1<?php 2/** 3 * Authentication library 4 * 5 * Including this file will automatically try to login 6 * a user by calling auth_login() 7 * 8 * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) 9 * @author Andreas Gohr <andi@splitbrain.org> 10 */ 11 12if(!defined('DOKU_INC')) die('meh.'); 13 14// some ACL level defines 15define('AUTH_NONE',0); 16define('AUTH_READ',1); 17define('AUTH_EDIT',2); 18define('AUTH_CREATE',4); 19define('AUTH_UPLOAD',8); 20define('AUTH_DELETE',16); 21define('AUTH_ADMIN',255); 22 23/** 24 * Initialize the auth system. 25 * 26 * This function is automatically called at the end of init.php 27 * 28 * This used to be the main() of the auth.php 29 * 30 * @todo backend loading maybe should be handled by the class autoloader 31 * @todo maybe split into multiple functions at the XXX marked positions 32 */ 33function auth_setup(){ 34 global $conf; 35 global $auth; 36 global $AUTH_ACL; 37 global $lang; 38 global $config_cascade; 39 $AUTH_ACL = array(); 40 41 if(!$conf['useacl']) return false; 42 43 // load the the backend auth functions and instantiate the auth object XXX 44 if (@file_exists(DOKU_INC.'inc/auth/'.$conf['authtype'].'.class.php')) { 45 require_once(DOKU_INC.'inc/auth/basic.class.php'); 46 require_once(DOKU_INC.'inc/auth/'.$conf['authtype'].'.class.php'); 47 48 $auth_class = "auth_".$conf['authtype']; 49 if (class_exists($auth_class)) { 50 $auth = new $auth_class(); 51 if ($auth->success == false) { 52 // degrade to unauthenticated user 53 unset($auth); 54 auth_logoff(); 55 msg($lang['authtempfail'], -1); 56 } 57 } else { 58 nice_die($lang['authmodfailed']); 59 } 60 } else { 61 nice_die($lang['authmodfailed']); 62 } 63 64 if(!$auth) return; 65 66 // do the login either by cookie or provided credentials XXX 67 if (!isset($_REQUEST['u'])) $_REQUEST['u'] = ''; 68 if (!isset($_REQUEST['p'])) $_REQUEST['p'] = ''; 69 if (!isset($_REQUEST['r'])) $_REQUEST['r'] = ''; 70 $_REQUEST['http_credentials'] = false; 71 if (!$conf['rememberme']) $_REQUEST['r'] = false; 72 73 // handle renamed HTTP_AUTHORIZATION variable (can happen when a fix like 74 // the one presented at 75 // http://www.besthostratings.com/articles/http-auth-php-cgi.html is used 76 // for enabling HTTP authentication with CGI/SuExec) 77 if(isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) 78 $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['REDIRECT_HTTP_AUTHORIZATION']; 79 // streamline HTTP auth credentials (IIS/rewrite -> mod_php) 80 if(isset($_SERVER['HTTP_AUTHORIZATION'])){ 81 list($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW']) = 82 explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6))); 83 } 84 85 // if no credentials were given try to use HTTP auth (for SSO) 86 if(empty($_REQUEST['u']) && empty($_COOKIE[DOKU_COOKIE]) && !empty($_SERVER['PHP_AUTH_USER'])){ 87 $_REQUEST['u'] = $_SERVER['PHP_AUTH_USER']; 88 $_REQUEST['p'] = $_SERVER['PHP_AUTH_PW']; 89 $_REQUEST['http_credentials'] = true; 90 } 91 92 // apply cleaning 93 $_REQUEST['u'] = $auth->cleanUser($_REQUEST['u']); 94 95 if(isset($_REQUEST['authtok'])){ 96 // when an authentication token is given, trust the session 97 auth_validateToken($_REQUEST['authtok']); 98 }elseif(!is_null($auth) && $auth->canDo('external')){ 99 // external trust mechanism in place 100 $auth->trustExternal($_REQUEST['u'],$_REQUEST['p'],$_REQUEST['r']); 101 }else{ 102 $evdata = array( 103 'user' => $_REQUEST['u'], 104 'password' => $_REQUEST['p'], 105 'sticky' => $_REQUEST['r'], 106 'silent' => $_REQUEST['http_credentials'], 107 ); 108 trigger_event('AUTH_LOGIN_CHECK', $evdata, 'auth_login_wrapper'); 109 } 110 111 //load ACL into a global array XXX 112 $AUTH_ACL = auth_loadACL(); 113} 114 115/** 116 * Loads the ACL setup and handle user wildcards 117 * 118 * @author Andreas Gohr <andi@splitbrain.org> 119 * @returns array 120 */ 121function auth_loadACL(){ 122 global $config_cascade; 123 124 if(!is_readable($config_cascade['acl']['default'])) return array(); 125 126 $acl = file($config_cascade['acl']['default']); 127 128 //support user wildcard 129 if(isset($_SERVER['REMOTE_USER'])){ 130 $len = count($acl); 131 for($i=0; $i<$len; $i++){ 132 if($acl[$i]{0} == '#') continue; 133 list($id,$rest) = preg_split('/\s+/',$acl[$i],2); 134 $id = str_replace('%USER%',cleanID($_SERVER['REMOTE_USER']),$id); 135 $rest = str_replace('%USER%',auth_nameencode($_SERVER['REMOTE_USER']),$rest); 136 $acl[$i] = "$id\t$rest"; 137 } 138 } 139 return $acl; 140} 141 142function auth_login_wrapper($evdata) { 143 return auth_login($evdata['user'], 144 $evdata['password'], 145 $evdata['sticky'], 146 $evdata['silent']); 147} 148 149/** 150 * This tries to login the user based on the sent auth credentials 151 * 152 * The authentication works like this: if a username was given 153 * a new login is assumed and user/password are checked. If they 154 * are correct the password is encrypted with blowfish and stored 155 * together with the username in a cookie - the same info is stored 156 * in the session, too. Additonally a browserID is stored in the 157 * session. 158 * 159 * If no username was given the cookie is checked: if the username, 160 * crypted password and browserID match between session and cookie 161 * no further testing is done and the user is accepted 162 * 163 * If a cookie was found but no session info was availabe the 164 * blowfish encrypted password from the cookie is decrypted and 165 * together with username rechecked by calling this function again. 166 * 167 * On a successful login $_SERVER[REMOTE_USER] and $USERINFO 168 * are set. 169 * 170 * @author Andreas Gohr <andi@splitbrain.org> 171 * 172 * @param string $user Username 173 * @param string $pass Cleartext Password 174 * @param bool $sticky Cookie should not expire 175 * @param bool $silent Don't show error on bad auth 176 * @return bool true on successful auth 177 */ 178function auth_login($user,$pass,$sticky=false,$silent=false){ 179 global $USERINFO; 180 global $conf; 181 global $lang; 182 global $auth; 183 $sticky ? $sticky = true : $sticky = false; //sanity check 184 185 if (!$auth) return false; 186 187 if(!empty($user)){ 188 //usual login 189 if ($auth->checkPass($user,$pass)){ 190 // make logininfo globally available 191 $_SERVER['REMOTE_USER'] = $user; 192 $secret = auth_cookiesalt(!$sticky); //bind non-sticky to session 193 auth_setCookie($user,PMA_blowfish_encrypt($pass,$secret),$sticky); 194 return true; 195 }else{ 196 //invalid credentials - log off 197 if(!$silent) msg($lang['badlogin'],-1); 198 auth_logoff(); 199 return false; 200 } 201 }else{ 202 // read cookie information 203 list($user,$sticky,$pass) = auth_getCookie(); 204 if($user && $pass){ 205 // we got a cookie - see if we can trust it 206 207 // get session info 208 $session = $_SESSION[DOKU_COOKIE]['auth']; 209 if(isset($session) && 210 $auth->useSessionCache($user) && 211 ($session['time'] >= time()-$conf['auth_security_timeout']) && 212 ($session['user'] == $user) && 213 ($session['pass'] == sha1($pass)) && //still crypted 214 ($session['buid'] == auth_browseruid()) ){ 215 216 // he has session, cookie and browser right - let him in 217 $_SERVER['REMOTE_USER'] = $user; 218 $USERINFO = $session['info']; //FIXME move all references to session 219 return true; 220 } 221 // no we don't trust it yet - recheck pass but silent 222 $secret = auth_cookiesalt(!$sticky); //bind non-sticky to session 223 $pass = PMA_blowfish_decrypt($pass,$secret); 224 return auth_login($user,$pass,$sticky,true); 225 } 226 } 227 //just to be sure 228 auth_logoff(true); 229 return false; 230} 231 232/** 233 * Checks if a given authentication token was stored in the session 234 * 235 * Will setup authentication data using data from the session if the 236 * token is correct. Will exit with a 401 Status if not. 237 * 238 * @author Andreas Gohr <andi@splitbrain.org> 239 * @param string $token The authentication token 240 * @return boolean true (or will exit on failure) 241 */ 242function auth_validateToken($token){ 243 if(!$token || $token != $_SESSION[DOKU_COOKIE]['auth']['token']){ 244 // bad token 245 header("HTTP/1.0 401 Unauthorized"); 246 print 'Invalid auth token - maybe the session timed out'; 247 unset($_SESSION[DOKU_COOKIE]['auth']['token']); // no second chance 248 exit; 249 } 250 // still here? trust the session data 251 global $USERINFO; 252 $_SERVER['REMOTE_USER'] = $_SESSION[DOKU_COOKIE]['auth']['user']; 253 $USERINFO = $_SESSION[DOKU_COOKIE]['auth']['info']; 254 return true; 255} 256 257/** 258 * Create an auth token and store it in the session 259 * 260 * NOTE: this is completely unrelated to the getSecurityToken() function 261 * 262 * @author Andreas Gohr <andi@splitbrain.org> 263 * @return string The auth token 264 */ 265function auth_createToken(){ 266 $token = md5(mt_rand()); 267 @session_start(); // reopen the session if needed 268 $_SESSION[DOKU_COOKIE]['auth']['token'] = $token; 269 session_write_close(); 270 return $token; 271} 272 273/** 274 * Builds a pseudo UID from browser and IP data 275 * 276 * This is neither unique nor unfakable - still it adds some 277 * security. Using the first part of the IP makes sure 278 * proxy farms like AOLs are stil okay. 279 * 280 * @author Andreas Gohr <andi@splitbrain.org> 281 * 282 * @return string a MD5 sum of various browser headers 283 */ 284function auth_browseruid(){ 285 $ip = clientIP(true); 286 $uid = ''; 287 $uid .= $_SERVER['HTTP_USER_AGENT']; 288 $uid .= $_SERVER['HTTP_ACCEPT_ENCODING']; 289 $uid .= $_SERVER['HTTP_ACCEPT_LANGUAGE']; 290 $uid .= $_SERVER['HTTP_ACCEPT_CHARSET']; 291 $uid .= substr($ip,0,strpos($ip,'.')); 292 return md5($uid); 293} 294 295/** 296 * Creates a random key to encrypt the password in cookies 297 * 298 * This function tries to read the password for encrypting 299 * cookies from $conf['metadir'].'/_htcookiesalt' 300 * if no such file is found a random key is created and 301 * and stored in this file. 302 * 303 * @author Andreas Gohr <andi@splitbrain.org> 304 * @param bool $addsession if true, the sessionid is added to the salt 305 * @return string 306 */ 307function auth_cookiesalt($addsession=false){ 308 global $conf; 309 $file = $conf['metadir'].'/_htcookiesalt'; 310 $salt = io_readFile($file); 311 if(empty($salt)){ 312 $salt = uniqid(rand(),true); 313 io_saveFile($file,$salt); 314 } 315 if($addsession){ 316 $salt .= session_id(); 317 } 318 return $salt; 319} 320 321/** 322 * Log out the current user 323 * 324 * This clears all authentication data and thus log the user 325 * off. It also clears session data. 326 * 327 * @author Andreas Gohr <andi@splitbrain.org> 328 * @param bool $keepbc - when true, the breadcrumb data is not cleared 329 */ 330function auth_logoff($keepbc=false){ 331 global $conf; 332 global $USERINFO; 333 global $INFO, $ID; 334 global $auth; 335 336 // make sure the session is writable (it usually is) 337 @session_start(); 338 339 if(isset($_SESSION[DOKU_COOKIE]['auth']['user'])) 340 unset($_SESSION[DOKU_COOKIE]['auth']['user']); 341 if(isset($_SESSION[DOKU_COOKIE]['auth']['pass'])) 342 unset($_SESSION[DOKU_COOKIE]['auth']['pass']); 343 if(isset($_SESSION[DOKU_COOKIE]['auth']['info'])) 344 unset($_SESSION[DOKU_COOKIE]['auth']['info']); 345 if(!$keepbc && isset($_SESSION[DOKU_COOKIE]['bc'])) 346 unset($_SESSION[DOKU_COOKIE]['bc']); 347 if(isset($_SERVER['REMOTE_USER'])) 348 unset($_SERVER['REMOTE_USER']); 349 $USERINFO=null; //FIXME 350 351 $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir']; 352 if (version_compare(PHP_VERSION, '5.2.0', '>')) { 353 setcookie(DOKU_COOKIE,'',time()-600000,$cookieDir,'',($conf['securecookie'] && is_ssl()),true); 354 }else{ 355 setcookie(DOKU_COOKIE,'',time()-600000,$cookieDir,'',($conf['securecookie'] && is_ssl())); 356 } 357 358 if($auth) $auth->logOff(); 359} 360 361/** 362 * Check if a user is a manager 363 * 364 * Should usually be called without any parameters to check the current 365 * user. 366 * 367 * The info is available through $INFO['ismanager'], too 368 * 369 * @author Andreas Gohr <andi@splitbrain.org> 370 * @see auth_isadmin 371 * @param string user - Username 372 * @param array groups - List of groups the user is in 373 * @param bool adminonly - when true checks if user is admin 374 */ 375function auth_ismanager($user=null,$groups=null,$adminonly=false){ 376 global $conf; 377 global $USERINFO; 378 global $auth; 379 380 if (!$auth) return false; 381 if(is_null($user)) { 382 if (!isset($_SERVER['REMOTE_USER'])) { 383 return false; 384 } else { 385 $user = $_SERVER['REMOTE_USER']; 386 } 387 } 388 if(is_null($groups)){ 389 $groups = (array) $USERINFO['grps']; 390 } 391 392 // check superuser match 393 if(auth_isMember($conf['superuser'],$user, $groups)) return true; 394 if($adminonly) return false; 395 // check managers 396 if(auth_isMember($conf['manager'],$user, $groups)) return true; 397 398 return false; 399} 400 401/** 402 * Check if a user is admin 403 * 404 * Alias to auth_ismanager with adminonly=true 405 * 406 * The info is available through $INFO['isadmin'], too 407 * 408 * @author Andreas Gohr <andi@splitbrain.org> 409 * @see auth_ismanager 410 */ 411function auth_isadmin($user=null,$groups=null){ 412 return auth_ismanager($user,$groups,true); 413} 414 415 416/** 417 * Match a user and his groups against a comma separated list of 418 * users and groups to determine membership status 419 * 420 * Note: all input should NOT be nameencoded. 421 * 422 * @param $memberlist string commaseparated list of allowed users and groups 423 * @param $user string user to match against 424 * @param $groups array groups the user is member of 425 * @returns bool true for membership acknowledged 426 */ 427function auth_isMember($memberlist,$user,array $groups){ 428 global $auth; 429 if (!$auth) return false; 430 431 // clean user and groups 432 if(!$auth->isCaseSensitive()){ 433 $user = utf8_strtolower($user); 434 $groups = array_map('utf8_strtolower',$groups); 435 } 436 $user = $auth->cleanUser($user); 437 $groups = array_map(array($auth,'cleanGroup'),$groups); 438 439 // extract the memberlist 440 $members = explode(',',$memberlist); 441 $members = array_map('trim',$members); 442 $members = array_unique($members); 443 $members = array_filter($members); 444 445 // compare cleaned values 446 foreach($members as $member){ 447 if(!$auth->isCaseSensitive()) $member = utf8_strtolower($member); 448 if($member[0] == '@'){ 449 $member = $auth->cleanGroup(substr($member,1)); 450 if(in_array($member, $groups)) return true; 451 }else{ 452 $member = $auth->cleanUser($member); 453 if($member == $user) return true; 454 } 455 } 456 457 // still here? not a member! 458 return false; 459} 460 461/** 462 * Convinience function for auth_aclcheck() 463 * 464 * This checks the permissions for the current user 465 * 466 * @author Andreas Gohr <andi@splitbrain.org> 467 * 468 * @param string $id page ID (needs to be resolved and cleaned) 469 * @return int permission level 470 */ 471function auth_quickaclcheck($id){ 472 global $conf; 473 global $USERINFO; 474 # if no ACL is used always return upload rights 475 if(!$conf['useacl']) return AUTH_UPLOAD; 476 return auth_aclcheck($id,$_SERVER['REMOTE_USER'],$USERINFO['grps']); 477} 478 479/** 480 * Returns the maximum rights a user has for 481 * the given ID or its namespace 482 * 483 * @author Andreas Gohr <andi@splitbrain.org> 484 * 485 * @param string $id page ID (needs to be resolved and cleaned) 486 * @param string $user Username 487 * @param array $groups Array of groups the user is in 488 * @return int permission level 489 */ 490function auth_aclcheck($id,$user,$groups){ 491 global $conf; 492 global $AUTH_ACL; 493 global $auth; 494 495 // if no ACL is used always return upload rights 496 if(!$conf['useacl']) return AUTH_UPLOAD; 497 if (!$auth) return AUTH_NONE; 498 499 //make sure groups is an array 500 if(!is_array($groups)) $groups = array(); 501 502 //if user is superuser or in superusergroup return 255 (acl_admin) 503 if(auth_isadmin($user,$groups)) { return AUTH_ADMIN; } 504 505 $ci = ''; 506 if(!$auth->isCaseSensitive()) $ci = 'ui'; 507 508 $user = $auth->cleanUser($user); 509 $groups = array_map(array($auth,'cleanGroup'),(array)$groups); 510 $user = auth_nameencode($user); 511 512 //prepend groups with @ and nameencode 513 $cnt = count($groups); 514 for($i=0; $i<$cnt; $i++){ 515 $groups[$i] = '@'.auth_nameencode($groups[$i]); 516 } 517 518 $ns = getNS($id); 519 $perm = -1; 520 521 if($user || count($groups)){ 522 //add ALL group 523 $groups[] = '@ALL'; 524 //add User 525 if($user) $groups[] = $user; 526 }else{ 527 $groups[] = '@ALL'; 528 } 529 530 //check exact match first 531 $matches = preg_grep('/^'.preg_quote($id,'/').'\s+(\S+)\s+/'.$ci,$AUTH_ACL); 532 if(count($matches)){ 533 foreach($matches as $match){ 534 $match = preg_replace('/#.*$/','',$match); //ignore comments 535 $acl = preg_split('/\s+/',$match); 536 if (!in_array($acl[1], $groups)) { 537 continue; 538 } 539 if($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL! 540 if($acl[2] > $perm){ 541 $perm = $acl[2]; 542 } 543 } 544 if($perm > -1){ 545 //we had a match - return it 546 return $perm; 547 } 548 } 549 550 //still here? do the namespace checks 551 if($ns){ 552 $path = $ns.':*'; 553 }else{ 554 $path = '*'; //root document 555 } 556 557 do{ 558 $matches = preg_grep('/^'.preg_quote($path,'/').'\s+(\S+)\s+/'.$ci,$AUTH_ACL); 559 if(count($matches)){ 560 foreach($matches as $match){ 561 $match = preg_replace('/#.*$/','',$match); //ignore comments 562 $acl = preg_split('/\s+/',$match); 563 if (!in_array($acl[1], $groups)) { 564 continue; 565 } 566 if($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL! 567 if($acl[2] > $perm){ 568 $perm = $acl[2]; 569 } 570 } 571 //we had a match - return it 572 if ($perm != -1) { 573 return $perm; 574 } 575 } 576 //get next higher namespace 577 $ns = getNS($ns); 578 579 if($path != '*'){ 580 $path = $ns.':*'; 581 if($path == ':*') $path = '*'; 582 }else{ 583 //we did this already 584 //looks like there is something wrong with the ACL 585 //break here 586 msg('No ACL setup yet! Denying access to everyone.'); 587 return AUTH_NONE; 588 } 589 }while(1); //this should never loop endless 590} 591 592/** 593 * Encode ASCII special chars 594 * 595 * Some auth backends allow special chars in their user and groupnames 596 * The special chars are encoded with this function. Only ASCII chars 597 * are encoded UTF-8 multibyte are left as is (different from usual 598 * urlencoding!). 599 * 600 * Decoding can be done with rawurldecode 601 * 602 * @author Andreas Gohr <gohr@cosmocode.de> 603 * @see rawurldecode() 604 */ 605function auth_nameencode($name,$skip_group=false){ 606 global $cache_authname; 607 $cache =& $cache_authname; 608 $name = (string) $name; 609 610 // never encode wildcard FS#1955 611 if($name == '%USER%') return $name; 612 613 if (!isset($cache[$name][$skip_group])) { 614 if($skip_group && $name{0} =='@'){ 615 $cache[$name][$skip_group] = '@'.preg_replace('/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/e', 616 "'%'.dechex(ord(substr('\\1',-1)))",substr($name,1)); 617 }else{ 618 $cache[$name][$skip_group] = preg_replace('/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/e', 619 "'%'.dechex(ord(substr('\\1',-1)))",$name); 620 } 621 } 622 623 return $cache[$name][$skip_group]; 624} 625 626/** 627 * Create a pronouncable password 628 * 629 * @author Andreas Gohr <andi@splitbrain.org> 630 * @link http://www.phpbuilder.com/annotate/message.php3?id=1014451 631 * 632 * @return string pronouncable password 633 */ 634function auth_pwgen(){ 635 $pw = ''; 636 $c = 'bcdfghjklmnprstvwz'; //consonants except hard to speak ones 637 $v = 'aeiou'; //vowels 638 $a = $c.$v; //both 639 640 //use two syllables... 641 for($i=0;$i < 2; $i++){ 642 $pw .= $c[rand(0, strlen($c)-1)]; 643 $pw .= $v[rand(0, strlen($v)-1)]; 644 $pw .= $a[rand(0, strlen($a)-1)]; 645 } 646 //... and add a nice number 647 $pw .= rand(10,99); 648 649 return $pw; 650} 651 652/** 653 * Sends a password to the given user 654 * 655 * @author Andreas Gohr <andi@splitbrain.org> 656 * 657 * @return bool true on success 658 */ 659function auth_sendPassword($user,$password){ 660 global $conf; 661 global $lang; 662 global $auth; 663 if (!$auth) return false; 664 665 $hdrs = ''; 666 $user = $auth->cleanUser($user); 667 $userinfo = $auth->getUserData($user); 668 669 if(!$userinfo['mail']) return false; 670 671 $text = rawLocale('password'); 672 $text = str_replace('@DOKUWIKIURL@',DOKU_URL,$text); 673 $text = str_replace('@FULLNAME@',$userinfo['name'],$text); 674 $text = str_replace('@LOGIN@',$user,$text); 675 $text = str_replace('@PASSWORD@',$password,$text); 676 $text = str_replace('@TITLE@',$conf['title'],$text); 677 678 if(empty($conf['mailprefix'])) { 679 $subject = $lang['regpwmail']; 680 } else { 681 $subject = '['.$conf['mailprefix'].'] '.$lang['regpwmail']; 682 } 683 684 return mail_send($userinfo['name'].' <'.$userinfo['mail'].'>', 685 $subject, 686 $text, 687 $conf['mailfrom']); 688} 689 690/** 691 * Register a new user 692 * 693 * This registers a new user - Data is read directly from $_POST 694 * 695 * @author Andreas Gohr <andi@splitbrain.org> 696 * 697 * @return bool true on success, false on any error 698 */ 699function register(){ 700 global $lang; 701 global $conf; 702 global $auth; 703 704 if(!$_POST['save']) return false; 705 if(!actionOK('register')) return false; 706 707 //clean username 708 $_POST['login'] = trim($auth->cleanUser($_POST['login'])); 709 710 //clean fullname and email 711 $_POST['fullname'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/','',$_POST['fullname'])); 712 $_POST['email'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/','',$_POST['email'])); 713 714 if( empty($_POST['login']) || 715 empty($_POST['fullname']) || 716 empty($_POST['email']) ){ 717 msg($lang['regmissing'],-1); 718 return false; 719 } 720 721 if ($conf['autopasswd']) { 722 $pass = auth_pwgen(); // automatically generate password 723 } elseif (empty($_POST['pass']) || 724 empty($_POST['passchk'])) { 725 msg($lang['regmissing'], -1); // complain about missing passwords 726 return false; 727 } elseif ($_POST['pass'] != $_POST['passchk']) { 728 msg($lang['regbadpass'], -1); // complain about misspelled passwords 729 return false; 730 } else { 731 $pass = $_POST['pass']; // accept checked and valid password 732 } 733 734 //check mail 735 if(!mail_isvalid($_POST['email'])){ 736 msg($lang['regbadmail'],-1); 737 return false; 738 } 739 740 //okay try to create the user 741 if(!$auth->triggerUserMod('create', array($_POST['login'],$pass,$_POST['fullname'],$_POST['email']))){ 742 msg($lang['reguexists'],-1); 743 return false; 744 } 745 746 // create substitutions for use in notification email 747 $substitutions = array( 748 'NEWUSER' => $_POST['login'], 749 'NEWNAME' => $_POST['fullname'], 750 'NEWEMAIL' => $_POST['email'], 751 ); 752 753 if (!$conf['autopasswd']) { 754 msg($lang['regsuccess2'],1); 755 notify('', 'register', '', $_POST['login'], false, $substitutions); 756 return true; 757 } 758 759 // autogenerated password? then send him the password 760 if (auth_sendPassword($_POST['login'],$pass)){ 761 msg($lang['regsuccess'],1); 762 notify('', 'register', '', $_POST['login'], false, $substitutions); 763 return true; 764 }else{ 765 msg($lang['regmailfail'],-1); 766 return false; 767 } 768} 769 770/** 771 * Update user profile 772 * 773 * @author Christopher Smith <chris@jalakai.co.uk> 774 */ 775function updateprofile() { 776 global $conf; 777 global $INFO; 778 global $lang; 779 global $auth; 780 781 if(empty($_POST['save'])) return false; 782 if(!checkSecurityToken()) return false; 783 784 if(!actionOK('profile')) { 785 msg($lang['profna'],-1); 786 return false; 787 } 788 789 if ($_POST['newpass'] != $_POST['passchk']) { 790 msg($lang['regbadpass'], -1); // complain about misspelled passwords 791 return false; 792 } 793 794 //clean fullname and email 795 $_POST['fullname'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/','',$_POST['fullname'])); 796 $_POST['email'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/','',$_POST['email'])); 797 798 if ((empty($_POST['fullname']) && $auth->canDo('modName')) || 799 (empty($_POST['email']) && $auth->canDo('modMail'))) { 800 msg($lang['profnoempty'],-1); 801 return false; 802 } 803 804 if (!mail_isvalid($_POST['email']) && $auth->canDo('modMail')){ 805 msg($lang['regbadmail'],-1); 806 return false; 807 } 808 809 if ($_POST['fullname'] != $INFO['userinfo']['name'] && $auth->canDo('modName')) $changes['name'] = $_POST['fullname']; 810 if ($_POST['email'] != $INFO['userinfo']['mail'] && $auth->canDo('modMail')) $changes['mail'] = $_POST['email']; 811 if (!empty($_POST['newpass']) && $auth->canDo('modPass')) $changes['pass'] = $_POST['newpass']; 812 813 if (!count($changes)) { 814 msg($lang['profnochange'], -1); 815 return false; 816 } 817 818 if ($conf['profileconfirm']) { 819 if (!$auth->checkPass($_SERVER['REMOTE_USER'], $_POST['oldpass'])) { 820 msg($lang['badlogin'],-1); 821 return false; 822 } 823 } 824 825 if ($result = $auth->triggerUserMod('modify', array($_SERVER['REMOTE_USER'], $changes))) { 826 // update cookie and session with the changed data 827 if ($changes['pass']){ 828 list($user,$sticky,$pass) = auth_getCookie(); 829 $pass = PMA_blowfish_encrypt($changes['pass'],auth_cookiesalt(!$sticky)); 830 auth_setCookie($_SERVER['REMOTE_USER'],$pass,(bool)$sticky); 831 } 832 return true; 833 } 834} 835 836/** 837 * Send a new password 838 * 839 * This function handles both phases of the password reset: 840 * 841 * - handling the first request of password reset 842 * - validating the password reset auth token 843 * 844 * @author Benoit Chesneau <benoit@bchesneau.info> 845 * @author Chris Smith <chris@jalakai.co.uk> 846 * @author Andreas Gohr <andi@splitbrain.org> 847 * 848 * @return bool true on success, false on any error 849 */ 850function act_resendpwd(){ 851 global $lang; 852 global $conf; 853 global $auth; 854 855 if(!actionOK('resendpwd')) { 856 msg($lang['resendna'],-1); 857 return false; 858 } 859 860 $token = preg_replace('/[^a-f0-9]+/','',$_REQUEST['pwauth']); 861 862 if($token){ 863 // we're in token phase - get user info from token 864 865 $tfile = $conf['cachedir'].'/'.$token{0}.'/'.$token.'.pwauth'; 866 if(!@file_exists($tfile)){ 867 msg($lang['resendpwdbadauth'],-1); 868 unset($_REQUEST['pwauth']); 869 return false; 870 } 871 // token is only valid for 3 days 872 if( (time() - filemtime($tfile)) > (3*60*60*24) ){ 873 msg($lang['resendpwdbadauth'],-1); 874 unset($_REQUEST['pwauth']); 875 @unlink($tfile); 876 return false; 877 } 878 879 $user = io_readfile($tfile); 880 $userinfo = $auth->getUserData($user); 881 if(!$userinfo['mail']) { 882 msg($lang['resendpwdnouser'], -1); 883 return false; 884 } 885 886 887 if(!$conf['autopasswd']){ // we let the user choose a password 888 // password given correctly? 889 if(!isset($_REQUEST['pass']) || $_REQUEST['pass'] == '') return false; 890 if($_REQUEST['pass'] != $_REQUEST['passchk']){ 891 msg($lang['regbadpass'],-1); 892 return false; 893 } 894 $pass = $_REQUEST['pass']; 895 896 if (!$auth->triggerUserMod('modify', array($user,array('pass' => $pass)))) { 897 msg('error modifying user data',-1); 898 return false; 899 } 900 901 }else{ // autogenerate the password and send by mail 902 903 $pass = auth_pwgen(); 904 if (!$auth->triggerUserMod('modify', array($user,array('pass' => $pass)))) { 905 msg('error modifying user data',-1); 906 return false; 907 } 908 909 if (auth_sendPassword($user,$pass)) { 910 msg($lang['resendpwdsuccess'],1); 911 } else { 912 msg($lang['regmailfail'],-1); 913 } 914 } 915 916 @unlink($tfile); 917 return true; 918 919 } else { 920 // we're in request phase 921 922 if(!$_POST['save']) return false; 923 924 if (empty($_POST['login'])) { 925 msg($lang['resendpwdmissing'], -1); 926 return false; 927 } else { 928 $user = trim($auth->cleanUser($_POST['login'])); 929 } 930 931 $userinfo = $auth->getUserData($user); 932 if(!$userinfo['mail']) { 933 msg($lang['resendpwdnouser'], -1); 934 return false; 935 } 936 937 // generate auth token 938 $token = md5(auth_cookiesalt().$user); //secret but user based 939 $tfile = $conf['cachedir'].'/'.$token{0}.'/'.$token.'.pwauth'; 940 $url = wl('',array('do'=>'resendpwd','pwauth'=>$token),true,'&'); 941 942 io_saveFile($tfile,$user); 943 944 $text = rawLocale('pwconfirm'); 945 $text = str_replace('@DOKUWIKIURL@',DOKU_URL,$text); 946 $text = str_replace('@FULLNAME@',$userinfo['name'],$text); 947 $text = str_replace('@LOGIN@',$user,$text); 948 $text = str_replace('@TITLE@',$conf['title'],$text); 949 $text = str_replace('@CONFIRM@',$url,$text); 950 951 if(empty($conf['mailprefix'])) { 952 $subject = $lang['regpwmail']; 953 } else { 954 $subject = '['.$conf['mailprefix'].'] '.$lang['regpwmail']; 955 } 956 957 if(mail_send($userinfo['name'].' <'.$userinfo['mail'].'>', 958 $subject, 959 $text, 960 $conf['mailfrom'])){ 961 msg($lang['resendpwdconfirm'],1); 962 }else{ 963 msg($lang['regmailfail'],-1); 964 } 965 return true; 966 } 967 968 return false; // never reached 969} 970 971/** 972 * Encrypts a password using the given method and salt 973 * 974 * If the selected method needs a salt and none was given, a random one 975 * is chosen. 976 * 977 * @author Andreas Gohr <andi@splitbrain.org> 978 * @return string The crypted password 979 */ 980function auth_cryptPassword($clear,$method='',$salt=null){ 981 global $conf; 982 if(empty($method)) $method = $conf['passcrypt']; 983 984 $pass = new PassHash(); 985 $call = 'hash_'.$method; 986 987 if(!method_exists($pass,$call)){ 988 msg("Unsupported crypt method $method",-1); 989 return false; 990 } 991 992 return $pass->$call($clear,$salt); 993} 994 995/** 996 * Verifies a cleartext password against a crypted hash 997 * 998 * @author Andreas Gohr <andi@splitbrain.org> 999 * @return bool 1000 */ 1001function auth_verifyPassword($clear,$crypt){ 1002 $pass = new PassHash(); 1003 return $pass->verify_hash($clear,$crypt); 1004} 1005 1006/** 1007 * Set the authentication cookie and add user identification data to the session 1008 * 1009 * @param string $user username 1010 * @param string $pass encrypted password 1011 * @param bool $sticky whether or not the cookie will last beyond the session 1012 */ 1013function auth_setCookie($user,$pass,$sticky) { 1014 global $conf; 1015 global $auth; 1016 global $USERINFO; 1017 1018 if (!$auth) return false; 1019 $USERINFO = $auth->getUserData($user); 1020 1021 // set cookie 1022 $cookie = base64_encode($user).'|'.((int) $sticky).'|'.base64_encode($pass); 1023 $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir']; 1024 $time = $sticky ? (time()+60*60*24*365) : 0; //one year 1025 if (version_compare(PHP_VERSION, '5.2.0', '>')) { 1026 setcookie(DOKU_COOKIE,$cookie,$time,$cookieDir,'',($conf['securecookie'] && is_ssl()),true); 1027 }else{ 1028 setcookie(DOKU_COOKIE,$cookie,$time,$cookieDir,'',($conf['securecookie'] && is_ssl())); 1029 } 1030 // set session 1031 $_SESSION[DOKU_COOKIE]['auth']['user'] = $user; 1032 $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass); 1033 $_SESSION[DOKU_COOKIE]['auth']['buid'] = auth_browseruid(); 1034 $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO; 1035 $_SESSION[DOKU_COOKIE]['auth']['time'] = time(); 1036} 1037 1038/** 1039 * Returns the user, (encrypted) password and sticky bit from cookie 1040 * 1041 * @returns array 1042 */ 1043function auth_getCookie(){ 1044 if (!isset($_COOKIE[DOKU_COOKIE])) { 1045 return array(null, null, null); 1046 } 1047 list($user,$sticky,$pass) = explode('|',$_COOKIE[DOKU_COOKIE],3); 1048 $sticky = (bool) $sticky; 1049 $pass = base64_decode($pass); 1050 $user = base64_decode($user); 1051 return array($user,$sticky,$pass); 1052} 1053 1054//Setup VIM: ex: et ts=2 : 1055