Provide a UUID in edittemplate templates.
[ikiwiki.git] / IkiWiki / Plugin / passwordauth.pm
1 #!/usr/bin/perl
2 # Ikiwiki password authentication.
3 package IkiWiki::Plugin::passwordauth;
4
5 use warnings;
6 use strict;
7 use IkiWiki 3.00;
8
9 sub import {
10         hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
11         hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
12         hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
13         hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
14         hook(type => "auth", id => "passwordauth", call => \&auth);
15 }
16
17 sub getsetup () {
18         return
19                 plugin => {
20                         safe => 1,
21                         rebuild => 0,
22                         section => "auth",
23                 },
24                 account_creation_password => {
25                         type => "string",
26                         example => "s3cr1t",
27                         description => "a password that must be entered when signing up for an account",
28                         safe => 1,
29                         rebuild => 0,
30                 },
31                 password_cost => {
32                         type => "integer",
33                         example => 8,
34                         description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
35                         safe => 1,
36                         rebuild => 0,
37                 },
38 }
39
40 # Checks if a string matches a user's password, and returns true or false.
41 sub checkpassword ($$;$) {
42         my $user=shift;
43         my $password=shift;
44         my $field=shift || "password";
45
46         # It's very important that the user not be allowed to log in with
47         # an empty password!
48         if (! length $password) {
49                 return 0;
50         }
51
52         my $userinfo=IkiWiki::userinfo_retrieve();
53         if (! length $user || ! defined $userinfo ||
54             ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
55                 return 0;
56         }
57
58         my $ret=0;
59         if (exists $userinfo->{$user}->{"crypt".$field}) {
60                 eval q{use Authen::Passphrase};
61                 error $@ if $@;
62                 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
63                 $ret=$p->match($password);
64         }
65         elsif (exists $userinfo->{$user}->{$field}) {
66                 $ret=$password eq $userinfo->{$user}->{$field};
67         }
68
69         if ($ret &&
70             (exists $userinfo->{$user}->{resettoken} ||
71              exists $userinfo->{$user}->{cryptresettoken})) {
72                 # Clear reset token since the user has successfully logged in.
73                 delete $userinfo->{$user}->{resettoken};
74                 delete $userinfo->{$user}->{cryptresettoken};
75                 IkiWiki::userinfo_store($userinfo);
76         }
77
78         return $ret;
79 }
80
81 sub setpassword ($$;$) {
82         my $user=shift;
83         my $password=shift;
84         my $field=shift || "password";
85
86         eval q{use Authen::Passphrase::BlowfishCrypt};
87         if (! $@) {
88                 my $p = Authen::Passphrase::BlowfishCrypt->new(
89                         cost => $config{password_cost} || 8,
90                         salt_random => 1,
91                         passphrase => $password,
92                 );
93                 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
94                 IkiWiki::userinfo_set($user, $field, "");
95         }
96         else {
97                 IkiWiki::userinfo_set($user, $field, $password);
98         }
99
100         # Setting the password clears any passwordless login token.
101         if ($field ne 'passwordless') {
102                 IkiWiki::userinfo_set($user, "passwordless", "");
103         }
104 }
105
106 # Generates a token that can be used to log the user in.
107 # This needs to be hard to guess. Generating a cgi session id will
108 # make it as hard to guess as any cgi session.
109 sub gentoken ($$;$) {
110         my $user=shift;
111         my $tokenfield=shift;
112         my $reversable=shift;
113
114         eval q{use CGI::Session};
115         error($@) if $@;
116         my $token = CGI::Session->new->id;
117         if (! $reversable) {
118                 setpassword($user, $token, $tokenfield);
119         }
120         else {
121                 IkiWiki::userinfo_set($user, $tokenfield, $token);
122         }
123         return $token;
124 }
125
126 # An anonymous user has no normal password, only a passwordless login
127 # token. Given an email address, this sets up such a user for that email,
128 # unless one already exists, and returns the username.
129 sub anonuser ($) {
130         my $email=shift;
131
132         # Want a username for this email that won't overlap with any other.
133         my $user=$email;
134         $user=~s/@/_/g;
135
136         my $userinfo=IkiWiki::userinfo_retrieve();
137         if (! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
138                 if (IkiWiki::userinfo_setall($user, {
139                         'email' => $email,
140                         'regdate' => time})) {
141                         gentoken($user, "passwordless", 1);
142                         return $user;
143                 }
144                 else {
145                         error(gettext("Error creating account."));
146                 }
147         }
148         elsif (defined anonusertoken($userinfo->{$user})) {
149                 return $user;
150         }
151         else {
152                 return undef;
153         }
154 }
155
156 sub anonusertoken ($) {
157         my $userhash=shift;
158         if (exists $userhash->{passwordless} &&
159             length $userhash->{passwordless}) {
160                 return $userhash->{passwordless};
161         }
162         else {
163                 return undef;
164         }
165 }
166
167 sub formbuilder_setup (@) {
168         my %params=@_;
169
170         my $form=$params{form};
171         my $session=$params{session};
172         my $cgi=$params{cgi};
173
174         my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
175
176         if ($form->title eq "signin" || $form->title eq "register" || $do_register) {
177                 $form->field(name => "name", required => 0);
178                 $form->field(name => "password", type => "password", required => 0);
179                 
180                 if ($form->submitted eq "Register" || $form->submitted eq "Create Account" || $do_register) {
181                         $form->field(name => "confirm_password", type => "password");
182                         $form->field(name => "account_creation_password", type => "password")
183                                  if (defined $config{account_creation_password} &&
184                                      length $config{account_creation_password});
185                         $form->field(name => "email", size => 50);
186                         $form->title("register");
187                         $form->text("");
188                 
189                         $form->field(name => "confirm_password",
190                                 validate => sub {
191                                         shift eq $form->field("password");
192                                 },
193                         );
194                         $form->field(name => "password",
195                                 validate => sub {
196                                         shift eq $form->field("confirm_password");
197                                 },
198                         );
199                 }
200
201                 if ($form->submitted) {
202                         my $submittype=$form->submitted;
203                         # Set required fields based on how form was submitted.
204                         my %required=(
205                                 "Login" => [qw(name password)],
206                                 "Register" => [],
207                                 "Create Account" => [qw(name password confirm_password email)],
208                                 "Reset Password" => [qw(name)],
209                         );
210                         foreach my $opt (@{$required{$submittype}}) {
211                                 $form->field(name => $opt, required => 1);
212                         }
213         
214                         if ($submittype eq "Create Account") {
215                                 $form->field(
216                                         name => "account_creation_password",
217                                         validate => sub {
218                                                 shift eq $config{account_creation_password};
219                                         },
220                                         required => 1,
221                                 ) if (defined $config{account_creation_password} &&
222                                       length $config{account_creation_password});
223                                 $form->field(
224                                         name => "email",
225                                         validate => "EMAIL",
226                                 );
227                         }
228
229                         # Validate password against name for Login.
230                         if ($submittype eq "Login") {
231                                 $form->field(
232                                         name => "password",
233                                         validate => sub {
234                                                 checkpassword($form->field("name"), shift);
235                                         },
236                                 );
237                         }
238                         elsif ($submittype eq "Register" ||
239                                $submittype eq "Create Account" ||
240                                $submittype eq "Reset Password") {
241                                 $form->field(name => "password", validate => 'VALUE');
242                         }
243                         
244                         # And make sure the entered name exists when logging
245                         # in or sending email, and does not when registering.
246                         if ($submittype eq 'Create Account' ||
247                             $submittype eq 'Register') {
248                                 $form->field(
249                                         name => "name",
250                                         validate => sub {
251                                                 my $name=shift;
252                                                 length $name &&
253                                                 $name=~/$config{wiki_file_regexp}/ &&
254                                                 ! IkiWiki::userinfo_get($name, "regdate");
255                                         },
256                                 );
257                         }
258                         elsif ($submittype eq "Login" ||
259                                $submittype eq "Reset Password") {
260                                 $form->field( 
261                                         name => "name",
262                                         validate => sub {
263                                                 my $name=shift;
264                                                 length $name &&
265                                                 IkiWiki::userinfo_get($name, "regdate");
266                                         },
267                                 );
268                         }
269                 }
270                 else {
271                         # First time settings.
272                         $form->field(name => "name");
273                         if ($session->param("name")) {
274                                 $form->field(name => "name", value => $session->param("name"));
275                         }
276                 }
277         }
278         elsif ($form->title eq "preferences") {
279                 my $user=$session->param("name");
280                 if (! IkiWiki::openiduser($user)) {
281                         $form->field(name => "name", disabled => 1, 
282                                 value => $user, force => 1,
283                                 fieldset => "login");
284                         $form->field(name => "password", type => "password",
285                                 fieldset => "login",
286                                 validate => sub {
287                                         shift eq $form->field("confirm_password");
288                                 });
289                         $form->field(name => "confirm_password", type => "password",
290                                 fieldset => "login",
291                                 validate => sub {
292                                         shift eq $form->field("password");
293                                 });
294                         
295                         my $userpage=IkiWiki::userpage($user);
296                         if (exists $pagesources{$userpage}) {
297                                 $form->text(gettext("Your user page: ").
298                                         htmllink("", "", $userpage,
299                                                 noimageinline => 1));
300                         }
301                         else {
302                                 $form->text("<a href=\"".
303                                         IkiWiki::cgiurl(do => "edit", page => $userpage).
304                                         "\">".gettext("Create your user page")."</a>");
305                         }
306                 }
307         }
308 }
309
310 sub formbuilder (@) {
311         my %params=@_;
312
313         my $form=$params{form};
314         my $session=$params{session};
315         my $cgi=$params{cgi};
316         my $buttons=$params{buttons};
317
318         my $do_register=defined $cgi->param("do") && $cgi->param("do") eq "register";
319
320         if ($form->title eq "signin" || $form->title eq "register") {
321                 if (($form->submitted && $form->validate) || $do_register) {
322                         if ($form->submitted eq 'Login') {
323                                 $session->param("name", $form->field("name"));
324                                 IkiWiki::cgi_postsignin($cgi, $session);
325                         }
326                         elsif ($form->submitted eq 'Create Account') {
327                                 my $user_name=$form->field('name');
328                                 if (IkiWiki::userinfo_setall($user_name, {
329                                         'email' => $form->field('email'),
330                                         'regdate' => time})) {
331                                         setpassword($user_name, $form->field('password'));
332                                         $form->field(name => "confirm_password", type => "hidden");
333                                         $form->field(name => "email", type => "hidden");
334                                         $form->text(gettext("Account creation successful. Now you can Login."));
335                                 }
336                                 else {
337                                         error(gettext("Error creating account."));
338                                 }
339                         }
340                         elsif ($form->submitted eq 'Reset Password') {
341                                 my $user_name=$form->field("name");
342                                 my $email=IkiWiki::userinfo_get($user_name, "email");
343                                 if (! length $email) {
344                                         error(gettext("No email address, so cannot email password reset instructions."));
345                                 }
346
347                                 my $token=gentoken($user_name, "resettoken");
348                                 
349                                 my $template=template("passwordmail.tmpl");
350                                 $template->param(
351                                         user_name => $user_name,
352                                         passwordurl => IkiWiki::cgiurl_abs(
353                                                 'do' => "reset",
354                                                 'name' => $user_name,
355                                                 'token' => $token,
356                                         ),
357                                         wikiurl => $config{url},
358                                         wikiname => $config{wikiname},
359                                         remote_addr => $session->remote_addr(),
360                                 );
361                                 
362                                 eval q{use Mail::Sendmail};
363                                 error($@) if $@;
364                                 sendmail(
365                                         To => IkiWiki::userinfo_get($user_name, "email"),
366                                         From => "$config{wikiname} admin <".
367                                                 (defined $config{adminemail} ? $config{adminemail} : "")
368                                                 .">",
369                                         Subject => "$config{wikiname} information",
370                                         Message => $template->output,
371                                 ) or error(gettext("Failed to send mail"));
372                                 
373                                 $form->text(gettext("You have been mailed password reset instructions."));
374                                 $form->field(name => "name", required => 0);
375                                 push @$buttons, "Reset Password";
376                         }
377                         elsif ($form->submitted eq "Register" || $do_register) {
378                                 @$buttons="Create Account";
379                         }
380                 }
381                 elsif ($form->submitted eq "Create Account") {
382                         @$buttons="Create Account";
383                 }
384                 else {
385                         push @$buttons, "Register", "Reset Password";
386                 }
387         }
388         elsif ($form->title eq "preferences") {
389                 if ($form->submitted eq "Save Preferences" && $form->validate) {
390                         my $user_name=$form->field('name');
391                         if (defined $form->field("password") && length $form->field("password")) {
392                                 setpassword($user_name, $form->field('password'));
393                         }
394                 }
395         }
396 }
397
398 sub sessioncgi ($$) {
399         my $q=shift;
400         my $session=shift;
401
402         if ($q->param('do') eq 'reset') {
403                 my $name=$q->param("name");
404                 my $token=$q->param("token");
405
406                 if (! defined $name || ! defined $token ||
407                     ! length $name  || ! length $token) {
408                         error(gettext("incorrect password reset url"));
409                 }
410                 if (! checkpassword($name, $token, "resettoken")) {
411                         error(gettext("password reset denied"));
412                 }
413
414                 $session->param("name", $name);
415                 IkiWiki::cgi_prefs($q, $session);
416                 exit;
417         }
418         elsif ($q->param('do') eq 'tokenauth') {
419                 my $name=$q->param("name");
420                 my $token=$q->param("token");
421
422                 if (! defined $name || ! defined $token ||
423                     ! length $name  || ! length $token) {
424                         error(gettext("incorrect url"));
425                 }
426                 if (! checkpassword($name, $token, "passwordless")) {
427                         error(gettext("access denied"));
428                 }
429
430                 $session->param("name", $name);
431                 IkiWiki::cgi_prefs($q, $session);
432                 exit;
433         }
434         elsif ($q->param("do") eq "register") {
435                 # After registration, need to go somewhere, so show prefs page.
436                 $session->param(postsignin => "do=prefs");
437                 # Due to do=register, this will run in registration-only
438                 # mode.
439                 IkiWiki::cgi_signin($q, $session);
440                 exit;
441         }
442 }
443
444 sub auth ($$) {
445         # While this hook is not currently used, it needs to exist
446         # so ikiwiki knows that the wiki supports logins, and will
447         # enable the Preferences page.
448 }
449
450 1