Page MenuHomeWickedGov Phorge
Files F5963395

AntiSpoofPreAuthenticationProvider.php
No OneTemporary
Actions

Size
5 KB
Referenced Files
None
Subscribers
None

AntiSpoofPreAuthenticationProvider.php
View Options

<?php
/**
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
* http://www.gnu.org/copyleft/gpl.html
*/
namespace MediaWiki\Extension\AntiSpoof;
use MediaWiki\Auth\AbstractPreAuthenticationProvider;
use MediaWiki\Auth\AuthenticationRequest;
use MediaWiki\Auth\AuthManager;
use MediaWiki\Context\RequestContext;
use MediaWiki\Language\RawMessage;
use MediaWiki\Message\Message;
use MediaWiki\Permissions\PermissionManager;
use MediaWiki\User\User;
use MediaWiki\User\UserIdentity;
use Psr\Log\LoggerInterface;
use Psr\Log\NullLogger;
use StatusValue;
class AntiSpoofPreAuthenticationProvider extends AbstractPreAuthenticationProvider {
/** @var bool False effectively disables this provider, but spoofed names will still be logged. */
protected $antiSpoofAccounts;
/** @var PermissionManager */
private $permissionManager;
/**
* @param PermissionManager $permissionManager
* @param array $params Options:
* - antiSpoofAccounts: (bool) stop spoofed accounts from being created. When false, only log.
*/
public function __construct( PermissionManager $permissionManager, array $params = [] ) {
global $wgAntiSpoofAccounts;
$params += [ 'antiSpoofAccounts' => $wgAntiSpoofAccounts ];
$this->antiSpoofAccounts = $params['antiSpoofAccounts'];
$this->permissionManager = $permissionManager;
}
/** @inheritDoc */
public function getAuthenticationRequests( $action, array $options ) {
$needed = false;
switch ( $action ) {
case AuthManager::ACTION_CREATE:
$user = User::newFromName( $options['username'] ) ?: new User();
$needed = $this->antiSpoofAccounts
&& $this->permissionManager->userHasAnyRight( $user, 'override-antispoof' );
break;
}
return $needed ? [ new AntiSpoofAuthenticationRequest() ] : [];
}
/** @inheritDoc */
public function testForAccountCreation( $user, $creator, array $reqs ) {
/** @var AntiSpoofAuthenticationRequest $req */
$req = AuthenticationRequest::getRequestByClass( $reqs, AntiSpoofAuthenticationRequest::class );
$override = $req && $req->ignoreAntiSpoof && $creator->isAllowed( 'override-antispoof' );
return $this->testUserInternal( $user, $override, $this->logger );
}
/**
* @param UserIdentity $user
* @param bool $override
* @param LoggerInterface $logger
* @return StatusValue
*/
private function testUserInternal( UserIdentity $user, $override, LoggerInterface $logger ) {
$name = $user->getName();
$spoofUser = $this->getSpoofUser( $user );
$mode = !$this->antiSpoofAccounts ? 'LOGGING ' : ( $override ? 'OVERRIDE ' : '' );
$active = $this->antiSpoofAccounts && !$override;
if ( $spoofUser->isLegal() ) {
$normalized = $spoofUser->getNormalized();
$conflicts = $spoofUser->getConflicts();
if ( !$conflicts ) {
$logger->debug( "{mode}PASS new account '{name}' [{normalized}]", [
'mode' => $mode,
'name' => $name,
'normalized' => $normalized,
] );
} else {
$logger->info( "{mode}CONFLICT new account '{name}' [{normalized}] spoofs {spoofs}", [
'mode' => $mode,
'name' => $name,
'normalized' => $normalized,
'spoofs' => $conflicts,
] );
if ( $active ) {
$list = [];
foreach ( $conflicts as $simUser ) {
$list[] = "* " . wfMessage( 'antispoof-conflict-item', $simUser )->plain();
}
$list = implode( "\n", $list );
return StatusValue::newFatal(
'antispoof-conflict',
$name,
Message::numParam( count( $conflicts ) ),
// Avoid forced wikitext escaping for params in the Status class
new RawMessage( $list )
);
}
}
} else {
$error = $spoofUser->getErrorStatus();
$logger->info( "{mode}ILLEGAL new account '{name}' {error}", [
'mode' => $mode,
'name' => $name,
'error' => $error->getMessage( false, false, 'en' )->text(),
] );
if ( $active ) {
return StatusValue::newFatal( 'antispoof-name-illegal', $name,
$error->getMessage() );
}
}
return StatusValue::newGood();
}
/** @inheritDoc */
public function testUserForCreation( $user, $autocreate, array $options = [] ) {
$sv = StatusValue::newGood();
// For "cancreate" checks via the API, test if the current user could
// create the username.
if ( $this->antiSpoofAccounts && !$autocreate && empty( $options['creating'] ) &&
!$this->permissionManager->userHasAnyRight( RequestContext::getMain()->getUser(), 'override-antispoof' )
) {
$sv->merge( $this->testUserInternal( $user, false, new NullLogger ) );
}
return $sv;
}
/**
* @param UserIdentity $user
* @return SpoofUser
*/
protected function getSpoofUser( UserIdentity $user ) {
return new SpoofUser( $user->getName() );
}
}

File Metadata

Mime Type
text/x-php
Expires
Sat, Oct 3, 09:36 (1 w, 3 d ago)
Storage Engine
local-disk
Storage Format
Raw Data
Storage Handle
84/e5/4f703c0ba51baadb4742aab17199
Default Alt Text
AntiSpoofPreAuthenticationProvider.php (5 KB)

Event Timeline