includes/functions-auth.php

   1 <?php
   2 /**
   3  * Check for valid user via login form or stored cookie. Returns true or an error message
   4  *
   5  */
   6 function yourls_is_valid_user() {
   7         static $valid = false;
   8
   9         if( $valid )
  10                 return true;
  11
  12         // Allow plugins to short-circuit the whole function
  13         $pre = yourls_apply_filter( 'shunt_is_valid_user', null );
  14         if ( null !== $pre ) {
  15                 $valid = ( $pre === true ) ;
  16                 return $pre;
  17         }
  18
  19         // $unfiltered_valid : are credentials valid? Boolean value. It's "unfiltered" to allow plugins to eventually filter it.
  20         $unfiltered_valid = false;
  21
  22         // Logout request
  23         if( isset( $_GET['action'] ) && $_GET['action'] == 'logout' ) {
  24                 yourls_do_action( 'logout' );
  25                 yourls_store_cookie( null );
  26                 return yourls__( 'Logged out successfully' );
  27         }
  28
  29         // Check cookies or login request. Login form has precedence.
  30
  31         yourls_do_action( 'pre_login' );
  32
  33         // Determine auth method and check credentials
  34         if
  35                 // API only: Secure (no login or pwd) and time limited token
  36                 // ?timestamp=12345678&signature=md5(totoblah12345678)
  37                 ( yourls_is_API() &&
  38                   isset( $_REQUEST['timestamp'] ) && !empty($_REQUEST['timestamp'] ) &&
  39                   isset( $_REQUEST['signature'] ) && !empty($_REQUEST['signature'] )
  40                 )
  41                 {
  42                         yourls_do_action( 'pre_login_signature_timestamp' );
  43                         $unfiltered_valid = yourls_check_signature_timestamp();
  44                 }
  45
  46         elseif
  47                 // API only: Secure (no login or pwd)
  48                 // ?signature=md5(totoblah)
  49                 ( yourls_is_API() &&
  50                   !isset( $_REQUEST['timestamp'] ) &&
  51                   isset( $_REQUEST['signature'] ) && !empty( $_REQUEST['signature'] )
  52                 )
  53                 {
  54                         yourls_do_action( 'pre_login_signature' );
  55                         $unfiltered_valid = yourls_check_signature();
  56                 }
  57
  58         elseif
  59                 // API or normal: login with username & pwd
  60                 ( isset( $_REQUEST['username'] ) && isset( $_REQUEST['password'] )
  61                   && !empty( $_REQUEST['username'] ) && !empty( $_REQUEST['password']  ) )
  62                 {
  63                         yourls_do_action( 'pre_login_username_password' );
  64                         $unfiltered_valid = yourls_check_username_password();
  65                 }
  66
  67         elseif
  68                 // Normal only: cookies
  69                 ( !yourls_is_API() &&
  70                   isset( $_COOKIE['yourls_username'] ) && isset( $_COOKIE['yourls_password'] ) )
  71                 {
  72                         yourls_do_action( 'pre_login_cookie' );
  73                         $unfiltered_valid = yourls_check_auth_cookie();
  74                 }
  75
  76         // Regardless of validity, allow plugins to filter the boolean and have final word
  77         $valid = yourls_apply_filter( 'is_valid_user', $unfiltered_valid );
  78
  79         // Login for the win!
  80         if ( $valid ) {
  81                 yourls_do_action( 'login' );
  82
  83                 // (Re)store encrypted cookie if needed
  84                 if ( !yourls_is_API() ) {
  85                         yourls_store_cookie( YOURLS_USER );
  86
  87                         // Login form : redirect to requested URL to avoid re-submitting the login form on page reload
  88                         if( isset( $_REQUEST['username'] ) && isset( $_REQUEST['password'] ) ) {
  89                                 $url = $_SERVER['REQUEST_URI'];
  90                                 // If password stored unencrypted, append query string. TODO: deprecate this when there's proper user management
  91                                 if( !yourls_has_hashed_password( $_REQUEST['username'] ) ) {
  92                                         $url = yourls_add_query_arg( array( 'login_msg' => 'pwdclear' ) );
  93                                 }
  94                                 yourls_redirect( $url );
  95                         }
  96                 }
  97
  98                 // Login successful
  99                 return true;
 100         }
 101
 102         // Login failed
 103         yourls_do_action( 'login_failed' );
 104
 105         if ( isset( $_REQUEST['username'] ) || isset( $_REQUEST['password'] ) ) {
 106                 return yourls__( 'Invalid username or password' );
 107         } else {
 108                 return yourls__( 'Please log in' );
 109         }
 110 }
 111
 112 /**
 113  * Check auth against list of login=>pwd. Sets user if applicable, returns bool
 114  *
 115  */
 116 function yourls_check_username_password() {
 117         global $yourls_user_passwords;
 118         if( isset( $yourls_user_passwords[ $_REQUEST['username'] ] ) && yourls_check_password_hash( $_REQUEST['username'], $_REQUEST['password'] ) ) {
 119                 yourls_set_user( $_REQUEST['username'] );
 120                 return true;
 121         }
 122         return false;
 123 }
 124
 125 /**
 126  * Check a submitted password sent in plain text against stored password which can be a salted hash
 127  *
 128  */
 129 function yourls_check_password_hash( $user, $submitted_password ) {
 130         global $yourls_user_passwords;
 131
 132         if( !isset( $yourls_user_passwords[ $user ] ) )
 133                 return false;
 134
 135         if( yourls_has_hashed_password( $user ) ) {
 136                 // Stored password is a salted hash: "md5:<$r = rand(10000,99999)>:<md5($r.'thepassword')>"
 137                 list( , $salt, ) = explode( ':', $yourls_user_passwords[ $user ] );
 138                 return( $yourls_user_passwords[ $user ] == 'md5:'.$salt.':'.md5( $salt . $submitted_password ) );
 139         } else {
 140                 // Password stored in clear text
 141                 return( $yourls_user_passwords[ $user ] == $submitted_password );
 142         }
 143 }
 144
 145 /**
 146  * Check if a user has a hashed password
 147  *
 148  * Check if a user password is 'md5:[38 chars]'. TODO: deprecate this when/if we have proper user management with
 149  * password hashes stored in the DB
 150  *
 151  * @since 1.7
 152  * @param string $user user login
 153  * @return bool true if password hashed, false otherwise
 154  */
 155 function yourls_has_hashed_password( $user ) {
 156         global $yourls_user_passwords;
 157         return(    isset( $yourls_user_passwords[ $user ] )
 158                 && substr( $yourls_user_passwords[ $user ], 0, 4 ) == 'md5:'
 159                     && strlen( $yourls_user_passwords[ $user ] ) == 42 // http://www.google.com/search?q=the+answer+to+life+the+universe+and+everything
 160                    );
 161 }
 162
 163 /**
 164  * Check auth against encrypted COOKIE data. Sets user if applicable, returns bool
 165  *
 166  */
 167 function yourls_check_auth_cookie() {
 168         global $yourls_user_passwords;
 169         foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
 170                 if(
 171                         yourls_salt( $valid_user ) == $_COOKIE['yourls_username']
 172                         && yourls_salt( $valid_password ) == $_COOKIE['yourls_password']
 173                 ) {
 174                         yourls_set_user( $valid_user );
 175                         return true;
 176                 }
 177         }
 178         return false;
 179 }
 180
 181 /**
 182  * Check auth against signature and timestamp. Sets user if applicable, returns bool
 183  *
 184  */
 185 function yourls_check_signature_timestamp() {
 186         // Timestamp in PHP : time()
 187         // Timestamp in JS: parseInt(new Date().getTime() / 1000)
 188         global $yourls_user_passwords;
 189         foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
 190                 if (
 191                         (
 192                                 md5( $_REQUEST['timestamp'].yourls_auth_signature( $valid_user ) ) == $_REQUEST['signature']
 193                                 or
 194                                 md5( yourls_auth_signature( $valid_user ).$_REQUEST['timestamp'] ) == $_REQUEST['signature']
 195                         )
 196                         &&
 197                         yourls_check_timestamp( $_REQUEST['timestamp'] )
 198                         ) {
 199                         yourls_set_user( $valid_user );
 200                         return true;
 201                 }
 202         }
 203         return false;
 204 }
 205
 206 /**
 207  * Check auth against signature. Sets user if applicable, returns bool
 208  *
 209  */
 210 function yourls_check_signature() {
 211         global $yourls_user_passwords;
 212         foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
 213                 if ( yourls_auth_signature( $valid_user ) == $_REQUEST['signature'] ) {
 214                         yourls_set_user( $valid_user );
 215                         return true;
 216                 }
 217         }
 218         return false;
 219 }
 220
 221 /**
 222  * Generate secret signature hash
 223  *
 224  */
 225 function yourls_auth_signature( $username = false ) {
 226         if( !$username && defined('YOURLS_USER') ) {
 227                 $username = YOURLS_USER;
 228         }
 229         return ( $username ? substr( yourls_salt( $username ), 0, 10 ) : 'Cannot generate auth signature: no username' );
 230 }
 231
 232 /**
 233  * Check if timestamp is not too old
 234  *
 235  */
 236 function yourls_check_timestamp( $time ) {
 237         $now = time();
 238         // Allow timestamp to be a little in the future or the past -- see Issue 766
 239         return yourls_apply_filter( 'check_timestamp', abs( $now - $time ) < YOURLS_NONCE_LIFE, $time );
 240 }
 241
 242 /**
 243  * Store new cookie. No $user will delete the cookie.
 244  *
 245  */
 246 function yourls_store_cookie( $user = null ) {
 247         if( !$user ) {
 248                 $pass = null;
 249                 $time = time() - 3600;
 250         } else {
 251                 global $yourls_user_passwords;
 252                 if( isset($yourls_user_passwords[$user]) ) {
 253                         $pass = $yourls_user_passwords[$user];
 254                 } else {
 255                         die( 'Stealing cookies?' ); // This should never happen
 256                 }
 257                 $time = time() + YOURLS_COOKIE_LIFE;
 258         }
 259
 260         $domain   = yourls_apply_filter( 'setcookie_domain',   parse_url( YOURLS_SITE, 1 ) );
 261         $secure   = yourls_apply_filter( 'setcookie_secure',   yourls_is_ssl() );
 262         $httponly = yourls_apply_filter( 'setcookie_httponly', true );
 263
 264         if ( !headers_sent() ) {
 265                 // Set httponly if the php version is >= 5.2.0
 266                 if( version_compare( phpversion(), '5.2.0', 'ge' ) ) {
 267                         setcookie('yourls_username', yourls_salt( $user ), $time, '/', $domain, $secure, $httponly );
 268                         setcookie('yourls_password', yourls_salt( $pass ), $time, '/', $domain, $secure, $httponly );
 269                 } else {
 270                         setcookie('yourls_username', yourls_salt( $user ), $time, '/', $domain, $secure );
 271                         setcookie('yourls_password', yourls_salt( $pass ), $time, '/', $domain, $secure );
 272                 }
 273         } else {
 274                 // For some reason cookies were not stored: action to be able to debug that
 275                 yourls_do_action( 'setcookie_failed', $user );
 276         }
 277 }
 278
 279 /**
 280  * Set user name
 281  *
 282  */
 283 function yourls_set_user( $user ) {
 284         if( !defined( 'YOURLS_USER' ) )
 285                 define( 'YOURLS_USER', $user );
 286 }
 287