X-Git-Url: https://git-public.kairo.at/?p=authserver.git;a=blobdiff_plain;f=authutils.php-class;h=bcf1b38dbb0a4e92929b6d7d5935977c0a6e06a2;hp=dfb89a22b6d5115a805e3d441db836edf9c1e25c;hb=4c6d80643398a11020d7f9f6c6682de90cbab9aa;hpb=be1082a69cdf3dec7db4060198834dd43ae6290f diff --git a/authutils.php-class b/authutils.php-class index dfb89a2..bcf1b38 100755 --- a/authutils.php-class +++ b/authutils.php-class @@ -7,39 +7,125 @@ class AuthUtils { // KaiRo.at authentication utilities PHP class // This class contains helper functions for the authentication system. // - // private static $pwd_cost - // Store cost parameter for use with PHP password_hash function. + // function __construct($settings, $db) + // CONSTRUCTOR + // Settings are an associative array with a numeric pwd_cost field and an array pwd_nonces field. + // The DB is a PDO object. // - // static function checkPasswordConstraints($new_password, $user_email) + // public $db + // A PDO database object for interaction. + // + // public $running_on_localhost + // A boolean telling if the system is running on localhost (where https is not required). + // + // private $pwd_cost + // The cost parameter for use with PHP password_hash function. + // + // private $pwd_nonces + // The array of nonces to use for "peppering" passwords. For new hashes, the last one of those will be used. + // Generate a nonce with this command: |openssl rand -base64 48| + // + // function log($code, $additional_info) + // Log an entry for admin purposes, with a code and some additional info. + // + // function checkForSecureConnection() + // Check is the connection is secure and return an array of error messages (empty if it's secure). + // + // function initSession() + // Initialize a session. Returns an associative array of all the DB fields of the session. + // + // function checkPasswordConstraints($new_password, $user_email) // Check password constraints and return an array of error messages (empty if all constraints are met). // - // static function createSessionKey() + // function createSessionKey() // Return a random session key. // - // static function createVerificationCode() + // function createVerificationCode() // Return a random acount/email verification code. // - // static function createTimeCode($session, [$offset], [$validity_minutes]) + // function createTimeCode($session, [$offset], [$validity_minutes]) // Return a time-based code based on the key and ID of the given session. // An offset can be given to create a specific code for verification, otherwise and offset will be generated. // Also, an amount of minutes for the code to stay valid can be handed over, by default 10 minutes will be used. // - // static function verifyTimeCode($timecode_to_verify, $session, [$validity_minutes]) + // function verifyTimeCode($timecode_to_verify, $session, [$validity_minutes]) // Verify a given time-based code and return true if it's valid or false if it's not. // See createTimeCode() documentation for the session and validity paramerters. // - // static function pwdHash($new_password) + // function pwdHash($new_password) // Return a hash for the given password. // - // static function pwdVerify($password_to_verify, $user) + // function pwdVerify($password_to_verify, $user) // Return true if the password verifies against the pwdhash field of the user, false if not. // - // static function pwdNeedsRehash($user) + // function pwdNeedsRehash($user) // Return true if the pwdhash field of the user uses an outdated standard and needs to be rehashed. - private static $pwd_cost = 10; + function __construct($settings, $db) { + // *** constructor *** + $this->db = $db; + $this->db->exec("SET time_zone='+00:00';"); // Execute directly on PDO object, set session to UTC to make our gmdate() values match correctly. + $this->running_on_localhost = preg_match('/^((.+\.)?localhost|127\.0\.0\.\d+)$/', $_SERVER['SERVER_NAME']); + if (array_key_exists('pwd_cost', $settings)) { + $this->pwd_cost = $settings['pwd_cost']; + } + if (array_key_exists('pwd_nonces', $settings)) { + $this->pwd_nonces = $settings['pwd_nonces']; + } + } + + public $db = null; + public $running_on_localhost = false; + private $pwd_cost = 10; + private $pwd_nonces = array(); + + function log($code, $info) { + $result = $this->db->prepare('INSERT INTO `auth_log` (`code`, `info`, `ip_addr`) VALUES (:code, :info, :ipaddr);'); + if (!$result->execute(array(':code' => $code, ':info' => $info, ':ipaddr' => $_SERVER['REMOTE_ADDR']))) { + // print($result->errorInfo()[2]); + } + } + + function checkForSecureConnection() { + $errors = array(); + if (($_SERVER['SERVER_PORT'] != 443) && !$this->running_on_localhost) { + $errors[] = _('You are not accessing this site on a secure connection, so authentication doesn\'t work.'); + } + return $errors; + } + + function initSession() { + $session = null; + if (strlen(@$_COOKIE['sessionkey'])) { + // Fetch the session - or at least try to. + $result = $this->db->prepare('SELECT * FROM `auth_sessions` WHERE `sesskey` = :sesskey AND `time_expire` > :expire;'); + $result->execute(array(':sesskey' => $_COOKIE['sessionkey'], ':expire' => gmdate('Y-m-d H:i:s'))); + $row = $result->fetch(PDO::FETCH_ASSOC); + if ($row) { + $session = $row; + } + } + if (is_null($session)) { + // Create new session and set cookie. + $sesskey = $this->createSessionKey(); + setcookie('sessionkey', $sesskey, 0, "", "", !$this->running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost. + $result = $this->db->prepare('INSERT INTO `auth_sessions` (`sesskey`, `time_expire`) VALUES (:sesskey, :expire);'); + $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s', strtotime('+5 minutes')))); + // After insert, actually fetch the session row from the DB so we have all values. + $result = $this->db->prepare('SELECT * FROM auth_sessions WHERE `sesskey` = :sesskey AND `time_expire` > :expire;'); + $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s'))); + $row = $result->fetch(PDO::FETCH_ASSOC); + if ($row) { + $session = $row; + } + else { + $this->log('session_create_failure', 'key: '.$sesskey); + } + } + return $session; + } - static function checkPasswordConstraints($new_password, $user_email) { + function checkPasswordConstraints($new_password, $user_email) { $errors = array(); if ($new_password != trim($new_password)) { $errors[] = _('Password must not start or end with a whitespace character like a space.'); @@ -62,15 +148,15 @@ class AuthUtils { return $errors; } - static function createSessionKey() { + function createSessionKey() { return bin2hex(openssl_random_pseudo_bytes(512 / 8)); // Get 512 bits of randomness (128 byte hex string). } - static function createVerificationCode() { + function createVerificationCode() { return bin2hex(openssl_random_pseudo_bytes(512 / 8)); // Get 512 bits of randomness (128 byte hex string). } - static function createTimeCode($session, $offset = null, $validity_minutes = 10) { + function createTimeCode($session, $offset = null, $validity_minutes = 10) { // Matches TOTP algorithms, see https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm $valid_seconds = intval($validity_minutes) * 60; if ($valid_seconds < 60) { $valid_seconds = 60; } @@ -85,23 +171,44 @@ class AuthUtils { return $rest.'.'.$totp_value; } - static function verifyTimeCode($timecode_to_verify, $session, $validity_minutes = 10) { + function verifyTimeCode($timecode_to_verify, $session, $validity_minutes = 10) { if (preg_match('/^(\d+)\.\d+$/', $timecode_to_verify, $regs)) { - return ($timecode_to_verify === self::createTimeCode($session, $regs[1], $validity_minutes)); + return ($timecode_to_verify === $this->createTimeCode($session, $regs[1], $validity_minutes)); } return false; } - static function pwdHash($new_password) { - return password_hash($new_password, PASSWORD_DEFAULT, array('cost' => self::$pwd_cost)); + function pwdHash($new_password) { + $hash_prefix = ''; + if (count($this->pwd_nonces)) { + $new_password .= $this->pwd_nonces[count($this->pwd_nonces) - 1]; + $hash_prefix = (count($this->pwd_nonces) - 1).'|'; + } + return $hash_prefix.password_hash($new_password, PASSWORD_DEFAULT, array('cost' => $this->pwd_cost)); } - static function pwdVerify($password_to_verify, $userdata) { - return password_verify($password_to_verify, $userdata['pwdhash'])); + function pwdVerify($password_to_verify, $userdata) { + $pwdhash = $userdata['pwdhash']; + if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) { + $password_to_verify .= $this->pwd_nonces[$regs[1]]; + $pwdhash = $regs[2]; + } + return password_verify($password_to_verify, $pwdhash); } - static function pwdNeedsRehash($userdata) { - return password_needs_rehash($userdata['pwdhash'], PASSWORD_DEFAULT, array('cost' => self::$pwd_cost)); + function pwdNeedsRehash($userdata) { + $nonceid = -1; + $pwdhash = $userdata['pwdhash']; + if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) { + $nonceid = $regs[1]; + $pwdhash = $regs[2]; + } + if ($nonceid == count($this->pwd_nonces) - 1) { + return password_needs_rehash($pwdhash, PASSWORD_DEFAULT, array('cost' => $this->pwd_cost)); + } + else { + return true; + } } } ?>