xref: /dokuwiki/inc/auth.php (revision 9399c87e10527bd9270ac34f45432bcff3a2b473) 
1<?php
2
3/**
4 * Authentication library
5 *
6 * Including this file will automatically try to login
7 * a user by calling auth_login()
8 *
9 * @license    GPL 2 (http://www.gnu.org/licenses/gpl.html)
10 * @author     Andreas Gohr <andi@splitbrain.org>
11 */
12
13use dokuwiki\Ip;
14use dokuwiki\ErrorHandler;
15use dokuwiki\JWT;
16use dokuwiki\Utf8\PhpString;
17use dokuwiki\Extension\AuthPlugin;
18use dokuwiki\Extension\Event;
19use dokuwiki\Extension\PluginController;
20use dokuwiki\PassHash;
21use dokuwiki\Subscriptions\RegistrationSubscriptionSender;
22use phpseclib3\Crypt\AES;
23use phpseclib3\Crypt\Common\SymmetricKey;
24use phpseclib3\Exception\BadDecryptionException;
25
26/**
27 * Initialize the auth system.
28 *
29 * This function is automatically called at the end of init.php
30 *
31 * This used to be the main() of the auth.php
32 *
33 * @todo backend loading maybe should be handled by the class autoloader
34 * @todo maybe split into multiple functions at the XXX marked positions
35 * @triggers AUTH_LOGIN_CHECK
36 * @return bool
37 */
38function auth_setup()
39{
40    global $conf;
41    /* @var AuthPlugin $auth */
42    global $auth;
43    /* @var Input $INPUT */
44    global $INPUT;
45    global $AUTH_ACL;
46    global $lang;
47    /* @var PluginController $plugin_controller */
48    global $plugin_controller;
49    $AUTH_ACL = [];
50
51    // unset REMOTE_USER if empty
52    if ($INPUT->server->str('REMOTE_USER') === '') {
53        $INPUT->server->remove('REMOTE_USER');
54    }
55
56    if (!$conf['useacl']) return false;
57
58    // try to load auth backend from plugins
59    foreach ($plugin_controller->getList('auth') as $plugin) {
60        if ($conf['authtype'] === $plugin) {
61            $auth = $plugin_controller->load('auth', $plugin);
62            break;
63        }
64    }
65
66    if (!$auth instanceof AuthPlugin) {
67        msg($lang['authtempfail'], -1);
68        return false;
69    }
70
71    if ($auth->success == false) {
72        // degrade to unauthenticated user
73        $auth = null;
74        auth_logoff();
75        msg($lang['authtempfail'], -1);
76        return false;
77    }
78
79    // do the login either by cookie or provided credentials XXX
80    $INPUT->set('http_credentials', false);
81    if (!$conf['rememberme']) $INPUT->set('r', false);
82
83    // Populate Basic Auth user/password from Authorization header
84    // Note: with FastCGI, data is in REDIRECT_HTTP_AUTHORIZATION instead of HTTP_AUTHORIZATION
85    $header = $INPUT->server->str('HTTP_AUTHORIZATION') ?: $INPUT->server->str('REDIRECT_HTTP_AUTHORIZATION');
86    if (preg_match('~^Basic ([a-z\d/+]*={0,2})$~i', $header, $matches)) {
87        $userpass = explode(':', base64_decode($matches[1]));
88        [$_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']] = $userpass;
89    }
90
91    // if no credentials were given try to use HTTP auth (for SSO)
92    if (!$INPUT->str('u') && empty($_COOKIE[DOKU_COOKIE]) && !empty($INPUT->server->str('PHP_AUTH_USER'))) {
93        $INPUT->set('u', $INPUT->server->str('PHP_AUTH_USER'));
94        $INPUT->set('p', $INPUT->server->str('PHP_AUTH_PW'));
95        $INPUT->set('http_credentials', true);
96    }
97
98    // apply cleaning (auth specific user names, remove control chars)
99    if (true === $auth->success) {
100        $INPUT->set('u', $auth->cleanUser(stripctl($INPUT->str('u'))));
101        $INPUT->set('p', stripctl($INPUT->str('p')));
102    }
103
104    if (!auth_tokenlogin()) {
105        $ok = null;
106
107        if ($auth->canDo('external')) {
108            $ok = $auth->trustExternal($INPUT->str('u'), $INPUT->str('p'), $INPUT->bool('r'));
109        }
110
111        if ($ok === null) {
112            // external trust mechanism not in place, or returns no result,
113            // then attempt auth_login
114            $evdata = [
115                'user' => $INPUT->str('u'),
116                'password' => $INPUT->str('p'),
117                'sticky' => $INPUT->bool('r'),
118                'silent' => $INPUT->bool('http_credentials')
119            ];
120            Event::createAndTrigger('AUTH_LOGIN_CHECK', $evdata, 'auth_login_wrapper');
121        }
122    }
123
124    //load ACL into a global array XXX
125    $AUTH_ACL = auth_loadACL();
126
127    return true;
128}
129
130/**
131 * Loads the ACL setup and handle user wildcards
132 *
133 * @author Andreas Gohr <andi@splitbrain.org>
134 *
135 * @return array
136 */
137function auth_loadACL()
138{
139    global $config_cascade;
140    global $USERINFO;
141    /* @var Input $INPUT */
142    global $INPUT;
143
144    if (!is_readable($config_cascade['acl']['default'])) return [];
145
146    $acl = file($config_cascade['acl']['default']);
147
148    $out = [];
149    foreach ($acl as $line) {
150        $line = trim($line);
151        if (empty($line) || ($line[0] == '#')) continue; // skip blank lines & comments
152        [$id, $rest] = preg_split('/[ \t]+/', $line, 2);
153
154        // substitute user wildcard first (its 1:1)
155        if (strstr($line, '%USER%')) {
156            // if user is not logged in, this ACL line is meaningless - skip it
157            if (!$INPUT->server->has('REMOTE_USER')) continue;
158
159            $id   = str_replace('%USER%', cleanID($INPUT->server->str('REMOTE_USER')), $id);
160            $rest = str_replace('%USER%', auth_nameencode($INPUT->server->str('REMOTE_USER')), $rest);
161        }
162
163        // substitute group wildcard (its 1:m)
164        if (strstr($line, '%GROUP%')) {
165            // if user is not logged in, grps is empty, no output will be added (i.e. skipped)
166            if (isset($USERINFO['grps'])) {
167                foreach ((array) $USERINFO['grps'] as $grp) {
168                    $nid   = str_replace('%GROUP%', cleanID($grp), $id);
169                    $nrest = str_replace('%GROUP%', '@' . auth_nameencode($grp), $rest);
170                    $out[] = "$nid\t$nrest";
171                }
172            }
173        } else {
174            $out[] = "$id\t$rest";
175        }
176    }
177
178    return $out;
179}
180
181/**
182 * Try a token login
183 *
184 * @return bool true if token login succeeded
185 */
186function auth_tokenlogin()
187{
188    global $USERINFO;
189    global $INPUT;
190    /** @var DokuWiki_Auth_Plugin $auth */
191    global $auth;
192    if (!$auth) return false;
193
194    $headers = [];
195
196    // try to get the headers from Apache
197    if (function_exists('getallheaders')) {
198        $headers = getallheaders();
199        if (is_array($headers)) {
200            $headers = array_change_key_case($headers);
201        }
202    }
203
204    // get the headers from $_SERVER
205    if (!$headers) {
206        foreach ($_SERVER as $key => $value) {
207            if (substr($key, 0, 5) === 'HTTP_') {
208                $headers[strtolower(substr($key, 5))] = $value;
209            }
210        }
211    }
212
213    // check authorization header
214    if (isset($headers['authorization'])) {
215        [$type, $token] = sexplode(' ', $headers['authorization'], 2);
216        if ($type !== 'Bearer') $token = ''; // not the token we want
217    }
218
219    // check x-dokuwiki-token header
220    if (isset($headers['x-dokuwiki-token'])) {
221        $token = $headers['x-dokuwiki-token'];
222    }
223
224    if (empty($token)) return false;
225
226    // check token
227    try {
228        $authtoken = JWT::validate($token);
229    } catch (Exception $e) {
230        msg(hsc($e->getMessage()), -1);
231        return false;
232    }
233
234    // fetch user info from backend
235    $user = $authtoken->getUser();
236    $USERINFO = $auth->getUserData($user);
237    if (!$USERINFO) return false;
238
239    // the code is correct, set up user
240    $INPUT->server->set('REMOTE_USER', $user);
241    $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
242    $_SESSION[DOKU_COOKIE]['auth']['pass'] = 'nope';
243    $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO;
244
245    return true;
246}
247
248/**
249 * Event hook callback for AUTH_LOGIN_CHECK
250 *
251 * @param array $evdata
252 * @return bool
253 * @throws Exception
254 */
255function auth_login_wrapper($evdata)
256{
257    return auth_login(
258        $evdata['user'],
259        $evdata['password'],
260        $evdata['sticky'],
261        $evdata['silent']
262    );
263}
264
265/**
266 * This tries to login the user based on the sent auth credentials
267 *
268 * The authentication works like this: if a username was given
269 * a new login is assumed and user/password are checked. If they
270 * are correct the password is encrypted with blowfish and stored
271 * together with the username in a cookie - the same info is stored
272 * in the session, too. Additonally a browserID is stored in the
273 * session.
274 *
275 * If no username was given the cookie is checked: if the username,
276 * crypted password and browserID match between session and cookie
277 * no further testing is done and the user is accepted
278 *
279 * If a cookie was found but no session info was availabe the
280 * blowfish encrypted password from the cookie is decrypted and
281 * together with username rechecked by calling this function again.
282 *
283 * On a successful login $_SERVER[REMOTE_USER] and $USERINFO
284 * are set.
285 *
286 * @param string $user Username
287 * @param string $pass Cleartext Password
288 * @param bool $sticky Cookie should not expire
289 * @param bool $silent Don't show error on bad auth
290 * @return bool true on successful auth
291 * @throws Exception
292 *
293 * @author  Andreas Gohr <andi@splitbrain.org>
294 */
295function auth_login($user, $pass, $sticky = false, $silent = false)
296{
297    global $USERINFO;
298    global $conf;
299    global $lang;
300    /* @var AuthPlugin $auth */
301    global $auth;
302    /* @var Input $INPUT */
303    global $INPUT;
304
305    if (!$auth instanceof AuthPlugin) return false;
306
307    if (!empty($user)) {
308        //usual login
309        if (!empty($pass)) usleep(random_int(0, 250)); // add a random delay to prevent timing attacks #4491
310        if (!empty($pass) && $auth->checkPass($user, $pass)) {
311            // make logininfo globally available
312            $INPUT->server->set('REMOTE_USER', $user);
313            $secret                 = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
314            auth_setCookie($user, auth_encrypt($pass, $secret), $sticky);
315            return true;
316        } else {
317            //invalid credentials - log off
318            if (!$silent) {
319                http_status(403, 'Login failed');
320                msg($lang['badlogin'], -1);
321            }
322            auth_logoff();
323            return false;
324        }
325    } else {
326        // read cookie information
327        [$user, $sticky, $pass] = auth_getCookie();
328        if ($user && $pass) {
329            // we got a cookie - see if we can trust it
330
331            // get session info
332            if (isset($_SESSION[DOKU_COOKIE])) {
333                $session = $_SESSION[DOKU_COOKIE]['auth'] ?? [];
334                if (
335                    ($session !== []) &&
336                    $auth->useSessionCache($user) &&
337                    ($session['time'] >= time() - $conf['auth_security_timeout']) &&
338                    ($session['user'] == $user) &&
339                    ($session['pass'] == sha1($pass)) && //still crypted
340                    ($session['buid'] == auth_browseruid())
341                ) {
342                    // he has session, cookie and browser right - let him in
343                    $INPUT->server->set('REMOTE_USER', $user);
344                    $USERINFO = $session['info']; //FIXME move all references to session
345                    return true;
346                }
347            }
348            // no we don't trust it yet - recheck pass but silent
349            $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session
350            $pass   = auth_decrypt($pass, $secret);
351            return auth_login($user, $pass, $sticky, true);
352        }
353    }
354    //just to be sure
355    auth_logoff(true);
356    return false;
357}
358
359/**
360 * Builds a pseudo UID from browser and IP data
361 *
362 * This is neither unique nor unfakable - still it adds some
363 * security. Using the first part of the IP makes sure
364 * proxy farms like AOLs are still okay.
365 *
366 * @author  Andreas Gohr <andi@splitbrain.org>
367 *
368 * @return  string  a SHA256 sum of various browser headers
369 */
370function auth_browseruid()
371{
372    /* @var Input $INPUT */
373    global $INPUT;
374
375    $ip = clientIP(true);
376    // convert IP string to packed binary representation
377    $pip = inet_pton($ip);
378
379    $uid = implode("\n", [
380        $INPUT->server->str('HTTP_USER_AGENT'),
381        $INPUT->server->str('HTTP_ACCEPT_LANGUAGE'),
382        substr($pip, 0, strlen($pip) / 2), // use half of the IP address (works for both IPv4 and IPv6)
383    ]);
384    return hash('sha256', $uid);
385}
386
387/**
388 * Creates a random key to encrypt the password in cookies
389 *
390 * This function tries to read the password for encrypting
391 * cookies from $conf['metadir'].'/_htcookiesalt'
392 * if no such file is found a random key is created and
393 * and stored in this file.
394 *
395 * @param bool $addsession if true, the sessionid is added to the salt
396 * @param bool $secure if security is more important than keeping the old value
397 * @return  string
398 * @throws Exception
399 *
400 * @author  Andreas Gohr <andi@splitbrain.org>
401 */
402function auth_cookiesalt($addsession = false, $secure = false)
403{
404    if (defined('SIMPLE_TEST')) {
405        return 'test';
406    }
407    global $conf;
408    $file = $conf['metadir'] . '/_htcookiesalt';
409    if ($secure || !file_exists($file)) {
410        $file = $conf['metadir'] . '/_htcookiesalt2';
411    }
412    $salt = io_readFile($file);
413    if (empty($salt)) {
414        $salt = bin2hex(auth_randombytes(64));
415        io_saveFile($file, $salt);
416    }
417    if ($addsession) {
418        $salt .= session_id();
419    }
420    return $salt;
421}
422
423/**
424 * Return cryptographically secure random bytes.
425 *
426 * @param int $length number of bytes
427 * @return string cryptographically secure random bytes
428 * @throws Exception
429 *
430 * @author Niklas Keller <me@kelunik.com>
431 */
432function auth_randombytes($length)
433{
434    return random_bytes($length);
435}
436
437/**
438 * Cryptographically secure random number generator.
439 *
440 * @param int $min
441 * @param int $max
442 * @return int
443 * @throws Exception
444 *
445 * @author Niklas Keller <me@kelunik.com>
446 */
447function auth_random($min, $max)
448{
449    return random_int($min, $max);
450}
451
452/**
453 * Encrypt data using the given secret using AES
454 *
455 * The mode is CBC with a random initialization vector, the key is derived
456 * using pbkdf2.
457 *
458 * @param string $data The data that shall be encrypted
459 * @param string $secret The secret/password that shall be used
460 * @return string The ciphertext
461 * @throws Exception
462 */
463function auth_encrypt($data, $secret)
464{
465    $iv     = auth_randombytes(16);
466    $cipher = new AES('cbc');
467    $cipher->setPassword($secret, 'pbkdf2', 'sha1', 'phpseclib');
468    $cipher->setIV($iv);
469
470    /*
471    this uses the encrypted IV as IV as suggested in
472    http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, Appendix C
473    for unique but necessarily random IVs. The resulting ciphertext is
474    compatible to ciphertext that was created using a "normal" IV.
475    */
476    return $cipher->encrypt($iv . $data);
477}
478
479/**
480 * Decrypt the given AES ciphertext
481 *
482 * The mode is CBC, the key is derived using pbkdf2
483 *
484 * @param string $ciphertext The encrypted data
485 * @param string $secret     The secret/password that shall be used
486 * @return string|null The decrypted data
487 */
488function auth_decrypt($ciphertext, $secret)
489{
490    $iv     = substr($ciphertext, 0, 16);
491    $cipher = new AES('cbc');
492    $cipher->setPassword($secret, 'pbkdf2', 'sha1', 'phpseclib');
493    $cipher->setIV($iv);
494
495    try {
496        return $cipher->decrypt(substr($ciphertext, 16));
497    } catch (BadDecryptionException $e) {
498        ErrorHandler::logException($e);
499        return null;
500    }
501}
502
503/**
504 * Log out the current user
505 *
506 * This clears all authentication data and thus log the user
507 * off. It also clears session data.
508 *
509 * @author  Andreas Gohr <andi@splitbrain.org>
510 *
511 * @param bool $keepbc - when true, the breadcrumb data is not cleared
512 */
513function auth_logoff($keepbc = false)
514{
515    global $conf;
516    global $USERINFO;
517    /* @var AuthPlugin $auth */
518    global $auth;
519    /* @var Input $INPUT */
520    global $INPUT;
521
522    // make sure the session is writable (it usually is)
523    @session_start();
524
525    if (isset($_SESSION[DOKU_COOKIE]['auth']['user']))
526        unset($_SESSION[DOKU_COOKIE]['auth']['user']);
527    if (isset($_SESSION[DOKU_COOKIE]['auth']['pass']))
528        unset($_SESSION[DOKU_COOKIE]['auth']['pass']);
529    if (isset($_SESSION[DOKU_COOKIE]['auth']['info']))
530        unset($_SESSION[DOKU_COOKIE]['auth']['info']);
531    if (!$keepbc && isset($_SESSION[DOKU_COOKIE]['bc']))
532        unset($_SESSION[DOKU_COOKIE]['bc']);
533    $INPUT->server->remove('REMOTE_USER');
534    $USERINFO = null; //FIXME
535
536    $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir'];
537    setcookie(DOKU_COOKIE, '', [
538        'expires' => time() - 600000,
539        'path' => $cookieDir,
540        'secure' => ($conf['securecookie'] && Ip::isSsl()),
541        'httponly' => true,
542        'samesite' => $conf['samesitecookie'] ?: null, // null means browser default
543    ]);
544
545    if ($auth instanceof AuthPlugin) {
546        $auth->logOff();
547    }
548}
549
550/**
551 * Check if a user is a manager
552 *
553 * Should usually be called without any parameters to check the current
554 * user.
555 *
556 * The info is available through $INFO['ismanager'], too
557 *
558 * @param string $user Username
559 * @param array $groups List of groups the user is in
560 * @param bool $adminonly when true checks if user is admin
561 * @param bool $recache set to true to refresh the cache
562 * @return bool
563 * @see    auth_isadmin
564 *
565 * @author Andreas Gohr <andi@splitbrain.org>
566 */
567function auth_ismanager($user = null, $groups = null, $adminonly = false, $recache = false)
568{
569    global $conf;
570    global $USERINFO;
571    /* @var AuthPlugin $auth */
572    global $auth;
573    /* @var Input $INPUT */
574    global $INPUT;
575
576
577    if (!$auth instanceof AuthPlugin) return false;
578    if (is_null($user)) {
579        if (!$INPUT->server->has('REMOTE_USER')) {
580            return false;
581        } else {
582            $user = $INPUT->server->str('REMOTE_USER');
583        }
584    }
585    if (is_null($groups)) {
586        // checking the logged in user, or another one?
587        if ($USERINFO && $user === $INPUT->server->str('REMOTE_USER')) {
588            $groups =  (array) $USERINFO['grps'];
589        } else {
590            $groups = $auth->getUserData($user);
591            $groups = $groups ? $groups['grps'] : [];
592        }
593    }
594
595    // prefer cached result
596    static $cache = [];
597    $cachekey = serialize([$user, $adminonly, $groups]);
598    if (!isset($cache[$cachekey]) || $recache) {
599        // check superuser match
600        $ok = auth_isMember($conf['superuser'], $user, $groups);
601
602        // check managers
603        if (!$ok && !$adminonly) {
604            $ok = auth_isMember($conf['manager'], $user, $groups);
605        }
606
607        $cache[$cachekey] = $ok;
608    }
609
610    return $cache[$cachekey];
611}
612
613/**
614 * Check if a user is admin
615 *
616 * Alias to auth_ismanager with adminonly=true
617 *
618 * The info is available through $INFO['isadmin'], too
619 *
620 * @param string $user Username
621 * @param array $groups List of groups the user is in
622 * @param bool $recache set to true to refresh the cache
623 * @return bool
624 * @author Andreas Gohr <andi@splitbrain.org>
625 * @see auth_ismanager()
626 *
627 */
628function auth_isadmin($user = null, $groups = null, $recache = false)
629{
630    return auth_ismanager($user, $groups, true, $recache);
631}
632
633/**
634 * Match a user and his groups against a comma separated list of
635 * users and groups to determine membership status
636 *
637 * Note: all input should NOT be nameencoded.
638 *
639 * @param string $memberlist commaseparated list of allowed users and groups
640 * @param string $user       user to match against
641 * @param array  $groups     groups the user is member of
642 * @return bool       true for membership acknowledged
643 */
644function auth_isMember($memberlist, $user, array $groups)
645{
646    /* @var AuthPlugin $auth */
647    global $auth;
648    if (!$auth instanceof AuthPlugin) return false;
649
650    // clean user and groups
651    if (!$auth->isCaseSensitive()) {
652        $user   = PhpString::strtolower($user);
653        $groups = array_map([PhpString::class, 'strtolower'], $groups);
654    }
655    $user   = $auth->cleanUser($user);
656    $groups = array_map([$auth, 'cleanGroup'], $groups);
657
658    // extract the memberlist
659    $members = explode(',', $memberlist);
660    $members = array_map('trim', $members);
661    $members = array_unique($members);
662    $members = array_filter($members);
663
664    // compare cleaned values
665    foreach ($members as $member) {
666        if ($member == '@ALL') return true;
667        if (!$auth->isCaseSensitive()) $member = PhpString::strtolower($member);
668        if ($member[0] == '@') {
669            $member = $auth->cleanGroup(substr($member, 1));
670            if (in_array($member, $groups)) return true;
671        } else {
672            $member = $auth->cleanUser($member);
673            if ($member == $user) return true;
674        }
675    }
676
677    // still here? not a member!
678    return false;
679}
680
681/**
682 * Convinience function for auth_aclcheck()
683 *
684 * This checks the permissions for the current user
685 *
686 * @author  Andreas Gohr <andi@splitbrain.org>
687 *
688 * @param  string  $id  page ID (needs to be resolved and cleaned)
689 * @return int          permission level
690 */
691function auth_quickaclcheck($id)
692{
693    global $conf;
694    global $USERINFO;
695    /* @var Input $INPUT */
696    global $INPUT;
697    # if no ACL is used always return upload rights
698    if (!$conf['useacl']) return AUTH_UPLOAD;
699    return auth_aclcheck($id, $INPUT->server->str('REMOTE_USER'), is_array($USERINFO) ? $USERINFO['grps'] : []);
700}
701
702/**
703 * Returns the maximum rights a user has for the given ID or its namespace
704 *
705 * @author  Andreas Gohr <andi@splitbrain.org>
706 *
707 * @triggers AUTH_ACL_CHECK
708 * @param  string       $id     page ID (needs to be resolved and cleaned)
709 * @param  string       $user   Username
710 * @param  array|null   $groups Array of groups the user is in
711 * @return int             permission level
712 */
713function auth_aclcheck($id, $user, $groups)
714{
715    $data = [
716        'id'     => $id ?? '',
717        'user'   => $user,
718        'groups' => $groups
719    ];
720
721    return Event::createAndTrigger('AUTH_ACL_CHECK', $data, 'auth_aclcheck_cb');
722}
723
724/**
725 * default ACL check method
726 *
727 * DO NOT CALL DIRECTLY, use auth_aclcheck() instead
728 *
729 * @author  Andreas Gohr <andi@splitbrain.org>
730 *
731 * @param  array $data event data
732 * @return int   permission level
733 */
734function auth_aclcheck_cb($data)
735{
736    $id     =& $data['id'];
737    $user   =& $data['user'];
738    $groups =& $data['groups'];
739
740    global $conf;
741    global $AUTH_ACL;
742    /* @var AuthPlugin $auth */
743    global $auth;
744
745    // if no ACL is used always return upload rights
746    if (!$conf['useacl']) return AUTH_UPLOAD;
747    if (!$auth instanceof AuthPlugin) return AUTH_NONE;
748    if (!is_array($AUTH_ACL)) return AUTH_NONE;
749
750    //make sure groups is an array
751    if (!is_array($groups)) $groups = [];
752
753    //if user is superuser or in superusergroup return 255 (acl_admin)
754    if (auth_isadmin($user, $groups)) {
755        return AUTH_ADMIN;
756    }
757
758    if (!$auth->isCaseSensitive()) {
759        $user   = PhpString::strtolower($user);
760        $groups = array_map([PhpString::class, 'strtolower'], $groups);
761    }
762    $user   = auth_nameencode($auth->cleanUser($user));
763    $groups = array_map([$auth, 'cleanGroup'], $groups);
764
765    //prepend groups with @ and nameencode
766    foreach ($groups as &$group) {
767        $group = '@' . auth_nameencode($group);
768    }
769
770    $ns   = getNS($id);
771    $perm = -1;
772
773    //add ALL group
774    $groups[] = '@ALL';
775
776    //add User
777    if ($user) $groups[] = $user;
778
779    //check exact match first
780    $matches = preg_grep('/^' . preg_quote($id, '/') . '[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL);
781    if (count($matches)) {
782        foreach ($matches as $match) {
783            $match = preg_replace('/#.*$/', '', $match); //ignore comments
784            $acl   = preg_split('/[ \t]+/', $match);
785            if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
786                $acl[1] = PhpString::strtolower($acl[1]);
787            }
788            if (!in_array($acl[1], $groups)) {
789                continue;
790            }
791            if ($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL!
792            if ($acl[2] > $perm) {
793                $perm = $acl[2];
794            }
795        }
796        if ($perm > -1) {
797            //we had a match - return it
798            return (int) $perm;
799        }
800    }
801
802    //still here? do the namespace checks
803    if ($ns) {
804        $path = $ns . ':*';
805    } else {
806        $path = '*'; //root document
807    }
808
809    do {
810        $matches = preg_grep('/^' . preg_quote($path, '/') . '[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL);
811        if (count($matches)) {
812            foreach ($matches as $match) {
813                $match = preg_replace('/#.*$/', '', $match); //ignore comments
814                $acl   = preg_split('/[ \t]+/', $match);
815                if (!$auth->isCaseSensitive() && $acl[1] !== '@ALL') {
816                    $acl[1] = PhpString::strtolower($acl[1]);
817                }
818                if (!in_array($acl[1], $groups)) {
819                    continue;
820                }
821                if ($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL!
822                if ($acl[2] > $perm) {
823                    $perm = $acl[2];
824                }
825            }
826            //we had a match - return it
827            if ($perm != -1) {
828                return (int) $perm;
829            }
830        }
831        //get next higher namespace
832        $ns = getNS($ns);
833
834        if ($path != '*') {
835            $path = $ns . ':*';
836            if ($path == ':*') $path = '*';
837        } else {
838            //we did this already
839            //looks like there is something wrong with the ACL
840            //break here
841            msg('No ACL setup yet! Denying access to everyone.');
842            return AUTH_NONE;
843        }
844    } while (1); //this should never loop endless
845    return AUTH_NONE;
846}
847
848/**
849 * Encode ASCII special chars
850 *
851 * Some auth backends allow special chars in their user and groupnames
852 * The special chars are encoded with this function. Only ASCII chars
853 * are encoded UTF-8 multibyte are left as is (different from usual
854 * urlencoding!).
855 *
856 * Decoding can be done with rawurldecode
857 *
858 * @author Andreas Gohr <gohr@cosmocode.de>
859 * @see rawurldecode()
860 *
861 * @param string $name
862 * @param bool $skip_group
863 * @return string
864 */
865function auth_nameencode($name, $skip_group = false)
866{
867    global $cache_authname;
868    $cache =& $cache_authname;
869    $name  = (string) $name;
870
871    // never encode wildcard FS#1955
872    if ($name == '%USER%') return $name;
873    if ($name == '%GROUP%') return $name;
874
875    if (!isset($cache[$name][$skip_group])) {
876        if ($skip_group && $name[0] == '@') {
877            $cache[$name][$skip_group] = '@' . preg_replace_callback(
878                '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
879                'auth_nameencode_callback',
880                substr($name, 1)
881            );
882        } else {
883            $cache[$name][$skip_group] = preg_replace_callback(
884                '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/',
885                'auth_nameencode_callback',
886                $name
887            );
888        }
889    }
890
891    return $cache[$name][$skip_group];
892}
893
894/**
895 * callback encodes the matches
896 *
897 * @param array $matches first complete match, next matching subpatterms
898 * @return string
899 */
900function auth_nameencode_callback($matches)
901{
902    return '%' . dechex(ord(substr($matches[1], -1)));
903}
904
905/**
906 * Create a pronouncable password
907 *
908 * The $foruser variable might be used by plugins to run additional password
909 * policy checks, but is not used by the default implementation
910 *
911 * @param string $foruser username for which the password is generated
912 * @return string  pronouncable password
913 * @throws Exception
914 *
915 * @link     http://www.phpbuilder.com/annotate/message.php3?id=1014451
916 * @triggers AUTH_PASSWORD_GENERATE
917 *
918 * @author   Andreas Gohr <andi@splitbrain.org>
919 */
920function auth_pwgen($foruser = '')
921{
922    $data = [
923        'password' => '',
924        'foruser'  => $foruser
925    ];
926
927    $evt = new Event('AUTH_PASSWORD_GENERATE', $data);
928    if ($evt->advise_before(true)) {
929        $c = 'bcdfghjklmnprstvwz'; //consonants except hard to speak ones
930        $v = 'aeiou'; //vowels
931        $a = $c . $v; //both
932        $s = '!$%&?+*~#-_:.;,'; // specials
933
934        //use thre syllables...
935        for ($i = 0; $i < 3; $i++) {
936            $data['password'] .= $c[auth_random(0, strlen($c) - 1)];
937            $data['password'] .= $v[auth_random(0, strlen($v) - 1)];
938            $data['password'] .= $a[auth_random(0, strlen($a) - 1)];
939        }
940        //... and add a nice number and special
941        $data['password'] .= $s[auth_random(0, strlen($s) - 1)] . auth_random(10, 99);
942    }
943    $evt->advise_after();
944
945    return $data['password'];
946}
947
948/**
949 * Sends a password to the given user
950 *
951 * @author  Andreas Gohr <andi@splitbrain.org>
952 *
953 * @param string $user Login name of the user
954 * @param string $password The new password in clear text
955 * @return bool  true on success
956 */
957function auth_sendPassword($user, $password)
958{
959    global $lang;
960    /* @var AuthPlugin $auth */
961    global $auth;
962    if (!$auth instanceof AuthPlugin) return false;
963
964    $user     = $auth->cleanUser($user);
965    $userinfo = $auth->getUserData($user, false);
966
967    if (!$userinfo['mail']) return false;
968
969    $text = rawLocale('password');
970    $trep = [
971        'FULLNAME' => $userinfo['name'],
972        'LOGIN'    => $user,
973        'PASSWORD' => $password
974    ];
975
976    $mail = new Mailer();
977    $mail->to($mail->getCleanName($userinfo['name']) . ' <' . $userinfo['mail'] . '>');
978    $mail->subject($lang['regpwmail']);
979    $mail->setBody($text, $trep);
980    return $mail->send();
981}
982
983/**
984 * Register a new user
985 *
986 * This registers a new user - Data is read directly from $_POST
987 *
988 * @return bool  true on success, false on any error
989 * @throws Exception
990 *
991 * @author  Andreas Gohr <andi@splitbrain.org>
992 */
993function register()
994{
995    global $lang;
996    global $conf;
997    /* @var AuthPlugin $auth */
998    global $auth;
999    global $INPUT;
1000
1001    if (!$INPUT->post->bool('save')) return false;
1002    if (!actionOK('register')) return false;
1003
1004    // gather input
1005    $login    = trim($auth->cleanUser($INPUT->post->str('login')));
1006    $fullname = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('fullname')));
1007    $email    = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('email')));
1008    $pass     = $INPUT->post->str('pass');
1009    $passchk  = $INPUT->post->str('passchk');
1010
1011    if (empty($login) || empty($fullname) || empty($email)) {
1012        msg($lang['regmissing'], -1);
1013        return false;
1014    }
1015
1016    if ($conf['autopasswd']) {
1017        $pass = auth_pwgen($login); // automatically generate password
1018    } elseif (empty($pass) || empty($passchk)) {
1019        msg($lang['regmissing'], -1); // complain about missing passwords
1020        return false;
1021    } elseif ($pass != $passchk) {
1022        msg($lang['regbadpass'], -1); // complain about misspelled passwords
1023        return false;
1024    }
1025
1026    //check mail
1027    if (!mail_isvalid($email)) {
1028        msg($lang['regbadmail'], -1);
1029        return false;
1030    }
1031
1032    //okay try to create the user
1033    if (!$auth->triggerUserMod('create', [$login, $pass, $fullname, $email])) {
1034        msg($lang['regfail'], -1);
1035        return false;
1036    }
1037
1038    // send notification about the new user
1039    $subscription = new RegistrationSubscriptionSender();
1040    $subscription->sendRegister($login, $fullname, $email);
1041
1042    // are we done?
1043    if (!$conf['autopasswd']) {
1044        msg($lang['regsuccess2'], 1);
1045        return true;
1046    }
1047
1048    // autogenerated password? then send password to user
1049    if (auth_sendPassword($login, $pass)) {
1050        msg($lang['regsuccess'], 1);
1051        return true;
1052    } else {
1053        msg($lang['regmailfail'], -1);
1054        return false;
1055    }
1056}
1057
1058/**
1059 * Update user profile
1060 *
1061 * @throws Exception
1062 *
1063 * @author    Christopher Smith <chris@jalakai.co.uk>
1064 */
1065function updateprofile()
1066{
1067    global $conf;
1068    global $lang;
1069    /* @var AuthPlugin $auth */
1070    global $auth;
1071    /* @var Input $INPUT */
1072    global $INPUT;
1073
1074    if (!$INPUT->post->bool('save')) return false;
1075    if (!checkSecurityToken()) return false;
1076
1077    if (!actionOK('profile')) {
1078        msg($lang['profna'], -1);
1079        return false;
1080    }
1081
1082    $changes         = [];
1083    $changes['pass'] = $INPUT->post->str('newpass');
1084    $changes['name'] = $INPUT->post->str('fullname');
1085    $changes['mail'] = $INPUT->post->str('email');
1086
1087    // check misspelled passwords
1088    if ($changes['pass'] != $INPUT->post->str('passchk')) {
1089        msg($lang['regbadpass'], -1);
1090        return false;
1091    }
1092
1093    // clean fullname and email
1094    $changes['name'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['name']));
1095    $changes['mail'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['mail']));
1096
1097    // no empty name and email (except the backend doesn't support them)
1098    if (
1099        (empty($changes['name']) && $auth->canDo('modName')) ||
1100        (empty($changes['mail']) && $auth->canDo('modMail'))
1101    ) {
1102        msg($lang['profnoempty'], -1);
1103        return false;
1104    }
1105    if (!mail_isvalid($changes['mail']) && $auth->canDo('modMail')) {
1106        msg($lang['regbadmail'], -1);
1107        return false;
1108    }
1109
1110    $changes = array_filter($changes);
1111
1112    // check for unavailable capabilities
1113    if (!$auth->canDo('modName')) unset($changes['name']);
1114    if (!$auth->canDo('modMail')) unset($changes['mail']);
1115    if (!$auth->canDo('modPass')) unset($changes['pass']);
1116
1117    // anything to do?
1118    if ($changes === []) {
1119        msg($lang['profnochange'], -1);
1120        return false;
1121    }
1122
1123    if ($conf['profileconfirm']) {
1124        if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1125            msg($lang['badpassconfirm'], -1);
1126            return false;
1127        }
1128    }
1129
1130    if (!$auth->triggerUserMod('modify', [$INPUT->server->str('REMOTE_USER'), &$changes])) {
1131        msg($lang['proffail'], -1);
1132        return false;
1133    }
1134
1135    if (array_key_exists('pass', $changes) && $changes['pass']) {
1136        // update cookie and session with the changed data
1137        [/* user */, $sticky, /* pass */] = auth_getCookie();
1138        $pass = auth_encrypt($changes['pass'], auth_cookiesalt(!$sticky, true));
1139        auth_setCookie($INPUT->server->str('REMOTE_USER'), $pass, (bool) $sticky);
1140    } else {
1141        // make sure the session is writable
1142        @session_start();
1143        // invalidate session cache
1144        $_SESSION[DOKU_COOKIE]['auth']['time'] = 0;
1145        session_write_close();
1146    }
1147
1148    return true;
1149}
1150
1151/**
1152 * Delete the current logged-in user
1153 *
1154 * @return bool true on success, false on any error
1155 */
1156function auth_deleteprofile()
1157{
1158    global $conf;
1159    global $lang;
1160    /* @var AuthPlugin $auth */
1161    global $auth;
1162    /* @var Input $INPUT */
1163    global $INPUT;
1164
1165    if (!$INPUT->post->bool('delete')) return false;
1166    if (!checkSecurityToken()) return false;
1167
1168    // action prevented or auth module disallows
1169    if (!actionOK('profile_delete') || !$auth->canDo('delUser')) {
1170        msg($lang['profnodelete'], -1);
1171        return false;
1172    }
1173
1174    if (!$INPUT->post->bool('confirm_delete')) {
1175        msg($lang['profconfdeletemissing'], -1);
1176        return false;
1177    }
1178
1179    if ($conf['profileconfirm']) {
1180        if (!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) {
1181            msg($lang['badpassconfirm'], -1);
1182            return false;
1183        }
1184    }
1185
1186    $deleted = [];
1187    $deleted[] = $INPUT->server->str('REMOTE_USER');
1188    if ($auth->triggerUserMod('delete', [$deleted])) {
1189        // force and immediate logout including removing the sticky cookie
1190        auth_logoff();
1191        return true;
1192    }
1193
1194    return false;
1195}
1196
1197/**
1198 * Send a  new password
1199 *
1200 * This function handles both phases of the password reset:
1201 *
1202 *   - handling the first request of password reset
1203 *   - validating the password reset auth token
1204 *
1205 * @return bool true on success, false on any error
1206 * @throws Exception
1207 *
1208 * @author Andreas Gohr <andi@splitbrain.org>
1209 * @author Benoit Chesneau <benoit@bchesneau.info>
1210 * @author Chris Smith <chris@jalakai.co.uk>
1211 */
1212function act_resendpwd()
1213{
1214    global $lang;
1215    global $conf;
1216    /* @var AuthPlugin $auth */
1217    global $auth;
1218    /* @var Input $INPUT */
1219    global $INPUT;
1220
1221    if (!actionOK('resendpwd')) {
1222        msg($lang['resendna'], -1);
1223        return false;
1224    }
1225
1226    $token = preg_replace('/[^a-f0-9]+/', '', $INPUT->str('pwauth'));
1227
1228    if ($token) {
1229        // we're in token phase - get user info from token
1230
1231        $tfile = $conf['cachedir'] . '/' . $token[0] . '/' . $token . '.pwauth';
1232        if (!file_exists($tfile)) {
1233            msg($lang['resendpwdbadauth'], -1);
1234            $INPUT->remove('pwauth');
1235            return false;
1236        }
1237        // token is only valid for 3 days
1238        if ((time() - filemtime($tfile)) > (3 * 60 * 60 * 24)) {
1239            msg($lang['resendpwdbadauth'], -1);
1240            $INPUT->remove('pwauth');
1241            @unlink($tfile);
1242            return false;
1243        }
1244
1245        $user     = io_readfile($tfile);
1246        $userinfo = $auth->getUserData($user, false);
1247        if (!$userinfo['mail']) {
1248            msg($lang['resendpwdnouser'], -1);
1249            return false;
1250        }
1251
1252        if (!$conf['autopasswd']) { // we let the user choose a password
1253            $pass = $INPUT->str('pass');
1254
1255            // password given correctly?
1256            if (!$pass) return false;
1257            if ($pass != $INPUT->str('passchk')) {
1258                msg($lang['regbadpass'], -1);
1259                return false;
1260            }
1261
1262            // change it
1263            if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1264                msg($lang['proffail'], -1);
1265                return false;
1266            }
1267        } else { // autogenerate the password and send by mail
1268            $pass = auth_pwgen($user);
1269            if (!$auth->triggerUserMod('modify', [$user, ['pass' => $pass]])) {
1270                msg($lang['proffail'], -1);
1271                return false;
1272            }
1273
1274            if (auth_sendPassword($user, $pass)) {
1275                msg($lang['resendpwdsuccess'], 1);
1276            } else {
1277                msg($lang['regmailfail'], -1);
1278            }
1279        }
1280
1281        @unlink($tfile);
1282        return true;
1283    } else {
1284        // we're in request phase
1285
1286        if (!$INPUT->post->bool('save')) return false;
1287
1288        if (!$INPUT->post->str('login')) {
1289            msg($lang['resendpwdmissing'], -1);
1290            return false;
1291        } else {
1292            $user = trim($auth->cleanUser($INPUT->post->str('login')));
1293        }
1294
1295        $userinfo = $auth->getUserData($user, false);
1296        if (!$userinfo['mail']) {
1297            msg($lang['resendpwdnouser'], -1);
1298            return false;
1299        }
1300
1301        // generate auth token
1302        $token = md5(auth_randombytes(16)); // random secret
1303        $tfile = $conf['cachedir'] . '/' . $token[0] . '/' . $token . '.pwauth';
1304        $url   = wl('', ['do' => 'resendpwd', 'pwauth' => $token], true, '&');
1305
1306        io_saveFile($tfile, $user);
1307
1308        $text = rawLocale('pwconfirm');
1309        $trep = ['FULLNAME' => $userinfo['name'], 'LOGIN'    => $user, 'CONFIRM'  => $url];
1310
1311        $mail = new Mailer();
1312        $mail->to($userinfo['name'] . ' <' . $userinfo['mail'] . '>');
1313        $mail->subject($lang['regpwmail']);
1314        $mail->setBody($text, $trep);
1315        if ($mail->send()) {
1316            msg($lang['resendpwdconfirm'], 1);
1317        } else {
1318            msg($lang['regmailfail'], -1);
1319        }
1320        return true;
1321    }
1322    // never reached
1323}
1324
1325/**
1326 * Encrypts a password using the given method and salt
1327 *
1328 * If the selected method needs a salt and none was given, a random one
1329 * is chosen.
1330 *
1331 * You can pass null as the password to create an unusable hash.
1332 *
1333 * @author  Andreas Gohr <andi@splitbrain.org>
1334 *
1335 * @param string $clear The clear text password
1336 * @param string $method The hashing method
1337 * @param string $salt A salt, null for random
1338 * @return  string  The crypted password
1339 */
1340function auth_cryptPassword($clear, $method = '', $salt = null)
1341{
1342    global $conf;
1343
1344    if ($clear === null) {
1345        return DOKU_UNUSABLE_PASSWORD;
1346    }
1347
1348    if (empty($method)) $method = $conf['passcrypt'];
1349
1350    $pass = new PassHash();
1351    $call = 'hash_' . $method;
1352
1353    if (!method_exists($pass, $call)) {
1354        msg("Unsupported crypt method $method", -1);
1355        return false;
1356    }
1357
1358    return $pass->$call($clear, $salt);
1359}
1360
1361/**
1362 * Verifies a cleartext password against a crypted hash
1363 *
1364 * @param string $clear The clear text password
1365 * @param string $crypt The hash to compare with
1366 * @return bool true if both match
1367 * @throws Exception
1368 *
1369 * @author Andreas Gohr <andi@splitbrain.org>
1370 */
1371function auth_verifyPassword($clear, $crypt)
1372{
1373    if ($crypt === DOKU_UNUSABLE_PASSWORD) {
1374        return false;
1375    }
1376
1377    $pass = new PassHash();
1378    return $pass->verify_hash($clear, $crypt);
1379}
1380
1381/**
1382 * Set the authentication cookie and add user identification data to the session
1383 *
1384 * @param string  $user       username
1385 * @param string  $pass       encrypted password
1386 * @param bool    $sticky     whether or not the cookie will last beyond the session
1387 * @return bool
1388 */
1389function auth_setCookie($user, $pass, $sticky)
1390{
1391    global $conf;
1392    /* @var AuthPlugin $auth */
1393    global $auth;
1394    global $USERINFO;
1395
1396    if (!$auth instanceof AuthPlugin) return false;
1397    $USERINFO = $auth->getUserData($user);
1398
1399    // set cookie
1400    $cookie    = base64_encode($user) . '|' . ((int) $sticky) . '|' . base64_encode($pass);
1401    $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir'];
1402    $time      = $sticky ? (time() + 60 * 60 * 24 * 365) : 0; //one year
1403    setcookie(DOKU_COOKIE, $cookie, [
1404        'expires' => $time,
1405        'path' => $cookieDir,
1406        'secure' => ($conf['securecookie'] && Ip::isSsl()),
1407        'httponly' => true,
1408        'samesite' => $conf['samesitecookie'] ?: null, // null means browser default
1409    ]);
1410
1411    // set session
1412    $_SESSION[DOKU_COOKIE]['auth']['user'] = $user;
1413    $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass);
1414    $_SESSION[DOKU_COOKIE]['auth']['buid'] = auth_browseruid();
1415    $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO;
1416    $_SESSION[DOKU_COOKIE]['auth']['time'] = time();
1417
1418    return true;
1419}
1420
1421/**
1422 * Returns the user, (encrypted) password and sticky bit from cookie
1423 *
1424 * @returns array
1425 */
1426function auth_getCookie()
1427{
1428    if (!isset($_COOKIE[DOKU_COOKIE])) {
1429        return [null, null, null];
1430    }
1431    [$user, $sticky, $pass] = sexplode('|', $_COOKIE[DOKU_COOKIE], 3, '');
1432    $sticky = (bool) $sticky;
1433    $pass   = base64_decode($pass);
1434    $user   = base64_decode($user);
1435    return [$user, $sticky, $pass];
1436}
1437
1438//Setup VIM: ex: et ts=2 :
1439