X-Git-Url: https://git-public.kairo.at/?p=authserver.git;a=blobdiff_plain;f=authutils.php-class;h=4d5680a5264b4402bd80ffce5e9bcd37aa6b352a;hp=dfb89a22b6d5115a805e3d441db836edf9c1e25c;hb=409b55f4dbb4267e83e8ae2fda56f243ab8be250;hpb=be1082a69cdf3dec7db4060198834dd43ae6290f diff --git a/authutils.php-class b/authutils.php-class index dfb89a2..4d5680a 100755 --- a/authutils.php-class +++ b/authutils.php-class @@ -7,39 +7,135 @@ class AuthUtils { // KaiRo.at authentication utilities PHP class // This class contains helper functions for the authentication system. // - // private static $pwd_cost - // Store cost parameter for use with PHP password_hash function. + // function __construct($settings, $db) + // CONSTRUCTOR + // Settings are an associative array with a numeric pwd_cost field and an array pwd_nonces field. + // The DB is a PDO object. // - // static function checkPasswordConstraints($new_password, $user_email) + // public $db + // A PDO database object for interaction. + // + // public $running_on_localhost + // A boolean telling if the system is running on localhost (where https is not required). + // + // private $pwd_cost + // The cost parameter for use with PHP password_hash function. + // + // private $pwd_nonces + // The array of nonces to use for "peppering" passwords. For new hashes, the last one of those will be used. + // Generate a nonce with this command: |openssl rand -base64 48| + // + // function log($code, $additional_info) + // Log an entry for admin purposes, with a code and some additional info. + // + // function checkForSecureConnection() + // Check is the connection is secure and return an array of error messages (empty if it's secure). + // + // function initSession() + // Initialize a session. Returns an associative array of all the DB fields of the session. + // + // function getDomainBaseURL() + // Get the base URL of the current domain, e.g. 'https://example.com'. + // + // function checkPasswordConstraints($new_password, $user_email) // Check password constraints and return an array of error messages (empty if all constraints are met). // - // static function createSessionKey() + // function createSessionKey() // Return a random session key. // - // static function createVerificationCode() + // function createVerificationCode() // Return a random acount/email verification code. // - // static function createTimeCode($session, [$offset], [$validity_minutes]) + // function createTimeCode($session, [$offset], [$validity_minutes]) // Return a time-based code based on the key and ID of the given session. // An offset can be given to create a specific code for verification, otherwise and offset will be generated. // Also, an amount of minutes for the code to stay valid can be handed over, by default 10 minutes will be used. // - // static function verifyTimeCode($timecode_to_verify, $session, [$validity_minutes]) + // function verifyTimeCode($timecode_to_verify, $session, [$validity_minutes]) // Verify a given time-based code and return true if it's valid or false if it's not. // See createTimeCode() documentation for the session and validity paramerters. // - // static function pwdHash($new_password) + // function pwdHash($new_password) // Return a hash for the given password. // - // static function pwdVerify($password_to_verify, $user) + // function pwdVerify($password_to_verify, $user) // Return true if the password verifies against the pwdhash field of the user, false if not. // - // static function pwdNeedsRehash($user) + // function pwdNeedsRehash($user) // Return true if the pwdhash field of the user uses an outdated standard and needs to be rehashed. + // + // function appendLoginForm($dom_element, $session, $user) + // append a login form for the given session to the given DOM element, possibly prefilling the email from the given user info array. + + function __construct($settings, $db) { + // *** constructor *** + $this->db = $db; + $this->db->exec("SET time_zone='+00:00';"); // Execute directly on PDO object, set session to UTC to make our gmdate() values match correctly. + $this->running_on_localhost = preg_match('/^((.+\.)?localhost|127\.0\.0\.\d+)$/', $_SERVER['SERVER_NAME']); + if (array_key_exists('pwd_cost', $settings)) { + $this->pwd_cost = $settings['pwd_cost']; + } + if (array_key_exists('pwd_nonces', $settings)) { + $this->pwd_nonces = $settings['pwd_nonces']; + } + } + + public $db = null; + public $running_on_localhost = false; + private $pwd_cost = 10; + private $pwd_nonces = array(); + + function log($code, $info) { + $result = $this->db->prepare('INSERT INTO `auth_log` (`code`, `info`, `ip_addr`) VALUES (:code, :info, :ipaddr);'); + if (!$result->execute(array(':code' => $code, ':info' => $info, ':ipaddr' => $_SERVER['REMOTE_ADDR']))) { + // print($result->errorInfo()[2]); + } + } - private static $pwd_cost = 10; + function checkForSecureConnection() { + $errors = array(); + if (($_SERVER['SERVER_PORT'] != 443) && !$this->running_on_localhost) { + $errors[] = _('You are not accessing this site on a secure connection, so authentication doesn\'t work.'); + } + return $errors; + } - static function checkPasswordConstraints($new_password, $user_email) { + function initSession() { + $session = null; + if (strlen(@$_COOKIE['sessionkey'])) { + // Fetch the session - or at least try to. + $result = $this->db->prepare('SELECT * FROM `auth_sessions` WHERE `sesskey` = :sesskey AND `time_expire` > :expire;'); + $result->execute(array(':sesskey' => $_COOKIE['sessionkey'], ':expire' => gmdate('Y-m-d H:i:s'))); + $row = $result->fetch(PDO::FETCH_ASSOC); + if ($row) { + $session = $row; + } + } + if (is_null($session)) { + // Create new session and set cookie. + $sesskey = $this->createSessionKey(); + setcookie('sessionkey', $sesskey, 0, "", "", !$this->running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost. + $result = $this->db->prepare('INSERT INTO `auth_sessions` (`sesskey`, `time_expire`) VALUES (:sesskey, :expire);'); + $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s', strtotime('+5 minutes')))); + // After insert, actually fetch the session row from the DB so we have all values. + $result = $this->db->prepare('SELECT * FROM auth_sessions WHERE `sesskey` = :sesskey AND `time_expire` > :expire;'); + $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s'))); + $row = $result->fetch(PDO::FETCH_ASSOC); + if ($row) { + $session = $row; + } + else { + $this->log('session_create_failure', 'key: '.$sesskey); + } + } + return $session; + } + + function getDomainBaseURL() { + return ($this->running_on_localhost?'http':'https').'://'.$_SERVER['SERVER_NAME']; + } + + function checkPasswordConstraints($new_password, $user_email) { $errors = array(); if ($new_password != trim($new_password)) { $errors[] = _('Password must not start or end with a whitespace character like a space.'); @@ -62,15 +158,15 @@ class AuthUtils { return $errors; } - static function createSessionKey() { + function createSessionKey() { return bin2hex(openssl_random_pseudo_bytes(512 / 8)); // Get 512 bits of randomness (128 byte hex string). } - static function createVerificationCode() { + function createVerificationCode() { return bin2hex(openssl_random_pseudo_bytes(512 / 8)); // Get 512 bits of randomness (128 byte hex string). } - static function createTimeCode($session, $offset = null, $validity_minutes = 10) { + function createTimeCode($session, $offset = null, $validity_minutes = 10) { // Matches TOTP algorithms, see https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm $valid_seconds = intval($validity_minutes) * 60; if ($valid_seconds < 60) { $valid_seconds = 60; } @@ -85,23 +181,75 @@ class AuthUtils { return $rest.'.'.$totp_value; } - static function verifyTimeCode($timecode_to_verify, $session, $validity_minutes = 10) { + function verifyTimeCode($timecode_to_verify, $session, $validity_minutes = 10) { if (preg_match('/^(\d+)\.\d+$/', $timecode_to_verify, $regs)) { - return ($timecode_to_verify === self::createTimeCode($session, $regs[1], $validity_minutes)); + return ($timecode_to_verify === $this->createTimeCode($session, $regs[1], $validity_minutes)); } return false; } - static function pwdHash($new_password) { - return password_hash($new_password, PASSWORD_DEFAULT, array('cost' => self::$pwd_cost)); + function pwdHash($new_password) { + $hash_prefix = ''; + if (count($this->pwd_nonces)) { + $new_password .= $this->pwd_nonces[count($this->pwd_nonces) - 1]; + $hash_prefix = (count($this->pwd_nonces) - 1).'|'; + } + return $hash_prefix.password_hash($new_password, PASSWORD_DEFAULT, array('cost' => $this->pwd_cost)); + } + + function pwdVerify($password_to_verify, $userdata) { + $pwdhash = $userdata['pwdhash']; + if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) { + $password_to_verify .= $this->pwd_nonces[$regs[1]]; + $pwdhash = $regs[2]; + } + return password_verify($password_to_verify, $pwdhash); } - static function pwdVerify($password_to_verify, $userdata) { - return password_verify($password_to_verify, $userdata['pwdhash'])); + function pwdNeedsRehash($userdata) { + $nonceid = -1; + $pwdhash = $userdata['pwdhash']; + if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) { + $nonceid = $regs[1]; + $pwdhash = $regs[2]; + } + if ($nonceid == count($this->pwd_nonces) - 1) { + return password_needs_rehash($pwdhash, PASSWORD_DEFAULT, array('cost' => $this->pwd_cost)); + } + else { + return true; + } } - static function pwdNeedsRehash($userdata) { - return password_needs_rehash($userdata['pwdhash'], PASSWORD_DEFAULT, array('cost' => self::$pwd_cost)); + function appendLoginForm($dom_element, $session, $user) { + $form = $dom_element->appendForm('./', 'POST', 'loginform'); + $form->setAttribute('id', 'loginform'); + $form->setAttribute('class', 'loginarea hidden'); + $ulist = $form->appendElement('ul'); + $ulist->setAttribute('class', 'flat login'); + $litem = $ulist->appendElement('li'); + $inptxt = $litem->appendInputEmail('email', 30, 20, 'login_email', (intval(@$user['id'])?$user['email']:'')); + $inptxt->setAttribute('autocomplete', 'email'); + $inptxt->setAttribute('required', ''); + $inptxt->setAttribute('placeholder', _('Email')); + $inptxt->setAttribute('class', 'login'); + $litem = $ulist->appendElement('li'); + $inptxt = $litem->appendInputPassword('pwd', 20, 20, 'login_pwd', ''); + $inptxt->setAttribute('required', ''); + $inptxt->setAttribute('placeholder', _('Password')); + $inptxt->setAttribute('class', 'login'); + $litem = $ulist->appendElement('li'); + $litem->appendLink('./?reset', _('Forgot password?')); + $litem = $ulist->appendElement('li'); + $cbox = $litem->appendInputCheckbox('remember', 'login_remember', 'true', false); + $cbox->setAttribute('class', 'logincheck'); + $label = $litem->appendLabel('login_remember', _('Remember me')); + $label->setAttribute('id', 'rememprompt'); + $label->setAttribute('class', 'loginprompt'); + $litem = $ulist->appendElement('li'); + $litem->appendInputHidden('tcode', $this->createTimeCode($session)); + $submit = $litem->appendInputSubmit(_('Log in / Register')); + $submit->setAttribute('class', 'loginbutton'); } } ?>