2 # Ikiwiki password authentication.
3 package IkiWiki::Plugin::passwordauth;
10 hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
11 hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
12 hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
13 hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
14 hook(type => "auth", id => "passwordauth", call => \&auth);
24 account_creation_password => {
27 description => "a password that must be entered when signing up for an account",
34 description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
40 # Checks if a string matches a user's password, and returns true or false.
41 sub checkpassword ($$;$) {
44 my $field=shift || "password";
46 # It's very important that the user not be allowed to log in with
48 if (! length $password) {
52 my $userinfo=IkiWiki::userinfo_retrieve();
53 if (! length $user || ! defined $userinfo ||
54 ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
59 if (exists $userinfo->{$user}->{"crypt".$field}) {
60 eval q{use Authen::Passphrase};
62 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
63 $ret=$p->match($password);
65 elsif (exists $userinfo->{$user}->{$field}) {
66 $ret=$password eq $userinfo->{$user}->{$field};
70 (exists $userinfo->{$user}->{resettoken} ||
71 exists $userinfo->{$user}->{cryptresettoken})) {
72 # Clear reset token since the user has successfully logged in.
73 delete $userinfo->{$user}->{resettoken};
74 delete $userinfo->{$user}->{cryptresettoken};
75 IkiWiki::userinfo_store($userinfo);
81 sub setpassword ($$;$) {
84 my $field=shift || "password";
86 eval q{use Authen::Passphrase::BlowfishCrypt};
88 my $p = Authen::Passphrase::BlowfishCrypt->new(
89 cost => $config{password_cost} || 8,
91 passphrase => $password,
93 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
94 IkiWiki::userinfo_set($user, $field, "");
97 IkiWiki::userinfo_set($user, $field, $password);
100 # Setting the password clears any passwordless login token.
101 if ($field ne 'passwordless') {
102 IkiWiki::userinfo_set($user, "passwordless", "");
106 # Generates a token that can be used to log the user in.
107 # This needs to be hard to guess. Generating a cgi session id will
108 # make it as hard to guess as any cgi session.
109 sub gentoken ($$;$) {
111 my $tokenfield=shift;
112 my $reversable=shift;
114 eval q{use CGI::Session};
116 my $token = CGI::Session->new->id;
118 setpassword($user, $token, $tokenfield);
121 IkiWiki::userinfo_set($user, $tokenfield, $token);
126 # An anonymous user has no normal password, only a passwordless login
127 # token. Given an email address, this sets up such a user for that email,
128 # unless one already exists, and returns the username.
132 # Want a username for this email that won't overlap with any other.
136 my $userinfo=IkiWiki::userinfo_retrieve();
137 if (! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
138 if (IkiWiki::userinfo_setall($user, {
140 'regdate' => time})) {
141 gentoken($user, "passwordless", 1);
145 error(gettext("Error creating account."));
148 elsif (defined anonusertoken($userinfo->{$user})) {
156 sub anonusertoken ($) {
158 if (exists $userhash->{passwordless} &&
159 length $userhash->{passwordless}) {
160 return $userhash->{passwordless};
167 sub formbuilder_setup (@) {
170 my $form=$params{form};
171 my $session=$params{session};
172 my $cgi=$params{cgi};
174 my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
176 if ($form->title eq "signin" || $form->title eq "register" || $do_register) {
177 $form->field(name => "name", required => 0);
178 $form->field(name => "password", type => "password", required => 0);
180 if ($form->submitted eq "Register" || $form->submitted eq "Create Account" || $do_register) {
181 $form->field(name => "confirm_password", type => "password");
182 $form->field(name => "account_creation_password", type => "password")
183 if (defined $config{account_creation_password} &&
184 length $config{account_creation_password});
185 $form->field(name => "email", size => 50);
186 $form->title("register");
189 $form->field(name => "confirm_password",
191 shift eq $form->field("password");
194 $form->field(name => "password",
196 shift eq $form->field("confirm_password");
201 if ($form->submitted) {
202 my $submittype=$form->submitted;
203 # Set required fields based on how form was submitted.
205 "Login" => [qw(name password)],
207 "Create Account" => [qw(name password confirm_password email)],
208 "Reset Password" => [qw(name)],
210 foreach my $opt (@{$required{$submittype}}) {
211 $form->field(name => $opt, required => 1);
214 if ($submittype eq "Create Account") {
216 name => "account_creation_password",
218 shift eq $config{account_creation_password};
221 ) if (defined $config{account_creation_password} &&
222 length $config{account_creation_password});
229 # Validate password against name for Login.
230 if ($submittype eq "Login") {
234 checkpassword($form->field("name"), shift);
238 elsif ($submittype eq "Register" ||
239 $submittype eq "Create Account" ||
240 $submittype eq "Reset Password") {
241 $form->field(name => "password", validate => 'VALUE');
244 # And make sure the entered name exists when logging
245 # in or sending email, and does not when registering.
246 if ($submittype eq 'Create Account' ||
247 $submittype eq 'Register') {
253 $name=~/$config{wiki_file_regexp}/ &&
254 ! IkiWiki::userinfo_get($name, "regdate");
258 elsif ($submittype eq "Login" ||
259 $submittype eq "Reset Password") {
265 IkiWiki::userinfo_get($name, "regdate");
271 # First time settings.
272 $form->field(name => "name");
273 if ($session->param("name")) {
274 $form->field(name => "name", value => $session->param("name"));
278 elsif ($form->title eq "preferences") {
279 my $user=$session->param("name");
280 if (! IkiWiki::openiduser($user) && ! IkiWiki::emailuser($user)) {
281 $form->field(name => "name", disabled => 1,
282 value => $user, force => 1,
283 fieldset => "login");
284 $form->field(name => "password", type => "password",
287 shift eq $form->field("confirm_password");
289 $form->field(name => "confirm_password", type => "password",
292 shift eq $form->field("password");
295 my $userpage=IkiWiki::userpage($user);
296 if (exists $pagesources{$userpage}) {
297 $form->text(gettext("Your user page: ").
298 htmllink("", "", $userpage,
299 noimageinline => 1));
302 $form->text("<a href=\"".
303 IkiWiki::cgiurl(do => "edit", page => $userpage).
304 "\">".gettext("Create your user page")."</a>");
310 sub formbuilder (@) {
313 my $form=$params{form};
314 my $session=$params{session};
315 my $cgi=$params{cgi};
316 my $buttons=$params{buttons};
318 my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
320 if ($form->title eq "signin" || $form->title eq "register") {
321 if (($form->submitted && $form->validate) || $do_register) {
322 if ($form->submitted eq 'Login') {
323 $session->param("name", $form->field("name"));
324 IkiWiki::cgi_postsignin($cgi, $session);
326 elsif ($form->submitted eq 'Create Account') {
327 my $user_name=$form->field('name');
328 if (IkiWiki::userinfo_setall($user_name, {
329 'email' => $form->field('email'),
330 'regdate' => time})) {
331 setpassword($user_name, $form->field('password'));
332 $form->field(name => "confirm_password", type => "hidden");
333 $form->field(name => "email", type => "hidden");
334 $form->text(gettext("Account creation successful. Now you can Login."));
337 error(gettext("Error creating account."));
340 elsif ($form->submitted eq 'Reset Password') {
341 my $user_name=$form->field("name");
342 my $email=IkiWiki::userinfo_get($user_name, "email");
343 if (! length $email) {
344 error(gettext("No email address, so cannot email password reset instructions."));
347 my $token=gentoken($user_name, "resettoken");
349 my $template=template("passwordmail.tmpl");
351 user_name => $user_name,
352 passwordurl => IkiWiki::cgiurl_abs(
354 'name' => $user_name,
357 wikiurl => $config{url},
358 wikiname => $config{wikiname},
359 remote_addr => $session->remote_addr(),
362 eval q{use Mail::Sendmail};
365 To => IkiWiki::userinfo_get($user_name, "email"),
366 From => "$config{wikiname} admin <".
367 (defined $config{adminemail} ? $config{adminemail} : "")
369 Subject => "$config{wikiname} information",
370 Message => $template->output,
371 ) or error(gettext("Failed to send mail"));
373 $form->text(gettext("You have been mailed password reset instructions."));
374 $form->field(name => "name", required => 0);
375 push @$buttons, "Reset Password";
377 elsif ($form->submitted eq "Register" || $do_register) {
378 @$buttons="Create Account";
381 elsif ($form->submitted eq "Create Account") {
382 @$buttons="Create Account";
385 push @$buttons, "Register", "Reset Password";
388 elsif ($form->title eq "preferences") {
389 if ($form->submitted eq "Save Preferences" && $form->validate) {
390 my $user_name=$form->field('name');
391 if (defined $form->field("password") && length $form->field("password")) {
392 setpassword($user_name, $form->field('password'));
398 sub sessioncgi ($$) {
402 if ($q->param('do') eq 'reset') {
403 my $name=$q->param("name");
404 my $token=$q->param("token");
406 if (! defined $name || ! defined $token ||
407 ! length $name || ! length $token) {
408 error(gettext("incorrect password reset url"));
410 if (! checkpassword($name, $token, "resettoken")) {
411 error(gettext("password reset denied"));
414 $session->param("name", $name);
415 IkiWiki::cgi_prefs($q, $session);
418 elsif ($q->param('do') eq 'tokenauth') {
419 my $name=$q->param("name");
420 my $token=$q->param("token");
422 if (! defined $name || ! defined $token ||
423 ! length $name || ! length $token) {
424 error(gettext("incorrect url"));
426 if (! checkpassword($name, $token, "passwordless")) {
427 error(gettext("access denied"));
430 $session->param("name", $name);
431 IkiWiki::cgi_prefs($q, $session);
434 elsif ($q->param("do") eq "register") {
435 # After registration, need to go somewhere, so show prefs page.
436 $session->param(postsignin => "do=prefs");
437 # Due to do=register, this will run in registration-only
439 IkiWiki::cgi_signin($q, $session);
445 # While this hook is not currently used, it needs to exist
446 # so ikiwiki knows that the wiki supports logins, and will
447 # enable the Preferences page.