123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320 |
- <?php
- /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@owncloud.com>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
- */
-
- namespace OC\Core\Controller;
-
- use OC\Authentication\TwoFactorAuth\Manager;
- use OC\Security\Bruteforce\Throttler;
- use OC\User\Session;
- use OC_App;
- use OC_Util;
- use OCP\AppFramework\Controller;
- use OCP\AppFramework\Http;
- use OCP\AppFramework\Http\DataResponse;
- use OCP\AppFramework\Http\RedirectResponse;
- use OCP\AppFramework\Http\TemplateResponse;
- use OCP\Authentication\TwoFactorAuth\IProvider;
- use OCP\IConfig;
- use OCP\IRequest;
- use OCP\ISession;
- use OCP\IURLGenerator;
- use OCP\IUser;
- use OCP\IUserManager;
- use OCP\IUserSession;
-
- class LoginController extends Controller {
- /** @var IUserManager */
- private $userManager;
- /** @var IConfig */
- private $config;
- /** @var ISession */
- private $session;
- /** @var IUserSession|Session */
- private $userSession;
- /** @var IURLGenerator */
- private $urlGenerator;
- /** @var Manager */
- private $twoFactorManager;
- /** @var Throttler */
- private $throttler;
-
- /**
- * @param string $appName
- * @param IRequest $request
- * @param IUserManager $userManager
- * @param IConfig $config
- * @param ISession $session
- * @param IUserSession $userSession
- * @param IURLGenerator $urlGenerator
- * @param Manager $twoFactorManager
- * @param Throttler $throttler
- */
- function __construct($appName,
- IRequest $request,
- IUserManager $userManager,
- IConfig $config,
- ISession $session,
- IUserSession $userSession,
- IURLGenerator $urlGenerator,
- Manager $twoFactorManager,
- Throttler $throttler) {
- parent::__construct($appName, $request);
- $this->userManager = $userManager;
- $this->config = $config;
- $this->session = $session;
- $this->userSession = $userSession;
- $this->urlGenerator = $urlGenerator;
- $this->twoFactorManager = $twoFactorManager;
- $this->throttler = $throttler;
- }
-
- /**
- * @NoAdminRequired
- * @UseSession
- *
- * @return RedirectResponse
- */
- public function logout() {
- $loginToken = $this->request->getCookie('oc_token');
- if (!is_null($loginToken)) {
- $this->config->deleteUserValue($this->userSession->getUser()->getUID(), 'login_token', $loginToken);
- }
- $this->userSession->logout();
-
- return new RedirectResponse($this->urlGenerator->linkToRouteAbsolute('core.login.showLoginForm'));
- }
-
- /**
- * @PublicPage
- * @NoCSRFRequired
- * @UseSession
- *
- * @param string $user
- * @param string $redirect_url
- * @param string $remember_login
- *
- * @return TemplateResponse|RedirectResponse
- */
- public function showLoginForm($user, $redirect_url, $remember_login) {
- if ($this->userSession->isLoggedIn()) {
- return new RedirectResponse(OC_Util::getDefaultPageUrl());
- }
-
- $parameters = array();
- $loginMessages = $this->session->get('loginMessages');
- $errors = [];
- $messages = [];
- if (is_array($loginMessages)) {
- list($errors, $messages) = $loginMessages;
- }
- $this->session->remove('loginMessages');
- foreach ($errors as $value) {
- $parameters[$value] = true;
- }
-
- $parameters['messages'] = $messages;
- if (!is_null($user) && $user !== '') {
- $parameters['loginName'] = $user;
- $parameters['user_autofocus'] = false;
- } else {
- $parameters['loginName'] = '';
- $parameters['user_autofocus'] = true;
- }
- if (!empty($redirect_url)) {
- $parameters['redirect_url'] = $redirect_url;
- }
-
- $parameters['canResetPassword'] = true;
- $parameters['resetPasswordLink'] = $this->config->getSystemValue('lost_password_link', '');
- if (!$parameters['resetPasswordLink']) {
- if (!is_null($user) && $user !== '') {
- $userObj = $this->userManager->get($user);
- if ($userObj instanceof IUser) {
- $parameters['canResetPassword'] = $userObj->canChangePassword();
- }
- }
- }
-
- $parameters['alt_login'] = OC_App::getAlternativeLogIns();
- $parameters['rememberLoginAllowed'] = OC_Util::rememberLoginAllowed();
- $parameters['rememberLoginState'] = !empty($remember_login) ? $remember_login : 0;
-
- if (!is_null($user) && $user !== '') {
- $parameters['loginName'] = $user;
- $parameters['user_autofocus'] = false;
- } else {
- $parameters['loginName'] = '';
- $parameters['user_autofocus'] = true;
- }
-
- return new TemplateResponse(
- $this->appName, 'login', $parameters, 'guest'
- );
- }
-
- /**
- * @param string $redirectUrl
- * @return RedirectResponse
- */
- private function generateRedirect($redirectUrl) {
- if (!is_null($redirectUrl) && $this->userSession->isLoggedIn()) {
- $location = $this->urlGenerator->getAbsoluteURL(urldecode($redirectUrl));
- // Deny the redirect if the URL contains a @
- // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
- if (strpos($location, '@') === false) {
- return new RedirectResponse($location);
- }
- }
- return new RedirectResponse(OC_Util::getDefaultPageUrl());
- }
-
- /**
- * @PublicPage
- * @UseSession
- * @NoCSRFRequired
- *
- * @param string $user
- * @param string $password
- * @param string $redirect_url
- * @param boolean $remember_login
- * @param string $timezone
- * @param string $timezone_offset
- * @return RedirectResponse
- */
- public function tryLogin($user, $password, $redirect_url, $remember_login = false, $timezone = '', $timezone_offset = '') {
- $currentDelay = $this->throttler->getDelay($this->request->getRemoteAddress());
- $this->throttler->sleepDelay($this->request->getRemoteAddress());
-
- // If the user is already logged in and the CSRF check does not pass then
- // simply redirect the user to the correct page as required. This is the
- // case when an user has already logged-in, in another tab.
- if(!$this->request->passesCSRFCheck()) {
- return $this->generateRedirect($redirect_url);
- }
-
- $originalUser = $user;
- // TODO: Add all the insane error handling
- /* @var $loginResult IUser */
- $loginResult = $this->userManager->checkPassword($user, $password);
- if ($loginResult === false) {
- $users = $this->userManager->getByEmail($user);
- // we only allow login by email if unique
- if (count($users) === 1) {
- $user = $users[0]->getUID();
- $loginResult = $this->userManager->checkPassword($user, $password);
- }
- }
- if ($loginResult === false) {
- $this->throttler->registerAttempt('login', $this->request->getRemoteAddress(), ['user' => $originalUser]);
- if($currentDelay === 0) {
- $this->throttler->sleepDelay($this->request->getRemoteAddress());
- }
- $this->session->set('loginMessages', [
- ['invalidpassword'], []
- ]);
- // Read current user and append if possible - we need to return the unmodified user otherwise we will leak the login name
- $args = !is_null($user) ? ['user' => $originalUser] : [];
- return new RedirectResponse($this->urlGenerator->linkToRoute('core.login.showLoginForm', $args));
- }
- // TODO: remove password checks from above and let the user session handle failures
- // requires https://github.com/owncloud/core/pull/24616
- $this->userSession->login($user, $password);
- $this->userSession->createSessionToken($this->request, $loginResult->getUID(), $user, $password, (int)$remember_login);
-
- // User has successfully logged in, now remove the password reset link, when it is available
- $this->config->deleteUserValue($loginResult->getUID(), 'core', 'lostpassword');
-
- $this->session->set('last-password-confirm', $loginResult->getLastLogin());
-
- if ($timezone_offset !== '') {
- $this->config->setUserValue($loginResult->getUID(), 'core', 'timezone', $timezone);
- $this->session->set('timezone', $timezone_offset);
- }
-
- if ($this->twoFactorManager->isTwoFactorAuthenticated($loginResult)) {
- $this->twoFactorManager->prepareTwoFactorLogin($loginResult, $remember_login);
-
- $providers = $this->twoFactorManager->getProviders($loginResult);
- if (count($providers) === 1) {
- // Single provider, hence we can redirect to that provider's challenge page directly
- /* @var $provider IProvider */
- $provider = array_pop($providers);
- $url = 'core.TwoFactorChallenge.showChallenge';
- $urlParams = [
- 'challengeProviderId' => $provider->getId(),
- ];
- } else {
- $url = 'core.TwoFactorChallenge.selectChallenge';
- $urlParams = [];
- }
-
- if (!is_null($redirect_url)) {
- $urlParams['redirect_url'] = $redirect_url;
- }
-
- return new RedirectResponse($this->urlGenerator->linkToRoute($url, $urlParams));
- }
-
- if ($remember_login) {
- $this->userSession->createRememberMeToken($loginResult);
- }
-
- return $this->generateRedirect($redirect_url);
- }
-
- /**
- * @NoAdminRequired
- * @UseSession
- *
- * @license GNU AGPL version 3 or any later version
- *
- * @param string $password
- * @return DataResponse
- */
- public function confirmPassword($password) {
- $currentDelay = $this->throttler->getDelay($this->request->getRemoteAddress());
- $this->throttler->sleepDelay($this->request->getRemoteAddress());
-
- $user = $this->userSession->getUser();
- if (!$user instanceof IUser) {
- return new DataResponse([], Http::STATUS_UNAUTHORIZED);
- }
-
- $loginResult = $this->userManager->checkPassword($user->getUID(), $password);
- if ($loginResult === false) {
- $this->throttler->registerAttempt('sudo', $this->request->getRemoteAddress(), ['user' => $user->getUID()]);
- if ($currentDelay === 0) {
- $this->throttler->sleepDelay($this->request->getRemoteAddress());
- }
-
- return new DataResponse([], Http::STATUS_FORBIDDEN);
- }
-
- $confirmTimestamp = time();
- $this->session->set('last-password-confirm', $confirmTimestamp);
- return new DataResponse(['lastLogin' => $confirmTimestamp], Http::STATUS_OK);
- }
- }
|