/
-function account_verify_password($email, $pass) {
+
+function account_verify_password($login, $pass) {
+
+ $ret = [ 'account' => null, 'channel' => null, 'xchan' => null ];
$email_verify = get_config('system', 'verify_email');
$register_policy = get_config('system', 'register_policy');
+ if(! $login)
+ return null;
+
+ $account = null;
+ $channel = null;
+ $xchan = null;
+
+ if(! strpos($login,'@')) {
+ $channel = channelx_by_nick($login);
+ if(! $channel) {
+ $x = q("select * from atoken where atoken_name = '%s' and atoken_token = '%s' limit 1",
+ dbesc($login),
+ dbesc($pass)
+ );
+ if($x) {
+ $ret['xchan'] = atoken_xchan($x[0]);
+ return $ret;
+ }
+ }
+ }
+ if($channel) {
+ $where = " where account_id = " . intval($channel['channel_account_id']) . " ";
+ }
+ else {
+ $where = " where account_email = '" . dbesc($login) . "' ";
+ }
+
+ $a = q("select * from account $where");
+ if(! $a) {
+ return null;
+ }
+
+ $account = $a[0];
+
// Currently we only verify email address if there is an open registration policy.
// This isn't because of any policy - it's because the workflow gets too complicated if
// you have to verify the email and then go through the account approval workflow before
// letting them login.
- if(($email_verify) && ($register_policy == REGISTER_OPEN) && ($record['account_flags'] & ACCOUNT_UNVERIFIED))
- return null;
-
- $r = q("select * from account where account_email = '%s'",
- dbesc($email)
- );
- if(! ($r && count($r)))
+ if(($email_verify) && ($register_policy == REGISTER_OPEN) && ($account['account_flags'] & ACCOUNT_UNVERIFIED)) {
+ logger('email verification required for ' . $login);
return null;
+ }
- foreach($r as $record) {
- if(($record['account_flags'] == ACCOUNT_OK)
- && (hash('whirlpool', $record['account_salt'] . $pass) === $record['account_password'])) {
- logger('password verified for ' . $email);
- return $record;
- }
+ if(($account['account_flags'] == ACCOUNT_OK)
+ && (hash('whirlpool',$account['account_salt'] . $pass) === $account['account_password'])) {
+ logger('password verified for ' . $login);
+ $ret['account'] = $account;
+ if($channel)
+ $ret['channel'] = $channel;
+ return $ret;
}
- $error = 'password failed for ' . $email;
+
+ $error = 'password failed for ' . $login;
logger($error);
- if($record['account_flags'] & ACCOUNT_UNVERIFIED)
- logger('Account is unverified. account_flags = ' . $record['account_flags']);
- if($record['account_flags'] & ACCOUNT_BLOCKED)
- logger('Account is blocked. account_flags = ' . $record['account_flags']);
- if($record['account_flags'] & ACCOUNT_EXPIRED)
- logger('Account is expired. account_flags = ' . $record['account_flags']);
- if($record['account_flags'] & ACCOUNT_REMOVED)
- logger('Account is removed. account_flags = ' . $record['account_flags']);
- if($record['account_flags'] & ACCOUNT_PENDING)
- logger('Account is pending. account_flags = ' . $record['account_flags']);
+ if($account['account_flags'] & ACCOUNT_UNVERIFIED)
+ logger('Account is unverified. account_flags = ' . $account['account_flags']);
+ if($account['account_flags'] & ACCOUNT_BLOCKED)
+ logger('Account is blocked. account_flags = ' . $account['account_flags']);
+ if($account['account_flags'] & ACCOUNT_EXPIRED)
+ logger('Account is expired. account_flags = ' . $account['account_flags']);
+ if($account['account_flags'] & ACCOUNT_REMOVED)
+ logger('Account is removed. account_flags = ' . $account['account_flags']);
+ if($account['account_flags'] & ACCOUNT_PENDING)
+ logger('Account is pending. account_flags = ' . $account['account_flags']);
log_failed_login($error);
@@ -101,7 +143,7 @@ if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
// process logout request
$args = array('channel_id' => local_channel());
call_hooks('logging_out', $args);
- \Zotlabs\Web\Session::nuke();
+ App::$session->nuke();
info( t('Logged out.') . EOL);
goaway(z_root());
}
@@ -117,16 +159,24 @@ if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
intval(ACCOUNT_ROLE_ADMIN)
);
if($x) {
- \Zotlabs\Web\Session::new_cookie(60 * 60 * 24); // one day
+ App::$session->new_cookie(60 * 60 * 24); // one day
$_SESSION['last_login_date'] = datetime_convert();
unset($_SESSION['visitor_id']); // no longer a visitor
- authenticate_success($x[0], true, true);
+ authenticate_success($x[0], null, true, true);
}
}
-
- $r = q("select * from xchan left join hubloc on xchan_hash = hubloc_hash where xchan_hash = '%s' limit 1",
- dbesc($_SESSION['visitor_id'])
- );
+ if(array_key_exists('atoken',$_SESSION)) {
+ $y = q("select * from atoken where atoken_id = %d limit 1",
+ intval($_SESSION['atoken'])
+ );
+ if($y)
+ $r = array(atoken_xchan($y[0]));
+ }
+ else {
+ $r = q("select * from xchan left join hubloc on xchan_hash = hubloc_hash where xchan_hash = '%s' limit 1",
+ dbesc($_SESSION['visitor_id'])
+ );
+ }
if($r) {
App::set_observer($r[0]);
}
@@ -141,7 +191,7 @@ if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
if(x($_SESSION, 'uid') || x($_SESSION, 'account_id')) {
- Zotlabs\Web\Session::return_check();
+ App::$session->return_check();
$r = q("select * from account where account_id = %d limit 1",
intval($_SESSION['account_id'])
@@ -155,14 +205,15 @@ if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
}
if(strcmp(datetime_convert('UTC','UTC','now - 12 hours'), $_SESSION['last_login_date']) > 0 ) {
$_SESSION['last_login_date'] = datetime_convert();
- Zotlabs\Web\Session::extend_cookie();
+ App::$session->extend_cookie();
$login_refresh = true;
}
- authenticate_success($r[0], false, false, false, $login_refresh);
+ $ch = (($_SESSION['uid']) ? channelx_by_n($_SESSION['uid']) : null);
+ authenticate_success($r[0], null, $ch, false, false, $login_refresh);
}
else {
$_SESSION['account_id'] = 0;
- \Zotlabs\Web\Session::nuke();
+ App::$session->nuke();
goaway(z_root());
}
} // end logged in user returning
@@ -170,7 +221,7 @@ if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
else {
if(isset($_SESSION)) {
- \Zotlabs\Web\Session::nuke();
+ App::$session->nuke();
}
// handle a fresh login request
@@ -199,30 +250,38 @@ else {
call_hooks('authenticate', $addon_auth);
+ $atoken = null;
+ $account = null;
+
if(($addon_auth['authenticated']) && (count($addon_auth['user_record']))) {
- $record = $addon_auth['user_record'];
+ $account = $addon_auth['user_record'];
}
else {
- $record = App::$account = account_verify_password($_POST['username'], $_POST['password']);
+ $verify = account_verify_password($_POST['username'], $_POST['password']);
+ if($verify) {
+ $atoken = $verify['xchan'];
+ $channel = $verify['channel'];
+ $account = App::$account = $verify['account'];
+ }
if(App::$account) {
$_SESSION['account_id'] = App::$account['account_id'];
}
+ elseif($atoken) {
+ atoken_login($atoken);
+ }
else {
notice( t('Failed authentication') . EOL);
}
-
- logger('authenticate: ' . print_r(App::$account, true), LOGGER_ALL);
}
- if((! $record) || (! count($record))) {
+ if(! ($account || $atoken)) {
$error = 'authenticate: failed login attempt: ' . notags(trim($_POST['username'])) . ' from IP ' . $_SERVER['REMOTE_ADDR'];
logger($error);
// Also log failed logins to a separate auth log to reduce overhead for server side intrusion prevention
$authlog = get_config('system', 'authlog');
if ($authlog)
@file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
-
notice( t('Login failed.') . EOL );
goaway(z_root() . '/login');
}
@@ -242,17 +301,18 @@ else {
if($_POST['remember_me']) {
$_SESSION['remember_me'] = 1;
- \Zotlabs\Web\Session::new_cookie(31449600); // one year
+ App::$session->new_cookie(31449600); // one year
}
else {
$_SESSION['remember_me'] = 0;
- \Zotlabs\Web\Session::new_cookie(0); // 0 means delete on browser exit
+ App::$session->new_cookie(0); // 0 means delete on browser exit
}
// if we haven't failed up this point, log them in.
$_SESSION['last_login_date'] = datetime_convert();
- authenticate_success($record, true, true);
+ if(! $atoken)
+ authenticate_success($account,$channel,true, true);
}
}
@@ -270,6 +330,7 @@ else {
* @return int|bool
* Return channel_id from pconfig or false.
*/
+
function match_openid($authid) {
// Query the uid/channel_id from pconfig for a given value.
$r = q("SELECT uid FROM pconfig WHERE cat = 'system' AND k = 'openid' AND v = '%s' LIMIT 1",
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-12 02:23:35 +0000