move helper functions to an abstract class

[authserver.git] / index.php

diff --git a/index.php b/index.php
index d31cb034b6a331e92b7308273f0804ace01dd597..2a560e8928dd54abb9096aa223d12112e690e97e 100644 (file)
--- a/index.php
+++ b/index.php
@@ -53,7 +53,7 @@ if (!count($errors)) {
         if (!preg_match('/^[^@]+@[^@]+\.[^@]+$/', $_POST['email'])) {
           $errors[] = _('The email address is invalid.');
         }
         if (!preg_match('/^[^@]+@[^@]+\.[^@]+$/', $_POST['email'])) {
           $errors[] = _('The email address is invalid.');
         }

-        else {
+        elseif (AuthUtils::verifyTimeCode(@$_POST['tcode'], $session)) {

           $result = $db->prepare('SELECT `id`, `pwdhash`, `email`, `status`, `verify_hash` FROM `auth_users` WHERE `email` = :email;');
           $result->execute(array(':email' => $_POST['email']));
           $user = $result->fetch(PDO::FETCH_ASSOC);
           $result = $db->prepare('SELECT `id`, `pwdhash`, `email`, `status`, `verify_hash` FROM `auth_users` WHERE `email` = :email;');
           $result->execute(array(':email' => $_POST['email']));
           $user = $result->fetch(PDO::FETCH_ASSOC);


@@ -72,7 +72,7 @@ if (!count($errors)) {
               }
 
               // Log user in - update session key for that, see https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Login
               }
 
               // Log user in - update session key for that, see https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Login

-              $sesskey = bin2hex(openssl_random_pseudo_bytes(512/8)); // Get 512 bits of randomness (128 byte hex string).
+              $sesskey = AuthUtils::createSessionKey();

               setcookie('sessionkey', $sesskey, 0, "", "", !$running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost.
               // If the session has a user set, create a new one - otherwise take existing session entry.
               if (intval($session['user'])) {
               setcookie('sessionkey', $sesskey, 0, "", "", !$running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost.
               // If the session has a user set, create a new one - otherwise take existing session entry.
               if (intval($session['user'])) {


@@ -86,7 +86,7 @@ if (!count($errors)) {
                   $session = $row;
                 }
                 else {
                   $session = $row;
                 }
                 else {

-                  // XXXlog: unexpected failure to create session!
+                  // XXXlog: Unexpected failure to create session!

                   $errors[] = _('The session system is not working. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
                 }
               }
                   $errors[] = _('The session system is not working. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
                 }
               }


@@ -97,6 +97,16 @@ if (!count($errors)) {
                   $errors[] = _('Login failed unexpectedly. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
                 }
               }
                   $errors[] = _('Login failed unexpectedly. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
                 }
               }

+              // If a verify_hash if set on a verified user, a password reset had been requested. As a login works right now, cancel that reset request by deleting the hash.
+              if (strlen(@$user['verify_hash'])) {
+                $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = \'\' WHERE `id` = :userid;');
+                if (!$result->execute(array(':userid' => $user['id']))) {
+                  // XXXlog: verify_hash could not be emptied!
+                }
+                else {
+                  $user['verify_hash'] = '';
+                }
+              }

             }
             else {
               $errors[] = _('This password is invalid or your email is not verified yet. Did you type them correctly?');
             }
             else {
               $errors[] = _('This password is invalid or your email is not verified yet. Did you type them correctly?');


@@ -105,27 +115,13 @@ if (!count($errors)) {
           else {
             // new user: check password, create user and send verification; existing users: re-send verification or send password change instructions
             if (array_key_exists('pwd', $_POST)) {
           else {
             // new user: check password, create user and send verification; existing users: re-send verification or send password change instructions
             if (array_key_exists('pwd', $_POST)) {

-              $new_password = strval($_POST['pwd']);
-              if ($new_password != trim($new_password)) {
-                $errors[] = _('Password must not start or end with a whitespace character like a space.');
-              }
-              if (strlen($new_password) < 8) { $errors[] = sprintf(_('Password too short (min. %s characters).'), 8); }
-              if (strlen($new_password) > 70) { $errors[] = sprintf(_('Password too long (max. %s characters).'), 70); }
-              if (strtolower($new_password) == strtolower($_POST['email']))  {
-                $errors[] = _('The passwort can not be equal to your email.');
-              }
-              if ((strlen($new_password) < 15) && (preg_match('/^[a-zA-Z]*$/', $new_password))) {
-                $errors[] = sprintf(_('Your password must use letters other than normal characters or contain least 15 characters.'), 15);
-              }
-              if (strlen(count_chars($new_password, 3)) < 5) {
-                $errors[] = sprintf(_('Password does have to contain at least %s different characters.'), 5);
-              }
+              $errors += AuthUtils::checkPasswordConstraints(strval($_POST['pwd']), $_POST['email']);

             }
             if (!count($errors)) {
               // Put user into the DB
               if (!$user['id']) {
                 $newHash = password_hash($_POST['pwd'], PASSWORD_DEFAULT, $pwd_options);
             }
             if (!count($errors)) {
               // Put user into the DB
               if (!$user['id']) {
                 $newHash = password_hash($_POST['pwd'], PASSWORD_DEFAULT, $pwd_options);

-                $vcode = bin2hex(openssl_random_pseudo_bytes(512/8)); // Get 512 bits of randomness (128 byte hex string).
+                $vcode = AuthUtils::createVerificationCode();

                 $result = $db->prepare('INSERT INTO `auth_users` (`email`, `pwdhash`, `status`, `verify_hash`) VALUES (:email, :pwdhash, \'unverified\', :vcode);');
                 if (!$result->execute(array(':email' => $_POST['email'], ':pwdhash' => $newHash, ':vcode' => $vcode))) {
                   // XXXlog: User insertion failure!
                 $result = $db->prepare('INSERT INTO `auth_users` (`email`, `pwdhash`, `status`, `verify_hash`) VALUES (:email, :pwdhash, \'unverified\', :vcode);');
                 if (!$result->execute(array(':email' => $_POST['email'], ':pwdhash' => $newHash, ':vcode' => $vcode))) {
                   // XXXlog: User insertion failure!


@@ -165,14 +161,55 @@ if (!count($errors)) {
                 }
               }
               else {
                 }
               }
               else {

-                // Send email with instructions for resetting the password.
+                // Password reset requested with "Password forgotten?" function.
+                $vcode = AuthUtils::createVerificationCode();
+                $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = :vcode WHERE `id` = :userid;');
+                if (!$result->execute(array(':vcode' => $vcode, ':userid' => $user['id']))) {
+                  // XXXlog: User insertion failure!
+                  $errors[] = _('Could not initiate reset request. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
+                }
+                else {
+                  $resetcode = $vcode.dechex($user['id'] + $session['id']).'_'.AuthUtils::createTimeCode($session, null, 60);
+                  // Send email with instructions for resetting the password.
+                  $mail = new email();
+                  $mail->setCharset('utf-8');
+                  $mail->addHeader('X-KAIRO-AUTH', 'password_reset');
+                  $mail->addRecipient($user['email']);
+                  $mail->setSender('noreply@auth.kairo.at', _('KaiRo.at Authentication Service'));
+                  $mail->setSubject('How to reset your password for KaiRo.at Authentication');
+                  $mail->addMailText(_('Hi,')."\n\n");
+                  $mail->addMailText(sprintf(_('A request for setting a new password for this email address, %s, has been submitted on "%s".'),
+                                            $user['email'], _('KaiRo.at Authentication Service'))."\n\n");
+                  $mail->addMailText(_('You can set a new password by clicking the following link (or calling it up in your browser):')."\n");
+                  $mail->addMailText(($running_on_localhost?'http':'https').'://'.$_SERVER['SERVER_NAME'].strstr($_SERVER['REQUEST_URI'], '?', true)
+                                    .'?email='.rawurlencode($user['email']).'&reset_code='.rawurlencode($resetcode)."\n\n");
+                  $mail->addMailText(_('If you do not call this confirmation link within 1 hour, this link expires and the existing password is being kept in place.')."\n\n");
+                  $mail->addMailText(sprintf(_('The %s team'), 'KaiRo.at'));
+                  //$mail->setDebugAddress("robert@localhost");
+                  $mailsent = $mail->send();
+                  if ($mailsent) {
+                    $pagetype = 'resetmail_sent';
+                  }
+                  else {
+                    $errors[] = _('The email with password reset instructions could not be sent to you. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
+                  }
+                }

               }
             }
           }
         }
               }
             }
           }
         }

+        else {
+          $errors[] = _('The form you used was not valid. Possibly it has expired and you need to initiate the action again.');
+        }

       }
       elseif (array_key_exists('reset', $_GET)) {
         if ($session['logged_in']) {
       }
       elseif (array_key_exists('reset', $_GET)) {
         if ($session['logged_in']) {

+          $result = $db->prepare('SELECT `id`,`email` FROM `auth_users` WHERE `id` = :userid;');
+          $result->execute(array(':userid' => $session['user']));
+          $user = $result->fetch(PDO::FETCH_ASSOC);
+          if (!$user['id']) {
+            // XXXlog: Unexpected failure to fetch user data!
+          }

           $pagetype = 'resetpwd';
         }
         else {
           $pagetype = 'resetpwd';
         }
         else {


@@ -187,7 +224,7 @@ if (!count($errors)) {
         if ($user['id']) {
           $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = \'\', `status` = \'ok\' WHERE `id` = :userid;');
           if (!$result->execute(array(':userid' => $user['id']))) {
         if ($user['id']) {
           $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = \'\', `status` = \'ok\' WHERE `id` = :userid;');
           if (!$result->execute(array(':userid' => $user['id']))) {

-            // XXXlog: unexpected failure to save verification!
+            // XXXlog: Unexpected failure to save verification!

             $errors[] = _('Could not save confirmation. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
           }
           $pagetype = 'verification_done';
             $errors[] = _('Could not save confirmation. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
           }
           $pagetype = 'verification_done';


@@ -196,19 +233,82 @@ if (!count($errors)) {
           $errors[] = _('The confirmation link you called is not valid. Possibly it has expired and you need to try registering again.');
         }
       }
           $errors[] = _('The confirmation link you called is not valid. Possibly it has expired and you need to try registering again.');
         }
       }

+      elseif (array_key_exists('reset_code', $_GET)) {
+        $reset_fail = true;
+        $result = $db->prepare('SELECT `id`,`email`,`verify_hash` FROM `auth_users` WHERE `email` = :email');
+        $result->execute(array(':email' => @$_GET['email']));
+        $user = $result->fetch(PDO::FETCH_ASSOC);
+        if ($user['id']) {
+          // Deconstruct reset code and verify it.
+          if (preg_match('/^([0-9a-f]{'.strlen($user['verify_hash']).'})([0-9a-f]+)_(\d+\.\d+)$/', $_GET['reset_code'], $regs)) {
+            $tcode_sessid = hexdec($regs[2]) - $user['id'];
+            $result = $db->prepare('SELECT `id`,`sesskey` FROM `auth_sessions` WHERE `id` = :sessid;');
+            $result->execute(array(':sessid' => $tcode_sessid));
+            $row = $result->fetch(PDO::FETCH_ASSOC);
+            if ($row) {
+              $tcode_session = $row;
+              if (($regs[1] == $user['verify_hash']) &&
+                  AuthUtils::verifyTimeCode($regs[3], $session, 60)) {
+                // Set a new verify_hash for the actual password reset.
+                $user['verify_hash'] = AuthUtils::createVerificationCode();
+                $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = :vcode WHERE `id` = :userid;');
+                if (!$result->execute(array(':vcode' => $user['verify_hash'], ':userid' => $user['id']))) {
+                  // XXXlog: Unexpected failure to reset verify_hash!
+                }
+                $result = $db->prepare('UPDATE `auth_sessions` SET `user` = :userid WHERE `id` = :sessid;');
+                if (!$result->execute(array(':userid' => $user['id'], ':sessid' => $session['id']))) {
+                  // XXXlog: Unexpected failure to update session!
+                }
+                $pagetype = 'resetpwd';
+                $reset_fail = false;
+              }
+            }
+          }
+        }
+        if ($reset_fail) {
+          $errors[] = _('The password reset link you called is not valid. Possibly it has expired and you need to call the "Password forgotten?" function again.');
+        }
+      }

       elseif (intval($session['user'])) {
       elseif (intval($session['user'])) {

-        $result = $db->prepare('SELECT `id`,`email` FROM `auth_users` WHERE `id` = :userid;');
+        $result = $db->prepare('SELECT `id`,`email`,`verify_hash` FROM `auth_users` WHERE `id` = :userid;');

         $result->execute(array(':userid' => $session['user']));
         $user = $result->fetch(PDO::FETCH_ASSOC);
         if (!$user['id']) {
         $result->execute(array(':userid' => $session['user']));
         $user = $result->fetch(PDO::FETCH_ASSOC);
         if (!$user['id']) {

-          // XXXlog: unexpected failure to fetch user data!
+          // XXXlog: Unexpected failure to fetch user data!
+        }
+        // Password reset requested.
+        if (array_key_exists('pwd', $_POST) && array_key_exists('reset', $_POST) && array_key_exists('tcode', $_POST)) {
+          // If not logged in, a password reset needs to have the proper vcode set.
+          if (!$session['logged_in'] && (!strlen(@$_POST['vcode']) || ($_POST['vcode'] != $user['verify_hash']))) {
+            $errors[] = _('Password reset failed. The reset form you used was not valid. Possibly it has expired and you need to initiate the password reset again.');
+          }
+          // If not logged in, a password reset also needs to have the proper email set.
+          if (!$session['logged_in'] && !count($errors) && (@$_POST['email_hidden'] != $user['email'])) {
+            $errors[] = _('Password reset failed. The reset form you used was not valid. Possibly it has expired and you need to initiate the password reset again.');
+          }
+          // Check validity of time code.
+          if (!count($errors) && !AuthUtils::verifyTimeCode($_POST['tcode'], $session)) {
+            $errors[] = _('Password reset failed. The reset form you used was not valid. Possibly it has expired and you need to initiate the password reset again.');
+          }
+          $errors += AuthUtils::checkPasswordConstraints(strval($_POST['pwd']), $user['email']);
+          if (!count($errors)) {
+            $newHash = password_hash($_POST['pwd'], PASSWORD_DEFAULT, $pwd_options);
+            $result = $db->prepare('UPDATE `auth_users` SET `pwdhash` = :pwdhash, `verify_hash` = \'\' WHERE `id` = :userid;');
+            if (!$result->execute(array(':pwdhash' => $newHash, ':userid' => $session['user']))) {
+              // XXXlog: Password reset failure!
+              $errors[] = _('Password reset failed. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
+            }
+            else {
+              $pagetype = 'reset_done';
+            }
+          }

         }
       }
     }
   }
   if (is_null($session)) {
     // Create new session and set cookie.
         }
       }
     }
   }
   if (is_null($session)) {
     // Create new session and set cookie.

-    $sesskey = bin2hex(openssl_random_pseudo_bytes(512/8)); // Get 512 bits of randomness (128 byte hex string).
+    $sesskey = AuthUtils::createSessionKey();

     setcookie('sessionkey', $sesskey, 0, "", "", !$running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost.
     $result = $db->prepare('INSERT INTO `auth_sessions` (`sesskey`, `time_expire`) VALUES (:sesskey, :expire);');
     $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s', strtotime('+5 minutes'))));
     setcookie('sessionkey', $sesskey, 0, "", "", !$running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost.
     $result = $db->prepare('INSERT INTO `auth_sessions` (`sesskey`, `time_expire`) VALUES (:sesskey, :expire);');
     $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s', strtotime('+5 minutes'))));


@@ -220,7 +320,7 @@ if (!count($errors)) {
       $session = $row;
     }
     else {
       $session = $row;
     }
     else {

-      // XXXlog: unexpected failure to create session!
+      // XXXlog: Unexpected failure to create session!

       $errors[] = _('The session system is not working. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
     }
   }
       $errors[] = _('The session system is not working. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
     }
   }


@@ -231,6 +331,11 @@ if (!count($errors)) {
     $para = $body->appendElement('p', sprintf(_('An email for confirmation has been sent to %s. Please follow the link provided there to complete the process.'), $user['email']));
     $para->setAttribute('class', 'verifyinfo pending');
   }
     $para = $body->appendElement('p', sprintf(_('An email for confirmation has been sent to %s. Please follow the link provided there to complete the process.'), $user['email']));
     $para->setAttribute('class', 'verifyinfo pending');
   }

+  elseif ($pagetype == 'resetmail_sent') {
+    $para = $body->appendElement('p',
+        _('An email has been sent to the requested account with further information. If you do not receive an email then please confirm you have entered the same email address used during account registration.'));
+    $para->setAttribute('class', 'resetinfo pending');
+  }

   elseif ($pagetype == 'resetstart') {
     $para = $body->appendElement('p', _('If you forgot your password or didn\'t receive the registration confirmation, please enter your email here.'));
     $para->setAttribute('class', '');
   elseif ($pagetype == 'resetstart') {
     $para = $body->appendElement('p', _('If you forgot your password or didn\'t receive the registration confirmation, please enter your email here.'));
     $para->setAttribute('class', '');


@@ -245,25 +350,40 @@ if (!count($errors)) {
     $inptxt->setAttribute('required', '');
     $inptxt->setAttribute('placeholder', _('Email'));
     $litem = $ulist->appendElement('li');
     $inptxt->setAttribute('required', '');
     $inptxt->setAttribute('placeholder', _('Email'));
     $litem = $ulist->appendElement('li');

+    $litem->appendInputHidden('tcode', AuthUtils::createTimeCode($session));

     $submit = $litem->appendInputSubmit(_('Send instructions to email'));
   }
   elseif ($pagetype == 'resetpwd') {
     $submit = $litem->appendInputSubmit(_('Send instructions to email'));
   }
   elseif ($pagetype == 'resetpwd') {

-    $para = $body->appendElement('p', _('You can set a new password here.'));
+    $para = $body->appendElement('p', sprintf(_('You can set a new password for %s here.'), $user['email']));

     $para->setAttribute('class', '');
     $para->setAttribute('class', '');

-    $form = $body->appendForm('?reset', 'POST', 'newpwdform');
+    $form = $body->appendForm('?', 'POST', 'newpwdform');

     $form->setAttribute('id', 'loginform');
     $form->setAttribute('class', 'loginarea hidden');
     $ulist = $form->appendElement('ul');
     $ulist->setAttribute('class', 'flat login');
     $litem = $ulist->appendElement('li');
     $form->setAttribute('id', 'loginform');
     $form->setAttribute('class', 'loginarea hidden');
     $ulist = $form->appendElement('ul');
     $ulist->setAttribute('class', 'flat login');
     $litem = $ulist->appendElement('li');

+    $litem->setAttribute('class', 'donotshow');
+    $inptxt = $litem->appendInputEmail('email_hidden', 30, 20, 'login_email', $user['email']);
+    $inptxt->setAttribute('autocomplete', 'email');
+    $inptxt->setAttribute('placeholder', _('Email'));
+    $litem = $ulist->appendElement('li');

     $inptxt = $litem->appendInputPassword('pwd', 20, 20, 'login_pwd', '');
     $inptxt->setAttribute('required', '');
     $inptxt->setAttribute('placeholder', _('Password'));
     $inptxt->setAttribute('class', 'login');
     $litem = $ulist->appendElement('li');
     $inptxt = $litem->appendInputPassword('pwd', 20, 20, 'login_pwd', '');
     $inptxt->setAttribute('required', '');
     $inptxt->setAttribute('placeholder', _('Password'));
     $inptxt->setAttribute('class', 'login');
     $litem = $ulist->appendElement('li');

+    $litem->appendInputHidden('reset', '');
+    $litem->appendInputHidden('tcode', AuthUtils::createTimeCode($session));
+    if (!$session['logged_in'] && strlen(@$user['verify_hash'])) {
+      $litem->appendInputHidden('vcode', $user['verify_hash']);
+    }

     $submit = $litem->appendInputSubmit(_('Save password'));
   }
   elseif ($session['logged_in']) {
     $submit = $litem->appendInputSubmit(_('Save password'));
   }
   elseif ($session['logged_in']) {

+    if ($pagetype == 'reset_done') {
+      $para = $body->appendElement('p', _('Your password has successfully been reset.'));
+      $para->setAttribute('class', 'resetinfo done');
+    }

     $div = $body->appendElement('div', $user['email']);
     $div->setAttribute('class', 'loginheader');
     $div = $body->appendElement('div');
     $div = $body->appendElement('div', $user['email']);
     $div->setAttribute('class', 'loginheader');
     $div = $body->appendElement('div');


@@ -280,6 +400,10 @@ if (!count($errors)) {
       $para = $body->appendElement('p', _('Hooray! Your email was successfully confirmed! You can log in now.'));
       $para->setAttribute('class', 'verifyinfo done');
     }
       $para = $body->appendElement('p', _('Hooray! Your email was successfully confirmed! You can log in now.'));
       $para->setAttribute('class', 'verifyinfo done');
     }

+    elseif ($pagetype == 'reset_done') {
+      $para = $body->appendElement('p', _('Your password has successfully been reset. You can log in now with the new password.'));
+      $para->setAttribute('class', 'resetinfo done');
+    }

     $form = $body->appendForm('?', 'POST', 'loginform');
     $form->setAttribute('id', 'loginform');
     $form->setAttribute('class', 'loginarea hidden');
     $form = $body->appendForm('?', 'POST', 'loginform');
     $form->setAttribute('id', 'loginform');
     $form->setAttribute('class', 'loginarea hidden');


@@ -305,7 +429,8 @@ if (!count($errors)) {
     $label->setAttribute('id', 'rememprompt');
     $label->setAttribute('class', 'loginprompt');
     $litem = $ulist->appendElement('li');
     $label->setAttribute('id', 'rememprompt');
     $label->setAttribute('class', 'loginprompt');
     $litem = $ulist->appendElement('li');

-    $submit = $litem->appendInputSubmit(_('Log in'));
+    $litem->appendInputHidden('tcode', AuthUtils::createTimeCode($session));
+    $submit = $litem->appendInputSubmit(_('Log in / Register'));

     $submit->setAttribute('class', 'loginbutton');
   }
 }
     $submit->setAttribute('class', 'loginbutton');
   }
 }