diff options
Diffstat (limited to 'src/Wallabag/CoreBundle/Security')
-rw-r--r-- | src/Wallabag/CoreBundle/Security/Authentication/Provider/WsseProvider.php | 21 | ||||
-rw-r--r-- | src/Wallabag/CoreBundle/Security/Firewall/WsseListener.php | 20 |
2 files changed, 31 insertions, 10 deletions
diff --git a/src/Wallabag/CoreBundle/Security/Authentication/Provider/WsseProvider.php b/src/Wallabag/CoreBundle/Security/Authentication/Provider/WsseProvider.php index eaad9c63..c9b9b692 100644 --- a/src/Wallabag/CoreBundle/Security/Authentication/Provider/WsseProvider.php +++ b/src/Wallabag/CoreBundle/Security/Authentication/Provider/WsseProvider.php | |||
@@ -23,6 +23,10 @@ class WsseProvider implements AuthenticationProviderInterface | |||
23 | { | 23 | { |
24 | $user = $this->userProvider->loadUserByUsername($token->getUsername()); | 24 | $user = $this->userProvider->loadUserByUsername($token->getUsername()); |
25 | 25 | ||
26 | if (!$user) { | ||
27 | throw new AuthenticationException("Bad credentials. Did you forgot your username?"); | ||
28 | } | ||
29 | |||
26 | if ($user && $this->validateDigest($token->digest, $token->nonce, $token->created, $user->getPassword())) { | 30 | if ($user && $this->validateDigest($token->digest, $token->nonce, $token->created, $user->getPassword())) { |
27 | $authenticatedToken = new WsseUserToken($user->getRoles()); | 31 | $authenticatedToken = new WsseUserToken($user->getRoles()); |
28 | $authenticatedToken->setUser($user); | 32 | $authenticatedToken->setUser($user); |
@@ -35,12 +39,17 @@ class WsseProvider implements AuthenticationProviderInterface | |||
35 | 39 | ||
36 | protected function validateDigest($digest, $nonce, $created, $secret) | 40 | protected function validateDigest($digest, $nonce, $created, $secret) |
37 | { | 41 | { |
38 | // Expire le timestamp après 5 minutes | 42 | // Check created time is not in the future |
43 | if (strtotime($created) > time()) { | ||
44 | throw new AuthenticationException("Back to the future..."); | ||
45 | } | ||
46 | |||
47 | // Expire timestamp after 5 minutes | ||
39 | if (time() - strtotime($created) > 300) { | 48 | if (time() - strtotime($created) > 300) { |
40 | return false; | 49 | throw new AuthenticationException("Too late for this timestamp... Watch your watch."); |
41 | } | 50 | } |
42 | 51 | ||
43 | // Valide que le nonce est unique dans les 5 minutes | 52 | // Validate nonce is unique within 5 minutes |
44 | if (file_exists($this->cacheDir.'/'.$nonce) && file_get_contents($this->cacheDir.'/'.$nonce) + 300 > time()) { | 53 | if (file_exists($this->cacheDir.'/'.$nonce) && file_get_contents($this->cacheDir.'/'.$nonce) + 300 > time()) { |
45 | throw new NonceExpiredException('Previously used nonce detected'); | 54 | throw new NonceExpiredException('Previously used nonce detected'); |
46 | } | 55 | } |
@@ -52,9 +61,13 @@ class WsseProvider implements AuthenticationProviderInterface | |||
52 | 61 | ||
53 | file_put_contents($this->cacheDir.'/'.$nonce, time()); | 62 | file_put_contents($this->cacheDir.'/'.$nonce, time()); |
54 | 63 | ||
55 | // Valide le Secret | 64 | // Validate Secret |
56 | $expected = base64_encode(sha1(base64_decode($nonce).$created.$secret, true)); | 65 | $expected = base64_encode(sha1(base64_decode($nonce).$created.$secret, true)); |
57 | 66 | ||
67 | if ($digest !== $expected) { | ||
68 | throw new AuthenticationException("Bad credentials ! Digest is not as expected."); | ||
69 | } | ||
70 | |||
58 | return $digest === $expected; | 71 | return $digest === $expected; |
59 | } | 72 | } |
60 | 73 | ||
diff --git a/src/Wallabag/CoreBundle/Security/Firewall/WsseListener.php b/src/Wallabag/CoreBundle/Security/Firewall/WsseListener.php index 4d4f2145..d815d536 100644 --- a/src/Wallabag/CoreBundle/Security/Firewall/WsseListener.php +++ b/src/Wallabag/CoreBundle/Security/Firewall/WsseListener.php | |||
@@ -9,16 +9,19 @@ use Symfony\Component\Security\Core\Exception\AuthenticationException; | |||
9 | use Symfony\Component\Security\Core\SecurityContextInterface; | 9 | use Symfony\Component\Security\Core\SecurityContextInterface; |
10 | use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface; | 10 | use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface; |
11 | use Wallabag\CoreBundle\Security\Authentication\Token\WsseUserToken; | 11 | use Wallabag\CoreBundle\Security\Authentication\Token\WsseUserToken; |
12 | use Symfony\Component\HttpKernel\Log\LoggerInterface; | ||
12 | 13 | ||
13 | class WsseListener implements ListenerInterface | 14 | class WsseListener implements ListenerInterface |
14 | { | 15 | { |
15 | protected $securityContext; | 16 | protected $securityContext; |
16 | protected $authenticationManager; | 17 | protected $authenticationManager; |
18 | protected $logger; | ||
17 | 19 | ||
18 | public function __construct(SecurityContextInterface $securityContext, AuthenticationManagerInterface $authenticationManager) | 20 | public function __construct(SecurityContextInterface $securityContext, AuthenticationManagerInterface $authenticationManager, LoggerInterface $logger) |
19 | { | 21 | { |
20 | $this->securityContext = $securityContext; | 22 | $this->securityContext = $securityContext; |
21 | $this->authenticationManager = $authenticationManager; | 23 | $this->authenticationManager = $authenticationManager; |
24 | $this->logger = $logger; | ||
22 | } | 25 | } |
23 | 26 | ||
24 | public function handle(GetResponseEvent $event) | 27 | public function handle(GetResponseEvent $event) |
@@ -42,16 +45,21 @@ class WsseListener implements ListenerInterface | |||
42 | 45 | ||
43 | $this->securityContext->setToken($authToken); | 46 | $this->securityContext->setToken($authToken); |
44 | } catch (AuthenticationException $failed) { | 47 | } catch (AuthenticationException $failed) { |
45 | // ... you might log something here | 48 | $failedMessage = 'WSSE Login failed for '.$token->getUsername().'. Why ? '.$failed->getMessage(); |
46 | 49 | $this->logger->err($failedMessage); | |
47 | // To deny the authentication clear the token. This will redirect to the login page. | ||
48 | // $this->securityContext->setToken(null); | ||
49 | // return; | ||
50 | 50 | ||
51 | // Deny authentication with a '403 Forbidden' HTTP response | 51 | // Deny authentication with a '403 Forbidden' HTTP response |
52 | $response = new Response(); | 52 | $response = new Response(); |
53 | $response->setStatusCode(403); | 53 | $response->setStatusCode(403); |
54 | $response->setContent($failedMessage); | ||
54 | $event->setResponse($response); | 55 | $event->setResponse($response); |
56 | |||
57 | return; | ||
55 | } | 58 | } |
59 | |||
60 | // By default deny authorization | ||
61 | $response = new Response(); | ||
62 | $response->setStatusCode(403); | ||
63 | $event->setResponse($response); | ||
56 | } | 64 | } |
57 | } | 65 | } |