Lines Matching +full:update +full:- +full:user +full:- +full:pass -(+path:inc +path:lang) -(+path:lib +path:plugins +path:lang) -(+path:lib +path:tpl +path:dokuwiki +path:lang)
7 * a user by calling auth_login()
51 if ($INPUT->server->str('REMOTE_USER') === '') {
52 $INPUT->server->remove('REMOTE_USER');
58 foreach ($plugin_controller->getList('auth') as $plugin) {
60 $auth = $plugin_controller->load('auth', $plugin);
66 msg($lang['authtempfail'], -1);
70 if ($auth->success == false) {
71 // degrade to unauthenticated user
74 msg($lang['authtempfail'], -1);
79 $INPUT->set('http_credentials', false);
80 if (!$conf['rememberme']) $INPUT->set('r', false);
82 // Populate Basic Auth user/password from Authorization header
84 $header = $INPUT->server->str('HTTP_AUTHORIZATION') ?: $INPUT->server->str('REDIRECT_HTTP_AUTHORIZATION');
85 if (preg_match('~^Basic ([a-z\d/+]*={0,2})$~i', $header, $matches)) {
91 if (!$INPUT->str('u') && empty($_COOKIE[DOKU_COOKIE]) && !empty($INPUT->server->str('PHP_AUTH_USER'))) {
92 $INPUT->set('u', $INPUT->server->str('PHP_AUTH_USER'));
93 $INPUT->set('p', $INPUT->server->str('PHP_AUTH_PW'));
94 $INPUT->set('http_credentials', true);
97 // apply cleaning (auth specific user names, remove control chars)
98 if (true === $auth->success) {
99 $INPUT->set('u', $auth->cleanUser(stripctl($INPUT->str('u'))));
100 $INPUT->set('p', stripctl($INPUT->str('p')));
106 if ($auth->canDo('external')) {
107 $ok = $auth->trustExternal($INPUT->str('u'), $INPUT->str('p'), $INPUT->bool('r'));
114 'user' => $INPUT->str('u'),
115 'password' => $INPUT->str('p'),
116 'sticky' => $INPUT->bool('r'),
117 'silent' => $INPUT->bool('http_credentials')
130 * Loads the ACL setup and handle user wildcards
153 // substitute user wildcard first (its 1:1)
154 if (strstr($line, '%USER%')) {
155 // if user is not logged in, this ACL line is meaningless - skip it
156 if (!$INPUT->server->has('REMOTE_USER')) continue;
158 $id = str_replace('%USER%', cleanID($INPUT->server->str('REMOTE_USER')), $id);
159 $rest = str_replace('%USER%', auth_nameencode($INPUT->server->str('REMOTE_USER')), $rest);
164 // if user is not logged in, grps is empty, no output will be added (i.e. skipped)
211 // check x-dokuwiki-token header
212 if (isset($headers['x-dokuwiki-token'])) {
213 $token = $headers['x-dokuwiki-token'];
222 msg(hsc($e->getMessage()), -1);
226 // fetch user info from backend
227 $user = $authtoken->getUser();
228 $USERINFO = $auth->getUserData($user);
231 // the code is correct, set up user
232 $INPUT->server->set('REMOTE_USER', $user);
233 $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
234 $_SESSION[DOKU_COOKIE]['auth']['pass'] = 'nope';
250 $evdata['user'],
258 * This tries to login the user based on the sent auth credentials
261 * a new login is assumed and user/password are checked. If they
263 * together with the username in a cookie - the same info is stored
269 * no further testing is done and the user is accepted
278 * @param string $user Username
279 * @param string $pass Cleartext Password
287 function auth_login($user, $pass, $sticky = false, $silent = false)
299 if (!empty($user)) {
301 if (!empty($pass) && $auth->checkPass($user, $pass)) {
303 $INPUT->server->set('REMOTE_USER', $user);
304 $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
305 auth_setCookie($user, auth_encrypt($pass, $secret), $sticky);
308 //invalid credentials - log off
311 msg($lang['badlogin'], -1);
318 [$user, $sticky, $pass] = auth_getCookie();
319 if ($user && $pass) {
320 // we got a cookie - see if we can trust it
327 $auth->useSessionCache($user) &&
328 ($session['time'] >= time() - $conf['auth_security_timeout']) &&
329 ($session['user'] == $user) &&
330 ($session['pass'] == sha1($pass)) && //still crypted
333 // he has session, cookie and browser right - let him in
334 $INPUT->server->set('REMOTE_USER', $user);
339 // no we don't trust it yet - recheck pass but silent
340 $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
341 $pass = auth_decrypt($pass, $secret);
342 return auth_login($user, $pass, $sticky, true);
353 * This is neither unique nor unfakable - still it adds some
371 $INPUT->server->str('HTTP_USER_AGENT'),
372 $INPUT->server->str('HTTP_ACCEPT_LANGUAGE'),
458 $cipher->setPassword($secret, 'pbkdf2', 'sha1', 'phpseclib');
459 $cipher->setIV($iv);
463 http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, Appendix C
467 return $cipher->encrypt($iv . $data);
483 $cipher->setPassword($secret, 'pbkdf2', 'sha1', 'phpseclib');
484 $cipher->setIV($iv);
487 return $cipher->decrypt(substr($ciphertext, 16));
495 * Log out the current user
497 * This clears all authentication data and thus log the user
502 * @param bool $keepbc - when true, the breadcrumb data is not cleared
516 if (isset($_SESSION[DOKU_COOKIE]['auth']['user']))
517 unset($_SESSION[DOKU_COOKIE]['auth']['user']);
518 if (isset($_SESSION[DOKU_COOKIE]['auth']['pass']))
519 unset($_SESSION[DOKU_COOKIE]['auth']['pass']);
524 $INPUT->server->remove('REMOTE_USER');
529 'expires' => time() - 600000,
537 $auth->logOff();
542 * Check if a user is a manager
545 * user.
549 * @param string $user Username
550 * @param array $groups List of groups the user is in
551 * @param bool $adminonly when true checks if user is admin
558 function auth_ismanager($user = null, $groups = null, $adminonly = false, $recache = false)
569 if (is_null($user)) {
570 if (!$INPUT->server->has('REMOTE_USER')) {
573 $user = $INPUT->server->str('REMOTE_USER');
577 // checking the logged in user, or another one?
578 if ($USERINFO && $user === $INPUT->server->str('REMOTE_USER')) {
581 $groups = $auth->getUserData($user);
588 $cachekey = serialize([$user, $adminonly, $groups]);
591 $ok = auth_isMember($conf['superuser'], $user, $groups);
595 $ok = auth_isMember($conf['manager'], $user, $groups);
605 * Check if a user is admin
611 * @param string $user Username
612 * @param array $groups List of groups the user is in
619 function auth_isadmin($user = null, $groups = null, $recache = false)
621 return auth_ismanager($user, $groups, true, $recache);
625 * Match a user and his groups against a comma separated list of
631 * @param string $user user to match against
632 * @param array $groups groups the user is member of
635 function auth_isMember($memberlist, $user, array $groups)
641 // clean user and groups
642 if (!$auth->isCaseSensitive()) {
643 $user = PhpString::strtolower($user);
646 $user = $auth->cleanUser($user);
658 if (!$auth->isCaseSensitive()) $member = PhpString::strtolower($member);
660 $member = $auth->cleanGroup(substr($member, 1));
663 $member = $auth->cleanUser($member);
664 if ($member == $user) return true;
675 * This checks the permissions for the current user
690 return auth_aclcheck($id, $INPUT->server->str('REMOTE_USER'), is_array($USERINFO) ? $USERINFO['grps'] : []);
694 * Returns the maximum rights a user has for the given ID or its namespace
700 * @param string $user Username
701 * @param array|null $groups Array of groups the user is in
704 function auth_aclcheck($id, $user, $groups)
708 'user' => $user,
728 $user =& $data['user'];
744 //if user is superuser or in superusergroup return 255 (acl_admin)
745 if (auth_isadmin($user, $groups)) {
749 if (!$auth->isCaseSensitive()) {
750 $user = PhpString::strtolower($user);
753 $user = auth_nameencode($auth->cleanUser($user));
762 $perm = -1;
767 //add User
768 if ($user) $groups[] = $user;
776 if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
787 if ($perm > -1) {
788 //we had a match - return it
806 if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
817 //we had a match - return it
818 if ($perm != -1) {
842 * Some auth backends allow special chars in their user and groupnames
844 * are encoded UTF-8 multibyte are left as is (different from usual
863 if ($name == '%USER%') return $name;
869 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
875 '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
893 return '%' . dechex(ord(substr($matches[1], -1)));
919 if ($evt->advise_before(true)) {
923 $s = '!$%&?+*~#-_:.;,'; // specials
927 $data['password'] .= $c[auth_random(0, strlen($c) - 1)];
928 $data['password'] .= $v[auth_random(0, strlen($v) - 1)];
929 $data['password'] .= $a[auth_random(0, strlen($a) - 1)];
932 $data['password'] .= $s[auth_random(0, strlen($s) - 1)] . auth_random(10, 99);
934 $evt->advise_after();
940 * Sends a password to the given user
944 * @param string $user Login name of the user
948 function auth_sendPassword($user, $password)
955 $user = $auth->cleanUser($user);
956 $userinfo = $auth->getUserData($user, false);
963 'LOGIN' => $user,
968 $mail->to($mail->getCleanName($userinfo['name']) . ' <' . $userinfo['mail'] . '>');
969 $mail->subject($lang['regpwmail']);
970 $mail->setBody($text, $trep);
971 return $mail->send();
975 * Register a new user
977 * This registers a new user - Data is read directly from $_POST
992 if (!$INPUT->post->bool('save')) return false;
996 $login = trim($auth->cleanUser($INPUT->post->str('login')));
997 $fullname = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('fullname')));
998 $email = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('email')));
999 $pass = $INPUT->post->str('pass');
1000 $passchk = $INPUT->post->str('passchk');
1003 msg($lang['regmissing'], -1);
1008 $pass = auth_pwgen($login); // automatically generate password
1009 } elseif (empty($pass) || empty($passchk)) {
1010 msg($lang['regmissing'], -1); // complain about missing passwords
1012 } elseif ($pass != $passchk) {
1013 msg($lang['regbadpass'], -1); // complain about misspelled passwords
1019 msg($lang['regbadmail'], -1);
1023 //okay try to create the user
1024 if (!$auth->triggerUserMod('create', [$login, $pass, $fullname, $email])) {
1025 msg($lang['regfail'], -1);
1029 // send notification about the new user
1031 $subscription->sendRegister($login, $fullname, $email);
1039 // autogenerated password? then send password to user
1040 if (auth_sendPassword($login, $pass)) {
1044 msg($lang['regmailfail'], -1);
1050 * Update user profile
1065 if (!$INPUT->post->bool('save')) return false;
1069 msg($lang['profna'], -1);
1074 $changes['pass'] = $INPUT->post->str('newpass');
1075 $changes['name'] = $INPUT->post->str('fullname');
1076 $changes['mail'] = $INPUT->post->str('email');
1079 if ($changes['pass'] != $INPUT->post->str('passchk')) {
1080 msg($lang['regbadpass'], -1);
1085 $changes['name'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['name']));
1086 $changes['mail'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['mail']));
1090 (empty($changes['name']) && $auth->canDo('modName')) ||
1091 (empty($changes['mail']) && $auth->canDo('modMail'))
1093 msg($lang['profnoempty'], -1);
1096 if (!mail_isvalid($changes['mail']) && $auth->canDo('modMail')) {
1097 msg($lang['regbadmail'], -1);
1104 if (!$auth->canDo('modName')) unset($changes['name']);
1105 if (!$auth->canDo('modMail')) unset($changes['mail']);
1106 if (!$auth->canDo('modPass')) unset($changes['pass']);
1110 msg($lang['profnochange'], -1);
1115 if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1116 msg($lang['badpassconfirm'], -1);
1121 if (!$auth->triggerUserMod('modify', [$INPUT->server->str('REMOTE_USER'), &$changes])) {
1122 msg($lang['proffail'], -1);
1126 if (array_key_exists('pass', $changes) && $changes['pass']) {
1127 // update cookie and session with the changed data
1128 [/* user */, $sticky, /* pass */] = auth_getCookie();
1129 $pass = auth_encrypt($changes['pass'], auth_cookiesalt(!$sticky, true));
1130 auth_setCookie($INPUT->server->str('REMOTE_USER'), $pass, (bool) $sticky);
1143 * Delete the current logged-in user
1156 if (!$INPUT->post->bool('delete')) return false;
1160 if (!actionOK('profile_delete') || !$auth->canDo('delUser')) {
1161 msg($lang['profnodelete'], -1);
1165 if (!$INPUT->post->bool('confirm_delete')) {
1166 msg($lang['profconfdeletemissing'], -1);
1171 if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1172 msg($lang['badpassconfirm'], -1);
1178 $deleted[] = $INPUT->server->str('REMOTE_USER');
1179 if ($auth->triggerUserMod('delete', [$deleted])) {
1193 * - handling the first request of password reset
1194 * - validating the password reset auth token
1213 msg($lang['resendna'], -1);
1217 $token = preg_replace('/[^a-f0-9]+/', '', $INPUT->str('pwauth'));
1220 // we're in token phase - get user info from token
1224 msg($lang['resendpwdbadauth'], -1);
1225 $INPUT->remove('pwauth');
1229 if ((time() - filemtime($tfile)) > (3 * 60 * 60 * 24)) {
1230 msg($lang['resendpwdbadauth'], -1);
1231 $INPUT->remove('pwauth');
1236 $user = io_readfile($tfile);
1237 $userinfo = $auth->getUserData($user, false);
1239 msg($lang['resendpwdnouser'], -1);
1243 if (!$conf['autopasswd']) { // we let the user choose a password
1244 $pass = $INPUT->str('pass');
1247 if (!$pass) return false;
1248 if ($pass != $INPUT->str('passchk')) {
1249 msg($lang['regbadpass'], -1);
1254 if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1255 msg($lang['proffail'], -1);
1259 $pass = auth_pwgen($user);
1260 if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1261 msg($lang['proffail'], -1);
1265 if (auth_sendPassword($user, $pass)) {
1268 msg($lang['regmailfail'], -1);
1277 if (!$INPUT->post->bool('save')) return false;
1279 if (!$INPUT->post->str('login')) {
1280 msg($lang['resendpwdmissing'], -1);
1283 $user = trim($auth->cleanUser($INPUT->post->str('login')));
1286 $userinfo = $auth->getUserData($user, false);
1288 msg($lang['resendpwdnouser'], -1);
1297 io_saveFile($tfile, $user);
1300 $trep = ['FULLNAME' => $userinfo['name'], 'LOGIN' => $user, 'CONFIRM' => $url];
1303 $mail->to($userinfo['name'] . ' <' . $userinfo['mail'] . '>');
1304 $mail->subject($lang['regpwmail']);
1305 $mail->setBody($text, $trep);
1306 if ($mail->send()) {
1309 msg($lang['regmailfail'], -1);
1334 $pass = new PassHash();
1337 if (!method_exists($pass, $call)) {
1338 msg("Unsupported crypt method $method", -1);
1342 return $pass->$call($clear, $salt);
1357 $pass = new PassHash();
1358 return $pass->verify_hash($clear, $crypt);
1362 * Set the authentication cookie and add user identification data to the session
1364 * @param string $user username
1365 * @param string $pass encrypted password
1369 function auth_setCookie($user, $pass, $sticky)
1377 $USERINFO = $auth->getUserData($user);
1380 $cookie = base64_encode($user) . '|' . ((int) $sticky) . '|' . base64_encode($pass);
1392 $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
1393 $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass);
1402 * Returns the user, (encrypted) password and sticky bit from cookie
1411 [$user, $sticky, $pass] = sexplode('|', $_COOKIE[DOKU_COOKIE], 3, '');
1413 $pass = base64_decode($pass);
1414 $user = base64_decode($user);
1415 return [$user, $sticky, $pass];