Lines Matching +full:check +full:- +full:pass -(+path:inc +path:lang) -(+path:lib +path:plugins +path:lang) -(+path:lib +path:tpl +path:dokuwiki +path:lang)
52 if ($INPUT->server->str('REMOTE_USER') === '') {
53 $INPUT->server->remove('REMOTE_USER');
59 foreach ($plugin_controller->getList('auth') as $plugin) {
61 $auth = $plugin_controller->load('auth', $plugin);
67 msg($lang['authtempfail'], -1);
71 if ($auth->success == false) {
75 msg($lang['authtempfail'], -1);
80 $INPUT->set('http_credentials', false);
81 if (!$conf['rememberme']) $INPUT->set('r', false);
85 …$header = $INPUT->server->str('HTTP_AUTHORIZATION') ?: $INPUT->server->str('REDIRECT_HTTP_AUTHORIZ…
86 if (preg_match('~^Basic ([a-z\d/+]*={0,2})$~i', $header, $matches)) {
92 …if (!$INPUT->str('u') && empty($_COOKIE[DOKU_COOKIE]) && !empty($INPUT->server->str('PHP_AUTH_USER…
93 $INPUT->set('u', $INPUT->server->str('PHP_AUTH_USER'));
94 $INPUT->set('p', $INPUT->server->str('PHP_AUTH_PW'));
95 $INPUT->set('http_credentials', true);
99 if (true === $auth->success) {
100 $INPUT->set('u', $auth->cleanUser(stripctl($INPUT->str('u'))));
101 $INPUT->set('p', stripctl($INPUT->str('p')));
107 if ($auth->canDo('external')) {
108 $ok = $auth->trustExternal($INPUT->str('u'), $INPUT->str('p'), $INPUT->bool('r'));
115 'user' => $INPUT->str('u'),
116 'password' => $INPUT->str('p'),
117 'sticky' => $INPUT->bool('r'),
118 'silent' => $INPUT->bool('http_credentials')
156 // if user is not logged in, this ACL line is meaningless - skip it
157 if (!$INPUT->server->has('REMOTE_USER')) continue;
159 $id = str_replace('%USER%', cleanID($INPUT->server->str('REMOTE_USER')), $id);
160 … $rest = str_replace('%USER%', auth_nameencode($INPUT->server->str('REMOTE_USER')), $rest);
213 // check authorization header
219 // check x-dokuwiki-token header
220 if (isset($headers['x-dokuwiki-token'])) {
221 $token = $headers['x-dokuwiki-token'];
226 // check token
230 msg(hsc($e->getMessage()), -1);
235 $user = $authtoken->getUser();
236 $USERINFO = $auth->getUserData($user);
240 $INPUT->server->set('REMOTE_USER', $user);
242 $_SESSION[DOKU_COOKIE]['auth']['pass'] = 'nope';
271 * together with the username in a cookie - the same info is stored
287 * @param string $pass Cleartext Password
295 function auth_login($user, $pass, $sticky = false, $silent = false) argument
309 …if (!empty($pass)) usleep(random_int(0, 250)); // add a random delay to prevent timing attacks #44…
310 if (!empty($pass) && $auth->checkPass($user, $pass)) {
312 $INPUT->server->set('REMOTE_USER', $user);
313 $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
314 auth_setCookie($user, auth_encrypt($pass, $secret), $sticky);
317 //invalid credentials - log off
320 msg($lang['badlogin'], -1);
327 [$user, $sticky, $pass] = auth_getCookie();
328 if ($user && $pass) {
329 // we got a cookie - see if we can trust it
336 $auth->useSessionCache($user) &&
337 ($session['time'] >= time() - $conf['auth_security_timeout']) &&
339 ($session['pass'] == sha1($pass)) && //still crypted
342 // he has session, cookie and browser right - let him in
343 $INPUT->server->set('REMOTE_USER', $user);
348 // no we don't trust it yet - recheck pass but silent
349 $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
350 $pass = auth_decrypt($pass, $secret);
351 return auth_login($user, $pass, $sticky, true);
362 * This is neither unique nor unfakable - still it adds some
380 $INPUT->server->str('HTTP_USER_AGENT'),
381 $INPUT->server->str('HTTP_ACCEPT_LANGUAGE'),
467 $cipher->setPassword($secret, 'pbkdf2', 'sha1', 'phpseclib');
468 $cipher->setIV($iv);
472 http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, Appendix C
476 return $cipher->encrypt($iv . $data);
492 $cipher->setPassword($secret, 'pbkdf2', 'sha1', 'phpseclib');
493 $cipher->setIV($iv);
496 return $cipher->decrypt(substr($ciphertext, 16));
511 * @param bool $keepbc - when true, the breadcrumb data is not cleared
527 if (isset($_SESSION[DOKU_COOKIE]['auth']['pass']))
528 unset($_SESSION[DOKU_COOKIE]['auth']['pass']);
533 $INPUT->server->remove('REMOTE_USER');
538 'expires' => time() - 600000,
546 $auth->logOff();
551 * Check if a user is a manager
553 * Should usually be called without any parameters to check the current
579 if (!$INPUT->server->has('REMOTE_USER')) {
582 $user = $INPUT->server->str('REMOTE_USER');
587 if ($USERINFO && $user === $INPUT->server->str('REMOTE_USER')) {
590 $groups = $auth->getUserData($user);
599 // check superuser match
602 // check managers
614 * Check if a user is admin
651 if (!$auth->isCaseSensitive()) {
655 $user = $auth->cleanUser($user);
667 if (!$auth->isCaseSensitive()) $member = PhpString::strtolower($member);
669 $member = $auth->cleanGroup(substr($member, 1));
672 $member = $auth->cleanUser($member);
699 …return auth_aclcheck($id, $INPUT->server->str('REMOTE_USER'), is_array($USERINFO) ? $USERINFO['grp…
725 * default ACL check method
758 if (!$auth->isCaseSensitive()) {
762 $user = auth_nameencode($auth->cleanUser($user));
771 $perm = -1;
779 //check exact match first
785 if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
796 if ($perm > -1) {
797 //we had a match - return it
815 if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
826 //we had a match - return it
827 if ($perm != -1) {
853 * are encoded UTF-8 multibyte are left as is (different from usual
878 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
884 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
902 return '%' . dechex(ord(substr($matches[1], -1)));
928 if ($evt->advise_before(true)) {
932 $s = '!$%&?+*~#-_:.;,'; // specials
936 $data['password'] .= $c[auth_random(0, strlen($c) - 1)];
937 $data['password'] .= $v[auth_random(0, strlen($v) - 1)];
938 $data['password'] .= $a[auth_random(0, strlen($a) - 1)];
941 $data['password'] .= $s[auth_random(0, strlen($s) - 1)] . auth_random(10, 99);
943 $evt->advise_after();
964 $user = $auth->cleanUser($user);
965 $userinfo = $auth->getUserData($user, false);
977 $mail->to($mail->getCleanName($userinfo['name']) . ' <' . $userinfo['mail'] . '>');
978 $mail->subject($lang['regpwmail']);
979 $mail->setBody($text, $trep);
980 return $mail->send();
986 * This registers a new user - Data is read directly from $_POST
1001 if (!$INPUT->post->bool('save')) return false;
1005 $login = trim($auth->cleanUser($INPUT->post->str('login')));
1006 $fullname = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('fullname')));
1007 $email = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('email')));
1008 $pass = $INPUT->post->str('pass');
1009 $passchk = $INPUT->post->str('passchk');
1012 msg($lang['regmissing'], -1);
1017 $pass = auth_pwgen($login); // automatically generate password
1018 } elseif (empty($pass) || empty($passchk)) {
1019 msg($lang['regmissing'], -1); // complain about missing passwords
1021 } elseif ($pass != $passchk) {
1022 msg($lang['regbadpass'], -1); // complain about misspelled passwords
1026 //check mail
1028 msg($lang['regbadmail'], -1);
1033 if (!$auth->triggerUserMod('create', [$login, $pass, $fullname, $email])) {
1034 msg($lang['regfail'], -1);
1040 $subscription->sendRegister($login, $fullname, $email);
1049 if (auth_sendPassword($login, $pass)) {
1053 msg($lang['regmailfail'], -1);
1074 if (!$INPUT->post->bool('save')) return false;
1078 msg($lang['profna'], -1);
1083 $changes['pass'] = $INPUT->post->str('newpass');
1084 $changes['name'] = $INPUT->post->str('fullname');
1085 $changes['mail'] = $INPUT->post->str('email');
1087 // check misspelled passwords
1088 if ($changes['pass'] != $INPUT->post->str('passchk')) {
1089 msg($lang['regbadpass'], -1);
1094 $changes['name'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['name']));
1095 $changes['mail'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['mail']));
1099 (empty($changes['name']) && $auth->canDo('modName')) ||
1100 (empty($changes['mail']) && $auth->canDo('modMail'))
1102 msg($lang['profnoempty'], -1);
1105 if (!mail_isvalid($changes['mail']) && $auth->canDo('modMail')) {
1106 msg($lang['regbadmail'], -1);
1112 // check for unavailable capabilities
1113 if (!$auth->canDo('modName')) unset($changes['name']);
1114 if (!$auth->canDo('modMail')) unset($changes['mail']);
1115 if (!$auth->canDo('modPass')) unset($changes['pass']);
1119 msg($lang['profnochange'], -1);
1124 if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1125 msg($lang['badpassconfirm'], -1);
1130 if (!$auth->triggerUserMod('modify', [$INPUT->server->str('REMOTE_USER'), &$changes])) {
1131 msg($lang['proffail'], -1);
1135 if (array_key_exists('pass', $changes) && $changes['pass']) {
1137 [/* user */, $sticky, /* pass */] = auth_getCookie();
1138 $pass = auth_encrypt($changes['pass'], auth_cookiesalt(!$sticky, true));
1139 auth_setCookie($INPUT->server->str('REMOTE_USER'), $pass, (bool) $sticky);
1152 * Delete the current logged-in user
1165 if (!$INPUT->post->bool('delete')) return false;
1169 if (!actionOK('profile_delete') || !$auth->canDo('delUser')) {
1170 msg($lang['profnodelete'], -1);
1174 if (!$INPUT->post->bool('confirm_delete')) {
1175 msg($lang['profconfdeletemissing'], -1);
1180 if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1181 msg($lang['badpassconfirm'], -1);
1187 $deleted[] = $INPUT->server->str('REMOTE_USER');
1188 if ($auth->triggerUserMod('delete', [$deleted])) {
1202 * - handling the first request of password reset
1203 * - validating the password reset auth token
1222 msg($lang['resendna'], -1);
1226 $token = preg_replace('/[^a-f0-9]+/', '', $INPUT->str('pwauth'));
1229 // we're in token phase - get user info from token
1233 msg($lang['resendpwdbadauth'], -1);
1234 $INPUT->remove('pwauth');
1238 if ((time() - filemtime($tfile)) > (3 * 60 * 60 * 24)) {
1239 msg($lang['resendpwdbadauth'], -1);
1240 $INPUT->remove('pwauth');
1246 $userinfo = $auth->getUserData($user, false);
1248 msg($lang['resendpwdnouser'], -1);
1253 $pass = $INPUT->str('pass');
1256 if (!$pass) return false;
1257 if ($pass != $INPUT->str('passchk')) {
1258 msg($lang['regbadpass'], -1);
1263 if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1264 msg($lang['proffail'], -1);
1268 $pass = auth_pwgen($user);
1269 if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1270 msg($lang['proffail'], -1);
1274 if (auth_sendPassword($user, $pass)) {
1277 msg($lang['regmailfail'], -1);
1286 if (!$INPUT->post->bool('save')) return false;
1288 if (!$INPUT->post->str('login')) {
1289 msg($lang['resendpwdmissing'], -1);
1292 $user = trim($auth->cleanUser($INPUT->post->str('login')));
1295 $userinfo = $auth->getUserData($user, false);
1297 msg($lang['resendpwdnouser'], -1);
1312 $mail->to($userinfo['name'] . ' <' . $userinfo['mail'] . '>');
1313 $mail->subject($lang['regpwmail']);
1314 $mail->setBody($text, $trep);
1315 if ($mail->send()) {
1318 msg($lang['regmailfail'], -1);
1331 * You can pass null as the password to create an unusable hash.
1350 $pass = new PassHash();
1353 if (!method_exists($pass, $call)) {
1354 msg("Unsupported crypt method $method", -1);
1358 return $pass->$call($clear, $salt);
1377 $pass = new PassHash();
1378 return $pass->verify_hash($clear, $crypt);
1385 * @param string $pass encrypted password
1389 function auth_setCookie($user, $pass, $sticky) argument
1397 $USERINFO = $auth->getUserData($user);
1400 $cookie = base64_encode($user) . '|' . ((int) $sticky) . '|' . base64_encode($pass);
1413 $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass);
1431 [$user, $sticky, $pass] = sexplode('|', $_COOKIE[DOKU_COOKIE], 3, '');
1433 $pass = base64_decode($pass);
1435 return [$user, $sticky, $pass];