]> git.vanrenterghem.biz Git - git.ikiwiki.info.git/blob - IkiWiki/Plugin/passwordauth.pm
reorg
[git.ikiwiki.info.git] / IkiWiki / Plugin / passwordauth.pm
1 #!/usr/bin/perl
2 # Ikiwiki password authentication.
3 package IkiWiki::Plugin::passwordauth;
5 use warnings;
6 use strict;
7 use IkiWiki 3.00;
9 sub import {
10         hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
11         hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
12         hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
13         hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
14 }
16 sub getsetup () {
17         return
18                 plugin => {
19                         safe => 1,
20                         rebuild => 0,
21                 },
22                 account_creation_password => {
23                         type => "string",
24                         example => "s3cr1t",
25                         description => "a password that must be entered when signing up for an account",
26                         safe => 1,
27                         rebuild => 0,
28                 },
29                 password_cost => {
30                         type => "integer",
31                         example => 8,
32                         description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
33                         safe => 1,
34                         rebuild => 0,
35                 },
36 }
38 # Checks if a string matches a user's password, and returns true or false.
39 sub checkpassword ($$;$) {
40         my $user=shift;
41         my $password=shift;
42         my $field=shift || "password";
44         # It's very important that the user not be allowed to log in with
45         # an empty password!
46         if (! length $password) {
47                 return 0;
48         }
50         my $userinfo=IkiWiki::userinfo_retrieve();
51         if (! length $user || ! defined $userinfo ||
52             ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
53                 return 0;
54         }
56         my $ret=0;
57         if (exists $userinfo->{$user}->{"crypt".$field}) {
58                 eval q{use Authen::Passphrase};
59                 error $@ if $@;
60                 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
61                 $ret=$p->match($password);
62         }
63         elsif (exists $userinfo->{$user}->{$field}) {
64                 $ret=$password eq $userinfo->{$user}->{$field};
65         }
67         if ($ret &&
68             (exists $userinfo->{$user}->{resettoken} ||
69              exists $userinfo->{$user}->{cryptresettoken})) {
70                 # Clear reset token since the user has successfully logged in.
71                 delete $userinfo->{$user}->{resettoken};
72                 delete $userinfo->{$user}->{cryptresettoken};
73                 IkiWiki::userinfo_store($userinfo);
74         }
76         return $ret;
77 }
79 sub setpassword ($$;$) {
80         my $user=shift;
81         my $password=shift;
82         my $field=shift || "password";
84         eval q{use Authen::Passphrase::BlowfishCrypt};
85         if (! $@) {
86                 my $p = Authen::Passphrase::BlowfishCrypt->new(
87                         cost => $config{password_cost} || 8,
88                         salt_random => 1,
89                         passphrase => $password,
90                 );
91                 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
92                 IkiWiki::userinfo_set($user, $field, "");
93         }
94         else {
95                 IkiWiki::userinfo_set($user, $field, $password);
96         }
97 }
99 sub formbuilder_setup (@) {
100         my %params=@_;
102         my $form=$params{form};
103         my $session=$params{session};
104         my $cgi=$params{cgi};
106         if ($form->title eq "signin" || $form->title eq "register") {
107                 $form->field(name => "name", required => 0);
108                 $form->field(name => "password", type => "password", required => 0);
109                 
110                 if ($form->submitted eq "Register" || $form->submitted eq "Create Account") {
111                         $form->field(name => "confirm_password", type => "password");
112                         $form->field(name => "account_creation_password", type => "password")
113                                  if (defined $config{account_creation_password} &&
114                                      length $config{account_creation_password});
115                         $form->field(name => "email", size => 50);
116                         $form->title("register");
117                         $form->text("");
118                 
119                         $form->field(name => "confirm_password",
120                                 validate => sub {
121                                         shift eq $form->field("password");
122                                 },
123                         );
124                         $form->field(name => "password",
125                                 validate => sub {
126                                         shift eq $form->field("confirm_password");
127                                 },
128                         );
129                 }
131                 if ($form->submitted) {
132                         my $submittype=$form->submitted;
133                         # Set required fields based on how form was submitted.
134                         my %required=(
135                                 "Login" => [qw(name password)],
136                                 "Register" => [],
137                                 "Create Account" => [qw(name password confirm_password email)],
138                                 "Reset Password" => [qw(name)],
139                         );
140                         foreach my $opt (@{$required{$submittype}}) {
141                                 $form->field(name => $opt, required => 1);
142                         }
143         
144                         if ($submittype eq "Create Account") {
145                                 $form->field(
146                                         name => "account_creation_password",
147                                         validate => sub {
148                                                 shift eq $config{account_creation_password};
149                                         },
150                                         required => 1,
151                                 ) if (defined $config{account_creation_password} &&
152                                       length $config{account_creation_password});
153                                 $form->field(
154                                         name => "email",
155                                         validate => "EMAIL",
156                                 );
157                         }
159                         # Validate password against name for Login.
160                         if ($submittype eq "Login") {
161                                 $form->field(
162                                         name => "password",
163                                         validate => sub {
164                                                 checkpassword($form->field("name"), shift);
165                                         },
166                                 );
167                         }
168                         elsif ($submittype eq "Register" ||
169                                $submittype eq "Create Account" ||
170                                $submittype eq "Reset Password") {
171                                 $form->field(name => "password", validate => 'VALUE');
172                         }
173                         
174                         # And make sure the entered name exists when logging
175                         # in or sending email, and does not when registering.
176                         if ($submittype eq 'Create Account' ||
177                             $submittype eq 'Register') {
178                                 $form->field(
179                                         name => "name",
180                                         validate => sub {
181                                                 my $name=shift;
182                                                 length $name &&
183                                                 $name=~/$config{wiki_file_regexp}/ &&
184                                                 ! IkiWiki::userinfo_get($name, "regdate");
185                                         },
186                                 );
187                         }
188                         elsif ($submittype eq "Login" ||
189                                $submittype eq "Reset Password") {
190                                 $form->field( 
191                                         name => "name",
192                                         validate => sub {
193                                                 my $name=shift;
194                                                 length $name &&
195                                                 IkiWiki::userinfo_get($name, "regdate");
196                                         },
197                                 );
198                         }
199                 }
200                 else {
201                         # First time settings.
202                         $form->field(name => "name");
203                         if ($session->param("name")) {
204                                 $form->field(name => "name", value => $session->param("name"));
205                         }
206                 }
207         }
208         elsif ($form->title eq "preferences") {
209                 $form->field(name => "name", disabled => 1, 
210                         value => $session->param("name"), force => 1,
211                         fieldset => "login");
212                 $form->field(name => "password", type => "password",
213                         fieldset => "login",
214                         validate => sub {
215                                 shift eq $form->field("confirm_password");
216                         }),
217                 $form->field(name => "confirm_password", type => "password",
218                         fieldset => "login",
219                         validate => sub {
220                                 shift eq $form->field("password");
221                         }),
222         }
225 sub formbuilder (@) {
226         my %params=@_;
228         my $form=$params{form};
229         my $session=$params{session};
230         my $cgi=$params{cgi};
231         my $buttons=$params{buttons};
233         if ($form->title eq "signin" || $form->title eq "register") {
234                 if ($form->submitted && $form->validate) {
235                         if ($form->submitted eq 'Login') {
236                                 $session->param("name", $form->field("name"));
237                                 IkiWiki::cgi_postsignin($cgi, $session);
238                         }
239                         elsif ($form->submitted eq 'Create Account') {
240                                 my $user_name=$form->field('name');
241                                 if (IkiWiki::userinfo_setall($user_name, {
242                                         'email' => $form->field('email'),
243                                         'regdate' => time})) {
244                                         setpassword($user_name, $form->field('password'));
245                                         $form->field(name => "confirm_password", type => "hidden");
246                                         $form->field(name => "email", type => "hidden");
247                                         $form->text(gettext("Account creation successful. Now you can Login."));
248                                 }
249                                 else {
250                                         error(gettext("Error creating account."));
251                                 }
252                         }
253                         elsif ($form->submitted eq 'Reset Password') {
254                                 my $user_name=$form->field("name");
255                                 my $email=IkiWiki::userinfo_get($user_name, "email");
256                                 if (! length $email) {
257                                         error(gettext("No email address, so cannot email password reset instructions."));
258                                 }
259                                 
260                                 # Store a token that can be used once
261                                 # to log the user in. This needs to be hard
262                                 # to guess. Generating a cgi session id will
263                                 # make it as hard to guess as any cgi session.
264                                 eval q{use CGI::Session};
265                                 error($@) if $@;
266                                 my $token = CGI::Session->new->id;
267                                 setpassword($user_name, $token, "resettoken");
268                                 
269                                 my $template=template("passwordmail.tmpl");
270                                 $template->param(
271                                         user_name => $user_name,
272                                         passwordurl => IkiWiki::cgiurl(
273                                                 'do' => "reset",
274                                                 'name' => $user_name,
275                                                 'token' => $token,
276                                         ),
277                                         wikiurl => $config{url},
278                                         wikiname => $config{wikiname},
279                                         REMOTE_ADDR => $ENV{REMOTE_ADDR},
280                                 );
281                                 
282                                 eval q{use Mail::Sendmail};
283                                 error($@) if $@;
284                                 sendmail(
285                                         To => IkiWiki::userinfo_get($user_name, "email"),
286                                         From => "$config{wikiname} admin <".
287                                                 (defined $config{adminemail} ? $config{adminemail} : "")
288                                                 .">",
289                                         Subject => "$config{wikiname} information",
290                                         Message => $template->output,
291                                 ) or error(gettext("Failed to send mail"));
292                                 
293                                 $form->text(gettext("You have been mailed password reset instructions."));
294                                 $form->field(name => "name", required => 0);
295                                 push @$buttons, "Reset Password";
296                         }
297                         elsif ($form->submitted eq "Register") {
298                                 @$buttons="Create Account";
299                         }
300                 }
301                 elsif ($form->submitted eq "Create Account") {
302                         @$buttons="Create Account";
303                 }
304                 else {
305                         push @$buttons, "Register", "Reset Password";
306                 }
307         }
308         elsif ($form->title eq "preferences") {
309                 if ($form->submitted eq "Save Preferences" && $form->validate) {
310                         my $user_name=$form->field('name');
311                         if ($form->field("password") && length $form->field("password")) {
312                                 setpassword($user_name, $form->field('password'));
313                         }
314                 }
315         }
318 sub sessioncgi ($$) {
319         my $q=shift;
320         my $session=shift;
322         if ($q->param('do') eq 'reset') {
323                 my $name=$q->param("name");
324                 my $token=$q->param("token");
326                 if (! defined $name || ! defined $token ||
327                     ! length $name  || ! length $token) {
328                         error(gettext("incorrect password reset url"));
329                 }
330                 if (! checkpassword($name, $token, "resettoken")) {
331                         error(gettext("password reset denied"));
332                 }
334                 $session->param("name", $name);
335                 IkiWiki::cgi_prefs($q, $session);
336                 exit;
337         }