]> sipb.mit.edu Git - ikiwiki.git/blob - IkiWiki/Plugin/passwordauth.pm
typo
[ikiwiki.git] / IkiWiki / Plugin / passwordauth.pm
1 #!/usr/bin/perl
2 # Ikiwiki password authentication.
3 package IkiWiki::Plugin::passwordauth;
4
5 use warnings;
6 use strict;
7 use IkiWiki 2.00;
8
9 sub import { #{{{
10         hook(type => "getsetup", id => "passwordauth", "call" => \&getsetup);
11         hook(type => "formbuilder_setup", id => "passwordauth", call => \&formbuilder_setup);
12         hook(type => "formbuilder", id => "passwordauth", call => \&formbuilder);
13         hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
14 } # }}}
15
16 sub getsetup () { #{{{
17         return
18                 account_creation_password => {
19                         type => "string",
20                         default => "",
21                         description => "a password that must be entered when signing up for an account",
22                         safe => 1,
23                         rebuild => 0,
24                 },
25                 password_cost => {
26                         type => "integer",
27                         default => 8,
28                         description => "cost of generating a password using Authen::Passphrase::BlowfishCrypt",
29                         safe => 1,
30                         rebuild => 0,
31                 },
32 } #}}}
33
34 # Checks if a string matches a user's password, and returns true or false.
35 sub checkpassword ($$;$) { #{{{
36         my $user=shift;
37         my $password=shift;
38         my $field=shift || "password";
39
40         # It's very important that the user not be allowed to log in with
41         # an empty password!
42         if (! length $password) {
43                 return 0;
44         }
45
46         my $userinfo=IkiWiki::userinfo_retrieve();
47         if (! length $user || ! defined $userinfo ||
48             ! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
49                 return 0;
50         }
51
52         my $ret=0;
53         if (exists $userinfo->{$user}->{"crypt".$field}) {
54                 eval q{use Authen::Passphrase};
55                 error $@ if $@;
56                 my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
57                 $ret=$p->match($password);
58         }
59         elsif (exists $userinfo->{$user}->{$field}) {
60                 $ret=$password eq $userinfo->{$user}->{$field};
61         }
62
63         if ($ret &&
64             (exists $userinfo->{$user}->{resettoken} ||
65              exists $userinfo->{$user}->{cryptresettoken})) {
66                 # Clear reset token since the user has successfully logged in.
67                 delete $userinfo->{$user}->{resettoken};
68                 delete $userinfo->{$user}->{cryptresettoken};
69                 IkiWiki::userinfo_store($userinfo);
70         }
71
72         return $ret;
73 } #}}}
74
75 sub setpassword ($$;$) { #{{{
76         my $user=shift;
77         my $password=shift;
78         my $field=shift || "password";
79
80         eval q{use Authen::Passphrase::BlowfishCrypt};
81         if (! $@) {
82                 my $p = Authen::Passphrase::BlowfishCrypt->new(
83                         cost => $config{password_cost} || 8,
84                         salt_random => 1,
85                         passphrase => $password,
86                 );
87                 IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
88                 IkiWiki::userinfo_set($user, $field, "");
89         }
90         else {
91                 IkiWiki::userinfo_set($user, $field, $password);
92         }
93 } #}}}
94
95 sub formbuilder_setup (@) { #{{{
96         my %params=@_;
97
98         my $form=$params{form};
99         my $session=$params{session};
100         my $cgi=$params{cgi};
101
102         if ($form->title eq "signin" || $form->title eq "register") {
103                 $form->field(name => "name", required => 0);
104                 $form->field(name => "password", type => "password", required => 0);
105                 
106                 if ($form->submitted eq "Register" || $form->submitted eq "Create Account") {
107                         $form->field(name => "confirm_password", type => "password");
108                         $form->field(name => "account_creation_password", type => "password")
109                                  if (defined $config{account_creation_password} &&
110                                      length $config{account_creation_password});
111                         $form->field(name => "email", size => 50);
112                         $form->title("register");
113                         $form->text("");
114                 
115                         $form->field(name => "confirm_password",
116                                 validate => sub {
117                                         shift eq $form->field("password");
118                                 },
119                         );
120                         $form->field(name => "password",
121                                 validate => sub {
122                                         shift eq $form->field("confirm_password");
123                                 },
124                         );
125                 }
126
127                 if ($form->submitted) {
128                         my $submittype=$form->submitted;
129                         # Set required fields based on how form was submitted.
130                         my %required=(
131                                 "Login" => [qw(name password)],
132                                 "Register" => [],
133                                 "Create Account" => [qw(name password confirm_password email)],
134                                 "Reset Password" => [qw(name)],
135                         );
136                         foreach my $opt (@{$required{$submittype}}) {
137                                 $form->field(name => $opt, required => 1);
138                         }
139         
140                         if ($submittype eq "Create Account") {
141                                 $form->field(
142                                         name => "account_creation_password",
143                                         validate => sub {
144                                                 shift eq $config{account_creation_password};
145                                         },
146                                         required => 1,
147                                 ) if (defined $config{account_creation_password} &&
148                                       length $config{account_creation_password});
149                                 $form->field(
150                                         name => "email",
151                                         validate => "EMAIL",
152                                 );
153                         }
154
155                         # Validate password against name for Login.
156                         if ($submittype eq "Login") {
157                                 $form->field(
158                                         name => "password",
159                                         validate => sub {
160                                                 checkpassword($form->field("name"), shift);
161                                         },
162                                 );
163                         }
164                         elsif ($submittype eq "Register" ||
165                                $submittype eq "Create Account" ||
166                                $submittype eq "Reset Password") {
167                                 $form->field(name => "password", validate => 'VALUE');
168                         }
169                         
170                         # And make sure the entered name exists when logging
171                         # in or sending email, and does not when registering.
172                         if ($submittype eq 'Create Account' ||
173                             $submittype eq 'Register') {
174                                 $form->field(
175                                         name => "name",
176                                         validate => sub {
177                                                 my $name=shift;
178                                                 length $name &&
179                                                 $name=~/$config{wiki_file_regexp}/ &&
180                                                 ! IkiWiki::userinfo_get($name, "regdate");
181                                         },
182                                 );
183                         }
184                         elsif ($submittype eq "Login" ||
185                                $submittype eq "Reset Password") {
186                                 $form->field( 
187                                         name => "name",
188                                         validate => sub {
189                                                 my $name=shift;
190                                                 length $name &&
191                                                 IkiWiki::userinfo_get($name, "regdate");
192                                         },
193                                 );
194                         }
195                 }
196                 else {
197                         # First time settings.
198                         $form->field(name => "name");
199                         if ($session->param("name")) {
200                                 $form->field(name => "name", value => $session->param("name"));
201                         }
202                 }
203         }
204         elsif ($form->title eq "preferences") {
205                 $form->field(name => "name", disabled => 1, 
206                         value => $session->param("name"), force => 1,
207                         fieldset => "login");
208                 $form->field(name => "password", type => "password",
209                         fieldset => "login",
210                         validate => sub {
211                                 shift eq $form->field("confirm_password");
212                         }),
213                 $form->field(name => "confirm_password", type => "password",
214                         fieldset => "login",
215                         validate => sub {
216                                 shift eq $form->field("password");
217                         }),
218         }
219 }
220
221 sub formbuilder (@) { #{{{
222         my %params=@_;
223
224         my $form=$params{form};
225         my $session=$params{session};
226         my $cgi=$params{cgi};
227         my $buttons=$params{buttons};
228
229         if ($form->title eq "signin" || $form->title eq "register") {
230                 if ($form->submitted && $form->validate) {
231                         if ($form->submitted eq 'Login') {
232                                 $session->param("name", $form->field("name"));
233                                 IkiWiki::cgi_postsignin($cgi, $session);
234                         }
235                         elsif ($form->submitted eq 'Create Account') {
236                                 my $user_name=$form->field('name');
237                                 if (IkiWiki::userinfo_setall($user_name, {
238                                         'email' => $form->field('email'),
239                                         'regdate' => time})) {
240                                         setpassword($user_name, $form->field('password'));
241                                         $form->field(name => "confirm_password", type => "hidden");
242                                         $form->field(name => "email", type => "hidden");
243                                         $form->text(gettext("Account creation successful. Now you can Login."));
244                                 }
245                                 else {
246                                         error(gettext("Error creating account."));
247                                 }
248                         }
249                         elsif ($form->submitted eq 'Reset Password') {
250                                 my $user_name=$form->field("name");
251                                 my $email=IkiWiki::userinfo_get($user_name, "email");
252                                 if (! length $email) {
253                                         error(gettext("No email address, so cannot email password reset instructions."));
254                                 }
255                                 
256                                 # Store a token that can be used once
257                                 # to log the user in. This needs to be hard
258                                 # to guess. Generating a cgi session id will
259                                 # make it as hard to guess as any cgi session.
260                                 eval q{use CGI::Session};
261                                 error($@) if $@;
262                                 my $token = CGI::Session->new->id;
263                                 setpassword($user_name, $token, "resettoken");
264                                 
265                                 my $template=template("passwordmail.tmpl");
266                                 $template->param(
267                                         user_name => $user_name,
268                                         passwordurl => IkiWiki::cgiurl(
269                                                 'do' => "reset",
270                                                 'name' => $user_name,
271                                                 'token' => $token,
272                                         ),
273                                         wikiurl => $config{url},
274                                         wikiname => $config{wikiname},
275                                         REMOTE_ADDR => $ENV{REMOTE_ADDR},
276                                 );
277                                 
278                                 eval q{use Mail::Sendmail};
279                                 error($@) if $@;
280                                 sendmail(
281                                         To => IkiWiki::userinfo_get($user_name, "email"),
282                                         From => "$config{wikiname} admin <".
283                                                 (defined $config{adminemail} ? $config{adminemail} : "")
284                                                 .">",
285                                         Subject => "$config{wikiname} information",
286                                         Message => $template->output,
287                                 ) or error(gettext("Failed to send mail"));
288                                 
289                                 $form->text(gettext("You have been mailed password reset instructions."));
290                                 $form->field(name => "name", required => 0);
291                                 push @$buttons, "Reset Password";
292                         }
293                         elsif ($form->submitted eq "Register") {
294                                 @$buttons="Create Account";
295                         }
296                 }
297                 elsif ($form->submitted eq "Create Account") {
298                         @$buttons="Create Account";
299                 }
300                 else {
301                         push @$buttons, "Register", "Reset Password";
302                 }
303         }
304         elsif ($form->title eq "preferences") {
305                 if ($form->submitted eq "Save Preferences" && $form->validate) {
306                         my $user_name=$form->field('name');
307                         if ($form->field("password") && length $form->field("password")) {
308                                 setpassword($user_name, $form->field('password'));
309                         }
310                 }
311         }
312 } #}}}
313
314 sub sessioncgi ($$) { #{{{
315         my $q=shift;
316         my $session=shift;
317
318         if ($q->param('do') eq 'reset') {
319                 my $name=$q->param("name");
320                 my $token=$q->param("token");
321
322                 if (! defined $name || ! defined $token ||
323                     ! length $name  || ! length $token) {
324                         error(gettext("incorrect password reset url"));
325                 }
326                 if (! checkpassword($name, $token, "resettoken")) {
327                         error(gettext("password reset denied"));
328                 }
329
330                 $session->param("name", $name);
331                 IkiWiki::cgi_prefs($q, $session);
332                 exit;
333         }
334 } #}}}
335
336 1