Commit 602895f9 authored by Jonathan Harker's avatar Jonathan Harker

Fix the SQL connection, use PDO and parameters.

parent b1d401af
<?php
/**
*Mediawiki Authentication Plugin for Mahara
*Copyright (C) 2004 Brion Vibber <brion@pobox.com>
*Copyright (C) 2010, 2011 Catalyst IT (http://www.catalyst.net.nz)
* Mahara External Database Authentication
*
*This program is free software; you can redistribute it and/or
*modify it under the terms of the GNU General Public License
*as published by the Free Software Foundation; either version 2
*of the License, or (at your option) any later version.
* This is an authentication plugin for MediaWiki which reads the user table
* in a Mahara database to authenticate MediaWiki logins.
* Requires a valid PDO DSN string, user and password for the database, and
* the Mahara site `passwordsaltmain` setting.
*
*This program is distributed in the hope that it will be useful,
*but WITHOUT ANY WARRANTY; without even the implied warranty of
*MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
*GNU General Public License for more details.
* © Copyright 2010-2016 Catalyst IT http://www.catalyst.net.nz
*
*You should have received a copy of the GNU General Public License
*along with this program; if not, write to the Free Software
*Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
**/
require_once('includes/AuthPlugin.php');
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
require_once "$IP/includes/AuthPlugin.php";
$wgExtensionCredits['other'][] = array(
'name' => 'Mahara Authentication Plugin',
'author' => 'Brett Wilkins',
'url' => 'http://gitorious.org/mahara-contrib/mediawiki-auth-mahara',
'description' => 'Authenticates against users in the Mahara database'
);
);
class MaharaAuthPlugin extends AuthPlugin {
/**
* Check whether there exists a user account with the given name.
* The name will be normalized to MediaWiki's requirements, so
/**
* Check whether there exists a user account with the given name.
* The name will be normalized to MediaWiki's requirements, so
* you might need to munge it (for instance, for lowercase initial
* letters).
*
* @param $username String: username.
* @return bool
*/
var $dbname;
var $host;
var $prefix;
var $dbtype;
var $dbuser;
var $dbpass;
var $passwordsaltmain;
public function __construct($dbname, $host='localhost',$dbtype='', $user='', $password='', $port=5432, $prefix='', $passwordsaltmain='') {
$this->dbname = $dbname;
$this->host = $host;
$this->dbport = $port;
$this->prefix = $prefix;
$this->dbtype = $dbtype;
* letters).
*
* @param $username String: username.
* @return bool
*/
var $pdo_dsn;
var $dbuser;
var $dbpass;
var $prefix;
var $passwordsaltmain;
/**
* Takes a Mahara database PDO DSN string, user and password, table prefix, and password salt.
*/
public function __construct($dsn, $user='', $password='', $prefix='', $passwordsaltmain='') {
$this->pdo_dsn = $dsn;
$this->dbuser = $user;
$this->dbpass = $password;
$this->prefix = $prefix;
$this->passwordsaltmain = $passwordsaltmain;
}
public function userExists( $username ) {
$username = strtolower($username);
$db = $this->getDatabase();
// This will only work for the "internal" auth plugin, where the user's password is stored locally.
$sql = "SELECT username FROM ".$this->prefix."usr u inner join {$this->prefix}auth_instance ai on u.authinstance=ai.id where ai.authname='internal' and LOWER(username) = '".$username."'";
$res = $db->query($sql);
$val = $db->fetchObject($res);
$db->close();
if (!empty($val)) {
return true;
public function userExists($username) {
// This will only work for the "internal" Mahara auth plugin, where the user's password is stored locally.
$sql = "SELECT u.username AS username
FROM {$this->prefix}usr u
INNER JOIN {$this->prefix}auth_instance ai ON u.authinstance = ai.id
WHERE ai.authname = 'internal'
AND LOWER(u.username) = :username
AND deleted != 1";
$params = array(
'username' => strtolower($username),
);
try {
$db = $this->getDatabase();
$query = $db->prepare($sql);
$query->execute($params);
$row = $query->fetchObject();
$db->close();
if (!empty($row)) {
return true;
}
return false;
} catch (PDOException $e) {
die('FATAL: could not authenticate with mahara.org - please try again later.<br>' . $e->getMessage());
}
return false;
}
/**
* Check if a username+password pair is a valid login.
* The name will be normalized to MediaWiki's requirements, so
* you might need to munge it (for instance, for lowercase initial
* letters).
*
* @param $username String: username.
* @param $password String: user password.
* @return bool
*/
public function authenticate( $username, $password ) {
$username = strtolower($username);
$db = $this->getDatabase();
$sql = "SELECT username, password, salt FROM ".$this->prefix."usr where LOWER(username) = '".$username."' and deleted != 1";
$res = $db->query($sql);
$val = $db->fetchObject($res);
$db->close();
if (!empty($val)) {
return $this->_validate_password($password, $val->password, $val->salt);
}
/**
* Check if a username+password pair is a valid login.
* The name will be normalized to MediaWiki's requirements, so
* you might need to munge it (for instance, for lowercase initial
* letters).
*
* @param $username String: username.
* @param $password String: user password.
* @return bool
*/
public function authenticate($username, $password) {
$username = strtolower($username);
$sql = "SELECT u.username AS username, u.password AS password, u.salt AS salt
FROM {$this->prefix}usr u
INNER JOIN {$this->prefix}auth_instance ai ON u.authinstance = ai.id
WHERE ai.authname = 'internal'
AND LOWER(username) = :username
AND deleted != 1";
$params = array(
'username' => strtolower($username),
);
try {
$db = $this->getDatabase();
$query = $db->prepare($sql);
$query->execute($params);
$row = $query->fetchObject();
$db->close();
if (!empty($row)) {
return $this->_validate_password($password, $row->password, $row->salt);
}
return false;
} catch (PDOException $e) {
die('FATAL: could not authenticate with mahara.org - please try again later.<br>' . $e->getMessage());
}
return false;
}
}
/**
* Given a password that the user has sent, the password we have for them
......@@ -175,208 +208,223 @@ class MaharaAuthPlugin extends AuthPlugin {
}
/**
* Modify options in the login template.
*
* @param $template UserLoginTemplate object.
*/
public function modifyUITemplate( &$template, &$type ) {
# Override this!
$template->set( 'usedomain', false );
}
/**
* Set the domain this plugin is supposed to use when authenticating.
*
* @param $domain String: authentication domain.
*/
public function setDomain( $domain ) {
$this->domain = $domain;
}
/**
* Check to see if the specific domain is a valid domain.
*
* @param $domain String: authentication domain.
* @return bool
*/
public function validDomain( $domain ) {
# Override this!
return true;
}
/**
* When a user logs in, optionally fill in preferences and such.
* For instance, you might pull the email address or real name from the
* external user database.
*
* The User object is passed by reference so it can be modified; don't
* forget the & on your function declaration.
*
* @param User $user
*/
public function updateUser( &$user ) {
$db = $this->getDatabase();
$sql = "SELECT * FROM ".$this->prefix."usr where LOWER(username) = LOWER('".$user->mName."')";
$res = $db->query($sql);
$val = $db->fetchObject($res);
$db->close();
$user->setOption('nickname',$val->username);
$user->setEmail($val->email);
$user->setRealName($val->firstname.' '.$val->lastname);
if (($val->admin == 1) and !(in_array('sysop',$user->getGroups()))) { // Now checks whether user is already a sysop before adding group (2015-05-28)
$user->addGroup('sysop');
} else if (in_array('sysop',$user->getGroups())) {
$user->removeGroup('sysop');
}
return true;
}
/**
* Return true if the wiki should create a new local account automatically
* when asked to login a user who doesn't exist locally but does in the
* external auth database.
*
* If you don't automatically create accounts, you must still create
* accounts in some way. It's not possible to authenticate without
* a local account.
*
* This is just a question, and shouldn't perform any actions.
*
* @return bool
*/
public function autoCreate() {
return true;
}
/**
* Can users change their passwords?
*
* @return bool
*/
public function allowPasswordChange() {
return false;
}
/**
* Set the given password in the authentication database.
* As a special case, the password may be set to null to request
* locking the password to an unusable value, with the expectation
* that it will be set later through a mail reset or other method.
*
* Return true if successful.
*
* @param $user User object.
* @param $password String: password.
* @return bool
*/
public function setPassword( $user, $password ) {
return false;
}
/**
* Update user information in the external authentication database.
* Return true if successful.
*
* @param $user User object.
* @return bool
*/
public function updateExternalDB( $user ) {
return false;
}
/**
* Check to see if external accounts can be created.
* Return true if external accounts can be created.
* @return bool
*/
public function canCreateAccounts() {
return false;
}
/**
* Add a user to the external authentication database.
* Return true if successful.
*
* @param User $user - only the name should be assumed valid at this point
* @param string $password
* @param string $email
* @param string $realname
* @return bool
*/
public function addUser( $user, $password, $email='', $realname='' ) {
return false;
}
/**
* Return true to prevent logins that don't authenticate here from being
* checked against the local database's password fields.
*
* This is just a question, and shouldn't perform any actions.
*
* @return bool
*/
public function strict() {
return true;
}
/**
* Check if a user should authenticate locally if the global authentication fails.
* If either this or strict() returns true, local authentication is not used.
*
* @param $username String: username.
* @return bool
*/
public function strictUserAuth( $username ) {
return true;
}
/**
* When creating a user account, optionally fill in preferences and such.
* For instance, you might pull the email address or real name from the
* external user database.
*
* The User object is passed by reference so it can be modified; don't
* forget the & on your function declaration.
*
* @param $user User object.
* @param $autocreate bool True if user is being autocreated on login
*/
public function initUser( &$user, $autocreate=false ) {
* Modify options in the login template.
*
* @param $template UserLoginTemplate object.
*/
public function modifyUITemplate(&$template) {
# Override this!
$template->set('usedomain', false);
}
/**
* Set the domain this plugin is supposed to use when authenticating.
*
* @param $domain String: authentication domain.
*/
public function setDomain($domain) {
$this->domain = $domain;
}
/**
* Check to see if the specific domain is a valid domain.
*
* @param $domain String: authentication domain.
* @return bool
*/
public function validDomain($domain) {
# Override this!
return true;
}
/**
* When a user logs in, optionally fill in preferences and such.
* For instance, you might pull the email address or real name from the
* external user database.
*
* The User object is passed by reference so it can be modified; don't
* forget the & on your function declaration.
*
* @param User $user
*/
public function updateUser(&$user) {
$sql = "SELECT *
FROM {$this->prefix}usr u
INNER JOIN {$this->prefix}auth_instance ai ON u.authinstance = ai.id
WHERE ai.authname = 'internal'
AND LOWER(u.username) = :username
AND deleted != 1";
$params = array(
'username' => strtolower($user->mName),
);
try {
$db = $this->getDatabase();
$query = $db->prepare($sql);
$query->execute($params);
$row = $query->fetchObject();
$db->close();
$user->setOption('nickname',$row->username);
$user->setEmail($row->email);
$user->setRealName($row->firstname.' '.$row->lastname);
if ($row->admin == 1) {
$user->addGroup('sysop');
} else if (in_array('sysop', $user->getGroups())) {
$user->removeGroup('sysop');
}
return true;
} catch (PDOException $e) {
die('FATAL: could not authenticate with mahara.org - please try again later.<br>' . $e->getMessage());
}
}
/**
* Return true if the wiki should create a new local account automatically
* when asked to login a user who doesn't exist locally but does in the
* external auth database.
*
* If you don't automatically create accounts, you must still create
* accounts in some way. It's not possible to authenticate without
* a local account.
*
* This is just a question, and shouldn't perform any actions.
*
* @return bool
*/
public function autoCreate() {
return true;
}
/**
* Can users change their passwords?
*
* @return bool
*/
public function allowPasswordChange() {
return false;
}
/**
* Set the given password in the authentication database.
* As a special case, the password may be set to null to request
* locking the password to an unusable value, with the expectation
* that it will be set later through a mail reset or other method.
*
* Return true if successful.
*
* @param $user User object.
* @param $password String: password.
* @return bool
*/
public function setPassword($user, $password) {
return false;
}
/**
* Update user information in the external authentication database.
* Return true if successful.
*
* @param $user User object.
* @return bool
*/
public function updateExternalDB($user) {
return false;
}
/**
* Check to see if external accounts can be created.
* Return true if external accounts can be created.
* @return bool
*/
public function canCreateAccounts() {
return false;
}
/**
* Add a user to the external authentication database.
* Return true if successful.
*
* @param User $user - only the name should be assumed valid at this point
* @param string $password
* @param string $email
* @param string $realname
* @return bool
*/
public function addUser($user, $password, $email='', $realname='') {
return false;
}
/**
* Return true to prevent logins that don't authenticate here from being
* checked against the local database's password fields.
*
* This is just a question, and shouldn't perform any actions.
*
* @return bool
*/
public function strict() {
return true;
}
/**
* Check if a user should authenticate locally if the global authentication fails.
* If either this or strict() returns true, local authentication is not used.
*
* @param $username String: username.
* @return bool
*/
public function strictUserAuth($username) {
return true;
}
/**
* When creating a user account, optionally fill in preferences and such.
* For instance, you might pull the email address or real name from the
* external user database.
*
* The User object is passed by reference so it can be modified; don't
* forget the & on your function declaration.
*
* @param $user User object.
* @param $autocreate bool True if user is being autocreated on login
*/
public function initUser(&$user, $autocreate=false) {
return $this->updateUser($user);
}
/**
* If you want to munge the case of an account name before the final
* check, now is your chance.
*/
public function getCanonicalName( $username ) {
return $username;
}
/**
* Get an instance of a User object
*
* @param $user User
* @public
*/
public function getUserInstance( User &$user ) {
return new AuthPluginUser( $user );
}
private function getDatabase() {
if (empty($this->dbtype)) {
return false;
}
return Database::factory($this->dbtype, array(
'host' => $this->host . ":" . $this->dbport,
'user' => $this->dbuser,
'password' => $this->dbpass,
'dbname' => $this->dbname
));
}
}
}
/**
* If you want to munge the case of an account name before the final
* check, now is your chance.
*/
public function getCanonicalName($username) {
return $username;
}
/**
* Get an instance of a User object
*
* @param $user User
* @public
*/
public function getUserInstance(User &$user) {
return new AuthPluginUser($user);
}
/**
* Return a connection-pooled static PDO connection to the Mahara database.
*/
private function getDatabase() {
$flags = array(
PDO::ATTR_PERSISTENT => true,
);
try {
$connection = new PDO($this->pdo_dsn, $this->dbuser, $this->dbpass, $flags);
return $connection;
} catch (PDOException $e) {
die("FATAL: could not connect to the Mahara database. Please try again later.<br>{$this->pdo_dsn}<br>{$e->getMessage()}");
}
}
}
......@@ -8,12 +8,13 @@ Installation
To install this plugin, follow these steps:
1. Copy MaharaAuthPlugin.php into the includes directory in your mediawiki instance.
1. Copy this extension into the extensions directory
2. Add the following to your LocalSettings.php file:
```php
$wgAutoloadLocalClasses['MaharaAuthPlugin'] = 'includes/MaharaAuthPlugin.php';
$wgAuth = new MaharaAuthPlugin('maharadbname', 'dbhost', 'dbtype', 'dbuser',
'dbpass', 'prefix', 'passwordsaltmain');
$wgAutoloadLocalClasses['MaharaAuthPlugin'] = 'extensions/MaharaAuth/MaharaAuthPlugin.php';
$wgAuth = new MaharaAuthPlugin('pdo_dsn', 'dbuser', 'dbpass', 'prefix', 'passwordsaltmain');
```
3. Replacing maharadbname, dbhost, dbtype, dbuser, dbpass, prefix, and
passwordsaltmain with the respective values in your setup.
3. Replacing pdo_dsn, dbuser, dbpass, prefix, and passwordsaltmain with the respective values in
your setup.
For information about PDO connection strings (DSN) see http://php.net/manual/en/book.pdo.php
MaharaAuthPlugin.php var/lib/mediawiki/extensions/MaharaAuth
MaharaAuthPlugin.php var/www/mediawiki/extensions/MaharaAuth