application/LoginManager.php

   1 <?php
   2 namespace Shaarli;
   3
   4 use Shaarli\Config\ConfigManager;
   5
   6 /**
   7  * User login management
   8  */
   9 class LoginManager
  10 {
  11     /** @var array A reference to the $_GLOBALS array */
  12     protected $globals = [];
  13
  14     /** @var ConfigManager Configuration Manager instance **/
  15     protected $configManager = null;
  16
  17     /** @var SessionManager Session Manager instance **/
  18     protected $sessionManager = null;
  19
  20     /** @var string Path to the file containing IP bans */
  21     protected $banFile = '';
  22
  23     /** @var bool Whether the user is logged in **/
  24     protected $isLoggedIn = false;
  25
  26     /** @var bool Whether the Shaarli instance is open to public edition **/
  27     protected $openShaarli = false;
  28
  29     /**
  30      * Constructor
  31      *
  32      * @param array          $globals        The $GLOBALS array (reference)
  33      * @param ConfigManager  $configManager  Configuration Manager instance
  34      * @param SessionManager $sessionManager SessionManager instance
  35      */
  36     public function __construct(& $globals, $configManager, $sessionManager)
  37     {
  38         $this->globals = &$globals;
  39         $this->configManager = $configManager;
  40         $this->sessionManager = $sessionManager;
  41         $this->banFile = $this->configManager->get('resource.ban_file', 'data/ipbans.php');
  42         $this->readBanFile();
  43         if ($this->configManager->get('security.open_shaarli')) {
  44             $this->openShaarli = true;
  45         }
  46     }
  47
  48     /**
  49      * Check user session state and validity (expiration)
  50      *
  51      * @param array  $session    The $_SESSION array (reference)
  52      * @param array  $cookie     The $_COOKIE array
  53      * @param string $webPath    Path on the server in which the cookie will be available on
  54      * @param string $clientIpId Client IP address identifier
  55      * @param string $token      Session token
  56      *
  57      * @return bool true if the user session is valid, false otherwise
  58      */
  59     public function checkLoginState(& $session, $cookie, $webPath, $clientIpId, $token)
  60     {
  61         if (! $this->configManager->exists('credentials.login')) {
  62             // Shaarli is not configured yet
  63             $this->isLoggedIn = false;
  64             return;
  65         }
  66
  67         if (isset($cookie[SessionManager::$LOGGED_IN_COOKIE])
  68             && $cookie[SessionManager::$LOGGED_IN_COOKIE] === $token
  69         ) {
  70             $this->sessionManager->storeLoginInfo($clientIpId);
  71             $this->isLoggedIn = true;
  72         }
  73
  74         if ($this->sessionManager->hasSessionExpired()
  75             || $this->sessionManager->hasClientIpChanged($clientIpId)
  76         ) {
  77             $this->sessionManager->logout($webPath);
  78             $this->isLoggedIn = false;
  79             return;
  80         }
  81
  82         $this->sessionManager->extendSession();
  83     }
  84
  85     /**
  86      * Return whether the user is currently logged in
  87      *
  88      * @return true when the user is logged in, false otherwise
  89      */
  90     public function isLoggedIn()
  91     {
  92         if ($this->openShaarli) {
  93             return true;
  94         }
  95         return $this->isLoggedIn;
  96     }
  97
  98     /**
  99      * Check user credentials are valid
 100      *
 101      * @param string $remoteIp   Remote client IP address
 102      * @param string $clientIpId Client IP address identifier
 103      * @param string $login      Username
 104      * @param string $password   Password
 105      *
 106      * @return bool true if the provided credentials are valid, false otherwise
 107      */
 108     public function checkCredentials($remoteIp, $clientIpId, $login, $password)
 109     {
 110         $hash = sha1($password . $login . $this->configManager->get('credentials.salt'));
 111
 112         if ($login != $this->configManager->get('credentials.login')
 113             || $hash != $this->configManager->get('credentials.hash')
 114         ) {
 115             logm(
 116                 $this->configManager->get('resource.log'),
 117                 $remoteIp,
 118                 'Login failed for user ' . $login
 119             );
 120             return false;
 121         }
 122
 123         $this->sessionManager->storeLoginInfo($clientIpId);
 124         logm(
 125             $this->configManager->get('resource.log'),
 126             $remoteIp,
 127             'Login successful'
 128         );
 129         return true;
 130     }
 131
 132     /**
 133      * Read a file containing banned IPs
 134      */
 135     protected function readBanFile()
 136     {
 137         if (! file_exists($this->banFile)) {
 138             return;
 139         }
 140         include $this->banFile;
 141     }
 142
 143     /**
 144      * Write the banned IPs to a file
 145      */
 146     protected function writeBanFile()
 147     {
 148         if (! array_key_exists('IPBANS', $this->globals)) {
 149             return;
 150         }
 151         file_put_contents(
 152             $this->banFile,
 153             "<?php\n\$GLOBALS['IPBANS']=" . var_export($this->globals['IPBANS'], true) . ";\n?>"
 154         );
 155     }
 156
 157     /**
 158      * Handle a failed login and ban the IP after too many failed attempts
 159      *
 160      * @param array $server The $_SERVER array
 161      */
 162     public function handleFailedLogin($server)
 163     {
 164         $ip = $server['REMOTE_ADDR'];
 165         $trusted = $this->configManager->get('security.trusted_proxies', []);
 166
 167         if (in_array($ip, $trusted)) {
 168             $ip = getIpAddressFromProxy($server, $trusted);
 169             if (! $ip) {
 170                 // the IP is behind a trusted forward proxy, but is not forwarded
 171                 // in the HTTP headers, so we do nothing
 172                 return;
 173             }
 174         }
 175
 176         // increment the fail count for this IP
 177         if (isset($this->globals['IPBANS']['FAILURES'][$ip])) {
 178             $this->globals['IPBANS']['FAILURES'][$ip]++;
 179         } else {
 180             $this->globals['IPBANS']['FAILURES'][$ip] = 1;
 181         }
 182
 183         if ($this->globals['IPBANS']['FAILURES'][$ip] >= $this->configManager->get('security.ban_after')) {
 184             $this->globals['IPBANS']['BANS'][$ip] = time() + $this->configManager->get('security.ban_duration', 1800);
 185             logm(
 186                 $this->configManager->get('resource.log'),
 187                 $server['REMOTE_ADDR'],
 188                 'IP address banned from login'
 189             );
 190         }
 191         $this->writeBanFile();
 192     }
 193
 194     /**
 195      * Handle a successful login
 196      *
 197      * @param array $server The $_SERVER array
 198      */
 199     public function handleSuccessfulLogin($server)
 200     {
 201         $ip = $server['REMOTE_ADDR'];
 202         // FIXME unban when behind a trusted proxy?
 203
 204         unset($this->globals['IPBANS']['FAILURES'][$ip]);
 205         unset($this->globals['IPBANS']['BANS'][$ip]);
 206
 207         $this->writeBanFile();
 208     }
 209
 210     /**
 211      * Check if the user can login from this IP
 212      *
 213      * @param array $server The $_SERVER array
 214      *
 215      * @return bool true if the user is allowed to login
 216      */
 217     public function canLogin($server)
 218     {
 219         $ip = $server['REMOTE_ADDR'];
 220
 221         if (! isset($this->globals['IPBANS']['BANS'][$ip])) {
 222             // the user is not banned
 223             return true;
 224         }
 225
 226         if ($this->globals['IPBANS']['BANS'][$ip] > time()) {
 227             // the user is still banned
 228             return false;
 229         }
 230
 231         // the ban has expired, the user can attempt to log in again
 232         logm($this->configManager->get('resource.log'), $server['REMOTE_ADDR'], 'Ban lifted.');
 233         unset($this->globals['IPBANS']['FAILURES'][$ip]);
 234         unset($this->globals['IPBANS']['BANS'][$ip]);
 235
 236         $this->writeBanFile();
 237         return true;
 238     }
 239 }