]>
Commit | Line | Data |
---|---|---|
1 | <?php | |
2 | ||
3 | declare(strict_types=1); | |
4 | ||
5 | namespace Shaarli\Front\Controller\Visitor; | |
6 | ||
7 | use Shaarli\Front\Exception\CantLoginException; | |
8 | use Shaarli\Front\Exception\LoginBannedException; | |
9 | use Shaarli\Front\Exception\WrongTokenException; | |
10 | use Shaarli\Render\TemplatePage; | |
11 | use Shaarli\Security\CookieManager; | |
12 | use Shaarli\Security\SessionManager; | |
13 | use Slim\Http\Request; | |
14 | use Slim\Http\Response; | |
15 | ||
16 | /** | |
17 | * Class LoginController | |
18 | * | |
19 | * Slim controller used to render the login page. | |
20 | * | |
21 | * The login page is not available if the user is banned | |
22 | * or if open shaarli setting is enabled. | |
23 | */ | |
24 | class LoginController extends ShaarliVisitorController | |
25 | { | |
26 | /** | |
27 | * GET /login - Display the login page. | |
28 | */ | |
29 | public function index(Request $request, Response $response): Response | |
30 | { | |
31 | try { | |
32 | $this->checkLoginState(); | |
33 | } catch (CantLoginException $e) { | |
34 | return $this->redirect($response, '/'); | |
35 | } | |
36 | ||
37 | if ($request->getParam('login') !== null) { | |
38 | $this->assignView('username', escape($request->getParam('login'))); | |
39 | } | |
40 | ||
41 | $returnUrl = $request->getParam('returnurl') ?? $this->container->environment['HTTP_REFERER'] ?? null; | |
42 | ||
43 | $this | |
44 | ->assignView('returnurl', escape($returnUrl)) | |
45 | ->assignView('remember_user_default', $this->container->conf->get('privacy.remember_user_default', true)) | |
46 | ->assignView('pagetitle', t('Login') .' - '. $this->container->conf->get('general.title', 'Shaarli')) | |
47 | ; | |
48 | ||
49 | return $response->write($this->render(TemplatePage::LOGIN)); | |
50 | } | |
51 | ||
52 | /** | |
53 | * POST /login - Process login | |
54 | */ | |
55 | public function login(Request $request, Response $response): Response | |
56 | { | |
57 | if (!$this->container->sessionManager->checkToken($request->getParam('token'))) { | |
58 | throw new WrongTokenException(); | |
59 | } | |
60 | ||
61 | try { | |
62 | $this->checkLoginState(); | |
63 | } catch (CantLoginException $e) { | |
64 | return $this->redirect($response, '/'); | |
65 | } | |
66 | ||
67 | if (!$this->container->loginManager->checkCredentials( | |
68 | $this->container->environment['REMOTE_ADDR'], | |
69 | client_ip_id($this->container->environment), | |
70 | $request->getParam('login'), | |
71 | $request->getParam('password') | |
72 | ) | |
73 | ) { | |
74 | $this->container->loginManager->handleFailedLogin($this->container->environment); | |
75 | ||
76 | $this->container->sessionManager->setSessionParameter( | |
77 | SessionManager::KEY_ERROR_MESSAGES, | |
78 | [t('Wrong login/password.')] | |
79 | ); | |
80 | ||
81 | // Call controller directly instead of unnecessary redirection | |
82 | return $this->index($request, $response); | |
83 | } | |
84 | ||
85 | $this->container->loginManager->handleSuccessfulLogin($this->container->environment); | |
86 | ||
87 | $cookiePath = $this->container->basePath . '/'; | |
88 | $expirationTime = $this->saveLongLastingSession($request, $cookiePath); | |
89 | $this->renewUserSession($cookiePath, $expirationTime); | |
90 | ||
91 | // Force referer from given return URL | |
92 | $this->container->environment['HTTP_REFERER'] = $request->getParam('returnurl'); | |
93 | ||
94 | return $this->redirectFromReferer($request, $response, ['login', 'install']); | |
95 | } | |
96 | ||
97 | /** | |
98 | * Make sure that the user is allowed to login and/or displaying the login page: | |
99 | * - not already logged in | |
100 | * - not open shaarli | |
101 | * - not banned | |
102 | */ | |
103 | protected function checkLoginState(): bool | |
104 | { | |
105 | if ($this->container->loginManager->isLoggedIn() | |
106 | || $this->container->conf->get('security.open_shaarli', false) | |
107 | ) { | |
108 | throw new CantLoginException(); | |
109 | } | |
110 | ||
111 | if (true !== $this->container->loginManager->canLogin($this->container->environment)) { | |
112 | throw new LoginBannedException(); | |
113 | } | |
114 | ||
115 | return true; | |
116 | } | |
117 | ||
118 | /** | |
119 | * @return int Session duration in seconds | |
120 | */ | |
121 | protected function saveLongLastingSession(Request $request, string $cookiePath): int | |
122 | { | |
123 | if (empty($request->getParam('longlastingsession'))) { | |
124 | // Standard session expiration (=when browser closes) | |
125 | $expirationTime = 0; | |
126 | } else { | |
127 | // Keep the session cookie even after the browser closes | |
128 | $this->container->sessionManager->setStaySignedIn(true); | |
129 | $expirationTime = $this->container->sessionManager->extendSession(); | |
130 | } | |
131 | ||
132 | $this->container->cookieManager->setCookieParameter( | |
133 | CookieManager::STAY_SIGNED_IN, | |
134 | $this->container->loginManager->getStaySignedInToken(), | |
135 | $expirationTime, | |
136 | $cookiePath | |
137 | ); | |
138 | ||
139 | return $expirationTime; | |
140 | } | |
141 | ||
142 | protected function renewUserSession(string $cookiePath, int $expirationTime): void | |
143 | { | |
144 | // Send cookie with the new expiration date to the browser | |
145 | $this->container->sessionManager->destroy(); | |
146 | $this->container->sessionManager->cookieParameters( | |
147 | $expirationTime, | |
148 | $cookiePath, | |
149 | $this->container->environment['SERVER_NAME'] | |
150 | ); | |
151 | $this->container->sessionManager->start(); | |
152 | $this->container->sessionManager->regenerateId(true); | |
153 | } | |
154 | } |