wamo/gnu-social
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[AuthCrypt] Update README and fix formatting

Browse Source
This commit is contained in:
Diogo Cordeiro 2020-07-25 17:42:46 +01:00 committed by Diogo Peralta Cordeiro
parent 360fc0262b
commit c85feeaa1f
4 changed files with 184 additions and 213 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
lib/modules/AuthenticationModule.php
View File

@ -1,42 +1,36 @@
<?php <?php
// This file is part of GNU social - https://www.gnu.org/software/social
//
// GNU social is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// GNU social is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with GNU social. If not, see <http://www.gnu.org/licenses/>.
/** /**
* StatusNet, the distributed open-source microblogging tool
*
* Superclass for plugins that do authentication and/or authorization * Superclass for plugins that do authentication and/or authorization
* *
* PHP version 5
*
* LICENCE: This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* @category Plugin * @category Plugin
* @package StatusNet * @package GNUsocial
*
* @author Craig Andrews <candrews@integralblue.com> * @author Craig Andrews <candrews@integralblue.com>
* @copyright 2009 Free Software Foundation, Inc http://www.fsf.org * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 * @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
* @link http://status.net/
*/ */
if (!defined('GNUSOCIAL')) { exit(1); } defined('GNUSOCIAL') || die;
/** /**
* Superclass for plugins that do authentication * Superclass for plugins that do authentication
* *
* @category Module * @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
* @package GNUsocial
* @author Craig Andrews <candrews@integralblue.com>
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
* @link http://status.net/
*/ */
abstract class AuthenticationModule extends Module abstract class AuthenticationModule extends Module
{ {
@ -50,16 +44,18 @@ abstract class AuthenticationModule extends Module
public $password_changeable = true; public $password_changeable = true;
//unique name for this authentication provider //unique name for this authentication provider
public $provider_name; public $provider_name = null;
//------------Auth plugin should implement some (or all) of these methods------------\\ //------------Auth plugin should implement some (or all) of these methods------------\\
/** /**
* Check if a nickname/password combination is valid * Check if a nickname/password combination is valid
* @param username *
* @param password * @param string $username
* @return boolean true if the credentials are valid, false if they are invalid. * @param string $password
*
* @return bool true if the credentials are valid, false if they are invalid.
*/ */
function checkPassword($username, $password) public function checkPassword($username, $password)
{ {
return false; return false;
} }
@ -67,16 +63,18 @@ abstract class AuthenticationModule extends Module
/** /**
* Automatically register a user when they attempt to login with valid credentials. * Automatically register a user when they attempt to login with valid credentials.
* User::register($data) is a very useful method for this implementation * User::register($data) is a very useful method for this implementation
* @param username username (that is used to login and find the user in the authentication provider) of the user to be registered *
* @param nickname nickname of the user in the SN system. If nickname is null, then set nickname = username * @param string $username username (that is used to login and find the user in the authentication provider) of the user to be registered
* @param null|string $nickname nickname of the user in the SN system. If nickname is null, then set nickname = username
*
* @return mixed instance of User, or false (if user couldn't be created) * @return mixed instance of User, or false (if user couldn't be created)
*/ */
function autoRegister($username, $nickname = null) public function autoRegister($username, $nickname = null)
{ {
if (is_null($nickname)) { if (is_null($nickname)) {
$nickname = $username; $nickname = $username;
} }
$registration_data = array(); $registration_data = [];
$registration_data['nickname'] = $nickname; $registration_data['nickname'] = $nickname;
return User::register($registration_data); return User::register($registration_data);
} }
@ -84,12 +82,14 @@ abstract class AuthenticationModule extends Module
/** /**
* Change a user's password * Change a user's password
* The old password has been verified to be valid by this plugin before this call is made * The old password has been verified to be valid by this plugin before this call is made
* @param username *
* @param oldpassword * @param string $username
* @param newpassword * @param string $oldpassword
* @return boolean true if the password was changed, false if password changing failed for some reason * @param string $newpassword
*
* @return bool true if the password was changed, false if password changing failed for some reason
*/ */
function changePassword($username,$oldpassword,$newpassword) public function changePassword($username, $oldpassword, $newpassword)
{ {
return false; return false;
} }
@ -101,28 +101,32 @@ abstract class AuthenticationModule extends Module
* nice looking nicknames when users initially sign on * nice looking nicknames when users initially sign on
* All nicknames returned by this function should be valid * All nicknames returned by this function should be valid
* implementations may want to use common_nicknamize() to ensure validity * implementations may want to use common_nicknamize() to ensure validity
* @param username *
* @param string $username
*
* @return string nickname * @return string nickname
*/ */
function suggestNicknameForUsername($username) public function suggestNicknameForUsername($username)
{ {
return common_nicknamize($username); return common_nicknamize($username);
} }
//------------Below are the methods that connect StatusNet to the implementing Auth plugin------------\\ //------------Below are the methods that connect StatusNet to the implementing Auth plugin------------\\
function onInitializePlugin(){ public function onInitializePlugin()
if(!isset($this->provider_name)){ {
throw new Exception("must specify a provider_name for this authentication provider"); if (is_null($this->provider_name)) {
throw new Exception('must specify a provider_name for this authentication provider');
} }
} }
/** /**
* Internal AutoRegister event handler * Internal AutoRegister event handler
* @param nickname *
* @param provider_name * @param string $nickname
* @param user - the newly registered user * @param string $provider_name
* @param User $user - the newly registered user
*/ */
function onAutoRegister($nickname, $provider_name, &$user) public function onAutoRegister($nickname, $provider_name, &$user)
{ {
if ($provider_name == $this->provider_name && $this->autoregistration) { if ($provider_name == $this->provider_name && $this->autoregistration) {
$suggested_nickname = $this->suggestNicknameForUsername($nickname); $suggested_nickname = $this->suggestNicknameForUsername($nickname);
@ -145,7 +149,8 @@ abstract class AuthenticationModule extends Module
} }
} }
function onStartCheckPassword($nickname, $password, &$authenticatedUser){ public function onStartCheckPassword($nickname, $password, &$authenticatedUser)
{
//map the nickname to a username //map the nickname to a username
$user_username = new User_username(); $user_username = new User_username();
$user_username->username = $nickname; $user_username->username = $nickname;
@ -182,7 +187,7 @@ abstract class AuthenticationModule extends Module
} else { } else {
$authenticated = $this->checkPassword($nickname, $password); $authenticated = $this->checkPassword($nickname, $password);
if ($authenticated) { if ($authenticated) {
if(! Event::handle('AutoRegister', array($nickname, $this->provider_name, &$authenticatedUser))){ if (!Event::handle('AutoRegister', [$nickname, $this->provider_name, &$authenticatedUser])) {
//unlike most Event::handle lines of code, this one has a ! (not) //unlike most Event::handle lines of code, this one has a ! (not)
//we want to do this if the event *was* handled - this isn't a "default" implementation //we want to do this if the event *was* handled - this isn't a "default" implementation
//like most code of this form. //like most code of this form.
@ -201,7 +206,7 @@ abstract class AuthenticationModule extends Module
} }
} }
function onStartChangePassword(Profile $target ,$oldpassword, $newpassword) public function onStartChangePassword(Profile $target, $oldpassword, $newpassword)
{ {
if ($this->password_changeable) { if ($this->password_changeable) {
$user_username = new User_username(); $user_username = new User_username();
@ -238,7 +243,7 @@ abstract class AuthenticationModule extends Module
} }
} }
function onStartAccountSettingsPasswordMenuItem($widget) public function onStartAccountSettingsPasswordMenuItem($widget)
{ {
if ($this->authoritative && !$this->password_changeable) { if ($this->authoritative && !$this->password_changeable) {
//since we're authoritative, no other plugin could change passwords, so do not render the menu item //since we're authoritative, no other plugin could change passwords, so do not render the menu item
@ -246,13 +251,14 @@ abstract class AuthenticationModule extends Module
} }
} }
function onCheckSchema() { public function onCheckSchema()
{
$schema = Schema::get(); $schema = Schema::get();
$schema->ensureTable('user_username', User_username::schemaDef()); $schema->ensureTable('user_username', User_username::schemaDef());
return true; return true;
} }
function onUserDeleteRelated($user, &$tables) public function onUserDeleteRelated($user, &$tables)
{ {
$tables[] = 'User_username'; $tables[] = 'User_username';
return true; return true;

91
modules/AuthCrypt/AuthCryptModule.php
View File

@ -1,50 +1,44 @@
<?php <?php
// This file is part of GNU social - https://www.gnu.org/software/social
//
// GNU social is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// GNU social is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with GNU social. If not, see <http://www.gnu.org/licenses/>.
/** /**
* StatusNet, the distributed open-source microblogging tool
*
* Module to use crypt() for user password hashes * Module to use crypt() for user password hashes
* *
* PHP version 5
*
* LICENCE: This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* @category Module * @category Module
* @package GNUsocial * @package GNUsocial
* @author Mikael Nordfeldth <mmn@hethane.se> * @author Mikael Nordfeldth <mmn@hethane.se>
* @copyright 2012 StatusNet, Inc. * @copyright 2012 StatusNet, Inc.
* @copyright 2013 Free Software Foundation, Inc http://www.fsf.org * @copyright 2013 Free Software Foundation, Inc http://www.fsf.org
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 * @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
* @link http://www.gnu.org/software/social/
*/ */
if (!defined('GNUSOCIAL')) { exit(1); } defined('GNUSOCIAL') || die;
class AuthCryptModule extends AuthenticationModule class AuthCryptModule extends AuthenticationModule
{ {
const MODULE_VERSION = '2.0.0'; const MODULE_VERSION = '2.0.0';
protected $hash = '$6$'; // defaults to SHA512, i.e. '$6$', in onInitializeModule()
protected $statusnet = true; // if true, also check StatusNet style password hash protected $statusnet = true; // if true, also check StatusNet style password hash
protected $overwrite = true; // if true, password change means overwrite with crypt() protected $overwrite = true; // if true, password change means overwrite with crypt()
protected $argon = false; // Use Argon if supported. protected $argon = false; // Use Argon if supported.
public $provider_name = 'password_hash'; // not actually used public $provider_name = 'crypt'; // not actually used
/* // FUNCTIONALITY
* FUNCTIONALITY
*/
function checkPassword($username, $password) public function checkPassword($username, $password)
{ {
$username = Nickname::normalize($username); $username = Nickname::normalize($username);
@ -79,24 +73,12 @@ class AuthCryptModule extends AuthenticationModule
return false; return false;
} }
protected function cryptSalt($len=CRYPT_SALT_LENGTH)
{
$chars = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
$salt = '';
for ($i=0; $i<$len; $i++) {
$salt .= $chars[mt_rand(0, strlen($chars)-1)];
}
return $salt;
}
// $oldpassword is already verified when calling this function... shouldn't this be private?! // $oldpassword is already verified when calling this function... shouldn't this be private?!
function changePassword($username, $oldpassword, $newpassword) public function changePassword($username, $oldpassword, $newpassword)
{ {
$username = Nickname::normalize($username); $username = Nickname::normalize($username);
if($this->overwrite == false) { if (!$this->overwrite) {
return false; return false;
} }
@ -104,24 +86,24 @@ class AuthCryptModule extends AuthenticationModule
if (empty($user)) { if (empty($user)) {
return false; return false;
} }
$original = clone($user); $original = clone $user;
$user->password = $this->hashPassword($newpassword, $user->getProfile()); $user->password = $this->hashPassword($newpassword, $user->getProfile());
return (true === $user->validate() && $user->update($original)); return $user->validate() === true && $user->update($original);
} }
public function hashPassword($password, Profile $profile=null) public function hashPassword($password, ?Profile $profile = null)
{ {
$algorithm = PASSWORD_DEFAULT; $algorithm = PASSWORD_DEFAULT;
$options = ['cost' => 12]; $options = ['cost' => 12];
if($this->argon == true && version_compare(PHP_VERSION, '7.2.0') == 1) { if ($this->argon) {
$algorithm = PASSWORD_ARGON2I; $algorithm = PASSWORD_ARGON2I;
$options = [ $options = [
'memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST, 'memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST,
'time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST, 'time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST,
'threads' => PASSWORD_ARGON2_DEFAULT_THREADS 'threads' => PASSWORD_ARGON2_DEFAULT_THREADS,
]; ];
} }
// Use the modern password hashing algorithm // Use the modern password hashing algorithm
@ -130,9 +112,7 @@ class AuthCryptModule extends AuthenticationModule
return password_hash($password, $algorithm, $options); return password_hash($password, $algorithm, $options);
} }
/* // EVENTS
* EVENTS
*/
public function onStartChangePassword(Profile $target, $oldpassword, $newpassword) public function onStartChangePassword(Profile $target, $oldpassword, $newpassword)
{ {
@ -146,17 +126,17 @@ class AuthCryptModule extends AuthenticationModule
} }
$changed = $this->changePassword($target->getNickname(), $oldpassword, $newpassword); $changed = $this->changePassword($target->getNickname(), $oldpassword, $newpassword);
return (!$changed && empty($this->authoritative)); return !$changed && empty($this->authoritative);
} }
public function onStartCheckPassword($nickname, $password, &$authenticatedUser) public function onStartCheckPassword($nickname, $password, &$authenticatedUser)
{ {
$authenticatedUser = $this->checkPassword($nickname, $password); $authenticatedUser = $this->checkPassword($nickname, $password);
// if we failed, only return false to stop plugin execution if we're authoritative // if we failed, only return false to stop plugin execution if we're authoritative
return (!($authenticatedUser instanceof User) && empty($this->authoritative)); return !($authenticatedUser instanceof User) && empty($this->authoritative);
} }
public function onStartHashPassword(&$hashed, $password, Profile $profile=null) public function onStartHashPassword(&$hashed, $password, ?Profile $profile = null)
{ {
$hashed = $this->hashPassword($password, $profile); $hashed = $this->hashPassword($password, $profile);
return false; return false;
@ -176,13 +156,14 @@ class AuthCryptModule extends AuthenticationModule
public function onModuleVersion(array &$versions): bool public function onModuleVersion(array &$versions): bool
{ {
$versions[] = array('name' => 'AuthCrypt', $versions[] = [
'name' => 'AuthCrypt',
'version' => self::MODULE_VERSION, 'version' => self::MODULE_VERSION,
'author' => 'Mikael Nordfeldth', 'author' => 'Mikael Nordfeldth',
'homepage' => GNUSOCIAL_ENGINE_REPO_URL . 'tree/master/plugins/AuthCrypt', 'homepage' => GNUSOCIAL_ENGINE_REPO_URL . 'tree/master/plugins/AuthCrypt',
'rawdescription' => 'rawdescription' => // TRANS: Module description.
// TRANS: Module description. _m('Authentication and password hashing with crypt()')
_m('Authentication and password hashing with crypt()')); ];
return true; return true;
} }
} }

36
modules/AuthCrypt/README
View File

@ -1,36 +0,0 @@
AuthCrypt allows for StatusNet and GNU social to use crypt() hashing to store password credentials.
Requirements
============
Nothing out of the ordinary (SHA512 is supported natively since PHP 5.3.2)
Installation
============
Add either of the following configurations to your config.php (see Example below for more options):
The recommended use is to overwrite old hash values when logging in (statusnet + overwrite modes) and be the authority on password checks when logging in. If you only wish to update entries on password change the default values are enough. 'statusnet' and 'overwrite' are true by default. 'authoritative' is only necessary if we want to exclude other plugins from verifying the password.
addModule('AuthCrypt');
To disable updating to crypt() on password change (and login with the 'statusnet' compatibility mode), simply set the 'overwrite' setting to false:
addModule('AuthCrypt', array(
'overwrite'=>false,
));
Settings
========
Default values in parenthesis. Many settings are inherited from the AuthenticationModule class.
authoritative (false): Set this to true when _all_ passwords are hashed with crypt()
(warning: this may disable all other password verification, also when changing passwords!)
hash ('$6$'): Hash signature to use, defaults to SHA512. See all supported strings at http://php.net/crypt
(warning: set this to something crypt() understands, or you will default to the very weak 2-char DES scheme)
statusnet (true): Do we check the password against legacy StatusNet md5 hash?
(notice: will check password login against old-style hash and if 'overwrite' is enabled update using crypt())
overwrite (true): Do we overwrite old style password hashes with crypt() hashes on password change?
(notice: to make use of stronger security or migrate to crypt() hashes, this must be true)
password_changeable (true): Enables or disables password changing.
(notice: if combined with authoritative, it disables changing passwords and removes option from menu.)
autoregistration: This setting is ignored. Password can never be valid without existing User.
provider_name: This setting defaults to 'crypt' but is never stored anywhere.

20
modules/AuthCrypt/README.md Normal file
View File

@ -0,0 +1,20 @@
AuthCrypt allows for GNU social to use password_hash() hashing to store password credentials.
Settings
========
You can change these settings in `config.php` with `$config['AuthCryptModule'][{setting name}] = {new setting value};`.
Default values in parenthesis.
authoritative (false): Set this to true when _all_ passwords are hashed with crypt()
(warning: this may disable all other password verification, also when changing passwords!)
statusnet (true): Do we check the password against legacy StatusNet md5 hash?
(notice: will check password login against old-style hash and if 'overwrite' is enabled update using crypt())
overwrite (true): Do we overwrite old style password hashes with crypt() hashes on password change?
(notice: to make use of stronger security or migrate to crypt() hashes, this must be true)
password_changeable (true): Enables or disables password changing.
(notice: if combined with authoritative, it disables changing passwords and removes option from menu.)
autoregistration: This setting is ignored. Password can never be valid without existing User.
provider_name: This setting defaults to 'crypt' but is never stored anywhere.
Technical note: Many settings are inherited from the AuthenticationModule class.