aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
Diffstat (limited to 'include')
-rw-r--r--include/auth.php127
1 files changed, 74 insertions, 53 deletions
diff --git a/include/auth.php b/include/auth.php
index f8188f443..8f68fc562 100644
--- a/include/auth.php
+++ b/include/auth.php
@@ -1,11 +1,23 @@
-<?php /** @file */
-
+<?php
+/**
+ * @file include/auth.php
+ * @brief Functions and inline functionality for authentication.
+ *
+ * This file provides some functions for authentication handling and inline
+ * functionality. Look for auth parameters or re-validate an existing session
+ * also handles logout.
+ * Also provides a function for OpenID identiy matching.
+ */
require_once('include/security.php');
+/**
+ * @brief Resets the current session.
+ *
+ * @return void
+ */
function nuke_session() {
-
- new_cookie(0);
+ new_cookie(0); // 0 means delete on browser exit
unset($_SESSION['authenticated']);
unset($_SESSION['account_id']);
@@ -27,21 +39,24 @@ function nuke_session() {
}
/**
- * Verify login credentials
- *
- * Returns account record on success, null on failure
+ * @brief Verify login credentials.
*
+ * @param string $email
+ * The email address to verify.
+ * @param string $pass
+ * The provided password to verify.
+ * @return array|null
+ * Returns account record on success, null on failure.
*/
+function account_verify_password($email, $pass) {
-function account_verify_password($email,$pass) {
-
- $email_verify = get_config('system','verify_email');
- $register_policy = get_config('system','register_policy');
+ $email_verify = get_config('system', 'verify_email');
+ $register_policy = get_config('system', 'register_policy');
// Currently we only verify email address if there is an open registration policy.
// This isn't because of any policy - it's because the workflow gets too complicated if
// you have to verify the email and then go through the account approval workflow before
- // letting them login.
+ // letting them login.
if(($email_verify) && ($register_policy == REGISTER_OPEN) && ($record['account_flags'] & ACCOUNT_UNVERIFIED))
return null;
@@ -51,9 +66,10 @@ function account_verify_password($email,$pass) {
);
if(! ($r && count($r)))
return null;
+
foreach($r as $record) {
if(($record['account_flags'] == ACCOUNT_OK)
- && (hash('whirlpool',$record['account_salt'] . $pass) === $record['account_password'])) {
+ && (hash('whirlpool', $record['account_salt'] . $pass) === $record['account_password'])) {
logger('password verified for ' . $email);
return $record;
}
@@ -61,7 +77,6 @@ function account_verify_password($email,$pass) {
$error = 'password failed for ' . $email;
logger($error);
-
if($record['account_flags'] & ACCOUNT_UNVERIFIED)
logger('Account is unverified. account_flags = ' . $record['account_flags']);
if($record['account_flags'] & ACCOUNT_BLOCKED)
@@ -88,14 +103,12 @@ function account_verify_password($email,$pass) {
* also handles logout
*/
-
-if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
-
+if((isset($_SESSION)) && (x($_SESSION, 'authenticated')) &&
+ ((! (x($_POST, 'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
// process a logout request
- if(((x($_POST,'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
-
+ if(((x($_POST, 'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
// process logout request
$args = array('channel_id' => local_user());
call_hooks('logging_out', $args);
@@ -106,16 +119,16 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
// re-validate a visitor, optionally invoke "su" if permitted to do so
- if(x($_SESSION,'visitor_id') && (! x($_SESSION,'uid'))) {
+ if(x($_SESSION, 'visitor_id') && (! x($_SESSION, 'uid'))) {
// if our authenticated guest is allowed to take control of the admin channel, make it so.
- $admins = get_config('system','remote_admin');
- if($admins && is_array($admins) && in_array($_SESSION['visitor_id'],$admins)) {
+ $admins = get_config('system', 'remote_admin');
+ if($admins && is_array($admins) && in_array($_SESSION['visitor_id'], $admins)) {
$x = q("select * from account where account_email = '%s' and account_email != '' and ( account_flags & %d ) limit 1",
- dbesc(get_config('system','admin_email')),
+ dbesc(get_config('system', 'admin_email')),
intval(ACCOUNT_ROLE_ADMIN)
);
if($x) {
- new_cookie(60*60*24); // one day
+ new_cookie(60 * 60 * 24); // one day
$_SESSION['last_login_date'] = datetime_convert();
unset($_SESSION['visitor_id']); // no longer a visitor
authenticate_success($x[0], true, true);
@@ -137,20 +150,19 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
// already logged in user returning
- if(x($_SESSION,'uid') || x($_SESSION,'account_id')) {
+ if(x($_SESSION, 'uid') || x($_SESSION, 'account_id')) {
// first check if we're enforcing that sessions can't change IP address
-
+ // @todo what to do with IPv6 addresses
if($_SESSION['addr'] && $_SESSION['addr'] != $_SERVER['REMOTE_ADDR']) {
logger('SECURITY: Session IP address changed: ' . $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
- $partial1 = substr($_SESSION['addr'],0,strrpos($_SESSION['addr'],'.'));
- $partial2 = substr($_SERVER['REMOTE_ADDR'],0,strrpos($_SERVER['REMOTE_ADDR'],'.'));
+ $partial1 = substr($_SESSION['addr'], 0, strrpos($_SESSION['addr'], '.'));
+ $partial2 = substr($_SERVER['REMOTE_ADDR'], 0, strrpos($_SERVER['REMOTE_ADDR'], '.'));
-
- $paranoia = intval(get_pconfig($_SESSION['uid'],'system','paranoia'));
+ $paranoia = intval(get_pconfig($_SESSION['uid'], 'system', 'paranoia'));
if(! $paranoia)
- $paranoia = intval(get_config('system','paranoia'));
+ $paranoia = intval(get_config('system', 'paranoia'));
switch($paranoia) {
case 0:
@@ -158,8 +170,8 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
break;
case 2:
// check 2 octets
- $partial1 = substr($partial1,0,strrpos($partial1,'.'));
- $partial2 = substr($partial2,0,strrpos($partial2,'.'));
+ $partial1 = substr($partial1, 0, strrpos($partial1, '.'));
+ $partial2 = substr($partial2, 0, strrpos($partial2, '.'));
if($partial1 == $partial2)
break;
case 1:
@@ -169,12 +181,11 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
case 3:
default:
// check any difference at all
- logger('Session address changed. Paranoid setting in effect, blocking session. '
+ logger('Session address changed. Paranoid setting in effect, blocking session. '
. $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
nuke_session();
goaway(z_root());
break;
-
}
}
@@ -191,17 +202,15 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
if(strcmp(datetime_convert('UTC','UTC','now - 12 hours'), $_SESSION['last_login_date']) > 0 ) {
$_SESSION['last_login_date'] = datetime_convert();
$login_refresh = true;
- }
- authenticate_success($r[0], false, false, false, $login_refresh);
+ }
+ authenticate_success($r[0], false, false, false, $login_refresh);
}
else {
$_SESSION['account_id'] = 0;
nuke_session();
goaway(z_root());
}
-
- }
-
+ } // end logged in user returning
}
else {
@@ -211,10 +220,10 @@ else {
// handle a fresh login request
- if((x($_POST,'password')) && strlen($_POST['password']))
- $encrypted = hash('whirlpool',trim($_POST['password']));
+ if((x($_POST, 'password')) && strlen($_POST['password']))
+ $encrypted = hash('whirlpool', trim($_POST['password']));
- if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') {
+ if((x($_POST, 'auth-params')) && $_POST['auth-params'] === 'login') {
$record = null;
@@ -239,8 +248,7 @@ else {
$record = $addon_auth['user_record'];
}
else {
-
- $record = get_app()->account = account_verify_password($_POST['username'],$_POST['password']);
+ $record = get_app()->account = account_verify_password($_POST['username'], $_POST['password']);
if(get_app()->account) {
$_SESSION['account_id'] = get_app()->account['account_id'];
@@ -249,21 +257,20 @@ else {
notice( t('Failed authentication') . EOL);
}
- logger('authenticate: ' . print_r(get_app()->account,true), LOGGER_DEBUG);
-
+ logger('authenticate: ' . print_r(get_app()->account, true), LOGGER_DEBUG);
}
if((! $record) || (! count($record))) {
$error = 'authenticate: failed login attempt: ' . notags(trim($_POST['username'])) . ' from IP ' . $_SERVER['REMOTE_ADDR'];
logger($error);
// Also log failed logins to a separate auth log to reduce overhead for server side intrusion prevention
- $authlog = get_config('system', 'authlog');
- if ($authlog)
- @file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
+ $authlog = get_config('system', 'authlog');
+ if ($authlog)
+ @file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
notice( t('Login failed.') . EOL );
goaway(z_root());
- }
+ }
// If the user specified to remember the authentication, then change the cookie
// to expire after one year (the default is when the browser is closed).
@@ -293,11 +300,25 @@ else {
}
+/**
+ * @brief Returns the channel_id for a given openid_identity.
+ *
+ * Queries the values from pconfig configuration for the given openid_identity
+ * and returns the corresponding channel_id.
+ *
+ * @fixme How do we prevent that an OpenID identity is used more than once?
+ *
+ * @param string $authid
+ * The given openid_identity
+ * @return int|bool
+ * Return channel_id from pconfig or false.
+ */
function match_openid($authid) {
- $r = q("select * from pconfig where cat = 'system' and k = 'openid' and v = '%s' limit 1",
+ // Query the uid/channel_id from pconfig for a given value.
+ $r = q("SELECT uid FROM pconfig WHERE cat = 'system' AND k = 'openid' AND v = '%s' LIMIT 1",
dbesc($authid)
);
if($r)
return $r[0]['uid'];
return false;
-}
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 18:37:12 +0000