2 # Ikiwiki password authentication.
3 package IkiWiki::Plugin::passwordauth;
10 hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
11 hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
12 hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
13 hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
14 hook(type => "auth", id => "passwordauth", call => \&auth);
24 account_creation_password => {
27 description => "a password that must be entered when signing up for an account",
34 description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
40 # Checks if a string matches a user's password, and returns true or false.
41 sub checkpassword ($$;$) {
44 my $field=shift || "password";
46 # It's very important that the user not be allowed to log in with
48 if (! length $password) {
52 my $userinfo=IkiWiki::userinfo_retrieve();
53 if (! length $user || ! defined $userinfo ||
54 ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
59 if (exists $userinfo->{$user}->{"crypt".$field}) {
60 eval q{use Authen::Passphrase};
62 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
63 $ret=$p->match($password);
65 elsif (exists $userinfo->{$user}->{$field}) {
66 $ret=$password eq $userinfo->{$user}->{$field};
70 (exists $userinfo->{$user}->{resettoken} ||
71 exists $userinfo->{$user}->{cryptresettoken})) {
72 # Clear reset token since the user has successfully logged in.
73 delete $userinfo->{$user}->{resettoken};
74 delete $userinfo->{$user}->{cryptresettoken};
75 IkiWiki::userinfo_store($userinfo);
81 sub setpassword ($$;$) {
84 my $field=shift || "password";
86 eval q{use Authen::Passphrase::BlowfishCrypt};
88 my $p = Authen::Passphrase::BlowfishCrypt->new(
89 cost => $config{password_cost} || 8,
91 passphrase => $password,
93 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
94 IkiWiki::userinfo_set($user, $field, "");
97 IkiWiki::userinfo_set($user, $field, $password);
100 # Setting the password clears any passwordless login token.
101 if ($field ne 'passwordless') {
102 IkiWiki::userinfo_set($user, "passwordless", "");
106 # Generates a token that can be used to log the user in.
107 # This needs to be hard to guess. Generating a cgi session id will
108 # make it as hard to guess as any cgi session.
109 sub gentoken ($$;$) {
111 my $tokenfield=shift;
112 my $reversable=shift;
114 eval q{use CGI::Session};
116 my $token = CGI::Session->new("driver:DB_File", undef, {FileName => "/dev/null"})->id;
118 setpassword($user, $token, $tokenfield);
121 IkiWiki::userinfo_set($user, $tokenfield, $token);
126 # An anonymous user has no normal password, only a passwordless login
127 # token. Given an email address, this sets up such a user for that email,
128 # unless one already exists, and returns the username.
132 # Want a username for this email that won't overlap with any other.
136 my $userinfo=IkiWiki::userinfo_retrieve();
137 if (! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
138 if (IkiWiki::userinfo_setall($user, {
140 'regdate' => time})) {
141 gentoken($user, "passwordless", 1);
145 error(gettext("Error creating account."));
148 elsif (defined anonusertoken($userinfo->{$user})) {
156 sub anonusertoken ($) {
158 if (exists $userhash->{passwordless} &&
159 length $userhash->{passwordless}) {
160 return $userhash->{passwordless};
167 sub formbuilder_setup (@) {
170 my $form=$params{form};
171 my $session=$params{session};
172 my $cgi=$params{cgi};
174 my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
176 if ($form->title eq "signin" || $form->title eq "register" || $do_register) {
177 $form->field(name => "name", required => 0);
178 $form->field(name => "password", type => "password", required => 0);
180 if ($form->submitted eq "Register" || $form->submitted eq "Create Account" || $do_register) {
181 $form->field(name => "confirm_password", type => "password");
182 $form->field(name => "account_creation_password", type => "password")
183 if (defined $config{account_creation_password} &&
184 length $config{account_creation_password});
185 $form->field(name => "email", size => 50);
186 $form->title("register");
189 $form->field(name => "confirm_password",
191 shift eq $form->field("password");
194 $form->field(name => "password",
196 shift eq $form->field("confirm_password");
201 if ($form->submitted) {
202 my $submittype=$form->submitted;
203 # Set required fields based on how form was submitted.
205 "Login" => [qw(name password)],
207 "Create Account" => [qw(name password confirm_password email)],
208 "Reset Password" => [qw(name)],
210 foreach my $opt (@{$required{$submittype}}) {
211 $form->field(name => $opt, required => 1);
214 if ($submittype eq "Create Account") {
216 name => "account_creation_password",
218 shift eq $config{account_creation_password};
221 ) if (defined $config{account_creation_password} &&
222 length $config{account_creation_password});
229 # Validate password against name for Login.
230 if ($submittype eq "Login") {
234 checkpassword(scalar $form->field("name"), shift);
238 elsif ($submittype eq "Register" ||
239 $submittype eq "Create Account" ||
240 $submittype eq "Reset Password") {
241 $form->field(name => "password", validate => 'VALUE');
244 # And make sure the entered name exists when logging
245 # in or sending email, and does not when registering.
246 if ($submittype eq 'Create Account' ||
247 $submittype eq 'Register') {
253 $name=~/$config{wiki_file_regexp}/ &&
254 # don't allow registering
255 # accounts that look like
257 # addresses, even if the
258 # file regexp allows it
260 ! IkiWiki::userinfo_get($name, "regdate");
264 elsif ($submittype eq "Login" ||
265 $submittype eq "Reset Password") {
271 IkiWiki::userinfo_get($name, "regdate");
277 # First time settings.
278 $form->field(name => "name");
279 if ($session->param("name")) {
280 $form->field(name => "name", value => $session->param("name"));
284 elsif ($form->title eq "preferences") {
285 my $user=$session->param("name");
286 if (! IkiWiki::openiduser($user) && ! IkiWiki::emailuser($user)) {
287 $form->field(name => "name", disabled => 1,
288 value => $user, force => 1,
289 fieldset => "login");
290 $form->field(name => "password", type => "password",
293 shift eq $form->field("confirm_password");
295 $form->field(name => "confirm_password", type => "password",
298 shift eq $form->field("password");
301 my $userpage=IkiWiki::userpage($user);
302 if (exists $pagesources{$userpage}) {
303 $form->text(gettext("Your user page: ").
304 htmllink("", "", $userpage,
305 noimageinline => 1));
308 $form->text("<a rel=\"nofollow\" href=\"".
309 IkiWiki::cgiurl(do => "edit", page => $userpage).
310 "\">".gettext("Create your user page")."</a>");
316 sub formbuilder (@) {
319 my $form=$params{form};
320 my $session=$params{session};
321 my $cgi=$params{cgi};
322 my $buttons=$params{buttons};
324 my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
326 if ($form->title eq "signin" || $form->title eq "register") {
327 if (($form->submitted && $form->validate) || $do_register) {
328 my $user_name = $form->field('name');
330 if ($form->submitted eq 'Login') {
331 $session->param("name", $user_name);
332 IkiWiki::cgi_postsignin($cgi, $session);
334 elsif ($form->submitted eq 'Create Account') {
335 my $email = $form->field('email');
336 my $password = $form->field('password');
338 if (IkiWiki::userinfo_setall($user_name, {
340 'regdate' => time})) {
341 setpassword($user_name, $password);
342 $form->field(name => "confirm_password", type => "hidden");
343 $form->field(name => "email", type => "hidden");
344 $form->text(gettext("Account creation successful. Now you can Login."));
347 error(gettext("Error creating account."));
350 elsif ($form->submitted eq 'Reset Password') {
351 my $email=IkiWiki::userinfo_get($user_name, "email");
352 if (! length $email) {
353 error(gettext("No email address, so cannot email password reset instructions."));
356 my $token=gentoken($user_name, "resettoken");
358 my $template=template("passwordmail.tmpl");
360 user_name => $user_name,
361 passwordurl => IkiWiki::cgiurl_abs_samescheme(
363 'name' => $user_name,
366 wikiurl => $config{url},
367 wikiname => $config{wikiname},
368 remote_addr => $session->remote_addr(),
371 eval q{use Mail::Sendmail};
374 To => IkiWiki::userinfo_get($user_name, "email"),
375 From => "$config{wikiname} admin <".
376 (defined $config{adminemail} ? $config{adminemail} : "")
378 Subject => "$config{wikiname} information",
379 Message => $template->output,
380 ) or error(gettext("Failed to send mail"));
382 $form->text(gettext("You have been mailed password reset instructions."));
383 $form->field(name => "name", required => 0);
384 push @$buttons, "Reset Password";
386 elsif ($form->submitted eq "Register" || $do_register) {
387 @$buttons="Create Account";
390 elsif ($form->submitted eq "Create Account") {
391 @$buttons="Create Account";
394 push @$buttons, "Register", "Reset Password";
397 elsif ($form->title eq "preferences") {
398 if ($form->submitted eq "Save Preferences" && $form->validate) {
399 my $user_name=$form->field('name');
400 my $password=$form->field('password');
401 if (defined $password && length $password) {
402 setpassword($user_name, $password);
408 sub sessioncgi ($$) {
412 if ($q->param('do') eq 'reset') {
413 my $name=$q->param("name");
414 my $token=$q->param("token");
416 if (! defined $name || ! defined $token ||
417 ! length $name || ! length $token) {
418 error(gettext("incorrect password reset url"));
420 if (! checkpassword($name, $token, "resettoken")) {
421 error(gettext("password reset denied"));
424 $session->param("name", $name);
425 IkiWiki::cgi_prefs($q, $session);
428 elsif ($q->param('do') eq 'tokenauth') {
429 my $name=$q->param("name");
430 my $token=$q->param("token");
432 if (! defined $name || ! defined $token ||
433 ! length $name || ! length $token) {
434 error(gettext("incorrect url"));
436 if (! checkpassword($name, $token, "passwordless")) {
437 error(gettext("access denied"));
440 $session->param("name", $name);
441 IkiWiki::cgi_prefs($q, $session);
444 elsif ($q->param("do") eq "register") {
445 # After registration, need to go somewhere, so show prefs page.
446 $session->param(postsignin => "do=prefs");
447 # Due to do=register, this will run in registration-only
449 IkiWiki::cgi_signin($q, $session);
455 # While this hook is not currently used, it needs to exist
456 # so ikiwiki knows that the wiki supports logins, and will
457 # enable the Preferences page.