inc/auth.php

   1 <?php
   2 /**
   3  * Authentication library
   4  *
   5  * Including this file will automatically try to login
   6  * a user by calling auth_login()
   7  *
   8  * @license    GPL 2 (http://www.gnu.org/licenses/gpl.html)
   9  * @author     Andreas Gohr <andi@splitbrain.org>
  10  */
  11
  12 use dokuwiki\Extension\AuthPlugin;
  13 use dokuwiki\Extension\Event;
  14 use dokuwiki\Extension\PluginController;
  15 use dokuwiki\PassHash;
  16 use dokuwiki\Subscriptions\RegistrationSubscriptionSender;
  17
  18 /**
  19  * Initialize the auth system.
  20  *
  21  * This function is automatically called at the end of init.php
  22  *
  23  * This used to be the main() of the auth.php
  24  *
  25  * @todo backend loading maybe should be handled by the class autoloader
  26  * @todo maybe split into multiple functions at the XXX marked positions
  27  * @triggers AUTH_LOGIN_CHECK
  28  * @return bool
  29  */
  30 function auth_setup() {
  31     global $conf;
  32     /* @var AuthPlugin $auth */
  33     global $auth;
  34     /* @var Input $INPUT */
  35     global $INPUT;
  36     global $AUTH_ACL;
  37     global $lang;
  38     /* @var PluginController $plugin_controller */
  39     global $plugin_controller;
  40     $AUTH_ACL = array();
  41
  42     if(!$conf['useacl']) return false;
  43
  44     // try to load auth backend from plugins
  45     foreach ($plugin_controller->getList('auth') as $plugin) {
  46         if ($conf['authtype'] === $plugin) {
  47             $auth = $plugin_controller->load('auth', $plugin);
  48             break;
  49         }
  50     }
  51
  52     if(!isset($auth) || !$auth){
  53         msg($lang['authtempfail'], -1);
  54         return false;
  55     }
  56
  57     if ($auth->success == false) {
  58         // degrade to unauthenticated user
  59         $auth = null;
  60         auth_logoff();
  61         msg($lang['authtempfail'], -1);
  62         return false;
  63     }
  64
  65     // do the login either by cookie or provided credentials XXX
  66     $INPUT->set('http_credentials', false);
  67     if(!$conf['rememberme']) $INPUT->set('r', false);
  68
  69     // Populate Basic Auth user/password from Authorization header
  70     // Note: with FastCGI, data is in REDIRECT_HTTP_AUTHORIZATION instead of HTTP_AUTHORIZATION
  71     $header = $INPUT->server->str('HTTP_AUTHORIZATION') ?: $INPUT->server->str('REDIRECT_HTTP_AUTHORIZATION');
  72     if(preg_match( '~^Basic ([a-z\d/+]*={0,2})$~i', $header, $matches )) {
  73         $userpass = explode(':', base64_decode($matches[1]));
  74         list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = $userpass;
  75     }
  76
  77     // if no credentials were given try to use HTTP auth (for SSO)
  78     if (!$INPUT->str('u') && empty($_COOKIE[DOKU_COOKIE]) && !empty($INPUT->server->str('PHP_AUTH_USER'))) {
  79         $INPUT->set('u', $INPUT->server->str('PHP_AUTH_USER'));
  80         $INPUT->set('p', $INPUT->server->str('PHP_AUTH_PW'));
  81         $INPUT->set('http_credentials', true);
  82     }
  83
  84     // apply cleaning (auth specific user names, remove control chars)
  85     if (true === $auth->success) {
  86         $INPUT->set('u', $auth->cleanUser(stripctl($INPUT->str('u'))));
  87         $INPUT->set('p', stripctl($INPUT->str('p')));
  88     }
  89
  90     $ok = null;
  91     if (!is_null($auth) && $auth->canDo('external')) {
  92         $ok = $auth->trustExternal($INPUT->str('u'), $INPUT->str('p'), $INPUT->bool('r'));
  93     }
  94
  95     if ($ok === null) {
  96         // external trust mechanism not in place, or returns no result,
  97         // then attempt auth_login
  98         $evdata = array(
  99             'user'     => $INPUT->str('u'),
 100             'password' => $INPUT->str('p'),
 101             'sticky'   => $INPUT->bool('r'),
 102             'silent'   => $INPUT->bool('http_credentials')
 103         );
 104         Event::createAndTrigger('AUTH_LOGIN_CHECK', $evdata, 'auth_login_wrapper');
 105     }
 106
 107     //load ACL into a global array XXX
 108     $AUTH_ACL = auth_loadACL();
 109
 110     return true;
 111 }
 112
 113 /**
 114  * Loads the ACL setup and handle user wildcards
 115  *
 116  * @author Andreas Gohr <andi@splitbrain.org>
 117  *
 118  * @return array
 119  */
 120 function auth_loadACL() {
 121     global $config_cascade;
 122     global $USERINFO;
 123     /* @var Input $INPUT */
 124     global $INPUT;
 125
 126     if(!is_readable($config_cascade['acl']['default'])) return array();
 127
 128     $acl = file($config_cascade['acl']['default']);
 129
 130     $out = array();
 131     foreach($acl as $line) {
 132         $line = trim($line);
 133         if(empty($line) || ($line[0] == '#')) continue; // skip blank lines & comments
 134         list($id,$rest) = preg_split('/[ \t]+/',$line,2);
 135
 136         // substitute user wildcard first (its 1:1)
 137         if(strstr($line, '%USER%')){
 138             // if user is not logged in, this ACL line is meaningless - skip it
 139             if (!$INPUT->server->has('REMOTE_USER')) continue;
 140
 141             $id   = str_replace('%USER%',cleanID($INPUT->server->str('REMOTE_USER')),$id);
 142             $rest = str_replace('%USER%',auth_nameencode($INPUT->server->str('REMOTE_USER')),$rest);
 143         }
 144
 145         // substitute group wildcard (its 1:m)
 146         if(strstr($line, '%GROUP%')){
 147             // if user is not logged in, grps is empty, no output will be added (i.e. skipped)
 148             if(isset($USERINFO['grps'])){
 149                 foreach((array) $USERINFO['grps'] as $grp){
 150                     $nid   = str_replace('%GROUP%',cleanID($grp),$id);
 151                     $nrest = str_replace('%GROUP%','@'.auth_nameencode($grp),$rest);
 152                     $out[] = "$nid\t$nrest";
 153                 }
 154             }
 155         } else {
 156             $out[] = "$id\t$rest";
 157         }
 158     }
 159
 160     return $out;
 161 }
 162
 163 /**
 164  * Event hook callback for AUTH_LOGIN_CHECK
 165  *
 166  * @param array $evdata
 167  * @return bool
 168  */
 169 function auth_login_wrapper($evdata) {
 170     return auth_login(
 171         $evdata['user'],
 172         $evdata['password'],
 173         $evdata['sticky'],
 174         $evdata['silent']
 175     );
 176 }
 177
 178 /**
 179  * This tries to login the user based on the sent auth credentials
 180  *
 181  * The authentication works like this: if a username was given
 182  * a new login is assumed and user/password are checked. If they
 183  * are correct the password is encrypted with blowfish and stored
 184  * together with the username in a cookie - the same info is stored
 185  * in the session, too. Additonally a browserID is stored in the
 186  * session.
 187  *
 188  * If no username was given the cookie is checked: if the username,
 189  * crypted password and browserID match between session and cookie
 190  * no further testing is done and the user is accepted
 191  *
 192  * If a cookie was found but no session info was availabe the
 193  * blowfish encrypted password from the cookie is decrypted and
 194  * together with username rechecked by calling this function again.
 195  *
 196  * On a successful login $_SERVER[REMOTE_USER] and $USERINFO
 197  * are set.
 198  *
 199  * @author  Andreas Gohr <andi@splitbrain.org>
 200  *
 201  * @param   string  $user    Username
 202  * @param   string  $pass    Cleartext Password
 203  * @param   bool    $sticky  Cookie should not expire
 204  * @param   bool    $silent  Don't show error on bad auth
 205  * @return  bool             true on successful auth
 206  */
 207 function auth_login($user, $pass, $sticky = false, $silent = false) {
 208     global $USERINFO;
 209     global $conf;
 210     global $lang;
 211     /* @var AuthPlugin $auth */
 212     global $auth;
 213     /* @var Input $INPUT */
 214     global $INPUT;
 215
 216     $sticky ? $sticky = true : $sticky = false; //sanity check
 217
 218     if(!$auth) return false;
 219
 220     if(!empty($user)) {
 221         //usual login
 222         if(!empty($pass) && $auth->checkPass($user, $pass)) {
 223             // make logininfo globally available
 224             $INPUT->server->set('REMOTE_USER', $user);
 225             $secret                 = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
 226             auth_setCookie($user, auth_encrypt($pass, $secret), $sticky);
 227             return true;
 228         } else {
 229             //invalid credentials - log off
 230             if(!$silent) {
 231                 http_status(403, 'Login failed');
 232                 msg($lang['badlogin'], -1);
 233             }
 234             auth_logoff();
 235             return false;
 236         }
 237     } else {
 238         // read cookie information
 239         list($user, $sticky, $pass) = auth_getCookie();
 240         if($user && $pass) {
 241             // we got a cookie - see if we can trust it
 242
 243             // get session info
 244             if (isset($_SESSION[DOKU_COOKIE])) {
 245                 $session = $_SESSION[DOKU_COOKIE]['auth'];
 246                 if (isset($session) &&
 247                     $auth->useSessionCache($user) &&
 248                     ($session['time'] >= time() - $conf['auth_security_timeout']) &&
 249                     ($session['user'] == $user) &&
 250                     ($session['pass'] == sha1($pass)) && //still crypted
 251                     ($session['buid'] == auth_browseruid())
 252                 ) {
 253
 254                     // he has session, cookie and browser right - let him in
 255                     $INPUT->server->set('REMOTE_USER', $user);
 256                     $USERINFO = $session['info']; //FIXME move all references to session
 257                     return true;
 258                 }
 259             }
 260             // no we don't trust it yet - recheck pass but silent
 261             $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
 262             $pass   = auth_decrypt($pass, $secret);
 263             return auth_login($user, $pass, $sticky, true);
 264         }
 265     }
 266     //just to be sure
 267     auth_logoff(true);
 268     return false;
 269 }
 270
 271 /**
 272  * Builds a pseudo UID from browser and IP data
 273  *
 274  * This is neither unique nor unfakable - still it adds some
 275  * security. Using the first part of the IP makes sure
 276  * proxy farms like AOLs are still okay.
 277  *
 278  * @author  Andreas Gohr <andi@splitbrain.org>
 279  *
 280  * @return  string  a SHA256 sum of various browser headers
 281  */
 282 function auth_browseruid() {
 283     /* @var Input $INPUT */
 284     global $INPUT;
 285
 286     $ip = clientIP(true);
 287     // convert IP string to packed binary representation
 288     $pip = inet_pton($ip);
 289
 290     $uid = implode("\n", [
 291         $INPUT->server->str('HTTP_USER_AGENT'),
 292         $INPUT->server->str('HTTP_ACCEPT_LANGUAGE'),
 293         substr($pip, 0, strlen($pip) / 2), // use half of the IP address (works for both IPv4 and IPv6)
 294     ]);
 295     return hash('sha256', $uid);
 296 }
 297
 298 /**
 299  * Creates a random key to encrypt the password in cookies
 300  *
 301  * This function tries to read the password for encrypting
 302  * cookies from $conf['metadir'].'/_htcookiesalt'
 303  * if no such file is found a random key is created and
 304  * and stored in this file.
 305  *
 306  * @author  Andreas Gohr <andi@splitbrain.org>
 307  *
 308  * @param   bool $addsession if true, the sessionid is added to the salt
 309  * @param   bool $secure     if security is more important than keeping the old value
 310  * @return  string
 311  */
 312 function auth_cookiesalt($addsession = false, $secure = false) {
 313     if (defined('SIMPLE_TEST')) {
 314         return 'test';
 315     }
 316     global $conf;
 317     $file = $conf['metadir'].'/_htcookiesalt';
 318     if ($secure || !file_exists($file)) {
 319         $file = $conf['metadir'].'/_htcookiesalt2';
 320     }
 321     $salt = io_readFile($file);
 322     if(empty($salt)) {
 323         $salt = bin2hex(auth_randombytes(64));
 324         io_saveFile($file, $salt);
 325     }
 326     if($addsession) {
 327         $salt .= session_id();
 328     }
 329     return $salt;
 330 }
 331
 332 /**
 333  * Return cryptographically secure random bytes.
 334  *
 335  * @author Niklas Keller <me@kelunik.com>
 336  *
 337  * @param int $length number of bytes
 338  * @return string cryptographically secure random bytes
 339  */
 340 function auth_randombytes($length) {
 341     return random_bytes($length);
 342 }
 343
 344 /**
 345  * Cryptographically secure random number generator.
 346  *
 347  * @author Niklas Keller <me@kelunik.com>
 348  *
 349  * @param int $min
 350  * @param int $max
 351  * @return int
 352  */
 353 function auth_random($min, $max) {
 354     return random_int($min, $max);
 355 }
 356
 357 /**
 358  * Encrypt data using the given secret using AES
 359  *
 360  * The mode is CBC with a random initialization vector, the key is derived
 361  * using pbkdf2.
 362  *
 363  * @param string $data   The data that shall be encrypted
 364  * @param string $secret The secret/password that shall be used
 365  * @return string The ciphertext
 366  */
 367 function auth_encrypt($data, $secret) {
 368     $iv     = auth_randombytes(16);
 369     $cipher = new \phpseclib\Crypt\AES();
 370     $cipher->setPassword($secret);
 371
 372     /*
 373     this uses the encrypted IV as IV as suggested in
 374     http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, Appendix C
 375     for unique but necessarily random IVs. The resulting ciphertext is
 376     compatible to ciphertext that was created using a "normal" IV.
 377     */
 378     return $cipher->encrypt($iv.$data);
 379 }
 380
 381 /**
 382  * Decrypt the given AES ciphertext
 383  *
 384  * The mode is CBC, the key is derived using pbkdf2
 385  *
 386  * @param string $ciphertext The encrypted data
 387  * @param string $secret     The secret/password that shall be used
 388  * @return string The decrypted data
 389  */
 390 function auth_decrypt($ciphertext, $secret) {
 391     $iv     = substr($ciphertext, 0, 16);
 392     $cipher = new \phpseclib\Crypt\AES();
 393     $cipher->setPassword($secret);
 394     $cipher->setIV($iv);
 395
 396     return $cipher->decrypt(substr($ciphertext, 16));
 397 }
 398
 399 /**
 400  * Log out the current user
 401  *
 402  * This clears all authentication data and thus log the user
 403  * off. It also clears session data.
 404  *
 405  * @author  Andreas Gohr <andi@splitbrain.org>
 406  *
 407  * @param bool $keepbc - when true, the breadcrumb data is not cleared
 408  */
 409 function auth_logoff($keepbc = false) {
 410     global $conf;
 411     global $USERINFO;
 412     /* @var AuthPlugin $auth */
 413     global $auth;
 414     /* @var Input $INPUT */
 415     global $INPUT;
 416
 417     // make sure the session is writable (it usually is)
 418     @session_start();
 419
 420     if(isset($_SESSION[DOKU_COOKIE]['auth']['user']))
 421         unset($_SESSION[DOKU_COOKIE]['auth']['user']);
 422     if(isset($_SESSION[DOKU_COOKIE]['auth']['pass']))
 423         unset($_SESSION[DOKU_COOKIE]['auth']['pass']);
 424     if(isset($_SESSION[DOKU_COOKIE]['auth']['info']))
 425         unset($_SESSION[DOKU_COOKIE]['auth']['info']);
 426     if(!$keepbc && isset($_SESSION[DOKU_COOKIE]['bc']))
 427         unset($_SESSION[DOKU_COOKIE]['bc']);
 428     $INPUT->server->remove('REMOTE_USER');
 429     $USERINFO = null; //FIXME
 430
 431     $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir'];
 432     setcookie(DOKU_COOKIE, '', time() - 600000, $cookieDir, '', ($conf['securecookie'] && is_ssl()), true);
 433
 434     if($auth) $auth->logOff();
 435 }
 436
 437 /**
 438  * Check if a user is a manager
 439  *
 440  * Should usually be called without any parameters to check the current
 441  * user.
 442  *
 443  * The info is available through $INFO['ismanager'], too
 444  *
 445  * @param string $user Username
 446  * @param array $groups List of groups the user is in
 447  * @param bool $adminonly when true checks if user is admin
 448  * @param bool $recache set to true to refresh the cache
 449  * @return bool
 450  * @see    auth_isadmin
 451  *
 452  * @author Andreas Gohr <andi@splitbrain.org>
 453  */
 454 function auth_ismanager($user = null, $groups = null, $adminonly = false, $recache=false) {
 455     global $conf;
 456     global $USERINFO;
 457     /* @var AuthPlugin $auth */
 458     global $auth;
 459     /* @var Input $INPUT */
 460     global $INPUT;
 461
 462
 463     if(!$auth) return false;
 464     if(is_null($user)) {
 465         if(!$INPUT->server->has('REMOTE_USER')) {
 466             return false;
 467         } else {
 468             $user = $INPUT->server->str('REMOTE_USER');
 469         }
 470     }
 471     if (is_null($groups)) {
 472         // checking the logged in user, or another one?
 473         if ($USERINFO && $user === $INPUT->server->str('REMOTE_USER')) {
 474             $groups =  (array) $USERINFO['grps'];
 475         } else {
 476             $groups = $auth->getUserData($user);
 477             $groups = $groups ? $groups['grps'] : [];
 478         }
 479     }
 480
 481     // prefer cached result
 482     static $cache = [];
 483     $cachekey = serialize([$user, $adminonly, $groups]);
 484     if (!isset($cache[$cachekey]) || $recache) {
 485         // check superuser match
 486         $ok = auth_isMember($conf['superuser'], $user, $groups);
 487
 488         // check managers
 489         if (!$ok && !$adminonly) {
 490             $ok = auth_isMember($conf['manager'], $user, $groups);
 491         }
 492
 493         $cache[$cachekey] = $ok;
 494     }
 495
 496     return $cache[$cachekey];
 497 }
 498
 499 /**
 500  * Check if a user is admin
 501  *
 502  * Alias to auth_ismanager with adminonly=true
 503  *
 504  * The info is available through $INFO['isadmin'], too
 505  *
 506  * @param string $user Username
 507  * @param array $groups List of groups the user is in
 508  * @param bool $recache set to true to refresh the cache
 509  * @return bool
 510  * @author Andreas Gohr <andi@splitbrain.org>
 511  * @see auth_ismanager()
 512  *
 513  */
 514 function auth_isadmin($user = null, $groups = null, $recache=false) {
 515     return auth_ismanager($user, $groups, true, $recache);
 516 }
 517
 518 /**
 519  * Match a user and his groups against a comma separated list of
 520  * users and groups to determine membership status
 521  *
 522  * Note: all input should NOT be nameencoded.
 523  *
 524  * @param string $memberlist commaseparated list of allowed users and groups
 525  * @param string $user       user to match against
 526  * @param array  $groups     groups the user is member of
 527  * @return bool       true for membership acknowledged
 528  */
 529 function auth_isMember($memberlist, $user, array $groups) {
 530     /* @var AuthPlugin $auth */
 531     global $auth;
 532     if(!$auth) return false;
 533
 534     // clean user and groups
 535     if(!$auth->isCaseSensitive()) {
 536         $user   = \dokuwiki\Utf8\PhpString::strtolower($user);
 537         $groups = array_map([\dokuwiki\Utf8\PhpString::class, 'strtolower'], $groups);
 538     }
 539     $user   = $auth->cleanUser($user);
 540     $groups = array_map(array($auth, 'cleanGroup'), $groups);
 541
 542     // extract the memberlist
 543     $members = explode(',', $memberlist);
 544     $members = array_map('trim', $members);
 545     $members = array_unique($members);
 546     $members = array_filter($members);
 547
 548     // compare cleaned values
 549     foreach($members as $member) {
 550         if($member == '@ALL' ) return true;
 551         if(!$auth->isCaseSensitive()) $member = \dokuwiki\Utf8\PhpString::strtolower($member);
 552         if($member[0] == '@') {
 553             $member = $auth->cleanGroup(substr($member, 1));
 554             if(in_array($member, $groups)) return true;
 555         } else {
 556             $member = $auth->cleanUser($member);
 557             if($member == $user) return true;
 558         }
 559     }
 560
 561     // still here? not a member!
 562     return false;
 563 }
 564
 565 /**
 566  * Convinience function for auth_aclcheck()
 567  *
 568  * This checks the permissions for the current user
 569  *
 570  * @author  Andreas Gohr <andi@splitbrain.org>
 571  *
 572  * @param  string  $id  page ID (needs to be resolved and cleaned)
 573  * @return int          permission level
 574  */
 575 function auth_quickaclcheck($id) {
 576     global $conf;
 577     global $USERINFO;
 578     /* @var Input $INPUT */
 579     global $INPUT;
 580     # if no ACL is used always return upload rights
 581     if(!$conf['useacl']) return AUTH_UPLOAD;
 582     return auth_aclcheck($id, $INPUT->server->str('REMOTE_USER'), is_array($USERINFO) ? $USERINFO['grps'] : array());
 583 }
 584
 585 /**
 586  * Returns the maximum rights a user has for the given ID or its namespace
 587  *
 588  * @author  Andreas Gohr <andi@splitbrain.org>
 589  *
 590  * @triggers AUTH_ACL_CHECK
 591  * @param  string       $id     page ID (needs to be resolved and cleaned)
 592  * @param  string       $user   Username
 593  * @param  array|null   $groups Array of groups the user is in
 594  * @return int             permission level
 595  */
 596 function auth_aclcheck($id, $user, $groups) {
 597     $data = array(
 598         'id'     => $id ?? '',
 599         'user'   => $user,
 600         'groups' => $groups
 601     );
 602
 603     return Event::createAndTrigger('AUTH_ACL_CHECK', $data, 'auth_aclcheck_cb');
 604 }
 605
 606 /**
 607  * default ACL check method
 608  *
 609  * DO NOT CALL DIRECTLY, use auth_aclcheck() instead
 610  *
 611  * @author  Andreas Gohr <andi@splitbrain.org>
 612  *
 613  * @param  array $data event data
 614  * @return int   permission level
 615  */
 616 function auth_aclcheck_cb($data) {
 617     $id     =& $data['id'];
 618     $user   =& $data['user'];
 619     $groups =& $data['groups'];
 620
 621     global $conf;
 622     global $AUTH_ACL;
 623     /* @var AuthPlugin $auth */
 624     global $auth;
 625
 626     // if no ACL is used always return upload rights
 627     if(!$conf['useacl']) return AUTH_UPLOAD;
 628     if(!$auth) return AUTH_NONE;
 629     if(!is_array($AUTH_ACL)) return AUTH_NONE;
 630
 631     //make sure groups is an array
 632     if(!is_array($groups)) $groups = array();
 633
 634     //if user is superuser or in superusergroup return 255 (acl_admin)
 635     if(auth_isadmin($user, $groups)) {
 636         return AUTH_ADMIN;
 637     }
 638
 639     if(!$auth->isCaseSensitive()) {
 640         $user   = \dokuwiki\Utf8\PhpString::strtolower($user);
 641         $groups = array_map([\dokuwiki\Utf8\PhpString::class, 'strtolower'], $groups);
 642     }
 643     $user   = auth_nameencode($auth->cleanUser($user));
 644     $groups = array_map(array($auth, 'cleanGroup'), (array) $groups);
 645
 646     //prepend groups with @ and nameencode
 647     foreach($groups as &$group) {
 648         $group = '@'.auth_nameencode($group);
 649     }
 650
 651     $ns   = getNS($id);
 652     $perm = -1;
 653
 654     //add ALL group
 655     $groups[] = '@ALL';
 656
 657     //add User
 658     if($user) $groups[] = $user;
 659
 660     //check exact match first
 661     $matches = preg_grep('/^'.preg_quote($id, '/').'[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL);
 662     if(count($matches)) {
 663         foreach($matches as $match) {
 664             $match = preg_replace('/#.*$/', '', $match); //ignore comments
 665             $acl   = preg_split('/[ \t]+/', $match);
 666             if(!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
 667                 $acl[1] = \dokuwiki\Utf8\PhpString::strtolower($acl[1]);
 668             }
 669             if(!in_array($acl[1], $groups)) {
 670                 continue;
 671             }
 672             if($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL!
 673             if($acl[2] > $perm) {
 674                 $perm = $acl[2];
 675             }
 676         }
 677         if($perm > -1) {
 678             //we had a match - return it
 679             return (int) $perm;
 680         }
 681     }
 682
 683     //still here? do the namespace checks
 684     if($ns) {
 685         $path = $ns.':*';
 686     } else {
 687         $path = '*'; //root document
 688     }
 689
 690     do {
 691         $matches = preg_grep('/^'.preg_quote($path, '/').'[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL);
 692         if(count($matches)) {
 693             foreach($matches as $match) {
 694                 $match = preg_replace('/#.*$/', '', $match); //ignore comments
 695                 $acl   = preg_split('/[ \t]+/', $match);
 696                 if(!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
 697                     $acl[1] = \dokuwiki\Utf8\PhpString::strtolower($acl[1]);
 698                 }
 699                 if(!in_array($acl[1], $groups)) {
 700                     continue;
 701                 }
 702                 if($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL!
 703                 if($acl[2] > $perm) {
 704                     $perm = $acl[2];
 705                 }
 706             }
 707             //we had a match - return it
 708             if($perm != -1) {
 709                 return (int) $perm;
 710             }
 711         }
 712         //get next higher namespace
 713         $ns = getNS($ns);
 714
 715         if($path != '*') {
 716             $path = $ns.':*';
 717             if($path == ':*') $path = '*';
 718         } else {
 719             //we did this already
 720             //looks like there is something wrong with the ACL
 721             //break here
 722             msg('No ACL setup yet! Denying access to everyone.');
 723             return AUTH_NONE;
 724         }
 725     } while(1); //this should never loop endless
 726     return AUTH_NONE;
 727 }
 728
 729 /**
 730  * Encode ASCII special chars
 731  *
 732  * Some auth backends allow special chars in their user and groupnames
 733  * The special chars are encoded with this function. Only ASCII chars
 734  * are encoded UTF-8 multibyte are left as is (different from usual
 735  * urlencoding!).
 736  *
 737  * Decoding can be done with rawurldecode
 738  *
 739  * @author Andreas Gohr <gohr@cosmocode.de>
 740  * @see rawurldecode()
 741  *
 742  * @param string $name
 743  * @param bool $skip_group
 744  * @return string
 745  */
 746 function auth_nameencode($name, $skip_group = false) {
 747     global $cache_authname;
 748     $cache =& $cache_authname;
 749     $name  = (string) $name;
 750
 751     // never encode wildcard FS#1955
 752     if($name == '%USER%') return $name;
 753     if($name == '%GROUP%') return $name;
 754
 755     if(!isset($cache[$name][$skip_group])) {
 756         if($skip_group && $name[0] == '@') {
 757             $cache[$name][$skip_group] = '@'.preg_replace_callback(
 758                 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
 759                 'auth_nameencode_callback', substr($name, 1)
 760             );
 761         } else {
 762             $cache[$name][$skip_group] = preg_replace_callback(
 763                 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
 764                 'auth_nameencode_callback', $name
 765             );
 766         }
 767     }
 768
 769     return $cache[$name][$skip_group];
 770 }
 771
 772 /**
 773  * callback encodes the matches
 774  *
 775  * @param array $matches first complete match, next matching subpatterms
 776  * @return string
 777  */
 778 function auth_nameencode_callback($matches) {
 779     return '%'.dechex(ord(substr($matches[1],-1)));
 780 }
 781
 782 /**
 783  * Create a pronouncable password
 784  *
 785  * The $foruser variable might be used by plugins to run additional password
 786  * policy checks, but is not used by the default implementation
 787  *
 788  * @author   Andreas Gohr <andi@splitbrain.org>
 789  * @link     http://www.phpbuilder.com/annotate/message.php3?id=1014451
 790  * @triggers AUTH_PASSWORD_GENERATE
 791  *
 792  * @param  string $foruser username for which the password is generated
 793  * @return string  pronouncable password
 794  */
 795 function auth_pwgen($foruser = '') {
 796     $data = array(
 797         'password' => '',
 798         'foruser'  => $foruser
 799     );
 800
 801     $evt = new Event('AUTH_PASSWORD_GENERATE', $data);
 802     if($evt->advise_before(true)) {
 803         $c = 'bcdfghjklmnprstvwz'; //consonants except hard to speak ones
 804         $v = 'aeiou'; //vowels
 805         $a = $c.$v; //both
 806         $s = '!$%&?+*~#-_:.;,'; // specials
 807
 808         //use thre syllables...
 809         for($i = 0; $i < 3; $i++) {
 810             $data['password'] .= $c[auth_random(0, strlen($c) - 1)];
 811             $data['password'] .= $v[auth_random(0, strlen($v) - 1)];
 812             $data['password'] .= $a[auth_random(0, strlen($a) - 1)];
 813         }
 814         //... and add a nice number and special
 815         $data['password'] .= $s[auth_random(0, strlen($s) - 1)].auth_random(10, 99);
 816     }
 817     $evt->advise_after();
 818
 819     return $data['password'];
 820 }
 821
 822 /**
 823  * Sends a password to the given user
 824  *
 825  * @author  Andreas Gohr <andi@splitbrain.org>
 826  *
 827  * @param string $user Login name of the user
 828  * @param string $password The new password in clear text
 829  * @return bool  true on success
 830  */
 831 function auth_sendPassword($user, $password) {
 832     global $lang;
 833     /* @var AuthPlugin $auth */
 834     global $auth;
 835     if(!$auth) return false;
 836
 837     $user     = $auth->cleanUser($user);
 838     $userinfo = $auth->getUserData($user, $requireGroups = false);
 839
 840     if(!$userinfo['mail']) return false;
 841
 842     $text = rawLocale('password');
 843     $trep = array(
 844         'FULLNAME' => $userinfo['name'],
 845         'LOGIN'    => $user,
 846         'PASSWORD' => $password
 847     );
 848
 849     $mail = new Mailer();
 850     $mail->to($mail->getCleanName($userinfo['name']).' <'.$userinfo['mail'].'>');
 851     $mail->subject($lang['regpwmail']);
 852     $mail->setBody($text, $trep);
 853     return $mail->send();
 854 }
 855
 856 /**
 857  * Register a new user
 858  *
 859  * This registers a new user - Data is read directly from $_POST
 860  *
 861  * @author  Andreas Gohr <andi@splitbrain.org>
 862  *
 863  * @return bool  true on success, false on any error
 864  */
 865 function register() {
 866     global $lang;
 867     global $conf;
 868     /* @var \dokuwiki\Extension\AuthPlugin $auth */
 869     global $auth;
 870     global $INPUT;
 871
 872     if(!$INPUT->post->bool('save')) return false;
 873     if(!actionOK('register')) return false;
 874
 875     // gather input
 876     $login    = trim($auth->cleanUser($INPUT->post->str('login')));
 877     $fullname = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('fullname')));
 878     $email    = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('email')));
 879     $pass     = $INPUT->post->str('pass');
 880     $passchk  = $INPUT->post->str('passchk');
 881
 882     if(empty($login) || empty($fullname) || empty($email)) {
 883         msg($lang['regmissing'], -1);
 884         return false;
 885     }
 886
 887     if($conf['autopasswd']) {
 888         $pass = auth_pwgen($login); // automatically generate password
 889     } elseif(empty($pass) || empty($passchk)) {
 890         msg($lang['regmissing'], -1); // complain about missing passwords
 891         return false;
 892     } elseif($pass != $passchk) {
 893         msg($lang['regbadpass'], -1); // complain about misspelled passwords
 894         return false;
 895     }
 896
 897     //check mail
 898     if(!mail_isvalid($email)) {
 899         msg($lang['regbadmail'], -1);
 900         return false;
 901     }
 902
 903     //okay try to create the user
 904     if(!$auth->triggerUserMod('create', array($login, $pass, $fullname, $email))) {
 905         msg($lang['regfail'], -1);
 906         return false;
 907     }
 908
 909     // send notification about the new user
 910     $subscription = new RegistrationSubscriptionSender();
 911     $subscription->sendRegister($login, $fullname, $email);
 912
 913     // are we done?
 914     if(!$conf['autopasswd']) {
 915         msg($lang['regsuccess2'], 1);
 916         return true;
 917     }
 918
 919     // autogenerated password? then send password to user
 920     if(auth_sendPassword($login, $pass)) {
 921         msg($lang['regsuccess'], 1);
 922         return true;
 923     } else {
 924         msg($lang['regmailfail'], -1);
 925         return false;
 926     }
 927 }
 928
 929 /**
 930  * Update user profile
 931  *
 932  * @author    Christopher Smith <chris@jalakai.co.uk>
 933  */
 934 function updateprofile() {
 935     global $conf;
 936     global $lang;
 937     /* @var AuthPlugin $auth */
 938     global $auth;
 939     /* @var Input $INPUT */
 940     global $INPUT;
 941
 942     if(!$INPUT->post->bool('save')) return false;
 943     if(!checkSecurityToken()) return false;
 944
 945     if(!actionOK('profile')) {
 946         msg($lang['profna'], -1);
 947         return false;
 948     }
 949
 950     $changes         = array();
 951     $changes['pass'] = $INPUT->post->str('newpass');
 952     $changes['name'] = $INPUT->post->str('fullname');
 953     $changes['mail'] = $INPUT->post->str('email');
 954
 955     // check misspelled passwords
 956     if($changes['pass'] != $INPUT->post->str('passchk')) {
 957         msg($lang['regbadpass'], -1);
 958         return false;
 959     }
 960
 961     // clean fullname and email
 962     $changes['name'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['name']));
 963     $changes['mail'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['mail']));
 964
 965     // no empty name and email (except the backend doesn't support them)
 966     if((empty($changes['name']) && $auth->canDo('modName')) ||
 967         (empty($changes['mail']) && $auth->canDo('modMail'))
 968     ) {
 969         msg($lang['profnoempty'], -1);
 970         return false;
 971     }
 972     if(!mail_isvalid($changes['mail']) && $auth->canDo('modMail')) {
 973         msg($lang['regbadmail'], -1);
 974         return false;
 975     }
 976
 977     $changes = array_filter($changes);
 978
 979     // check for unavailable capabilities
 980     if(!$auth->canDo('modName')) unset($changes['name']);
 981     if(!$auth->canDo('modMail')) unset($changes['mail']);
 982     if(!$auth->canDo('modPass')) unset($changes['pass']);
 983
 984     // anything to do?
 985     if(!count($changes)) {
 986         msg($lang['profnochange'], -1);
 987         return false;
 988     }
 989
 990     if($conf['profileconfirm']) {
 991         if(!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
 992             msg($lang['badpassconfirm'], -1);
 993             return false;
 994         }
 995     }
 996
 997     if(!$auth->triggerUserMod('modify', array($INPUT->server->str('REMOTE_USER'), &$changes))) {
 998         msg($lang['proffail'], -1);
 999         return false;
1000     }
1001
1002     if($changes['pass']) {
1003         // update cookie and session with the changed data
1004         list( /*user*/, $sticky, /*pass*/) = auth_getCookie();
1005         $pass = auth_encrypt($changes['pass'], auth_cookiesalt(!$sticky, true));
1006         auth_setCookie($INPUT->server->str('REMOTE_USER'), $pass, (bool) $sticky);
1007     } else {
1008         // make sure the session is writable
1009         @session_start();
1010         // invalidate session cache
1011         $_SESSION[DOKU_COOKIE]['auth']['time'] = 0;
1012         session_write_close();
1013     }
1014
1015     return true;
1016 }
1017
1018 /**
1019  * Delete the current logged-in user
1020  *
1021  * @return bool true on success, false on any error
1022  */
1023 function auth_deleteprofile(){
1024     global $conf;
1025     global $lang;
1026     /* @var \dokuwiki\Extension\AuthPlugin $auth */
1027     global $auth;
1028     /* @var Input $INPUT */
1029     global $INPUT;
1030
1031     if(!$INPUT->post->bool('delete')) return false;
1032     if(!checkSecurityToken()) return false;
1033
1034     // action prevented or auth module disallows
1035     if(!actionOK('profile_delete') || !$auth->canDo('delUser')) {
1036         msg($lang['profnodelete'], -1);
1037         return false;
1038     }
1039
1040     if(!$INPUT->post->bool('confirm_delete')){
1041         msg($lang['profconfdeletemissing'], -1);
1042         return false;
1043     }
1044
1045     if($conf['profileconfirm']) {
1046         if(!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1047             msg($lang['badpassconfirm'], -1);
1048             return false;
1049         }
1050     }
1051
1052     $deleted = array();
1053     $deleted[] = $INPUT->server->str('REMOTE_USER');
1054     if($auth->triggerUserMod('delete', array($deleted))) {
1055         // force and immediate logout including removing the sticky cookie
1056         auth_logoff();
1057         return true;
1058     }
1059
1060     return false;
1061 }
1062
1063 /**
1064  * Send a  new password
1065  *
1066  * This function handles both phases of the password reset:
1067  *
1068  *   - handling the first request of password reset
1069  *   - validating the password reset auth token
1070  *
1071  * @author Benoit Chesneau <benoit@bchesneau.info>
1072  * @author Chris Smith <chris@jalakai.co.uk>
1073  * @author Andreas Gohr <andi@splitbrain.org>
1074  *
1075  * @return bool true on success, false on any error
1076  */
1077 function act_resendpwd() {
1078     global $lang;
1079     global $conf;
1080     /* @var AuthPlugin $auth */
1081     global $auth;
1082     /* @var Input $INPUT */
1083     global $INPUT;
1084
1085     if(!actionOK('resendpwd')) {
1086         msg($lang['resendna'], -1);
1087         return false;
1088     }
1089
1090     $token = preg_replace('/[^a-f0-9]+/', '', $INPUT->str('pwauth'));
1091
1092     if($token) {
1093         // we're in token phase - get user info from token
1094
1095         $tfile = $conf['cachedir'].'/'.$token[0].'/'.$token.'.pwauth';
1096         if(!file_exists($tfile)) {
1097             msg($lang['resendpwdbadauth'], -1);
1098             $INPUT->remove('pwauth');
1099             return false;
1100         }
1101         // token is only valid for 3 days
1102         if((time() - filemtime($tfile)) > (3 * 60 * 60 * 24)) {
1103             msg($lang['resendpwdbadauth'], -1);
1104             $INPUT->remove('pwauth');
1105             @unlink($tfile);
1106             return false;
1107         }
1108
1109         $user     = io_readfile($tfile);
1110         $userinfo = $auth->getUserData($user, $requireGroups = false);
1111         if(!$userinfo['mail']) {
1112             msg($lang['resendpwdnouser'], -1);
1113             return false;
1114         }
1115
1116         if(!$conf['autopasswd']) { // we let the user choose a password
1117             $pass = $INPUT->str('pass');
1118
1119             // password given correctly?
1120             if(!$pass) return false;
1121             if($pass != $INPUT->str('passchk')) {
1122                 msg($lang['regbadpass'], -1);
1123                 return false;
1124             }
1125
1126             // change it
1127             if(!$auth->triggerUserMod('modify', array($user, array('pass' => $pass)))) {
1128                 msg($lang['proffail'], -1);
1129                 return false;
1130             }
1131
1132         } else { // autogenerate the password and send by mail
1133
1134             $pass = auth_pwgen($user);
1135             if(!$auth->triggerUserMod('modify', array($user, array('pass' => $pass)))) {
1136                 msg($lang['proffail'], -1);
1137                 return false;
1138             }
1139
1140             if(auth_sendPassword($user, $pass)) {
1141                 msg($lang['resendpwdsuccess'], 1);
1142             } else {
1143                 msg($lang['regmailfail'], -1);
1144             }
1145         }
1146
1147         @unlink($tfile);
1148         return true;
1149
1150     } else {
1151         // we're in request phase
1152
1153         if(!$INPUT->post->bool('save')) return false;
1154
1155         if(!$INPUT->post->str('login')) {
1156             msg($lang['resendpwdmissing'], -1);
1157             return false;
1158         } else {
1159             $user = trim($auth->cleanUser($INPUT->post->str('login')));
1160         }
1161
1162         $userinfo = $auth->getUserData($user, $requireGroups = false);
1163         if(!$userinfo['mail']) {
1164             msg($lang['resendpwdnouser'], -1);
1165             return false;
1166         }
1167
1168         // generate auth token
1169         $token = md5(auth_randombytes(16)); // random secret
1170         $tfile = $conf['cachedir'].'/'.$token[0].'/'.$token.'.pwauth';
1171         $url   = wl('', array('do'=> 'resendpwd', 'pwauth'=> $token), true, '&');
1172
1173         io_saveFile($tfile, $user);
1174
1175         $text = rawLocale('pwconfirm');
1176         $trep = array(
1177             'FULLNAME' => $userinfo['name'],
1178             'LOGIN'    => $user,
1179             'CONFIRM'  => $url
1180         );
1181
1182         $mail = new Mailer();
1183         $mail->to($userinfo['name'].' <'.$userinfo['mail'].'>');
1184         $mail->subject($lang['regpwmail']);
1185         $mail->setBody($text, $trep);
1186         if($mail->send()) {
1187             msg($lang['resendpwdconfirm'], 1);
1188         } else {
1189             msg($lang['regmailfail'], -1);
1190         }
1191         return true;
1192     }
1193     // never reached
1194 }
1195
1196 /**
1197  * Encrypts a password using the given method and salt
1198  *
1199  * If the selected method needs a salt and none was given, a random one
1200  * is chosen.
1201  *
1202  * @author  Andreas Gohr <andi@splitbrain.org>
1203  *
1204  * @param string $clear The clear text password
1205  * @param string $method The hashing method
1206  * @param string $salt A salt, null for random
1207  * @return  string  The crypted password
1208  */
1209 function auth_cryptPassword($clear, $method = '', $salt = null) {
1210     global $conf;
1211     if(empty($method)) $method = $conf['passcrypt'];
1212
1213     $pass = new PassHash();
1214     $call = 'hash_'.$method;
1215
1216     if(!method_exists($pass, $call)) {
1217         msg("Unsupported crypt method $method", -1);
1218         return false;
1219     }
1220
1221     return $pass->$call($clear, $salt);
1222 }
1223
1224 /**
1225  * Verifies a cleartext password against a crypted hash
1226  *
1227  * @author Andreas Gohr <andi@splitbrain.org>
1228  *
1229  * @param  string $clear The clear text password
1230  * @param  string $crypt The hash to compare with
1231  * @return bool true if both match
1232  */
1233 function auth_verifyPassword($clear, $crypt) {
1234     $pass = new PassHash();
1235     return $pass->verify_hash($clear, $crypt);
1236 }
1237
1238 /**
1239  * Set the authentication cookie and add user identification data to the session
1240  *
1241  * @param string  $user       username
1242  * @param string  $pass       encrypted password
1243  * @param bool    $sticky     whether or not the cookie will last beyond the session
1244  * @return bool
1245  */
1246 function auth_setCookie($user, $pass, $sticky) {
1247     global $conf;
1248     /* @var AuthPlugin $auth */
1249     global $auth;
1250     global $USERINFO;
1251
1252     if(!$auth) return false;
1253     $USERINFO = $auth->getUserData($user);
1254
1255     // set cookie
1256     $cookie    = base64_encode($user).'|'.((int) $sticky).'|'.base64_encode($pass);
1257     $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir'];
1258     $time      = $sticky ? (time() + 60 * 60 * 24 * 365) : 0; //one year
1259     setcookie(DOKU_COOKIE, $cookie, $time, $cookieDir, '', ($conf['securecookie'] && is_ssl()), true);
1260
1261     // set session
1262     $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
1263     $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass);
1264     $_SESSION[DOKU_COOKIE]['auth']['buid'] = auth_browseruid();
1265     $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO;
1266     $_SESSION[DOKU_COOKIE]['auth']['time'] = time();
1267
1268     return true;
1269 }
1270
1271 /**
1272  * Returns the user, (encrypted) password and sticky bit from cookie
1273  *
1274  * @returns array
1275  */
1276 function auth_getCookie() {
1277     if(!isset($_COOKIE[DOKU_COOKIE])) {
1278         return array(null, null, null);
1279     }
1280     list($user, $sticky, $pass) = sexplode('|', $_COOKIE[DOKU_COOKIE], 3, '');
1281     $sticky = (bool) $sticky;
1282     $pass   = base64_decode($pass);
1283     $user   = base64_decode($user);
1284     return array($user, $sticky, $pass);
1285 }
1286
1287 //Setup VIM: ex: et ts=2 :