IkiWiki/Plugin/emailauth.pm

   1 #!/usr/bin/perl
   2 # Ikiwiki email address as login
   3 package IkiWiki::Plugin::emailauth;
   4
   5 use warnings;
   6 use strict;
   7 use IkiWiki 3.00;
   8
   9 sub import {
  10         hook(type => "getsetup", id => "emailauth", "call" => \&getsetup);
  11         hook(type => "cgi", id => "emailauth", "call" => \&cgi);
  12         hook(type => "formbuilder_setup", id => "emailauth", "call" => \&formbuilder_setup);
  13         IkiWiki::loadplugin("loginselector");
  14         IkiWiki::Plugin::loginselector::register_login_plugin(
  15                 "emailauth",
  16                 \&email_setup,
  17                 \&email_check_input,
  18                 \&email_auth,
  19         );
  20 }
  21
  22 sub getsetup () {
  23         return
  24                 plugin => {
  25                         safe => 1,
  26                         rebuild => 0,
  27                         section => "auth",
  28                 },
  29 }
  30
  31 sub email_setup ($$) {
  32         my $q=shift;
  33         my $template=shift;
  34
  35         return 1;
  36 }
  37
  38 sub email_check_input ($) {
  39         my $cgi=shift;
  40         defined $cgi->param('do')
  41                 && $cgi->param("do") eq "signin"
  42                 && defined $cgi->param('Email_entry')
  43                 && length $cgi->param('Email_entry');
  44 }
  45
  46 # Send login link to email.
  47 sub email_auth ($$$$) {
  48         my $cgi=shift;
  49         my $session=shift;
  50         my $errordisplayer=shift;
  51         my $infodisplayer=shift;
  52
  53         my $email=$cgi->param('Email_entry');
  54         unless ($email =~ /.\@./) {
  55                 $errordisplayer->(gettext("Invalid email address."));
  56                 return;
  57         }
  58
  59         # Implicit account creation.
  60         my $userinfo=IkiWiki::userinfo_retrieve();
  61         if (! exists $userinfo->{$email} || ! ref $userinfo->{$email}) {
  62                 IkiWiki::userinfo_setall($email, {
  63                         'email' => $email,
  64                         'regdate' => time,
  65                 });
  66         }
  67
  68         my $token=gentoken($email, $session);
  69         my $template=template("emailauth.tmpl");
  70         $template->param(
  71                 wikiname => $config{wikiname},
  72                 # Intentionally using short field names to keep link short.
  73                 authurl => IkiWiki::cgiurl_abs(
  74                         'e' => $email,
  75                         'v' => $token,
  76                 ),
  77         );
  78
  79         eval q{use Mail::Sendmail};
  80         error($@) if $@;
  81         my $shorturl=$config{url};
  82         $shorturl=~s/^https?:\/\///i;
  83         sendmail(
  84                 To => $email,
  85                 From => "$config{wikiname} admin <".
  86                         (defined $config{adminemail} ? $config{adminemail} : "")
  87                         .">",
  88                 Subject => "$config{wikiname} login | $shorturl",
  89                 Message => $template->output,
  90         ) or error(gettext("Failed to send mail"));
  91
  92         $infodisplayer->(gettext("You have been sent an email, with a link you can open to complete the login process."));
  93 }
  94
  95 # Finish login process.
  96 sub cgi ($$) {
  97         my $cgi=shift;
  98
  99         my $email=$cgi->param('e');
 100         my $v=$cgi->param('v');
 101         if (defined $email && defined $v && length $email && length $v) {
 102                 my $token=gettoken($email);
 103                 if ($token eq $v) {
 104                         cleartoken($email);
 105                         my $session=getsession($email);
 106                         IkiWiki::cgi_postsignin($cgi, $session);
 107                 }
 108                 elsif (length $token ne length $cgi->param('v')) {
 109                         error(gettext("Wrong login token length. Please check that you pasted in the complete login link from the email!"));
 110                 }
 111                 else {
 112                         loginfailure();
 113                 }
 114         }
 115 }
 116
 117 sub formbuilder_setup (@) {
 118         my %params=@_;
 119         my $form=$params{form};
 120         my $session=$params{session};
 121
 122         if ($form->title eq "preferences" &&
 123             IkiWiki::emailuser($session->param("name"))) {
 124                 $form->field(name => "email", disabled => 1);
 125         }
 126 }
 127
 128 # Generates the token that will be used in the authurl to log the user in.
 129 # This needs to be hard to guess, and relatively short. Generating a cgi
 130 # session id will make it as hard to guess as any cgi session.
 131 #
 132 # Store token in userinfo; this allows the user to log in
 133 # using a different browser session, if it takes a while for the
 134 # email to get to them.
 135 #
 136 # The postsignin value from the session is also stored in the userinfo
 137 # to allow resuming in a different browser session.
 138 sub gentoken ($$) {
 139         my $email=shift;
 140         my $session=shift;
 141         eval q{use CGI::Session};
 142         error($@) if $@;
 143         my $token = CGI::Session->new->id;
 144         IkiWiki::userinfo_set($email, "emailauthexpire", time+(60*60*24));
 145         IkiWiki::userinfo_set($email, "emailauth", $token);
 146         IkiWiki::userinfo_set($email, "emailauthpostsignin", defined $session->param("postsignin") ? $session->param("postsignin") : "");
 147         return $token;
 148 }
 149
 150 # Gets the token, checking for expiry.
 151 sub gettoken ($) {
 152         my $email=shift;
 153         my $val=IkiWiki::userinfo_get($email, "emailauth");
 154         my $expire=IkiWiki::userinfo_get($email, "emailauthexpire");
 155         if (! length $val || time > $expire) {
 156                 loginfailure();
 157         }
 158         return $val;
 159 }
 160
 161 # Generate a session to use after successful login.
 162 sub getsession ($) {
 163         my $email=shift;
 164
 165         IkiWiki::lockwiki();
 166         IkiWiki::loadindex();
 167         my $session=IkiWiki::cgi_getsession();
 168
 169         my $postsignin=IkiWiki::userinfo_get($email, "emailauthpostsignin");
 170         IkiWiki::userinfo_set($email, "emailauthpostsignin", "");
 171         if (defined $postsignin && length $postsignin) {
 172                 $session->param(postsignin => $postsignin);
 173         }
 174
 175         $session->param(name => $email);
 176         my $nickname=$email;
 177         $nickname=~s/@.*//;
 178         $session->param(nickname => Encode::decode_utf8($nickname));
 179
 180         IkiWiki::cgi_savesession($session);
 181
 182         return $session;
 183 }
 184
 185 sub cleartoken ($) {
 186         my $email=shift;
 187         IkiWiki::userinfo_set($email, "emailauthexpire", 0);
 188         IkiWiki::userinfo_set($email, "emailauth", "");
 189 }
 190
 191 sub loginfailure () {
 192         error "Bad email authentication token. Please retry login.";
 193 }
 194
 195 1