| Index: trunk/phase3/includes/User.php |
| — | — | @@ -1377,8 +1377,17 @@ |
| 1378 | 1378 | * @return bool True if the given password is correct otherwise False. |
| 1379 | 1379 | */ |
| 1380 | 1380 | function checkPassword( $password ) { |
| 1381 | | - global $wgAuth; |
| | 1381 | + global $wgAuth, $wgMinimalPasswordLength; |
| 1382 | 1382 | $this->loadFromDatabase(); |
| | 1383 | + |
| | 1384 | + // Even though we stop people from creating passwords that |
| | 1385 | + // are shorter than this, doesn't mean people wont be able |
| | 1386 | + // to. Certain authentication plugins do NOT want to save |
| | 1387 | + // domain passwords in a mysql database, so we should |
| | 1388 | + // check this (incase $wgAuth->strict() is false). |
| | 1389 | + if( strlen( $password ) < $wgMinimalPasswordLength ) { |
| | 1390 | + return false; |
| | 1391 | + } |
| 1383 | 1392 | |
| 1384 | 1393 | if( $wgAuth->authenticate( $this->getName(), $password ) ) { |
| 1385 | 1394 | return true; |
| Index: trunk/phase3/includes/SpecialUserlogin.php |
| — | — | @@ -27,7 +27,7 @@ |
| 28 | 28 | class LoginForm { |
| 29 | 29 | var $mName, $mPassword, $mRetype, $mReturnto, $mCookieCheck, $mPosted; |
| 30 | 30 | var $mAction, $mCreateaccount, $mCreateaccountMail, $mMailmypassword; |
| 31 | | - var $mLoginattempt, $mRemember, $mEmail; |
| | 31 | + var $mLoginattempt, $mRemember, $mEmail, $mDomain; |
| 32 | 32 | |
| 33 | 33 | /** |
| 34 | 34 | * Constructor |
| — | — | @@ -35,10 +35,12 @@ |
| 36 | 36 | */ |
| 37 | 37 | function LoginForm( &$request ) { |
| 38 | 38 | global $wgLang, $wgAllowRealName, $wgEnableEmail; |
| | 39 | + global $wgAuth; |
| 39 | 40 | |
| 40 | 41 | $this->mName = $request->getText( 'wpName' ); |
| 41 | 42 | $this->mPassword = $request->getText( 'wpPassword' ); |
| 42 | 43 | $this->mRetype = $request->getText( 'wpRetype' ); |
| | 44 | + $this->mDomain = $request->getText( 'wpDomain' ); |
| 43 | 45 | $this->mReturnto = $request->getVal( 'returnto' ); |
| 44 | 46 | $this->mCookieCheck = $request->getVal( 'wpCookieCheck' ); |
| 45 | 47 | $this->mPosted = $request->wasPosted(); |
| — | — | @@ -61,7 +63,12 @@ |
| 62 | 64 | } else { |
| 63 | 65 | $this->mRealName = ''; |
| 64 | 66 | } |
| 65 | | - |
| | 67 | + |
| | 68 | + if( !$wgAuth->validDomain( $this->mDomain ) ) { |
| | 69 | + $this->mDomain = 'invaliddomain'; |
| | 70 | + } |
| | 71 | + $wgAuth->setDomain( $this->mDomain ); |
| | 72 | + |
| 66 | 73 | # When switching accounts, it sucks to get automatically logged out |
| 67 | 74 | if( $this->mReturnto == $wgLang->specialPage( 'Userlogout' ) ) { |
| 68 | 75 | $this->mReturnto = ''; |
| — | — | @@ -155,7 +162,29 @@ |
| 156 | 163 | global $wgMaxNameChars; |
| 157 | 164 | global $wgMemc, $wgAccountCreationThrottle, $wgDBname, $wgIP; |
| 158 | 165 | global $wgMinimalPasswordLength; |
| | 166 | + global $wgAuth; |
| 159 | 167 | |
| | 168 | + // If the user passes an invalid domain, something is fishy |
| | 169 | + if( !$wgAuth->validDomain( $this->mDomain ) ) { |
| | 170 | + $this->mainLoginForm( wfMsg( 'wrongpassword' ) ); |
| | 171 | + return false; |
| | 172 | + } |
| | 173 | + |
| | 174 | + // If we are not allowing users to login locally, we should |
| | 175 | + // be checking to see if the user is actually able to |
| | 176 | + // authenticate to the authentication server before they |
| | 177 | + // create an account (otherwise, they can create a local account |
| | 178 | + // and login as any domain user). We only need to check this for |
| | 179 | + // domains that aren't local. |
| | 180 | + if( 'local' != $this->mDomain && '' != $this->mDomain ) { |
| | 181 | + if( !$wgAuth->canCreateAccounts() && ( !$wgAuth->userExists( $this->mName ) || !$wgAuth->authenticate( $this->mName, $this->mPassword ) ) ) { |
| | 182 | + $this->mainLoginForm( wfMsg( 'wrongpassword' ) ); |
| | 183 | + return false; |
| | 184 | + } |
| | 185 | + } |
| | 186 | + |
| | 187 | + |
| | 188 | + |
| 160 | 189 | if (!$wgUser->isAllowedToCreateAccount()) { |
| 161 | 190 | $this->userNotPrivilegedMessage(); |
| 162 | 191 | return false; |
| — | — | @@ -205,6 +234,11 @@ |
| 206 | 235 | } |
| 207 | 236 | } |
| 208 | 237 | |
| | 238 | + if( !$wgAuth->addUser( $u, $this->mPassword ) ) { |
| | 239 | + $this->mainLoginForm( wfMsg( 'externaldberror' ) ); |
| | 240 | + return false; |
| | 241 | + } |
| | 242 | + |
| 209 | 243 | return $this->initUser( $u ); |
| 210 | 244 | } |
| 211 | 245 | |
| — | — | @@ -238,6 +272,7 @@ |
| 239 | 273 | */ |
| 240 | 274 | function processLogin() { |
| 241 | 275 | global $wgUser; |
| | 276 | + global $wgAuth; |
| 242 | 277 | |
| 243 | 278 | if ( '' == $this->mName ) { |
| 244 | 279 | $this->mainLoginForm( wfMsg( 'noname' ) ); |
| — | — | @@ -284,6 +319,8 @@ |
| 285 | 320 | } |
| 286 | 321 | $u->setOption( 'rememberpassword', $r ); |
| 287 | 322 | |
| | 323 | + $wgAuth->updateUser( $u ); |
| | 324 | + |
| 288 | 325 | $wgUser = $u; |
| 289 | 326 | $wgUser->setCookies(); |
| 290 | 327 | |
| — | — | @@ -395,6 +432,7 @@ |
| 396 | 433 | function mainLoginForm( $err ) { |
| 397 | 434 | global $wgUser, $wgOut, $wgLang; |
| 398 | 435 | global $wgDBname, $wgAllowRealName, $wgEnableEmail; |
| | 436 | + global $wgAuth; |
| 399 | 437 | |
| 400 | 438 | if ( '' == $this->mName ) { |
| 401 | 439 | if ( $wgUser->isLoggedIn() ) { |
| — | — | @@ -418,6 +456,7 @@ |
| 419 | 457 | $template->set( 'retype', $this->mRetype ); |
| 420 | 458 | $template->set( 'email', $this->mEmail ); |
| 421 | 459 | $template->set( 'realname', $this->mRealName ); |
| | 460 | + $template->set( 'domain', $this->mDomain ); |
| 422 | 461 | |
| 423 | 462 | $template->set( 'action', $titleObj->getLocalUrl( $q ) ); |
| 424 | 463 | $template->set( 'error', $err ); |
| — | — | @@ -426,6 +465,7 @@ |
| 427 | 466 | $template->set( 'userealname', $wgAllowRealName ); |
| 428 | 467 | $template->set( 'useemail', $wgEnableEmail ); |
| 429 | 468 | $template->set( 'remember', $wgUser->getOption( 'rememberpassword' ) or $this->mRemember ); |
| | 469 | + $wgAuth->modifyUITemplate( $template ); |
| 430 | 470 | |
| 431 | 471 | $wgOut->setPageTitle( wfMsg( 'userlogin' ) ); |
| 432 | 472 | $wgOut->setRobotpolicy( 'noindex,nofollow' ); |
| Index: trunk/phase3/includes/AuthPlugin.php |
| — | — | @@ -68,6 +68,56 @@ |
| 69 | 69 | } |
| 70 | 70 | |
| 71 | 71 | /** |
| | 72 | + * Modify options in the login template. |
| | 73 | + * |
| | 74 | + * @param UserLoginTemplate $template |
| | 75 | + * @access public |
| | 76 | + */ |
| | 77 | + function modifyUITemplate( &$template ) { |
| | 78 | + # Override this! |
| | 79 | + $template->set( 'usedomain', false ); |
| | 80 | + } |
| | 81 | + |
| | 82 | + /** |
| | 83 | + * Set the domain this plugin is supposed to use when authenticating. |
| | 84 | + * |
| | 85 | + * @param string $domain |
| | 86 | + * @access public |
| | 87 | + */ |
| | 88 | + function setDomain( $domain ) { |
| | 89 | + $this->domain = $domain; |
| | 90 | + } |
| | 91 | + |
| | 92 | + /** |
| | 93 | + * Check to see if the specific domain is a valid domain. |
| | 94 | + * |
| | 95 | + * @param string $domain |
| | 96 | + * @return bool |
| | 97 | + * @access public |
| | 98 | + */ |
| | 99 | + function validDomain( $domain ) { |
| | 100 | + # Override this! |
| | 101 | + return true; |
| | 102 | + } |
| | 103 | + |
| | 104 | + /** |
| | 105 | + * When a user logs in, optionally fill in preferences and such. |
| | 106 | + * For instance, you might pull the email address or real name from the |
| | 107 | + * external user database. |
| | 108 | + * |
| | 109 | + * The User object is passed by reference so it can be modified; don't |
| | 110 | + * forget the & on your function declaration. |
| | 111 | + * |
| | 112 | + * @param User $user |
| | 113 | + * @access public |
| | 114 | + */ |
| | 115 | + function updateUser( &$user ) { |
| | 116 | + # Override this and do something |
| | 117 | + return true; |
| | 118 | + } |
| | 119 | + |
| | 120 | + |
| | 121 | + /** |
| 72 | 122 | * Return true if the wiki should create a new local account automatically |
| 73 | 123 | * when asked to login a user who doesn't exist locally but does in the |
| 74 | 124 | * external auth database. |
| — | — | @@ -86,6 +136,54 @@ |
| 87 | 137 | } |
| 88 | 138 | |
| 89 | 139 | /** |
| | 140 | + * Set the given password in the authentication database. |
| | 141 | + * Return true if successful. |
| | 142 | + * |
| | 143 | + * @param string $password |
| | 144 | + * @return bool |
| | 145 | + * @access public |
| | 146 | + */ |
| | 147 | + function setPassword( $password ) { |
| | 148 | + return true; |
| | 149 | + } |
| | 150 | + |
| | 151 | + /** |
| | 152 | + * Update user information in the external authentication database. |
| | 153 | + * Return true if successful. |
| | 154 | + * |
| | 155 | + * @param User $user |
| | 156 | + * @return bool |
| | 157 | + * @access public |
| | 158 | + */ |
| | 159 | + function updateExternalDB( $user ) { |
| | 160 | + return true; |
| | 161 | + } |
| | 162 | + |
| | 163 | + /** |
| | 164 | + * Check to see if external accounts can be created. |
| | 165 | + * Return true if external accounts can be created. |
| | 166 | + * @return bool |
| | 167 | + * @access public |
| | 168 | + */ |
| | 169 | + function canCreateAccounts() { |
| | 170 | + return false; |
| | 171 | + } |
| | 172 | + |
| | 173 | + /** |
| | 174 | + * Add a user to the external authentication database. |
| | 175 | + * Return true if successful. |
| | 176 | + * |
| | 177 | + * @param User $user |
| | 178 | + * @param string $password |
| | 179 | + * @return bool |
| | 180 | + * @access public |
| | 181 | + */ |
| | 182 | + function addUser( $user, $password ) { |
| | 183 | + return true; |
| | 184 | + } |
| | 185 | + |
| | 186 | + |
| | 187 | + /** |
| 90 | 188 | * Return true to prevent logins that don't authenticate here from being |
| 91 | 189 | * checked against the local database's password fields. |
| 92 | 190 | * |
| — | — | @@ -114,4 +212,4 @@ |
| 115 | 213 | } |
| 116 | 214 | } |
| 117 | 215 | |
| 118 | | -?> |
| \ No newline at end of file |
| | 216 | +?> |
| Index: trunk/phase3/includes/SpecialPreferences.php |
| — | — | @@ -180,7 +180,9 @@ |
| 181 | 181 | global $wgUser, $wgLang, $wgOut; |
| 182 | 182 | global $wgEnableUserEmail, $wgEnableEmail; |
| 183 | 183 | global $wgEmailAuthentication, $wgMinimalPasswordLength; |
| | 184 | + global $wgAuth; |
| 184 | 185 | |
| | 186 | + |
| 185 | 187 | if ( '' != $this->mNewpass ) { |
| 186 | 188 | if ( $this->mNewpass != $this->mRetypePass ) { |
| 187 | 189 | $this->mainPrefsForm( wfMsg( 'badretype' ) ); |
| — | — | @@ -196,6 +198,10 @@ |
| 197 | 199 | $this->mainPrefsForm( wfMsg( 'wrongpassword' ) ); |
| 198 | 200 | return; |
| 199 | 201 | } |
| | 202 | + if (!$wgAuth->setPassword( $wgUser, $this->mNewpass )) { |
| | 203 | + $this->mainPrefsForm( wfMsg( 'externaldberror' ) ); |
| | 204 | + return; |
| | 205 | + } |
| 200 | 206 | $wgUser->setPassword( $this->mNewpass ); |
| 201 | 207 | } |
| 202 | 208 | $wgUser->setRealName( $this->mRealName ); |
| — | — | @@ -233,6 +239,10 @@ |
| 234 | 240 | foreach ( $this->mToggles as $tname => $tvalue ) { |
| 235 | 241 | $wgUser->setOption( $tname, $tvalue ); |
| 236 | 242 | } |
| | 243 | + if (!$wgAuth->updateExternalDB($wgUser)) { |
| | 244 | + $this->mainPrefsForm( wfMsg( 'externaldberror' ) ); |
| | 245 | + return; |
| | 246 | + } |
| 237 | 247 | $wgUser->setCookies(); |
| 238 | 248 | $wgUser->saveSettings(); |
| 239 | 249 | |
| Index: trunk/phase3/includes/templates/Userlogin.php |
| — | — | @@ -49,6 +49,21 @@ |
| 50 | 50 | value="<?php $this->msg('login') ?>" /> |
| 51 | 51 | </td> |
| 52 | 52 | </tr> |
| | 53 | + <?php if( $this->data['usedomain'] ) { |
| | 54 | + $doms = ""; |
| | 55 | + foreach( $this->data['domainnames'] as $dom ) { |
| | 56 | + $doms .= "<option>" . htmlspecialchars( $dom ) . "</option>"; |
| | 57 | + } |
| | 58 | + ?> |
| | 59 | + <tr> |
| | 60 | + <td align='right'><?php $this->msg( 'yourdomainname' ) ?>:</td> |
| | 61 | + <td align='left'> |
| | 62 | + <select tabindex='11' name="wpDomain" value="<?php $this->text( 'domain' ) ?>"> |
| | 63 | + <?php echo $doms ?> |
| | 64 | + </select> |
| | 65 | + </td> |
| | 66 | + </tr> |
| | 67 | + <?php } ?> |
| 53 | 68 | <?php if( $this->data['create'] ) { ?> |
| 54 | 69 | <tr> |
| 55 | 70 | <td colspan='3'> </td> |
| — | — | @@ -110,4 +125,4 @@ |
| 111 | 126 | } |
| 112 | 127 | } |
| 113 | 128 | |
| 114 | | -?> |
| \ No newline at end of file |
| | 129 | +?> |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -240,6 +240,8 @@ |
| 241 | 241 | * Removed -f parameter from mail() usage, likely to cause failures and bounces. |
| 242 | 242 | * (bug 2130) Fixed interwiki links with fragments |
| 243 | 243 | * (bug 684) Accept an attribute parameter array on parser hook tags |
| | 244 | +* (bug 814) Integrate AuthPlugin changes to support Ryan Lane's external |
| | 245 | + LDAP authentication plugin |
| 244 | 246 | |
| 245 | 247 | |
| 246 | 248 | === Caveats === |
| Index: trunk/phase3/languages/Language.php |
| — | — | @@ -570,6 +570,8 @@ |
| 571 | 571 | 'yourpasswordagain' => 'Retype password', |
| 572 | 572 | 'newusersonly' => ' (new users only)', |
| 573 | 573 | 'remembermypassword' => 'Remember my password across sessions.', |
| | 574 | +'yourdomainname' => 'Your domain', |
| | 575 | +'externaldberror' => 'There was either an external authentication database error or you are not allowed to update your external account.', |
| 574 | 576 | 'loginproblem' => '<b>There has been a problem with your login.</b><br />Try again!', |
| 575 | 577 | 'alreadyloggedin' => "<font color=red><b>User $1, you are already logged in!</b></font><br />\n", |
| 576 | 578 | |