IkiWiki/Plugin/emailauth.pm

   1 #!/usr/bin/perl
   2 # Ikiwiki email address as login
   3 package IkiWiki::Plugin::emailauth;
   4
   5 use warnings;
   6 use strict;
   7 use IkiWiki 3.00;
   8
   9 sub import {
  10         hook(type => "getsetup", id => "emailauth", "call" => \&getsetup);
  11         hook(type => "cgi", id => "emailauth", "call" => \&cgi);
  12         hook(type => "formbuilder_setup", id => "emailauth", "call" => \&formbuilder_setup);
  13         IkiWiki::loadplugin("loginselector");
  14         IkiWiki::Plugin::loginselector::register_login_plugin(
  15                 "emailauth",
  16                 \&email_setup,
  17                 \&email_check_input,
  18                 \&email_auth,
  19         );
  20 }
  21
  22 sub getsetup () {
  23         return
  24                 plugin => {
  25                         safe => 1,
  26                         rebuild => 0,
  27                         section => "auth",
  28                 },
  29 }
  30
  31 sub email_setup ($$) {
  32         my $q=shift;
  33         my $template=shift;
  34
  35         return 1;
  36 }
  37
  38 sub email_check_input ($) {
  39         my $cgi=shift;
  40         defined $cgi->param('do')
  41                 && $cgi->param("do") eq "signin"
  42                 && defined $cgi->param('Email_entry')
  43                 && length $cgi->param('Email_entry');
  44 }
  45
  46 # Send login link to email.
  47 sub email_auth ($$$$) {
  48         my $cgi=shift;
  49         my $session=shift;
  50         my $errordisplayer=shift;
  51         my $infodisplayer=shift;
  52
  53         my $email=$cgi->param('Email_entry');
  54         unless ($email =~ /.\@./) {
  55                 $errordisplayer->(gettext("Invalid email address."));
  56                 return;
  57         }
  58
  59         # Implicit account creation.
  60         my $userinfo=IkiWiki::userinfo_retrieve();
  61         if (! exists $userinfo->{$email} || ! ref $userinfo->{$email}) {
  62                 IkiWiki::userinfo_setall($email, {
  63                         'email' => $email,
  64                         'regdate' => time,
  65                 });
  66         }
  67
  68         my $token=gentoken($email, $session);
  69         my $template=template("emailauth.tmpl");
  70         $template->param(
  71                 wikiname => $config{wikiname},
  72                 # Intentionally using short field names to keep link short.
  73                 authurl => IkiWiki::cgiurl_abs(
  74                         'e' => $email,
  75                         'v' => $token,
  76                 ),
  77         );
  78
  79         eval q{use Mail::Sendmail};
  80         error($@) if $@;
  81         sendmail(
  82                 To => $email,
  83                 From => "$config{wikiname} admin <".
  84                         (defined $config{adminemail} ? $config{adminemail} : "")
  85                         .">",
  86                 Subject => "$config{wikiname} login",
  87                 Message => $template->output,
  88         ) or error(gettext("Failed to send mail"));
  89
  90         $infodisplayer->(gettext("You have been sent an email, with a link you can open to complete the login process."));
  91 }
  92
  93 # Finish login process.
  94 sub cgi ($$) {
  95         my $cgi=shift;
  96
  97         my $email=$cgi->param('e');
  98         my $v=$cgi->param('v');
  99         if (defined $email && defined $v && length $email && length $v) {
 100                 my $token=gettoken($email);
 101                 if ($token eq $v) {
 102                         cleartoken($email);
 103                         my $session=getsession($email);
 104                         IkiWiki::cgi_postsignin($cgi, $session);
 105                 }
 106                 elsif (length $token ne length $cgi->param('v')) {
 107                         error(gettext("Wrong login token length. Please check that you pasted in the complete login link from the email!"));
 108                 }
 109                 else {
 110                         loginfailure();
 111                 }
 112         }
 113 }
 114
 115 sub formbuilder_setup (@) {
 116         my %params=@_;
 117         my $form=$params{form};
 118         my $session=$params{session};
 119
 120         if ($form->title eq "preferences" &&
 121             IkiWiki::emailuser($session->param("name"))) {
 122                 $form->field(name => "email", disabled => 1);
 123         }
 124 }
 125
 126 # Generates the token that will be used in the authurl to log the user in.
 127 # This needs to be hard to guess, and relatively short. Generating a cgi
 128 # session id will make it as hard to guess as any cgi session.
 129 #
 130 # Store token in userinfo; this allows the user to log in
 131 # using a different browser session, if it takes a while for the
 132 # email to get to them.
 133 #
 134 # The postsignin value from the session is also stored in the userinfo
 135 # to allow resuming in a different browser session.
 136 sub gentoken ($$) {
 137         my $email=shift;
 138         my $session=shift;
 139         eval q{use CGI::Session};
 140         error($@) if $@;
 141         my $token = CGI::Session->new->id;
 142         IkiWiki::userinfo_set($email, "emailauthexpire", time+(60*60*24));
 143         IkiWiki::userinfo_set($email, "emailauth", $token);
 144         IkiWiki::userinfo_set($email, "emailauthpostsignin", defined $session->param("postsignin") ? $session->param("postsignin") : "");
 145         return $token;
 146 }
 147
 148 # Gets the token, checking for expiry.
 149 sub gettoken ($) {
 150         my $email=shift;
 151         my $val=IkiWiki::userinfo_get($email, "emailauth");
 152         my $expire=IkiWiki::userinfo_get($email, "emailauthexpire");
 153         if (! length $val || time > $expire) {
 154                 loginfailure();
 155         }
 156         return $val;
 157 }
 158
 159 # Generate a session to use after successful login.
 160 sub getsession ($) {
 161         my $email=shift;
 162
 163         IkiWiki::lockwiki();
 164         IkiWiki::loadindex();
 165         my $session=IkiWiki::cgi_getsession();
 166
 167         my $postsignin=IkiWiki::userinfo_get($email, "emailauthpostsignin");
 168         IkiWiki::userinfo_set($email, "emailauthpostsignin", "");
 169         if (defined $postsignin && length $postsignin) {
 170                 $session->param(postsignin => $postsignin);
 171         }
 172
 173         $session->param(name => $email);
 174         my $nickname=$email;
 175         $nickname=~s/@.*//;
 176         $session->param(nickname => Encode::decode_utf8($nickname));
 177
 178         IkiWiki::cgi_savesession($session);
 179
 180         return $session;
 181 }
 182
 183 sub cleartoken ($) {
 184         my $email=shift;
 185         IkiWiki::userinfo_set($email, "emailauthexpire", 0);
 186         IkiWiki::userinfo_set($email, "emailauth", "");
 187 }
 188
 189 sub loginfailure () {
 190         error "Bad email authentication token. Please retry login.";
 191 }
 192
 193 1