Last commit: Fri Apr 15 14:51:22 2022 +0200	dankert	Refactoring: User,Config and Database info is now stored in the Request, because so there is no session required for clients which are using Basic Authorization.


      <?php
      namespace cms\action\login;
      use cms\action\Action;
      use cms\action\LoginAction;
      use cms\action\Method;
      use cms\action\RequestParams;
      use cms\auth\Auth;
      use cms\auth\AuthRunner;
      use cms\base\Configuration;
     use cms\base\DB;
     use cms\base\Startup;
     use cms\model\User;
     use language\Language;
     use language\Messages;
     use logger\Logger;
     use security\Password;
     use util\Browser;
     use util\exception\ObjectNotFoundException;
     use util\exception\SecurityException;
     use util\exception\ValidationException;
     use util\mail\Mail;
     use util\Request;
     use util\Session;
     use util\text\TextMessage;
     
     
     class LoginLoginAction extends LoginAction implements Method {
         public function view() {
             $loginConfig    = Configuration::subset('security');
             $securityConfig = Configuration::subset('security');
             $authenticateConfig  = Configuration::subset('authenticate');
     
             $authenticateEnabled = $authenticateConfig->is('enable',true);
     		$oidcList = [];
     
             $oidcConfig = Configuration::subset(['security','oidc']);
     
             if   ( $oidcConfig->is('enabled',true) ) {
             	foreach ( $oidcConfig->subset('provider')->subsets() as $name=>$providerConfig ) {
             		if   ( $providerConfig->is('enabled',true)) {
             			$oidcList[ $name ] = $providerConfig->get('label',$name );
     				}
     			}
     		}
     
             $this->setTemplateVar('enableUserPasswordLogin',$authenticateEnabled);
             $this->setTemplateVar('enableOpenIdConnect'    ,(boolean)$oidcList  );
             $this->setTemplateVar('provider'               ,$oidcList           );
     
     		$dbids = $this->getSelectableDatabases();
     
             if	( ! $dbids )
                 $this->addWarningFor( null,Messages::NO_DATABASE_CONFIGURATION );
     
             $this->setTemplateVar( 'dbids',$dbids );
     
             // Database was already connected in the Dispatcher. So we MUST have a db connection here.
             $dbId = Request::getDatabaseId();
             $this->setTemplateVar('dbid',$dbId);
     
             $this->setTemplateVar('register'     ,$loginConfig->get('register' ));
             $this->setTemplateVar('send_password',$loginConfig->get('send_password'));
     
             // Versuchen, einen Benutzernamen zu ermitteln, der im Eingabeformular vorausgewählt wird.
             $username = AuthRunner::getUsername('preselect');
     
             $this->setTemplateVar('login_name',$username);
     
             // If the preselected user is the default user, we have a password.
     		if   ( $username == $securityConfig->subset('default')->get('username') )
     			$this->setTemplateVar('login_password',  $securityConfig->subset('default')->get('password') );
         }
     
     
         public function post() {
     
     		Request::setUser(null); // Altes Login entfernen.
     		
     		if	( Configuration::subset('login')->is('nologin',false ) )
     			throw new SecurityException('login disabled');
     
     		$loginName     = $this->request->getAlphanum('login_name' );
     		$loginPassword = $this->request->getText('login_password');
     		$newPassword1  = $this->request->getText('password1'     );
     		$newPassword2  = $this->request->getText('password2'     );
     		$token         = $this->request->getText('user_token'    );
     
     
     		// Jedes Authentifizierungsmodul durchlaufen, bis ein Login erfolgreich ist.
     		$authResult = AuthRunner::checkLogin('authenticate',$loginName,$loginPassword, $token );
     		Password::delay();
     
     		if  ( $authResult & Auth::STATUS_PW_EXPIRED ) {
     
     			// Der Benutzer hat zwar ein richtiges Kennwort eingegeben, aber dieses ist abgelaufen.
     			// Wir versuchen hier, das neue zu setzen (sofern eingegeben).
     			if	( $newPassword1 )
     			{
     				$passwordConfig = Configuration::subset(['security','password']);
    
    				if	( $newPassword1 != $newPassword2 )
    					throw new ValidationException('password2',Messages::PASSWORDS_DO_NOT_MATCH);
    				elseif	( strlen($newPassword1) < $passwordConfig->get('min_length',10) )
    					throw new ValidationException('password1',Messages::PASSWORD_MINLENGTH,array('minlength'=>$passwordConfig->get('min_length',10)));
    				else
    				{
    					// Kennwoerter identisch und lang genug.
    					$user = User::loadWithName($loginName,User::AUTH_TYPE_INTERNAL);
    					$user->setPassword( $newPassword1,true );
    					$loginPassword = $newPassword1;
    
    					$authResult -= Auth::STATUS_PW_EXPIRED;
    				}
    			}
    		}
    
    		if	( $authResult & Auth::STATUS_TOKEN_NEEDED )
    			// Token falsch.
    			throw new ValidationException('user_token',Messages::LOGIN_FAILED_TOKEN_FAILED );
    
    		if	( $authResult & Auth::STATUS_PW_EXPIRED ) {
    
    			if   ( $authResult & Auth::STATUS_FAILED )
    				// Anmeldung gescheitert, Benutzer muss Kennwort ?ndern.
    				throw new ValidationException('password1',Messages::LOGIN_FAILED_MUSTCHANGEPASSWORD);
    		}
    
    		$ip = getenv("REMOTE_ADDR");
    
    		if	( $authResult & Auth::STATUS_FAILED ) {
    			Logger::debug(TextMessage::create('login failed for user ${name} from IP ${ip}',
    				[
    					'name' => $loginName,
    					'ip' => $ip
    				]
    			));
    
    			// Login failed.
    			throw new ValidationException('login_password',Messages::LOGIN_FAILED, ['name' => $loginName] );
    		}
    
    		if ( $authResult & Auth::STATUS_SUCCESS ) {
    
    			Logger::info(TextMessage::create('Login successful for user ${0}', [$loginName]));
    
    			$browser = new Browser();
    			Logger::debug(TextMessage::create('Login successful for user ${0} from IP ${1} with ${2} (${3})',[$loginName,$ip,$browser->name,$browser->platform]));
    
    			try {
    				// Benutzer über den Benutzernamen laden.
    				$user = User::loadWithName($loginName, User::AUTH_TYPE_INTERNAL, null);
    				$user->setCurrent();
    				$user->updateLoginTimestamp();
    
    				if ($user->passwordAlgo != Password::bestAlgoAvailable())
    					// Re-Hash the password with a better hash algo.
    					$user->setPassword($loginPassword);
    
    			} catch (ObjectNotFoundException $ex) {
    				// Benutzer wurde zwar authentifiziert, ist aber in der
    				// internen Datenbank nicht vorhanden
    				if (Configuration::subset(['security', 'newuser'])->is('autoadd', true)) {
    
    					if   ( Startup::readonly() )
    						throw new \LogicException('System is readonly so this user cannot be inserted.');
    
    					// Neue Benutzer in die interne Datenbank uebernehmen.
    					$user = new User();
    					$user->name = $loginName;
    					$user->fullname = $loginName;
    					$user->persist();
    					Logger::debug( TextMessage::create('user ${0} authenticated successful and added to internal user table',[$loginName]) );
    					$user->updateLoginTimestamp();
    				} else {
    					// Benutzer soll nicht angelegt werden.
    					// Daher ist die Anmeldung hier gescheitert.
    					// Anmeldung gescheitert.
    					Logger::warn( TextMessage::create('user ${0} authenticated successful, but not found in internal user table',[$loginName]) );
    
    					throw new ValidationException('login_password',Messages::LOGIN_FAILED,['name' => $loginName ]);
    				}
    			}
    
    			// Cookie setzen
    			$this->setCookie(Action::COOKIE_DB_ID   ,DB::get()->id );
    			$this->setCookie(Action::COOKIE_USERNAME,$user->name   );
    
    			if	( $this->request->isTrue('remember') ) {
    				// Sets the login token cookie
    				$this->setCookie(Action::COOKIE_TOKEN   ,$user->createNewLoginToken() );
    			}
    
    			// Anmeldung erfolgreich.
    			if	( Configuration::subset('security')->is('renew_session_login',false) )
    				$this->recreateSession();
    
    			// Send mail to user to inform about the new login.
    			if   ( $user->mail && Configuration::subset('security')->is('inform_user_about_new_login',true) ) {
    				$mail = new Mail( $user->mail, Messages::MAIL_NEW_LOGIN_SUBJECT, Messages::MAIL_NEW_LOGIN_TEXT );
    				$browser = new \util\Browser();
    				$mail->setVar( 'platform',$browser->platform );
    				$mail->setVar( 'browser' ,$browser->name     );
    				$mail->setVar( 'username',$user->name        );
    				$mail->setVar( 'name'    ,$user->getName()   );
    				$mail->send();
    			}
    
    			$this->addNoticeFor( $user,Messages::LOGIN_OK, array('name' => $user->getName() ));
    
    			// Setting the user-defined language
    			$config = Request::getConfig();
    			$language = new Language();
    			$config['language'] = $language->getLanguage($user->language);
    			$config['language']['language_code'] = $user->language;
    
    			Request::setConfig( $config );
    
    			return; // everything ok, user logged in.
    		}
    
    		throw new \LogicException('Auth module must return either SUCCESS or FAIL, but got '.$authResult);
    	}
    }


Download modules/cms/action/login/LoginLoginAction.class.php

History
Fri, 15 Apr 2022 14:51:22 +0200	dankert	Refactoring: User,Config and Database info is now stored in the Request, because so there is no session required for clients which are using Basic Authorization.
Wed, 9 Mar 2022 13:28:52 +0100	dankert	Refactoring: Checkbox values are always sent to the server. In the actions we must test the value with 'isTrue()'
Mon, 7 Feb 2022 22:52:12 +0100	dankert	Password lock check is moved into "InternalAuth", because it must be called on all authentication requests.
Wed, 27 Oct 2021 02:27:59 +0200	Jan Dankert	Refactoring: Splitted the mail client into a.) sendmail and b.) smtp.
Sun, 14 Mar 2021 23:51:49 +0100	Jan Dankert	Refactoring: Using the ValidationException where possible.
Wed, 10 Mar 2021 23:51:22 +0100	Jan Dankert	Refactoring: Cleaned the Request params.
Fri, 26 Feb 2021 01:06:01 +0100	Jan Dankert	Refactoring accessing the request parameter values.
Mon, 30 Nov 2020 10:31:50 +0100	Jan Dankert	Fix: Reset password fail counter after successful login.
Sun, 29 Nov 2020 21:46:57 +0100	Jan Dankert	Auth modules should only use the Auth::STATUS_* constants as return value.
Sat, 28 Nov 2020 00:53:41 +0100	Jan Dankert	New: Lock password after a number of login fails.
Fri, 27 Nov 2020 20:11:28 +0100	Jan Dankert	New: Send mail to user after login and after the password has changed.
Thu, 19 Nov 2020 23:25:29 +0100	Jan Dankert	Fix: Calculation of enabled databases was totally broken.
Thu, 19 Nov 2020 14:49:58 +0100	Jan Dankert	Fix: Action::addNotice() is replaced by Action::addNoticeFor()
Thu, 19 Nov 2020 00:45:44 +0100	Jan Dankert	Security fix: We must update the login token on every login; Administrators are able to see the login tokens of users.
Wed, 18 Nov 2020 20:42:57 +0100	Jan Dankert	Getting/Setting cookies with constants, this is more safe.
Wed, 18 Nov 2020 01:46:36 +0100	Jan Dankert	Refactoring of model classes: New method persist() and some other cleanups.
Tue, 17 Nov 2020 23:51:00 +0100	Jan Dankert	Refactoring: Every Actionmethod has now its own class.