]> git.vanrenterghem.biz Git - git.ikiwiki.info.git/blob - IkiWiki/Plugin/passwordauth.pm
(no commit message)
[git.ikiwiki.info.git] / IkiWiki / Plugin / passwordauth.pm
1 #!/usr/bin/perl
2 # Ikiwiki password authentication.
3 package IkiWiki::Plugin::passwordauth;
5 use warnings;
6 use strict;
7 use IkiWiki 3.00;
9 sub import {
10         hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
11         hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
12         hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
13         hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
14         hook(type => "auth", id => "passwordauth", call => \&auth);
15 }
17 sub getsetup () {
18         return
19                 plugin => {
20                         safe => 1,
21                         rebuild => 0,
22                         section => "auth",
23                 },
24                 account_creation_password => {
25                         type => "string",
26                         example => "s3cr1t",
27                         description => "a password that must be entered when signing up for an account",
28                         safe => 1,
29                         rebuild => 0,
30                 },
31                 password_cost => {
32                         type => "integer",
33                         example => 8,
34                         description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
35                         safe => 1,
36                         rebuild => 0,
37                 },
38 }
40 # Checks if a string matches a user's password, and returns true or false.
41 sub checkpassword ($$;$) {
42         my $user=shift;
43         my $password=shift;
44         my $field=shift || "password";
46         # It's very important that the user not be allowed to log in with
47         # an empty password!
48         if (! length $password) {
49                 return 0;
50         }
52         my $userinfo=IkiWiki::userinfo_retrieve();
53         if (! length $user || ! defined $userinfo ||
54             ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
55                 return 0;
56         }
58         my $ret=0;
59         if (exists $userinfo->{$user}->{"crypt".$field}) {
60                 eval q{use Authen::Passphrase};
61                 error $@ if $@;
62                 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
63                 $ret=$p->match($password);
64         }
65         elsif (exists $userinfo->{$user}->{$field}) {
66                 $ret=$password eq $userinfo->{$user}->{$field};
67         }
69         if ($ret &&
70             (exists $userinfo->{$user}->{resettoken} ||
71              exists $userinfo->{$user}->{cryptresettoken})) {
72                 # Clear reset token since the user has successfully logged in.
73                 delete $userinfo->{$user}->{resettoken};
74                 delete $userinfo->{$user}->{cryptresettoken};
75                 IkiWiki::userinfo_store($userinfo);
76         }
78         return $ret;
79 }
81 sub setpassword ($$;$) {
82         my $user=shift;
83         my $password=shift;
84         my $field=shift || "password";
86         eval q{use Authen::Passphrase::BlowfishCrypt};
87         if (! $@) {
88                 my $p = Authen::Passphrase::BlowfishCrypt->new(
89                         cost => $config{password_cost} || 8,
90                         salt_random => 1,
91                         passphrase => $password,
92                 );
93                 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
94                 IkiWiki::userinfo_set($user, $field, "");
95         }
96         else {
97                 IkiWiki::userinfo_set($user, $field, $password);
98         }
99 }
101 sub formbuilder_setup (@) {
102         my %params=@_;
104         my $form=$params{form};
105         my $session=$params{session};
106         my $cgi=$params{cgi};
108         my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
110         if ($form->title eq "signin" || $form->title eq "register" || $do_register) {
111                 $form->field(name => "name", required => 0);
112                 $form->field(name => "password", type => "password", required => 0);
113                 
114                 if ($form->submitted eq "Register" || $form->submitted eq "Create Account" || $do_register) {
115                         $form->field(name => "confirm_password", type => "password");
116                         $form->field(name => "account_creation_password", type => "password")
117                                  if (defined $config{account_creation_password} &&
118                                      length $config{account_creation_password});
119                         $form->field(name => "email", size => 50);
120                         $form->title("register");
121                         $form->text("");
122                 
123                         $form->field(name => "confirm_password",
124                                 validate => sub {
125                                         shift eq $form->field("password");
126                                 },
127                         );
128                         $form->field(name => "password",
129                                 validate => sub {
130                                         shift eq $form->field("confirm_password");
131                                 },
132                         );
133                 }
135                 if ($form->submitted) {
136                         my $submittype=$form->submitted;
137                         # Set required fields based on how form was submitted.
138                         my %required=(
139                                 "Login" => [qw(name password)],
140                                 "Register" => [],
141                                 "Create Account" => [qw(name password confirm_password email)],
142                                 "Reset Password" => [qw(name)],
143                         );
144                         foreach my $opt (@{$required{$submittype}}) {
145                                 $form->field(name => $opt, required => 1);
146                         }
147         
148                         if ($submittype eq "Create Account") {
149                                 $form->field(
150                                         name => "account_creation_password",
151                                         validate => sub {
152                                                 shift eq $config{account_creation_password};
153                                         },
154                                         required => 1,
155                                 ) if (defined $config{account_creation_password} &&
156                                       length $config{account_creation_password});
157                                 $form->field(
158                                         name => "email",
159                                         validate => "EMAIL",
160                                 );
161                         }
163                         # Validate password against name for Login.
164                         if ($submittype eq "Login") {
165                                 $form->field(
166                                         name => "password",
167                                         validate => sub {
168                                                 checkpassword($form->field("name"), shift);
169                                         },
170                                 );
171                         }
172                         elsif ($submittype eq "Register" ||
173                                $submittype eq "Create Account" ||
174                                $submittype eq "Reset Password") {
175                                 $form->field(name => "password", validate => 'VALUE');
176                         }
177                         
178                         # And make sure the entered name exists when logging
179                         # in or sending email, and does not when registering.
180                         if ($submittype eq 'Create Account' ||
181                             $submittype eq 'Register') {
182                                 $form->field(
183                                         name => "name",
184                                         validate => sub {
185                                                 my $name=shift;
186                                                 length $name &&
187                                                 $name=~/$config{wiki_file_regexp}/ &&
188                                                 ! IkiWiki::userinfo_get($name, "regdate");
189                                         },
190                                 );
191                         }
192                         elsif ($submittype eq "Login" ||
193                                $submittype eq "Reset Password") {
194                                 $form->field( 
195                                         name => "name",
196                                         validate => sub {
197                                                 my $name=shift;
198                                                 length $name &&
199                                                 IkiWiki::userinfo_get($name, "regdate");
200                                         },
201                                 );
202                         }
203                 }
204                 else {
205                         # First time settings.
206                         $form->field(name => "name");
207                         if ($session->param("name")) {
208                                 $form->field(name => "name", value => $session->param("name"));
209                         }
210                 }
211         }
212         elsif ($form->title eq "preferences") {
213                 my $user=$session->param("name");
214                 if (! IkiWiki::openiduser($user)) {
215                         $form->field(name => "name", disabled => 1, 
216                                 value => $user, force => 1,
217                                 fieldset => "login");
218                         $form->field(name => "password", type => "password",
219                                 fieldset => "login",
220                                 validate => sub {
221                                         shift eq $form->field("confirm_password");
222                                 });
223                         $form->field(name => "confirm_password", type => "password",
224                                 fieldset => "login",
225                                 validate => sub {
226                                         shift eq $form->field("password");
227                                 });
228                         
229                         my $userpage=IkiWiki::userpage($user);
230                         if (exists $pagesources{$userpage}) {
231                                 $form->text(gettext("Your user page: ").
232                                         htmllink("", "", $userpage,
233                                                 noimageinline => 1));
234                         }
235                         else {
236                                 $form->text("<a href=\"".
237                                         IkiWiki::cgiurl(do => "edit", page => $userpage).
238                                         "\">".gettext("Create your user page")."</a>");
239                         }
240                 }
241         }
244 sub formbuilder (@) {
245         my %params=@_;
247         my $form=$params{form};
248         my $session=$params{session};
249         my $cgi=$params{cgi};
250         my $buttons=$params{buttons};
252         my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
254         if ($form->title eq "signin" || $form->title eq "register") {
255                 if (($form->submitted && $form->validate) || $do_register) {
256                         if ($form->submitted eq 'Login') {
257                                 $session->param("name", $form->field("name"));
258                                 IkiWiki::cgi_postsignin($cgi, $session);
259                         }
260                         elsif ($form->submitted eq 'Create Account') {
261                                 my $user_name=$form->field('name');
262                                 if (IkiWiki::userinfo_setall($user_name, {
263                                         'email' => $form->field('email'),
264                                         'regdate' => time})) {
265                                         setpassword($user_name, $form->field('password'));
266                                         $form->field(name => "confirm_password", type => "hidden");
267                                         $form->field(name => "email", type => "hidden");
268                                         $form->text(gettext("Account creation successful. Now you can Login."));
269                                 }
270                                 else {
271                                         error(gettext("Error creating account."));
272                                 }
273                         }
274                         elsif ($form->submitted eq 'Reset Password') {
275                                 my $user_name=$form->field("name");
276                                 my $email=IkiWiki::userinfo_get($user_name, "email");
277                                 if (! length $email) {
278                                         error(gettext("No email address, so cannot email password reset instructions."));
279                                 }
280                                 
281                                 # Store a token that can be used once
282                                 # to log the user in. This needs to be hard
283                                 # to guess. Generating a cgi session id will
284                                 # make it as hard to guess as any cgi session.
285                                 eval q{use CGI::Session};
286                                 error($@) if $@;
287                                 my $token = CGI::Session->new->id;
288                                 setpassword($user_name, $token, "resettoken");
289                                 
290                                 my $template=template("passwordmail.tmpl");
291                                 $template->param(
292                                         user_name => $user_name,
293                                         passwordurl => IkiWiki::cgiurl(
294                                                 'do' => "reset",
295                                                 'name' => $user_name,
296                                                 'token' => $token,
297                                         ),
298                                         wikiurl => $config{url},
299                                         wikiname => $config{wikiname},
300                                         remote_addr => $session->remote_addr(),
301                                 );
302                                 
303                                 eval q{use Mail::Sendmail};
304                                 error($@) if $@;
305                                 sendmail(
306                                         To => IkiWiki::userinfo_get($user_name, "email"),
307                                         From => "$config{wikiname} admin <".
308                                                 (defined $config{adminemail} ? $config{adminemail} : "")
309                                                 .">",
310                                         Subject => "$config{wikiname} information",
311                                         Message => $template->output,
312                                 ) or error(gettext("Failed to send mail"));
313                                 
314                                 $form->text(gettext("You have been mailed password reset instructions."));
315                                 $form->field(name => "name", required => 0);
316                                 push @$buttons, "Reset Password";
317                         }
318                         elsif ($form->submitted eq "Register" || $do_register) {
319                                 @$buttons="Create Account";
320                         }
321                 }
322                 elsif ($form->submitted eq "Create Account") {
323                         @$buttons="Create Account";
324                 }
325                 else {
326                         push @$buttons, "Register", "Reset Password";
327                 }
328         }
329         elsif ($form->title eq "preferences") {
330                 if ($form->submitted eq "Save Preferences" && $form->validate) {
331                         my $user_name=$form->field('name');
332                         if ($form->field("password") && length $form->field("password")) {
333                                 setpassword($user_name, $form->field('password'));
334                         }
335                 }
336         }
339 sub sessioncgi ($$) {
340         my $q=shift;
341         my $session=shift;
343         if ($q->param('do') eq 'reset') {
344                 my $name=$q->param("name");
345                 my $token=$q->param("token");
347                 if (! defined $name || ! defined $token ||
348                     ! length $name  || ! length $token) {
349                         error(gettext("incorrect password reset url"));
350                 }
351                 if (! checkpassword($name, $token, "resettoken")) {
352                         error(gettext("password reset denied"));
353                 }
355                 $session->param("name", $name);
356                 IkiWiki::cgi_prefs($q, $session);
357                 exit;
358         }
359         elsif ($q->param("do") eq "register") {
360                 # After registration, need to go somewhere, so show prefs page.
361                 $session->param(postsignin => "do=prefs");
362                 # Due to do=register, this will run in registration-only
363                 # mode.
364                 IkiWiki::cgi_signin($q, $session);
365                 exit;
366         }
369 sub auth ($$) {
370         # While this hook is not currently used, it needs to exist
371         # so ikiwiki knows that the wiki supports logins, and will
372         # enable the Preferences page.