inc/auth.php

   1 <?php
   2
   3 /**
   4  * Authentication library
   5  *
   6  * Including this file will automatically try to login
   7  * a user by calling auth_login()
   8  *
   9  * @license    GPL 2 (http://www.gnu.org/licenses/gpl.html)
  10  * @author     Andreas Gohr <andi@splitbrain.org>
  11  */
  12
  13 use dokuwiki\JWT;
  14 use phpseclib\Crypt\AES;
  15 use dokuwiki\Utf8\PhpString;
  16 use dokuwiki\Extension\AuthPlugin;
  17 use dokuwiki\Extension\Event;
  18 use dokuwiki\Extension\PluginController;
  19 use dokuwiki\PassHash;
  20 use dokuwiki\Subscriptions\RegistrationSubscriptionSender;
  21
  22 /**
  23  * Initialize the auth system.
  24  *
  25  * This function is automatically called at the end of init.php
  26  *
  27  * This used to be the main() of the auth.php
  28  *
  29  * @todo backend loading maybe should be handled by the class autoloader
  30  * @todo maybe split into multiple functions at the XXX marked positions
  31  * @triggers AUTH_LOGIN_CHECK
  32  * @return bool
  33  */
  34 function auth_setup()
  35 {
  36     global $conf;
  37     /* @var AuthPlugin $auth */
  38     global $auth;
  39     /* @var Input $INPUT */
  40     global $INPUT;
  41     global $AUTH_ACL;
  42     global $lang;
  43     /* @var PluginController $plugin_controller */
  44     global $plugin_controller;
  45     $AUTH_ACL = [];
  46
  47     if (!$conf['useacl']) return false;
  48
  49     // try to load auth backend from plugins
  50     foreach ($plugin_controller->getList('auth') as $plugin) {
  51         if ($conf['authtype'] === $plugin) {
  52             $auth = $plugin_controller->load('auth', $plugin);
  53             break;
  54         }
  55     }
  56
  57     if (!$auth instanceof AuthPlugin) {
  58         msg($lang['authtempfail'], -1);
  59         return false;
  60     }
  61
  62     if ($auth->success == false) {
  63         // degrade to unauthenticated user
  64         $auth = null;
  65         auth_logoff();
  66         msg($lang['authtempfail'], -1);
  67         return false;
  68     }
  69
  70     // do the login either by cookie or provided credentials XXX
  71     $INPUT->set('http_credentials', false);
  72     if (!$conf['rememberme']) $INPUT->set('r', false);
  73
  74     // Populate Basic Auth user/password from Authorization header
  75     // Note: with FastCGI, data is in REDIRECT_HTTP_AUTHORIZATION instead of HTTP_AUTHORIZATION
  76     $header = $INPUT->server->str('HTTP_AUTHORIZATION') ?: $INPUT->server->str('REDIRECT_HTTP_AUTHORIZATION');
  77     if (preg_match('~^Basic ([a-z\d/+]*={0,2})$~i', $header, $matches)) {
  78         $userpass = explode(':', base64_decode($matches[1]));
  79         [$_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']] = $userpass;
  80     }
  81
  82     // if no credentials were given try to use HTTP auth (for SSO)
  83     if (!$INPUT->str('u') && empty($_COOKIE[DOKU_COOKIE]) && !empty($INPUT->server->str('PHP_AUTH_USER'))) {
  84         $INPUT->set('u', $INPUT->server->str('PHP_AUTH_USER'));
  85         $INPUT->set('p', $INPUT->server->str('PHP_AUTH_PW'));
  86         $INPUT->set('http_credentials', true);
  87     }
  88
  89     // apply cleaning (auth specific user names, remove control chars)
  90     if (true === $auth->success) {
  91         $INPUT->set('u', $auth->cleanUser(stripctl($INPUT->str('u'))));
  92         $INPUT->set('p', stripctl($INPUT->str('p')));
  93     }
  94
  95     if (!auth_tokenlogin()) {
  96         $ok = null;
  97
  98         if ($auth instanceof AuthPlugin && $auth->canDo('external')) {
  99             $ok = $auth->trustExternal($INPUT->str('u'), $INPUT->str('p'), $INPUT->bool('r'));
 100         }
 101
 102         if ($ok === null) {
 103             // external trust mechanism not in place, or returns no result,
 104             // then attempt auth_login
 105             $evdata = [
 106                 'user' => $INPUT->str('u'),
 107                 'password' => $INPUT->str('p'),
 108                 'sticky' => $INPUT->bool('r'),
 109                 'silent' => $INPUT->bool('http_credentials')
 110             ];
 111             Event::createAndTrigger('AUTH_LOGIN_CHECK', $evdata, 'auth_login_wrapper');
 112         }
 113     }
 114
 115     //load ACL into a global array XXX
 116     $AUTH_ACL = auth_loadACL();
 117
 118     return true;
 119 }
 120
 121 /**
 122  * Loads the ACL setup and handle user wildcards
 123  *
 124  * @author Andreas Gohr <andi@splitbrain.org>
 125  *
 126  * @return array
 127  */
 128 function auth_loadACL()
 129 {
 130     global $config_cascade;
 131     global $USERINFO;
 132     /* @var Input $INPUT */
 133     global $INPUT;
 134
 135     if (!is_readable($config_cascade['acl']['default'])) return [];
 136
 137     $acl = file($config_cascade['acl']['default']);
 138
 139     $out = [];
 140     foreach ($acl as $line) {
 141         $line = trim($line);
 142         if (empty($line) || ($line[0] == '#')) continue; // skip blank lines & comments
 143         [$id, $rest] = preg_split('/[ \t]+/', $line, 2);
 144
 145         // substitute user wildcard first (its 1:1)
 146         if (strstr($line, '%USER%')) {
 147             // if user is not logged in, this ACL line is meaningless - skip it
 148             if (!$INPUT->server->has('REMOTE_USER')) continue;
 149
 150             $id   = str_replace('%USER%', cleanID($INPUT->server->str('REMOTE_USER')), $id);
 151             $rest = str_replace('%USER%', auth_nameencode($INPUT->server->str('REMOTE_USER')), $rest);
 152         }
 153
 154         // substitute group wildcard (its 1:m)
 155         if (strstr($line, '%GROUP%')) {
 156             // if user is not logged in, grps is empty, no output will be added (i.e. skipped)
 157             if (isset($USERINFO['grps'])) {
 158                 foreach ((array) $USERINFO['grps'] as $grp) {
 159                     $nid   = str_replace('%GROUP%', cleanID($grp), $id);
 160                     $nrest = str_replace('%GROUP%', '@' . auth_nameencode($grp), $rest);
 161                     $out[] = "$nid\t$nrest";
 162                 }
 163             }
 164         } else {
 165             $out[] = "$id\t$rest";
 166         }
 167     }
 168
 169     return $out;
 170 }
 171
 172 /**
 173  * Try a token login
 174  *
 175  * @return bool true if token login succeeded
 176  */
 177 function auth_tokenlogin()
 178 {
 179     global $USERINFO;
 180     global $INPUT;
 181     /** @var DokuWiki_Auth_Plugin $auth */
 182     global $auth;
 183     if (!$auth) return false;
 184
 185     // see if header has token
 186     $header = '';
 187     if (function_exists('getallheaders')) {
 188         // Authorization headers are not in $_SERVER for mod_php
 189         $headers = array_change_key_case(getallheaders());
 190         if (isset($headers['authorization'])) $header = $headers['authorization'];
 191     } else {
 192         $header = $INPUT->server->str('HTTP_AUTHORIZATION');
 193     }
 194     if (!$header) return false;
 195     [$type, $token] = sexplode(' ', $header, 2);
 196     if ($type !== 'Bearer') return false;
 197
 198     // check token
 199     try {
 200         $authtoken = JWT::validate($token);
 201     } catch (Exception $e) {
 202         msg(hsc($e->getMessage()), -1);
 203         return false;
 204     }
 205
 206     // fetch user info from backend
 207     $user = $authtoken->getUser();
 208     $USERINFO = $auth->getUserData($user);
 209     if (!$USERINFO) return false;
 210
 211     // the code is correct, set up user
 212     $INPUT->server->set('REMOTE_USER', $user);
 213     $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
 214     $_SESSION[DOKU_COOKIE]['auth']['pass'] = 'nope';
 215     $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO;
 216
 217     return true;
 218 }
 219
 220 /**
 221  * Event hook callback for AUTH_LOGIN_CHECK
 222  *
 223  * @param array $evdata
 224  * @return bool
 225  * @throws Exception
 226  */
 227 function auth_login_wrapper($evdata)
 228 {
 229     return auth_login(
 230         $evdata['user'],
 231         $evdata['password'],
 232         $evdata['sticky'],
 233         $evdata['silent']
 234     );
 235 }
 236
 237 /**
 238  * This tries to login the user based on the sent auth credentials
 239  *
 240  * The authentication works like this: if a username was given
 241  * a new login is assumed and user/password are checked. If they
 242  * are correct the password is encrypted with blowfish and stored
 243  * together with the username in a cookie - the same info is stored
 244  * in the session, too. Additonally a browserID is stored in the
 245  * session.
 246  *
 247  * If no username was given the cookie is checked: if the username,
 248  * crypted password and browserID match between session and cookie
 249  * no further testing is done and the user is accepted
 250  *
 251  * If a cookie was found but no session info was availabe the
 252  * blowfish encrypted password from the cookie is decrypted and
 253  * together with username rechecked by calling this function again.
 254  *
 255  * On a successful login $_SERVER[REMOTE_USER] and $USERINFO
 256  * are set.
 257  *
 258  * @param string $user Username
 259  * @param string $pass Cleartext Password
 260  * @param bool $sticky Cookie should not expire
 261  * @param bool $silent Don't show error on bad auth
 262  * @return bool true on successful auth
 263  * @throws Exception
 264  *
 265  * @author  Andreas Gohr <andi@splitbrain.org>
 266  */
 267 function auth_login($user, $pass, $sticky = false, $silent = false)
 268 {
 269     global $USERINFO;
 270     global $conf;
 271     global $lang;
 272     /* @var AuthPlugin $auth */
 273     global $auth;
 274     /* @var Input $INPUT */
 275     global $INPUT;
 276
 277     if (!$auth instanceof AuthPlugin) return false;
 278
 279     if (!empty($user)) {
 280         //usual login
 281         if (!empty($pass) && $auth->checkPass($user, $pass)) {
 282             // make logininfo globally available
 283             $INPUT->server->set('REMOTE_USER', $user);
 284             $secret                 = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
 285             auth_setCookie($user, auth_encrypt($pass, $secret), $sticky);
 286             return true;
 287         } else {
 288             //invalid credentials - log off
 289             if (!$silent) {
 290                 http_status(403, 'Login failed');
 291                 msg($lang['badlogin'], -1);
 292             }
 293             auth_logoff();
 294             return false;
 295         }
 296     } else {
 297         // read cookie information
 298         [$user, $sticky, $pass] = auth_getCookie();
 299         if ($user && $pass) {
 300             // we got a cookie - see if we can trust it
 301
 302             // get session info
 303             if (isset($_SESSION[DOKU_COOKIE])) {
 304                 $session = $_SESSION[DOKU_COOKIE]['auth'];
 305                 if (
 306                     isset($session) &&
 307                     $auth->useSessionCache($user) &&
 308                     ($session['time'] >= time() - $conf['auth_security_timeout']) &&
 309                     ($session['user'] == $user) &&
 310                     ($session['pass'] == sha1($pass)) && //still crypted
 311                     ($session['buid'] == auth_browseruid())
 312                 ) {
 313                     // he has session, cookie and browser right - let him in
 314                     $INPUT->server->set('REMOTE_USER', $user);
 315                     $USERINFO = $session['info']; //FIXME move all references to session
 316                     return true;
 317                 }
 318             }
 319             // no we don't trust it yet - recheck pass but silent
 320             $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
 321             $pass   = auth_decrypt($pass, $secret);
 322             return auth_login($user, $pass, $sticky, true);
 323         }
 324     }
 325     //just to be sure
 326     auth_logoff(true);
 327     return false;
 328 }
 329
 330 /**
 331  * Builds a pseudo UID from browser and IP data
 332  *
 333  * This is neither unique nor unfakable - still it adds some
 334  * security. Using the first part of the IP makes sure
 335  * proxy farms like AOLs are still okay.
 336  *
 337  * @author  Andreas Gohr <andi@splitbrain.org>
 338  *
 339  * @return  string  a SHA256 sum of various browser headers
 340  */
 341 function auth_browseruid()
 342 {
 343     /* @var Input $INPUT */
 344     global $INPUT;
 345
 346     $ip = clientIP(true);
 347     // convert IP string to packed binary representation
 348     $pip = inet_pton($ip);
 349
 350     $uid = implode("\n", [
 351         $INPUT->server->str('HTTP_USER_AGENT'),
 352         $INPUT->server->str('HTTP_ACCEPT_LANGUAGE'),
 353         substr($pip, 0, strlen($pip) / 2), // use half of the IP address (works for both IPv4 and IPv6)
 354     ]);
 355     return hash('sha256', $uid);
 356 }
 357
 358 /**
 359  * Creates a random key to encrypt the password in cookies
 360  *
 361  * This function tries to read the password for encrypting
 362  * cookies from $conf['metadir'].'/_htcookiesalt'
 363  * if no such file is found a random key is created and
 364  * and stored in this file.
 365  *
 366  * @param bool $addsession if true, the sessionid is added to the salt
 367  * @param bool $secure if security is more important than keeping the old value
 368  * @return  string
 369  * @throws Exception
 370  *
 371  * @author  Andreas Gohr <andi@splitbrain.org>
 372  */
 373 function auth_cookiesalt($addsession = false, $secure = false)
 374 {
 375     if (defined('SIMPLE_TEST')) {
 376         return 'test';
 377     }
 378     global $conf;
 379     $file = $conf['metadir'] . '/_htcookiesalt';
 380     if ($secure || !file_exists($file)) {
 381         $file = $conf['metadir'] . '/_htcookiesalt2';
 382     }
 383     $salt = io_readFile($file);
 384     if (empty($salt)) {
 385         $salt = bin2hex(auth_randombytes(64));
 386         io_saveFile($file, $salt);
 387     }
 388     if ($addsession) {
 389         $salt .= session_id();
 390     }
 391     return $salt;
 392 }
 393
 394 /**
 395  * Return cryptographically secure random bytes.
 396  *
 397  * @param int $length number of bytes
 398  * @return string cryptographically secure random bytes
 399  * @throws Exception
 400  *
 401  * @author Niklas Keller <me@kelunik.com>
 402  */
 403 function auth_randombytes($length)
 404 {
 405     return random_bytes($length);
 406 }
 407
 408 /**
 409  * Cryptographically secure random number generator.
 410  *
 411  * @param int $min
 412  * @param int $max
 413  * @return int
 414  * @throws Exception
 415  *
 416  * @author Niklas Keller <me@kelunik.com>
 417  */
 418 function auth_random($min, $max)
 419 {
 420     return random_int($min, $max);
 421 }
 422
 423 /**
 424  * Encrypt data using the given secret using AES
 425  *
 426  * The mode is CBC with a random initialization vector, the key is derived
 427  * using pbkdf2.
 428  *
 429  * @param string $data The data that shall be encrypted
 430  * @param string $secret The secret/password that shall be used
 431  * @return string The ciphertext
 432  * @throws Exception
 433  */
 434 function auth_encrypt($data, $secret)
 435 {
 436     $iv     = auth_randombytes(16);
 437     $cipher = new AES();
 438     $cipher->setPassword($secret);
 439
 440     /*
 441     this uses the encrypted IV as IV as suggested in
 442     http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, Appendix C
 443     for unique but necessarily random IVs. The resulting ciphertext is
 444     compatible to ciphertext that was created using a "normal" IV.
 445     */
 446     return $cipher->encrypt($iv . $data);
 447 }
 448
 449 /**
 450  * Decrypt the given AES ciphertext
 451  *
 452  * The mode is CBC, the key is derived using pbkdf2
 453  *
 454  * @param string $ciphertext The encrypted data
 455  * @param string $secret     The secret/password that shall be used
 456  * @return string The decrypted data
 457  */
 458 function auth_decrypt($ciphertext, $secret)
 459 {
 460     $iv     = substr($ciphertext, 0, 16);
 461     $cipher = new AES();
 462     $cipher->setPassword($secret);
 463     $cipher->setIV($iv);
 464
 465     return $cipher->decrypt(substr($ciphertext, 16));
 466 }
 467
 468 /**
 469  * Log out the current user
 470  *
 471  * This clears all authentication data and thus log the user
 472  * off. It also clears session data.
 473  *
 474  * @author  Andreas Gohr <andi@splitbrain.org>
 475  *
 476  * @param bool $keepbc - when true, the breadcrumb data is not cleared
 477  */
 478 function auth_logoff($keepbc = false)
 479 {
 480     global $conf;
 481     global $USERINFO;
 482     /* @var AuthPlugin $auth */
 483     global $auth;
 484     /* @var Input $INPUT */
 485     global $INPUT;
 486
 487     // make sure the session is writable (it usually is)
 488     @session_start();
 489
 490     if (isset($_SESSION[DOKU_COOKIE]['auth']['user']))
 491         unset($_SESSION[DOKU_COOKIE]['auth']['user']);
 492     if (isset($_SESSION[DOKU_COOKIE]['auth']['pass']))
 493         unset($_SESSION[DOKU_COOKIE]['auth']['pass']);
 494     if (isset($_SESSION[DOKU_COOKIE]['auth']['info']))
 495         unset($_SESSION[DOKU_COOKIE]['auth']['info']);
 496     if (!$keepbc && isset($_SESSION[DOKU_COOKIE]['bc']))
 497         unset($_SESSION[DOKU_COOKIE]['bc']);
 498     $INPUT->server->remove('REMOTE_USER');
 499     $USERINFO = null; //FIXME
 500
 501     $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir'];
 502     setcookie(DOKU_COOKIE, '', [
 503         'expires' => time() - 600000,
 504         'path' => $cookieDir,
 505         'secure' => ($conf['securecookie'] && is_ssl()),
 506         'httponly' => true,
 507         'samesite' => $conf['samesitecookie'] ?: null, // null means browser default
 508     ]);
 509
 510     if ($auth instanceof AuthPlugin) {
 511         $auth->logOff();
 512     }
 513 }
 514
 515 /**
 516  * Check if a user is a manager
 517  *
 518  * Should usually be called without any parameters to check the current
 519  * user.
 520  *
 521  * The info is available through $INFO['ismanager'], too
 522  *
 523  * @param string $user Username
 524  * @param array $groups List of groups the user is in
 525  * @param bool $adminonly when true checks if user is admin
 526  * @param bool $recache set to true to refresh the cache
 527  * @return bool
 528  * @see    auth_isadmin
 529  *
 530  * @author Andreas Gohr <andi@splitbrain.org>
 531  */
 532 function auth_ismanager($user = null, $groups = null, $adminonly = false, $recache = false)
 533 {
 534     global $conf;
 535     global $USERINFO;
 536     /* @var AuthPlugin $auth */
 537     global $auth;
 538     /* @var Input $INPUT */
 539     global $INPUT;
 540
 541
 542     if (!$auth instanceof AuthPlugin) return false;
 543     if (is_null($user)) {
 544         if (!$INPUT->server->has('REMOTE_USER')) {
 545             return false;
 546         } else {
 547             $user = $INPUT->server->str('REMOTE_USER');
 548         }
 549     }
 550     if (is_null($groups)) {
 551         // checking the logged in user, or another one?
 552         if ($USERINFO && $user === $INPUT->server->str('REMOTE_USER')) {
 553             $groups =  (array) $USERINFO['grps'];
 554         } else {
 555             $groups = $auth->getUserData($user);
 556             $groups = $groups ? $groups['grps'] : [];
 557         }
 558     }
 559
 560     // prefer cached result
 561     static $cache = [];
 562     $cachekey = serialize([$user, $adminonly, $groups]);
 563     if (!isset($cache[$cachekey]) || $recache) {
 564         // check superuser match
 565         $ok = auth_isMember($conf['superuser'], $user, $groups);
 566
 567         // check managers
 568         if (!$ok && !$adminonly) {
 569             $ok = auth_isMember($conf['manager'], $user, $groups);
 570         }
 571
 572         $cache[$cachekey] = $ok;
 573     }
 574
 575     return $cache[$cachekey];
 576 }
 577
 578 /**
 579  * Check if a user is admin
 580  *
 581  * Alias to auth_ismanager with adminonly=true
 582  *
 583  * The info is available through $INFO['isadmin'], too
 584  *
 585  * @param string $user Username
 586  * @param array $groups List of groups the user is in
 587  * @param bool $recache set to true to refresh the cache
 588  * @return bool
 589  * @author Andreas Gohr <andi@splitbrain.org>
 590  * @see auth_ismanager()
 591  *
 592  */
 593 function auth_isadmin($user = null, $groups = null, $recache = false)
 594 {
 595     return auth_ismanager($user, $groups, true, $recache);
 596 }
 597
 598 /**
 599  * Match a user and his groups against a comma separated list of
 600  * users and groups to determine membership status
 601  *
 602  * Note: all input should NOT be nameencoded.
 603  *
 604  * @param string $memberlist commaseparated list of allowed users and groups
 605  * @param string $user       user to match against
 606  * @param array  $groups     groups the user is member of
 607  * @return bool       true for membership acknowledged
 608  */
 609 function auth_isMember($memberlist, $user, array $groups)
 610 {
 611     /* @var AuthPlugin $auth */
 612     global $auth;
 613     if (!$auth instanceof AuthPlugin) return false;
 614
 615     // clean user and groups
 616     if (!$auth->isCaseSensitive()) {
 617         $user   = PhpString::strtolower($user);
 618         $groups = array_map([PhpString::class, 'strtolower'], $groups);
 619     }
 620     $user   = $auth->cleanUser($user);
 621     $groups = array_map([$auth, 'cleanGroup'], $groups);
 622
 623     // extract the memberlist
 624     $members = explode(',', $memberlist);
 625     $members = array_map('trim', $members);
 626     $members = array_unique($members);
 627     $members = array_filter($members);
 628
 629     // compare cleaned values
 630     foreach ($members as $member) {
 631         if ($member == '@ALL') return true;
 632         if (!$auth->isCaseSensitive()) $member = PhpString::strtolower($member);
 633         if ($member[0] == '@') {
 634             $member = $auth->cleanGroup(substr($member, 1));
 635             if (in_array($member, $groups)) return true;
 636         } else {
 637             $member = $auth->cleanUser($member);
 638             if ($member == $user) return true;
 639         }
 640     }
 641
 642     // still here? not a member!
 643     return false;
 644 }
 645
 646 /**
 647  * Convinience function for auth_aclcheck()
 648  *
 649  * This checks the permissions for the current user
 650  *
 651  * @author  Andreas Gohr <andi@splitbrain.org>
 652  *
 653  * @param  string  $id  page ID (needs to be resolved and cleaned)
 654  * @return int          permission level
 655  */
 656 function auth_quickaclcheck($id)
 657 {
 658     global $conf;
 659     global $USERINFO;
 660     /* @var Input $INPUT */
 661     global $INPUT;
 662     # if no ACL is used always return upload rights
 663     if (!$conf['useacl']) return AUTH_UPLOAD;
 664     return auth_aclcheck($id, $INPUT->server->str('REMOTE_USER'), is_array($USERINFO) ? $USERINFO['grps'] : []);
 665 }
 666
 667 /**
 668  * Returns the maximum rights a user has for the given ID or its namespace
 669  *
 670  * @author  Andreas Gohr <andi@splitbrain.org>
 671  *
 672  * @triggers AUTH_ACL_CHECK
 673  * @param  string       $id     page ID (needs to be resolved and cleaned)
 674  * @param  string       $user   Username
 675  * @param  array|null   $groups Array of groups the user is in
 676  * @return int             permission level
 677  */
 678 function auth_aclcheck($id, $user, $groups)
 679 {
 680     $data = [
 681         'id'     => $id ?? '',
 682         'user'   => $user,
 683         'groups' => $groups
 684     ];
 685
 686     return Event::createAndTrigger('AUTH_ACL_CHECK', $data, 'auth_aclcheck_cb');
 687 }
 688
 689 /**
 690  * default ACL check method
 691  *
 692  * DO NOT CALL DIRECTLY, use auth_aclcheck() instead
 693  *
 694  * @author  Andreas Gohr <andi@splitbrain.org>
 695  *
 696  * @param  array $data event data
 697  * @return int   permission level
 698  */
 699 function auth_aclcheck_cb($data)
 700 {
 701     $id     =& $data['id'];
 702     $user   =& $data['user'];
 703     $groups =& $data['groups'];
 704
 705     global $conf;
 706     global $AUTH_ACL;
 707     /* @var AuthPlugin $auth */
 708     global $auth;
 709
 710     // if no ACL is used always return upload rights
 711     if (!$conf['useacl']) return AUTH_UPLOAD;
 712     if (!$auth instanceof AuthPlugin) return AUTH_NONE;
 713     if (!is_array($AUTH_ACL)) return AUTH_NONE;
 714
 715     //make sure groups is an array
 716     if (!is_array($groups)) $groups = [];
 717
 718     //if user is superuser or in superusergroup return 255 (acl_admin)
 719     if (auth_isadmin($user, $groups)) {
 720         return AUTH_ADMIN;
 721     }
 722
 723     if (!$auth->isCaseSensitive()) {
 724         $user   = PhpString::strtolower($user);
 725         $groups = array_map([PhpString::class, 'strtolower'], $groups);
 726     }
 727     $user   = auth_nameencode($auth->cleanUser($user));
 728     $groups = array_map([$auth, 'cleanGroup'], $groups);
 729
 730     //prepend groups with @ and nameencode
 731     foreach ($groups as &$group) {
 732         $group = '@' . auth_nameencode($group);
 733     }
 734
 735     $ns   = getNS($id);
 736     $perm = -1;
 737
 738     //add ALL group
 739     $groups[] = '@ALL';
 740
 741     //add User
 742     if ($user) $groups[] = $user;
 743
 744     //check exact match first
 745     $matches = preg_grep('/^' . preg_quote($id, '/') . '[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL);
 746     if (count($matches)) {
 747         foreach ($matches as $match) {
 748             $match = preg_replace('/#.*$/', '', $match); //ignore comments
 749             $acl   = preg_split('/[ \t]+/', $match);
 750             if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
 751                 $acl[1] = PhpString::strtolower($acl[1]);
 752             }
 753             if (!in_array($acl[1], $groups)) {
 754                 continue;
 755             }
 756             if ($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL!
 757             if ($acl[2] > $perm) {
 758                 $perm = $acl[2];
 759             }
 760         }
 761         if ($perm > -1) {
 762             //we had a match - return it
 763             return (int) $perm;
 764         }
 765     }
 766
 767     //still here? do the namespace checks
 768     if ($ns) {
 769         $path = $ns . ':*';
 770     } else {
 771         $path = '*'; //root document
 772     }
 773
 774     do {
 775         $matches = preg_grep('/^' . preg_quote($path, '/') . '[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL);
 776         if (count($matches)) {
 777             foreach ($matches as $match) {
 778                 $match = preg_replace('/#.*$/', '', $match); //ignore comments
 779                 $acl   = preg_split('/[ \t]+/', $match);
 780                 if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
 781                     $acl[1] = PhpString::strtolower($acl[1]);
 782                 }
 783                 if (!in_array($acl[1], $groups)) {
 784                     continue;
 785                 }
 786                 if ($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL!
 787                 if ($acl[2] > $perm) {
 788                     $perm = $acl[2];
 789                 }
 790             }
 791             //we had a match - return it
 792             if ($perm != -1) {
 793                 return (int) $perm;
 794             }
 795         }
 796         //get next higher namespace
 797         $ns = getNS($ns);
 798
 799         if ($path != '*') {
 800             $path = $ns . ':*';
 801             if ($path == ':*') $path = '*';
 802         } else {
 803             //we did this already
 804             //looks like there is something wrong with the ACL
 805             //break here
 806             msg('No ACL setup yet! Denying access to everyone.');
 807             return AUTH_NONE;
 808         }
 809     } while (1); //this should never loop endless
 810     return AUTH_NONE;
 811 }
 812
 813 /**
 814  * Encode ASCII special chars
 815  *
 816  * Some auth backends allow special chars in their user and groupnames
 817  * The special chars are encoded with this function. Only ASCII chars
 818  * are encoded UTF-8 multibyte are left as is (different from usual
 819  * urlencoding!).
 820  *
 821  * Decoding can be done with rawurldecode
 822  *
 823  * @author Andreas Gohr <gohr@cosmocode.de>
 824  * @see rawurldecode()
 825  *
 826  * @param string $name
 827  * @param bool $skip_group
 828  * @return string
 829  */
 830 function auth_nameencode($name, $skip_group = false)
 831 {
 832     global $cache_authname;
 833     $cache =& $cache_authname;
 834     $name  = (string) $name;
 835
 836     // never encode wildcard FS#1955
 837     if ($name == '%USER%') return $name;
 838     if ($name == '%GROUP%') return $name;
 839
 840     if (!isset($cache[$name][$skip_group])) {
 841         if ($skip_group && $name[0] == '@') {
 842             $cache[$name][$skip_group] = '@' . preg_replace_callback(
 843                 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
 844                 'auth_nameencode_callback',
 845                 substr($name, 1)
 846             );
 847         } else {
 848             $cache[$name][$skip_group] = preg_replace_callback(
 849                 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
 850                 'auth_nameencode_callback',
 851                 $name
 852             );
 853         }
 854     }
 855
 856     return $cache[$name][$skip_group];
 857 }
 858
 859 /**
 860  * callback encodes the matches
 861  *
 862  * @param array $matches first complete match, next matching subpatterms
 863  * @return string
 864  */
 865 function auth_nameencode_callback($matches)
 866 {
 867     return '%' . dechex(ord(substr($matches[1], -1)));
 868 }
 869
 870 /**
 871  * Create a pronouncable password
 872  *
 873  * The $foruser variable might be used by plugins to run additional password
 874  * policy checks, but is not used by the default implementation
 875  *
 876  * @param string $foruser username for which the password is generated
 877  * @return string  pronouncable password
 878  * @throws Exception
 879  *
 880  * @link     http://www.phpbuilder.com/annotate/message.php3?id=1014451
 881  * @triggers AUTH_PASSWORD_GENERATE
 882  *
 883  * @author   Andreas Gohr <andi@splitbrain.org>
 884  */
 885 function auth_pwgen($foruser = '')
 886 {
 887     $data = [
 888         'password' => '',
 889         'foruser'  => $foruser
 890     ];
 891
 892     $evt = new Event('AUTH_PASSWORD_GENERATE', $data);
 893     if ($evt->advise_before(true)) {
 894         $c = 'bcdfghjklmnprstvwz'; //consonants except hard to speak ones
 895         $v = 'aeiou'; //vowels
 896         $a = $c . $v; //both
 897         $s = '!$%&?+*~#-_:.;,'; // specials
 898
 899         //use thre syllables...
 900         for ($i = 0; $i < 3; $i++) {
 901             $data['password'] .= $c[auth_random(0, strlen($c) - 1)];
 902             $data['password'] .= $v[auth_random(0, strlen($v) - 1)];
 903             $data['password'] .= $a[auth_random(0, strlen($a) - 1)];
 904         }
 905         //... and add a nice number and special
 906         $data['password'] .= $s[auth_random(0, strlen($s) - 1)] . auth_random(10, 99);
 907     }
 908     $evt->advise_after();
 909
 910     return $data['password'];
 911 }
 912
 913 /**
 914  * Sends a password to the given user
 915  *
 916  * @author  Andreas Gohr <andi@splitbrain.org>
 917  *
 918  * @param string $user Login name of the user
 919  * @param string $password The new password in clear text
 920  * @return bool  true on success
 921  */
 922 function auth_sendPassword($user, $password)
 923 {
 924     global $lang;
 925     /* @var AuthPlugin $auth */
 926     global $auth;
 927     if (!$auth instanceof AuthPlugin) return false;
 928
 929     $user     = $auth->cleanUser($user);
 930     $userinfo = $auth->getUserData($user, false);
 931
 932     if (!$userinfo['mail']) return false;
 933
 934     $text = rawLocale('password');
 935     $trep = [
 936         'FULLNAME' => $userinfo['name'],
 937         'LOGIN'    => $user,
 938         'PASSWORD' => $password
 939     ];
 940
 941     $mail = new Mailer();
 942     $mail->to($mail->getCleanName($userinfo['name']) . ' <' . $userinfo['mail'] . '>');
 943     $mail->subject($lang['regpwmail']);
 944     $mail->setBody($text, $trep);
 945     return $mail->send();
 946 }
 947
 948 /**
 949  * Register a new user
 950  *
 951  * This registers a new user - Data is read directly from $_POST
 952  *
 953  * @return bool  true on success, false on any error
 954  * @throws Exception
 955  *
 956  * @author  Andreas Gohr <andi@splitbrain.org>
 957  */
 958 function register()
 959 {
 960     global $lang;
 961     global $conf;
 962     /* @var AuthPlugin $auth */
 963     global $auth;
 964     global $INPUT;
 965
 966     if (!$INPUT->post->bool('save')) return false;
 967     if (!actionOK('register')) return false;
 968
 969     // gather input
 970     $login    = trim($auth->cleanUser($INPUT->post->str('login')));
 971     $fullname = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('fullname')));
 972     $email    = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('email')));
 973     $pass     = $INPUT->post->str('pass');
 974     $passchk  = $INPUT->post->str('passchk');
 975
 976     if (empty($login) || empty($fullname) || empty($email)) {
 977         msg($lang['regmissing'], -1);
 978         return false;
 979     }
 980
 981     if ($conf['autopasswd']) {
 982         $pass = auth_pwgen($login); // automatically generate password
 983     } elseif (empty($pass) || empty($passchk)) {
 984         msg($lang['regmissing'], -1); // complain about missing passwords
 985         return false;
 986     } elseif ($pass != $passchk) {
 987         msg($lang['regbadpass'], -1); // complain about misspelled passwords
 988         return false;
 989     }
 990
 991     //check mail
 992     if (!mail_isvalid($email)) {
 993         msg($lang['regbadmail'], -1);
 994         return false;
 995     }
 996
 997     //okay try to create the user
 998     if (!$auth->triggerUserMod('create', [$login, $pass, $fullname, $email])) {
 999         msg($lang['regfail'], -1);
1000         return false;
1001     }
1002
1003     // send notification about the new user
1004     $subscription = new RegistrationSubscriptionSender();
1005     $subscription->sendRegister($login, $fullname, $email);
1006
1007     // are we done?
1008     if (!$conf['autopasswd']) {
1009         msg($lang['regsuccess2'], 1);
1010         return true;
1011     }
1012
1013     // autogenerated password? then send password to user
1014     if (auth_sendPassword($login, $pass)) {
1015         msg($lang['regsuccess'], 1);
1016         return true;
1017     } else {
1018         msg($lang['regmailfail'], -1);
1019         return false;
1020     }
1021 }
1022
1023 /**
1024  * Update user profile
1025  *
1026  * @throws Exception
1027  *
1028  * @author    Christopher Smith <chris@jalakai.co.uk>
1029  */
1030 function updateprofile()
1031 {
1032     global $conf;
1033     global $lang;
1034     /* @var AuthPlugin $auth */
1035     global $auth;
1036     /* @var Input $INPUT */
1037     global $INPUT;
1038
1039     if (!$INPUT->post->bool('save')) return false;
1040     if (!checkSecurityToken()) return false;
1041
1042     if (!actionOK('profile')) {
1043         msg($lang['profna'], -1);
1044         return false;
1045     }
1046
1047     $changes         = [];
1048     $changes['pass'] = $INPUT->post->str('newpass');
1049     $changes['name'] = $INPUT->post->str('fullname');
1050     $changes['mail'] = $INPUT->post->str('email');
1051
1052     // check misspelled passwords
1053     if ($changes['pass'] != $INPUT->post->str('passchk')) {
1054         msg($lang['regbadpass'], -1);
1055         return false;
1056     }
1057
1058     // clean fullname and email
1059     $changes['name'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['name']));
1060     $changes['mail'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['mail']));
1061
1062     // no empty name and email (except the backend doesn't support them)
1063     if (
1064         (empty($changes['name']) && $auth->canDo('modName')) ||
1065         (empty($changes['mail']) && $auth->canDo('modMail'))
1066     ) {
1067         msg($lang['profnoempty'], -1);
1068         return false;
1069     }
1070     if (!mail_isvalid($changes['mail']) && $auth->canDo('modMail')) {
1071         msg($lang['regbadmail'], -1);
1072         return false;
1073     }
1074
1075     $changes = array_filter($changes);
1076
1077     // check for unavailable capabilities
1078     if (!$auth->canDo('modName')) unset($changes['name']);
1079     if (!$auth->canDo('modMail')) unset($changes['mail']);
1080     if (!$auth->canDo('modPass')) unset($changes['pass']);
1081
1082     // anything to do?
1083     if ($changes === []) {
1084         msg($lang['profnochange'], -1);
1085         return false;
1086     }
1087
1088     if ($conf['profileconfirm']) {
1089         if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1090             msg($lang['badpassconfirm'], -1);
1091             return false;
1092         }
1093     }
1094
1095     if (!$auth->triggerUserMod('modify', [$INPUT->server->str('REMOTE_USER'), &$changes])) {
1096         msg($lang['proffail'], -1);
1097         return false;
1098     }
1099
1100     if (array_key_exists('pass', $changes) && $changes['pass']) {
1101         // update cookie and session with the changed data
1102         [/* user */, $sticky, /* pass */] = auth_getCookie();
1103         $pass = auth_encrypt($changes['pass'], auth_cookiesalt(!$sticky, true));
1104         auth_setCookie($INPUT->server->str('REMOTE_USER'), $pass, (bool) $sticky);
1105     } else {
1106         // make sure the session is writable
1107         @session_start();
1108         // invalidate session cache
1109         $_SESSION[DOKU_COOKIE]['auth']['time'] = 0;
1110         session_write_close();
1111     }
1112
1113     return true;
1114 }
1115
1116 /**
1117  * Delete the current logged-in user
1118  *
1119  * @return bool true on success, false on any error
1120  */
1121 function auth_deleteprofile()
1122 {
1123     global $conf;
1124     global $lang;
1125     /* @var AuthPlugin $auth */
1126     global $auth;
1127     /* @var Input $INPUT */
1128     global $INPUT;
1129
1130     if (!$INPUT->post->bool('delete')) return false;
1131     if (!checkSecurityToken()) return false;
1132
1133     // action prevented or auth module disallows
1134     if (!actionOK('profile_delete') || !$auth->canDo('delUser')) {
1135         msg($lang['profnodelete'], -1);
1136         return false;
1137     }
1138
1139     if (!$INPUT->post->bool('confirm_delete')) {
1140         msg($lang['profconfdeletemissing'], -1);
1141         return false;
1142     }
1143
1144     if ($conf['profileconfirm']) {
1145         if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1146             msg($lang['badpassconfirm'], -1);
1147             return false;
1148         }
1149     }
1150
1151     $deleted = [];
1152     $deleted[] = $INPUT->server->str('REMOTE_USER');
1153     if ($auth->triggerUserMod('delete', [$deleted])) {
1154         // force and immediate logout including removing the sticky cookie
1155         auth_logoff();
1156         return true;
1157     }
1158
1159     return false;
1160 }
1161
1162 /**
1163  * Send a  new password
1164  *
1165  * This function handles both phases of the password reset:
1166  *
1167  *   - handling the first request of password reset
1168  *   - validating the password reset auth token
1169  *
1170  * @return bool true on success, false on any error
1171  * @throws Exception
1172  *
1173  * @author Andreas Gohr <andi@splitbrain.org>
1174  * @author Benoit Chesneau <benoit@bchesneau.info>
1175  * @author Chris Smith <chris@jalakai.co.uk>
1176  */
1177 function act_resendpwd()
1178 {
1179     global $lang;
1180     global $conf;
1181     /* @var AuthPlugin $auth */
1182     global $auth;
1183     /* @var Input $INPUT */
1184     global $INPUT;
1185
1186     if (!actionOK('resendpwd')) {
1187         msg($lang['resendna'], -1);
1188         return false;
1189     }
1190
1191     $token = preg_replace('/[^a-f0-9]+/', '', $INPUT->str('pwauth'));
1192
1193     if ($token) {
1194         // we're in token phase - get user info from token
1195
1196         $tfile = $conf['cachedir'] . '/' . $token[0] . '/' . $token . '.pwauth';
1197         if (!file_exists($tfile)) {
1198             msg($lang['resendpwdbadauth'], -1);
1199             $INPUT->remove('pwauth');
1200             return false;
1201         }
1202         // token is only valid for 3 days
1203         if ((time() - filemtime($tfile)) > (3 * 60 * 60 * 24)) {
1204             msg($lang['resendpwdbadauth'], -1);
1205             $INPUT->remove('pwauth');
1206             @unlink($tfile);
1207             return false;
1208         }
1209
1210         $user     = io_readfile($tfile);
1211         $userinfo = $auth->getUserData($user, false);
1212         if (!$userinfo['mail']) {
1213             msg($lang['resendpwdnouser'], -1);
1214             return false;
1215         }
1216
1217         if (!$conf['autopasswd']) { // we let the user choose a password
1218             $pass = $INPUT->str('pass');
1219
1220             // password given correctly?
1221             if (!$pass) return false;
1222             if ($pass != $INPUT->str('passchk')) {
1223                 msg($lang['regbadpass'], -1);
1224                 return false;
1225             }
1226
1227             // change it
1228             if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1229                 msg($lang['proffail'], -1);
1230                 return false;
1231             }
1232         } else { // autogenerate the password and send by mail
1233             $pass = auth_pwgen($user);
1234             if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1235                 msg($lang['proffail'], -1);
1236                 return false;
1237             }
1238
1239             if (auth_sendPassword($user, $pass)) {
1240                 msg($lang['resendpwdsuccess'], 1);
1241             } else {
1242                 msg($lang['regmailfail'], -1);
1243             }
1244         }
1245
1246         @unlink($tfile);
1247         return true;
1248     } else {
1249         // we're in request phase
1250
1251         if (!$INPUT->post->bool('save')) return false;
1252
1253         if (!$INPUT->post->str('login')) {
1254             msg($lang['resendpwdmissing'], -1);
1255             return false;
1256         } else {
1257             $user = trim($auth->cleanUser($INPUT->post->str('login')));
1258         }
1259
1260         $userinfo = $auth->getUserData($user, false);
1261         if (!$userinfo['mail']) {
1262             msg($lang['resendpwdnouser'], -1);
1263             return false;
1264         }
1265
1266         // generate auth token
1267         $token = md5(auth_randombytes(16)); // random secret
1268         $tfile = $conf['cachedir'] . '/' . $token[0] . '/' . $token . '.pwauth';
1269         $url   = wl('', ['do' => 'resendpwd', 'pwauth' => $token], true, '&');
1270
1271         io_saveFile($tfile, $user);
1272
1273         $text = rawLocale('pwconfirm');
1274         $trep = ['FULLNAME' => $userinfo['name'], 'LOGIN'    => $user, 'CONFIRM'  => $url];
1275
1276         $mail = new Mailer();
1277         $mail->to($userinfo['name'] . ' <' . $userinfo['mail'] . '>');
1278         $mail->subject($lang['regpwmail']);
1279         $mail->setBody($text, $trep);
1280         if ($mail->send()) {
1281             msg($lang['resendpwdconfirm'], 1);
1282         } else {
1283             msg($lang['regmailfail'], -1);
1284         }
1285         return true;
1286     }
1287     // never reached
1288 }
1289
1290 /**
1291  * Encrypts a password using the given method and salt
1292  *
1293  * If the selected method needs a salt and none was given, a random one
1294  * is chosen.
1295  *
1296  * @author  Andreas Gohr <andi@splitbrain.org>
1297  *
1298  * @param string $clear The clear text password
1299  * @param string $method The hashing method
1300  * @param string $salt A salt, null for random
1301  * @return  string  The crypted password
1302  */
1303 function auth_cryptPassword($clear, $method = '', $salt = null)
1304 {
1305     global $conf;
1306     if (empty($method)) $method = $conf['passcrypt'];
1307
1308     $pass = new PassHash();
1309     $call = 'hash_' . $method;
1310
1311     if (!method_exists($pass, $call)) {
1312         msg("Unsupported crypt method $method", -1);
1313         return false;
1314     }
1315
1316     return $pass->$call($clear, $salt);
1317 }
1318
1319 /**
1320  * Verifies a cleartext password against a crypted hash
1321  *
1322  * @param string $clear The clear text password
1323  * @param string $crypt The hash to compare with
1324  * @return bool true if both match
1325  * @throws Exception
1326  *
1327  * @author Andreas Gohr <andi@splitbrain.org>
1328  */
1329 function auth_verifyPassword($clear, $crypt)
1330 {
1331     $pass = new PassHash();
1332     return $pass->verify_hash($clear, $crypt);
1333 }
1334
1335 /**
1336  * Set the authentication cookie and add user identification data to the session
1337  *
1338  * @param string  $user       username
1339  * @param string  $pass       encrypted password
1340  * @param bool    $sticky     whether or not the cookie will last beyond the session
1341  * @return bool
1342  */
1343 function auth_setCookie($user, $pass, $sticky)
1344 {
1345     global $conf;
1346     /* @var AuthPlugin $auth */
1347     global $auth;
1348     global $USERINFO;
1349
1350     if (!$auth instanceof AuthPlugin) return false;
1351     $USERINFO = $auth->getUserData($user);
1352
1353     // set cookie
1354     $cookie    = base64_encode($user) . '|' . ((int) $sticky) . '|' . base64_encode($pass);
1355     $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir'];
1356     $time      = $sticky ? (time() + 60 * 60 * 24 * 365) : 0; //one year
1357     setcookie(DOKU_COOKIE, $cookie, [
1358         'expires' => $time,
1359         'path' => $cookieDir,
1360         'secure' => ($conf['securecookie'] && is_ssl()),
1361         'httponly' => true,
1362         'samesite' => $conf['samesitecookie'] ?: null, // null means browser default
1363     ]);
1364
1365     // set session
1366     $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
1367     $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass);
1368     $_SESSION[DOKU_COOKIE]['auth']['buid'] = auth_browseruid();
1369     $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO;
1370     $_SESSION[DOKU_COOKIE]['auth']['time'] = time();
1371
1372     return true;
1373 }
1374
1375 /**
1376  * Returns the user, (encrypted) password and sticky bit from cookie
1377  *
1378  * @returns array
1379  */
1380 function auth_getCookie()
1381 {
1382     if (!isset($_COOKIE[DOKU_COOKIE])) {
1383         return [null, null, null];
1384     }
1385     [$user, $sticky, $pass] = sexplode('|', $_COOKIE[DOKU_COOKIE], 3, '');
1386     $sticky = (bool) $sticky;
1387     $pass   = base64_decode($pass);
1388     $user   = base64_decode($user);
1389     return [$user, $sticky, $pass];
1390 }
1391
1392 //Setup VIM: ex: et ts=2 :