includes/functions-auth.php

   1 <?php
   2 /**
   3  * Check for valid user via login form or stored cookie. Returns true or an error message
   4  *
   5  */
   6 function yourls_is_valid_user() {
   7         static $valid = false;
   8
   9         if( $valid )
  10                 return true;
  11
  12         // Allow plugins to short-circuit the whole function
  13         $pre = yourls_apply_filter( 'shunt_is_valid_user', null );
  14         if ( null !== $pre ) {
  15                 $valid = ( $pre === true ) ;
  16                 return $pre;
  17         }
  18
  19         $unfiltered_valid = false;
  20
  21         // Logout request
  22         if( isset( $_GET['action'] ) && $_GET['action'] == 'logout' ) {
  23                 yourls_do_action( 'logout' );
  24                 yourls_store_cookie( null );
  25                 return yourls__( 'Logged out successfully' );
  26         }
  27
  28         // Check cookies or login request. Login form has precedence.
  29         global $yourls_user_passwords;
  30
  31         yourls_do_action( 'pre_login' );
  32
  33         // Determine auth method and check credentials
  34         if
  35                 // API only: Secure (no login or pwd) and time limited token
  36                 // ?timestamp=12345678&signature=md5(totoblah12345678)
  37                 ( yourls_is_API() &&
  38                   isset( $_REQUEST['timestamp'] ) && !empty($_REQUEST['timestamp'] ) &&
  39                   isset( $_REQUEST['signature'] ) && !empty($_REQUEST['signature'] )
  40                 )
  41                 {
  42                         yourls_do_action( 'pre_login_signature_timestamp' );
  43                         $unfiltered_valid = yourls_check_signature_timestamp();
  44                 }
  45
  46         elseif
  47                 // API only: Secure (no login or pwd)
  48                 // ?signature=md5(totoblah)
  49                 ( yourls_is_API() &&
  50                   !isset( $_REQUEST['timestamp'] ) &&
  51                   isset( $_REQUEST['signature'] ) && !empty( $_REQUEST['signature'] )
  52                 )
  53                 {
  54                         yourls_do_action( 'pre_login_signature' );
  55                         $unfiltered_valid = yourls_check_signature();
  56                 }
  57
  58         elseif
  59                 // API or normal: login with username & pwd
  60                 ( isset( $_REQUEST['username'] ) && isset( $_REQUEST['password'] )
  61                   && !empty( $_REQUEST['username'] ) && !empty( $_REQUEST['password']  ) )
  62                 {
  63                         yourls_do_action( 'pre_login_username_password' );
  64                         $unfiltered_valid = yourls_check_username_password();
  65                 }
  66
  67         elseif
  68                 // Normal only: cookies
  69                 ( !yourls_is_API() &&
  70                   isset( $_COOKIE['yourls_username'] ) && isset( $_COOKIE['yourls_password'] ) )
  71                 {
  72                         yourls_do_action( 'pre_login_cookie' );
  73                         $unfiltered_valid = yourls_check_auth_cookie();
  74                 }
  75
  76         $valid = yourls_apply_filter( 'is_valid_user', $unfiltered_valid );
  77
  78         // Login for the win!
  79         if ( $valid ) {
  80                 yourls_do_action( 'login' );
  81                 // (Re)store encrypted cookie if needed and tell it's ok
  82                 if ( !yourls_is_API() && $unfiltered_valid )
  83                         yourls_store_cookie( YOURLS_USER );
  84                 return true;
  85         }
  86
  87         // Login failed
  88         yourls_do_action( 'login_failed' );
  89
  90         if ( isset( $_REQUEST['username'] ) || isset( $_REQUEST['password'] ) ) {
  91                 return yourls__( 'Invalid username or password' );
  92         } else {
  93                 return yourls__( 'Please log in' );
  94         }
  95 }
  96
  97 /**
  98  * Check auth against list of login=>pwd. Sets user if applicable, returns bool
  99  *
 100  */
 101 function yourls_check_username_password() {
 102         global $yourls_user_passwords;
 103         if( isset( $yourls_user_passwords[ $_REQUEST['username'] ] ) && yourls_check_password_hash( $yourls_user_passwords[ $_REQUEST['username'] ], $_REQUEST['password'] ) ) {
 104                 yourls_set_user( $_REQUEST['username'] );
 105                 return true;
 106         }
 107         return false;
 108 }
 109
 110 /**
 111  * Check a REQUEST password sent in plain text against stored password which can be a salted hash
 112  *
 113  */
 114 function yourls_check_password_hash( $stored, $plaintext ) {
 115         if ( substr( $stored, 0, 4 ) == 'md5:' and strlen( $stored ) == 42 ) {
 116                 // Stored password is a salted hash: "md5:<$r = rand(10000,99999)>:<md5($r.'thepassword')>"
 117                 // And 42. Of course. http://www.google.com/search?q=the+answer+to+life+the+universe+and+everything
 118                 list( $temp, $salt, $md5 ) = explode( ':', $stored );
 119                 return( $stored == 'md5:'.$salt.':'.md5( $salt.$plaintext ) );
 120         } else {
 121                 // Password was sent in clear
 122                 $message  = '';
 123                 $message .= yourls__( '<strong>Notice</strong>: your password is stored as clear text in your <tt>config.php</tt>' );
 124                 $message .= yourls__( 'Did you know you can easily improve the security of your YOURLS install by <strong>encrypting</strong> your password?' );
 125                 $message .= yourls__( 'See <a href="http://yourls.org/userpassword">UsernamePassword</a> for details' );
 126                 yourls_add_notice( $message, 'notice' );
 127                 return( $stored == $plaintext );
 128         }
 129 }
 130
 131
 132 /**
 133  * Check auth against encrypted COOKIE data. Sets user if applicable, returns bool
 134  *
 135  */
 136 function yourls_check_auth_cookie() {
 137         global $yourls_user_passwords;
 138         foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
 139                 if(
 140                         yourls_salt( $valid_user ) == $_COOKIE['yourls_username']
 141                         && yourls_salt( $valid_password ) == $_COOKIE['yourls_password']
 142                 ) {
 143                         yourls_set_user( $valid_user );
 144                         return true;
 145                 }
 146         }
 147         return false;
 148 }
 149
 150 /**
 151  * Check auth against signature and timestamp. Sets user if applicable, returns bool
 152  *
 153  */
 154 function yourls_check_signature_timestamp() {
 155         // Timestamp in PHP : time()
 156         // Timestamp in JS: parseInt(new Date().getTime() / 1000)
 157         global $yourls_user_passwords;
 158         foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
 159                 if (
 160                         (
 161                                 md5( $_REQUEST['timestamp'].yourls_auth_signature( $valid_user ) ) == $_REQUEST['signature']
 162                                 or
 163                                 md5( yourls_auth_signature( $valid_user ).$_REQUEST['timestamp'] ) == $_REQUEST['signature']
 164                         )
 165                         &&
 166                         yourls_check_timestamp( $_REQUEST['timestamp'] )
 167                         ) {
 168                         yourls_set_user( $valid_user );
 169                         return true;
 170                 }
 171         }
 172         return false;
 173 }
 174
 175 /**
 176  * Check auth against signature. Sets user if applicable, returns bool
 177  *
 178  */
 179 function yourls_check_signature() {
 180         global $yourls_user_passwords;
 181         foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
 182                 if ( yourls_auth_signature( $valid_user ) == $_REQUEST['signature'] ) {
 183                         yourls_set_user( $valid_user );
 184                         return true;
 185                 }
 186         }
 187         return false;
 188 }
 189
 190 /**
 191  * Generate secret signature hash
 192  *
 193  */
 194 function yourls_auth_signature( $username = false ) {
 195         if( !$username && defined('YOURLS_USER') ) {
 196                 $username = YOURLS_USER;
 197         }
 198         return ( $username ? substr( yourls_salt( $username ), 0, 10 ) : 'Cannot generate auth signature: no username' );
 199 }
 200
 201 /**
 202  * Check if timestamp is not too old
 203  *
 204  */
 205 function yourls_check_timestamp( $time ) {
 206         $now = time();
 207         // Allow timestamp to be a little in the future or the past -- see Issue 766
 208         return yourls_apply_filter( 'check_timestamp', abs( $now - $time ) < YOURLS_NONCE_LIFE, $time );
 209 }
 210
 211 /**
 212  * Store new cookie. No $user will delete the cookie.
 213  *
 214  */
 215 function yourls_store_cookie( $user = null ) {
 216         if( !$user ) {
 217                 $pass = null;
 218                 $time = time() - 3600;
 219         } else {
 220                 global $yourls_user_passwords;
 221                 if( isset($yourls_user_passwords[$user]) ) {
 222                         $pass = $yourls_user_passwords[$user];
 223                 } else {
 224                         die( 'Stealing cookies?' ); // This should never happen
 225                 }
 226                 $time = time() + YOURLS_COOKIE_LIFE;
 227         }
 228
 229         $domain   = yourls_apply_filter( 'setcookie_domain',   parse_url( YOURLS_SITE, 1 ) );
 230         $secure   = yourls_apply_filter( 'setcookie_secure',   yourls_is_ssl() );
 231         $httponly = yourls_apply_filter( 'setcookie_httponly', true );
 232
 233         if ( !headers_sent() ) {
 234                 // Set httponly if the php version is >= 5.2.0
 235                 if( version_compare( phpversion(), '5.2.0', 'ge' ) ) {
 236                         setcookie('yourls_username', yourls_salt( $user ), $time, '/', $domain, $secure, $httponly );
 237                         setcookie('yourls_password', yourls_salt( $pass ), $time, '/', $domain, $secure, $httponly );
 238                 } else {
 239                         setcookie('yourls_username', yourls_salt( $user ), $time, '/', $domain, $secure );
 240                         setcookie('yourls_password', yourls_salt( $pass ), $time, '/', $domain, $secure );
 241                 }
 242         }
 243 }
 244
 245 /**
 246  * Set user name
 247  *
 248  */
 249 function yourls_set_user( $user ) {
 250         if( !defined( 'YOURLS_USER' ) )
 251                 define( 'YOURLS_USER', $user );
 252 }