IkiWiki/Plugin/passwordauth.pm

   1 #!/usr/bin/perl
   2 # Ikiwiki password authentication.
   3 package IkiWiki::Plugin::passwordauth;
   4
   5 use warnings;
   6 use strict;
   7 use IkiWiki 3.00;
   8
   9 sub import {
  10         hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
  11         hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
  12         hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
  13         hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
  14         hook(type => "auth", id => "passwordauth", call => \&auth);
  15 }
  16
  17 sub getsetup () {
  18         return
  19                 plugin => {
  20                         safe => 1,
  21                         rebuild => 0,
  22                 },
  23                 account_creation_password => {
  24                         type => "string",
  25                         example => "s3cr1t",
  26                         description => "a password that must be entered when signing up for an account",
  27                         safe => 1,
  28                         rebuild => 0,
  29                 },
  30                 password_cost => {
  31                         type => "integer",
  32                         example => 8,
  33                         description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
  34                         safe => 1,
  35                         rebuild => 0,
  36                 },
  37 }
  38
  39 # Checks if a string matches a user's password, and returns true or false.
  40 sub checkpassword ($$;$) {
  41         my $user=shift;
  42         my $password=shift;
  43         my $field=shift || "password";
  44
  45         # It's very important that the user not be allowed to log in with
  46         # an empty password!
  47         if (! length $password) {
  48                 return 0;
  49         }
  50
  51         my $userinfo=IkiWiki::userinfo_retrieve();
  52         if (! length $user || ! defined $userinfo ||
  53             ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
  54                 return 0;
  55         }
  56
  57         my $ret=0;
  58         if (exists $userinfo->{$user}->{"crypt".$field}) {
  59                 eval q{use Authen::Passphrase};
  60                 error $@ if $@;
  61                 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
  62                 $ret=$p->match($password);
  63         }
  64         elsif (exists $userinfo->{$user}->{$field}) {
  65                 $ret=$password eq $userinfo->{$user}->{$field};
  66         }
  67
  68         if ($ret &&
  69             (exists $userinfo->{$user}->{resettoken} ||
  70              exists $userinfo->{$user}->{cryptresettoken})) {
  71                 # Clear reset token since the user has successfully logged in.
  72                 delete $userinfo->{$user}->{resettoken};
  73                 delete $userinfo->{$user}->{cryptresettoken};
  74                 IkiWiki::userinfo_store($userinfo);
  75         }
  76
  77         return $ret;
  78 }
  79
  80 sub setpassword ($$;$) {
  81         my $user=shift;
  82         my $password=shift;
  83         my $field=shift || "password";
  84
  85         eval q{use Authen::Passphrase::BlowfishCrypt};
  86         if (! $@) {
  87                 my $p = Authen::Passphrase::BlowfishCrypt->new(
  88                         cost => $config{password_cost} || 8,
  89                         salt_random => 1,
  90                         passphrase => $password,
  91                 );
  92                 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
  93                 IkiWiki::userinfo_set($user, $field, "");
  94         }
  95         else {
  96                 IkiWiki::userinfo_set($user, $field, $password);
  97         }
  98 }
  99
 100 sub formbuilder_setup (@) {
 101         my %params=@_;
 102
 103         my $form=$params{form};
 104         my $session=$params{session};
 105         my $cgi=$params{cgi};
 106
 107         if ($form->title eq "signin" || $form->title eq "register") {
 108                 $form->field(name => "name", required => 0);
 109                 $form->field(name => "password", type => "password", required => 0);
 110
 111                 if ($form->submitted eq "Register" || $form->submitted eq "Create Account") {
 112                         $form->field(name => "confirm_password", type => "password");
 113                         $form->field(name => "account_creation_password", type => "password")
 114                                  if (defined $config{account_creation_password} &&
 115                                      length $config{account_creation_password});
 116                         $form->field(name => "email", size => 50);
 117                         $form->title("register");
 118                         $form->text("");
 119
 120                         $form->field(name => "confirm_password",
 121                                 validate => sub {
 122                                         shift eq $form->field("password");
 123                                 },
 124                         );
 125                         $form->field(name => "password",
 126                                 validate => sub {
 127                                         shift eq $form->field("confirm_password");
 128                                 },
 129                         );
 130                 }
 131
 132                 if ($form->submitted) {
 133                         my $submittype=$form->submitted;
 134                         # Set required fields based on how form was submitted.
 135                         my %required=(
 136                                 "Login" => [qw(name password)],
 137                                 "Register" => [],
 138                                 "Create Account" => [qw(name password confirm_password email)],
 139                                 "Reset Password" => [qw(name)],
 140                         );
 141                         foreach my $opt (@{$required{$submittype}}) {
 142                                 $form->field(name => $opt, required => 1);
 143                         }
 144
 145                         if ($submittype eq "Create Account") {
 146                                 $form->field(
 147                                         name => "account_creation_password",
 148                                         validate => sub {
 149                                                 shift eq $config{account_creation_password};
 150                                         },
 151                                         required => 1,
 152                                 ) if (defined $config{account_creation_password} &&
 153                                       length $config{account_creation_password});
 154                                 $form->field(
 155                                         name => "email",
 156                                         validate => "EMAIL",
 157                                 );
 158                         }
 159
 160                         # Validate password against name for Login.
 161                         if ($submittype eq "Login") {
 162                                 $form->field(
 163                                         name => "password",
 164                                         validate => sub {
 165                                                 checkpassword($form->field("name"), shift);
 166                                         },
 167                                 );
 168                         }
 169                         elsif ($submittype eq "Register" ||
 170                                $submittype eq "Create Account" ||
 171                                $submittype eq "Reset Password") {
 172                                 $form->field(name => "password", validate => 'VALUE');
 173                         }
 174
 175                         # And make sure the entered name exists when logging
 176                         # in or sending email, and does not when registering.
 177                         if ($submittype eq 'Create Account' ||
 178                             $submittype eq 'Register') {
 179                                 $form->field(
 180                                         name => "name",
 181                                         validate => sub {
 182                                                 my $name=shift;
 183                                                 length $name &&
 184                                                 $name=~/$config{wiki_file_regexp}/ &&
 185                                                 ! IkiWiki::userinfo_get($name, "regdate");
 186                                         },
 187                                 );
 188                         }
 189                         elsif ($submittype eq "Login" ||
 190                                $submittype eq "Reset Password") {
 191                                 $form->field(
 192                                         name => "name",
 193                                         validate => sub {
 194                                                 my $name=shift;
 195                                                 length $name &&
 196                                                 IkiWiki::userinfo_get($name, "regdate");
 197                                         },
 198                                 );
 199                         }
 200                 }
 201                 else {
 202                         # First time settings.
 203                         $form->field(name => "name");
 204                         if ($session->param("name")) {
 205                                 $form->field(name => "name", value => $session->param("name"));
 206                         }
 207                 }
 208         }
 209         elsif ($form->title eq "preferences") {
 210                 $form->field(name => "name", disabled => 1,
 211                         value => $session->param("name"), force => 1,
 212                         fieldset => "login");
 213                 $form->field(name => "password", type => "password",
 214                         fieldset => "login",
 215                         validate => sub {
 216                                 shift eq $form->field("confirm_password");
 217                         }),
 218                 $form->field(name => "confirm_password", type => "password",
 219                         fieldset => "login",
 220                         validate => sub {
 221                                 shift eq $form->field("password");
 222                         }),
 223         }
 224 }
 225
 226 sub formbuilder (@) {
 227         my %params=@_;
 228
 229         my $form=$params{form};
 230         my $session=$params{session};
 231         my $cgi=$params{cgi};
 232         my $buttons=$params{buttons};
 233
 234         if ($form->title eq "signin" || $form->title eq "register") {
 235                 if ($form->submitted && $form->validate) {
 236                         if ($form->submitted eq 'Login') {
 237                                 $session->param("name", $form->field("name"));
 238                                 IkiWiki::cgi_postsignin($cgi, $session);
 239                         }
 240                         elsif ($form->submitted eq 'Create Account') {
 241                                 my $user_name=$form->field('name');
 242                                 if (IkiWiki::userinfo_setall($user_name, {
 243                                         'email' => $form->field('email'),
 244                                         'regdate' => time})) {
 245                                         setpassword($user_name, $form->field('password'));
 246                                         $form->field(name => "confirm_password", type => "hidden");
 247                                         $form->field(name => "email", type => "hidden");
 248                                         $form->text(gettext("Account creation successful. Now you can Login."));
 249                                 }
 250                                 else {
 251                                         error(gettext("Error creating account."));
 252                                 }
 253                         }
 254                         elsif ($form->submitted eq 'Reset Password') {
 255                                 my $user_name=$form->field("name");
 256                                 my $email=IkiWiki::userinfo_get($user_name, "email");
 257                                 if (! length $email) {
 258                                         error(gettext("No email address, so cannot email password reset instructions."));
 259                                 }
 260
 261                                 # Store a token that can be used once
 262                                 # to log the user in. This needs to be hard
 263                                 # to guess. Generating a cgi session id will
 264                                 # make it as hard to guess as any cgi session.
 265                                 eval q{use CGI::Session};
 266                                 error($@) if $@;
 267                                 my $token = CGI::Session->new->id;
 268                                 setpassword($user_name, $token, "resettoken");
 269
 270                                 my $template=template("passwordmail.tmpl");
 271                                 $template->param(
 272                                         user_name => $user_name,
 273                                         passwordurl => IkiWiki::cgiurl(
 274                                                 'do' => "reset",
 275                                                 'name' => $user_name,
 276                                                 'token' => $token,
 277                                         ),
 278                                         wikiurl => $config{url},
 279                                         wikiname => $config{wikiname},
 280                                         REMOTE_ADDR => $ENV{REMOTE_ADDR},
 281                                 );
 282
 283                                 eval q{use Mail::Sendmail};
 284                                 error($@) if $@;
 285                                 sendmail(
 286                                         To => IkiWiki::userinfo_get($user_name, "email"),
 287                                         From => "$config{wikiname} admin <".
 288                                                 (defined $config{adminemail} ? $config{adminemail} : "")
 289                                                 .">",
 290                                         Subject => "$config{wikiname} information",
 291                                         Message => $template->output,
 292                                 ) or error(gettext("Failed to send mail"));
 293
 294                                 $form->text(gettext("You have been mailed password reset instructions."));
 295                                 $form->field(name => "name", required => 0);
 296                                 push @$buttons, "Reset Password";
 297                         }
 298                         elsif ($form->submitted eq "Register") {
 299                                 @$buttons="Create Account";
 300                         }
 301                 }
 302                 elsif ($form->submitted eq "Create Account") {
 303                         @$buttons="Create Account";
 304                 }
 305                 else {
 306                         push @$buttons, "Register", "Reset Password";
 307                 }
 308         }
 309         elsif ($form->title eq "preferences") {
 310                 if ($form->submitted eq "Save Preferences" && $form->validate) {
 311                         my $user_name=$form->field('name');
 312                         if ($form->field("password") && length $form->field("password")) {
 313                                 setpassword($user_name, $form->field('password'));
 314                         }
 315                 }
 316         }
 317 }
 318
 319 sub sessioncgi ($$) {
 320         my $q=shift;
 321         my $session=shift;
 322
 323         if ($q->param('do') eq 'reset') {
 324                 my $name=$q->param("name");
 325                 my $token=$q->param("token");
 326
 327                 if (! defined $name || ! defined $token ||
 328                     ! length $name  || ! length $token) {
 329                         error(gettext("incorrect password reset url"));
 330                 }
 331                 if (! checkpassword($name, $token, "resettoken")) {
 332                         error(gettext("password reset denied"));
 333                 }
 334
 335                 $session->param("name", $name);
 336                 IkiWiki::cgi_prefs($q, $session);
 337                 exit;
 338         }
 339 }
 340
 341 sub auth ($$) {
 342         # While this hook is not currently used, it needs to exist
 343         # so ikiwiki knows that the wiki supports logins, and will
 344         # enable the Preferences page.
 345 }
 346
 347 1