IkiWiki/Plugin/passwordauth.pm

   1 #!/usr/bin/perl
   2 # Ikiwiki password authentication.
   3 package IkiWiki::Plugin::passwordauth;
   4
   5 use warnings;
   6 use strict;
   7 use IkiWiki 2.00;
   8
   9 sub import { #{{{
  10         hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
  11         hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
  12         hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
  13         hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
  14 } # }}}
  15
  16 sub getsetup () { #{{{
  17         return
  18                 account_creation_password => {
  19                         type => "string",
  20                         example => "s3cr1t",
  21                         description => "a password that must be entered when signing up for an account",
  22                         safe => 1,
  23                         rebuild => 0,
  24                 },
  25                 password_cost => {
  26                         type => "integer",
  27                         example => 8,
  28                         description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
  29                         safe => 1,
  30                         rebuild => 0,
  31                 },
  32 } #}}}
  33
  34 # Checks if a string matches a user's password, and returns true or false.
  35 sub checkpassword ($$;$) { #{{{
  36         my $user=shift;
  37         my $password=shift;
  38         my $field=shift || "password";
  39
  40         # It's very important that the user not be allowed to log in with
  41         # an empty password!
  42         if (! length $password) {
  43                 return 0;
  44         }
  45
  46         my $userinfo=IkiWiki::userinfo_retrieve();
  47         if (! length $user || ! defined $userinfo ||
  48             ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
  49                 return 0;
  50         }
  51
  52         my $ret=0;
  53         if (exists $userinfo->{$user}->{"crypt".$field}) {
  54                 eval q{use Authen::Passphrase};
  55                 error $@ if $@;
  56                 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
  57                 $ret=$p->match($password);
  58         }
  59         elsif (exists $userinfo->{$user}->{$field}) {
  60                 $ret=$password eq $userinfo->{$user}->{$field};
  61         }
  62
  63         if ($ret &&
  64             (exists $userinfo->{$user}->{resettoken} ||
  65              exists $userinfo->{$user}->{cryptresettoken})) {
  66                 # Clear reset token since the user has successfully logged in.
  67                 delete $userinfo->{$user}->{resettoken};
  68                 delete $userinfo->{$user}->{cryptresettoken};
  69                 IkiWiki::userinfo_store($userinfo);
  70         }
  71
  72         return $ret;
  73 } #}}}
  74
  75 sub setpassword ($$;$) { #{{{
  76         my $user=shift;
  77         my $password=shift;
  78         my $field=shift || "password";
  79
  80         eval q{use Authen::Passphrase::BlowfishCrypt};
  81         if (! $@) {
  82                 my $p = Authen::Passphrase::BlowfishCrypt->new(
  83                         cost => $config{password_cost} || 8,
  84                         salt_random => 1,
  85                         passphrase => $password,
  86                 );
  87                 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
  88                 IkiWiki::userinfo_set($user, $field, "");
  89         }
  90         else {
  91                 IkiWiki::userinfo_set($user, $field, $password);
  92         }
  93 } #}}}
  94
  95 sub formbuilder_setup (@) { #{{{
  96         my %params=@_;
  97
  98         my $form=$params{form};
  99         my $session=$params{session};
 100         my $cgi=$params{cgi};
 101
 102         if ($form->title eq "signin" || $form->title eq "register") {
 103                 $form->field(name => "name", required => 0);
 104                 $form->field(name => "password", type => "password", required => 0);
 105
 106                 if ($form->submitted eq "Register" || $form->submitted eq "Create Account") {
 107                         $form->field(name => "confirm_password", type => "password");
 108                         $form->field(name => "account_creation_password", type => "password")
 109                                  if (defined $config{account_creation_password} &&
 110                                      length $config{account_creation_password});
 111                         $form->field(name => "email", size => 50);
 112                         $form->title("register");
 113                         $form->text("");
 114
 115                         $form->field(name => "confirm_password",
 116                                 validate => sub {
 117                                         shift eq $form->field("password");
 118                                 },
 119                         );
 120                         $form->field(name => "password",
 121                                 validate => sub {
 122                                         shift eq $form->field("confirm_password");
 123                                 },
 124                         );
 125                 }
 126
 127                 if ($form->submitted) {
 128                         my $submittype=$form->submitted;
 129                         # Set required fields based on how form was submitted.
 130                         my %required=(
 131                                 "Login" => [qw(name password)],
 132                                 "Register" => [],
 133                                 "Create Account" => [qw(name password confirm_password email)],
 134                                 "Reset Password" => [qw(name)],
 135                         );
 136                         foreach my $opt (@{$required{$submittype}}) {
 137                                 $form->field(name => $opt, required => 1);
 138                         }
 139
 140                         if ($submittype eq "Create Account") {
 141                                 $form->field(
 142                                         name => "account_creation_password",
 143                                         validate => sub {
 144                                                 shift eq $config{account_creation_password};
 145                                         },
 146                                         required => 1,
 147                                 ) if (defined $config{account_creation_password} &&
 148                                       length $config{account_creation_password});
 149                                 $form->field(
 150                                         name => "email",
 151                                         validate => "EMAIL",
 152                                 );
 153                         }
 154
 155                         # Validate password against name for Login.
 156                         if ($submittype eq "Login") {
 157                                 $form->field(
 158                                         name => "password",
 159                                         validate => sub {
 160                                                 checkpassword($form->field("name"), shift);
 161                                         },
 162                                 );
 163                         }
 164                         elsif ($submittype eq "Register" ||
 165                                $submittype eq "Create Account" ||
 166                                $submittype eq "Reset Password") {
 167                                 $form->field(name => "password", validate => 'VALUE');
 168                         }
 169
 170                         # And make sure the entered name exists when logging
 171                         # in or sending email, and does not when registering.
 172                         if ($submittype eq 'Create Account' ||
 173                             $submittype eq 'Register') {
 174                                 $form->field(
 175                                         name => "name",
 176                                         validate => sub {
 177                                                 my $name=shift;
 178                                                 length $name &&
 179                                                 $name=~/$config{wiki_file_regexp}/ &&
 180                                                 ! IkiWiki::userinfo_get($name, "regdate");
 181                                         },
 182                                 );
 183                         }
 184                         elsif ($submittype eq "Login" ||
 185                                $submittype eq "Reset Password") {
 186                                 $form->field(
 187                                         name => "name",
 188                                         validate => sub {
 189                                                 my $name=shift;
 190                                                 length $name &&
 191                                                 IkiWiki::userinfo_get($name, "regdate");
 192                                         },
 193                                 );
 194                         }
 195                 }
 196                 else {
 197                         # First time settings.
 198                         $form->field(name => "name");
 199                         if ($session->param("name")) {
 200                                 $form->field(name => "name", value => $session->param("name"));
 201                         }
 202                 }
 203         }
 204         elsif ($form->title eq "preferences") {
 205                 $form->field(name => "name", disabled => 1,
 206                         value => $session->param("name"), force => 1,
 207                         fieldset => "login");
 208                 $form->field(name => "password", type => "password",
 209                         fieldset => "login",
 210                         validate => sub {
 211                                 shift eq $form->field("confirm_password");
 212                         }),
 213                 $form->field(name => "confirm_password", type => "password",
 214                         fieldset => "login",
 215                         validate => sub {
 216                                 shift eq $form->field("password");
 217                         }),
 218         }
 219 }
 220
 221 sub formbuilder (@) { #{{{
 222         my %params=@_;
 223
 224         my $form=$params{form};
 225         my $session=$params{session};
 226         my $cgi=$params{cgi};
 227         my $buttons=$params{buttons};
 228
 229         if ($form->title eq "signin" || $form->title eq "register") {
 230                 if ($form->submitted && $form->validate) {
 231                         if ($form->submitted eq 'Login') {
 232                                 $session->param("name", $form->field("name"));
 233                                 IkiWiki::cgi_postsignin($cgi, $session);
 234                         }
 235                         elsif ($form->submitted eq 'Create Account') {
 236                                 my $user_name=$form->field('name');
 237                                 if (IkiWiki::userinfo_setall($user_name, {
 238                                         'email' => $form->field('email'),
 239                                         'regdate' => time})) {
 240                                         setpassword($user_name, $form->field('password'));
 241                                         $form->field(name => "confirm_password", type => "hidden");
 242                                         $form->field(name => "email", type => "hidden");
 243                                         $form->text(gettext("Account creation successful. Now you can Login."));
 244                                 }
 245                                 else {
 246                                         error(gettext("Error creating account."));
 247                                 }
 248                         }
 249                         elsif ($form->submitted eq 'Reset Password') {
 250                                 my $user_name=$form->field("name");
 251                                 my $email=IkiWiki::userinfo_get($user_name, "email");
 252                                 if (! length $email) {
 253                                         error(gettext("No email address, so cannot email password reset instructions."));
 254                                 }
 255
 256                                 # Store a token that can be used once
 257                                 # to log the user in. This needs to be hard
 258                                 # to guess. Generating a cgi session id will
 259                                 # make it as hard to guess as any cgi session.
 260                                 eval q{use CGI::Session};
 261                                 error($@) if $@;
 262                                 my $token = CGI::Session->new->id;
 263                                 setpassword($user_name, $token, "resettoken");
 264
 265                                 my $template=template("passwordmail.tmpl");
 266                                 $template->param(
 267                                         user_name => $user_name,
 268                                         passwordurl => IkiWiki::cgiurl(
 269                                                 'do' => "reset",
 270                                                 'name' => $user_name,
 271                                                 'token' => $token,
 272                                         ),
 273                                         wikiurl => $config{url},
 274                                         wikiname => $config{wikiname},
 275                                         REMOTE_ADDR => $ENV{REMOTE_ADDR},
 276                                 );
 277
 278                                 eval q{use Mail::Sendmail};
 279                                 error($@) if $@;
 280                                 sendmail(
 281                                         To => IkiWiki::userinfo_get($user_name, "email"),
 282                                         From => "$config{wikiname} admin <".
 283                                                 (defined $config{adminemail} ? $config{adminemail} : "")
 284                                                 .">",
 285                                         Subject => "$config{wikiname} information",
 286                                         Message => $template->output,
 287                                 ) or error(gettext("Failed to send mail"));
 288
 289                                 $form->text(gettext("You have been mailed password reset instructions."));
 290                                 $form->field(name => "name", required => 0);
 291                                 push @$buttons, "Reset Password";
 292                         }
 293                         elsif ($form->submitted eq "Register") {
 294                                 @$buttons="Create Account";
 295                         }
 296                 }
 297                 elsif ($form->submitted eq "Create Account") {
 298                         @$buttons="Create Account";
 299                 }
 300                 else {
 301                         push @$buttons, "Register", "Reset Password";
 302                 }
 303         }
 304         elsif ($form->title eq "preferences") {
 305                 if ($form->submitted eq "Save Preferences" && $form->validate) {
 306                         my $user_name=$form->field('name');
 307                         if ($form->field("password") && length $form->field("password")) {
 308                                 setpassword($user_name, $form->field('password'));
 309                         }
 310                 }
 311         }
 312 } #}}}
 313
 314 sub sessioncgi ($$) { #{{{
 315         my $q=shift;
 316         my $session=shift;
 317
 318         if ($q->param('do') eq 'reset') {
 319                 my $name=$q->param("name");
 320                 my $token=$q->param("token");
 321
 322                 if (! defined $name || ! defined $token ||
 323                     ! length $name  || ! length $token) {
 324                         error(gettext("incorrect password reset url"));
 325                 }
 326                 if (! checkpassword($name, $token, "resettoken")) {
 327                         error(gettext("password reset denied"));
 328                 }
 329
 330                 $session->param("name", $name);
 331                 IkiWiki::cgi_prefs($q, $session);
 332                 exit;
 333         }
 334 } #}}}
 335
 336 1