login.php
156 lines
| 1 | <?php |
| 2 | /** |
| 3 | * @package VikAppointments |
| 4 | * @subpackage core |
| 5 | * @author E4J s.r.l. |
| 6 | * @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved. |
| 7 | * @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL |
| 8 | * @link https://vikwp.com |
| 9 | */ |
| 10 | |
| 11 | // No direct access |
| 12 | defined('ABSPATH') or die('No script kiddies please!'); |
| 13 | |
| 14 | /** |
| 15 | * VikAppointments API user implementors. |
| 16 | * This class is used from the framework to connect the users and to authorise the events. |
| 17 | * |
| 18 | * @see VAPApiUser |
| 19 | * @see VAPApiEvents |
| 20 | * |
| 21 | * @since 1.7 |
| 22 | */ |
| 23 | class VAPApiLogin extends VAPApiUser |
| 24 | { |
| 25 | /** |
| 26 | * Class constructor. |
| 27 | * |
| 28 | * @param string $username The username of the user for login. |
| 29 | * @param string $password The password of the user for login. |
| 30 | * @param string $ip The IP address from which the user is trying to login. |
| 31 | * |
| 32 | * @uses isUsernameAccepted() Validate if the provided username mets the structure requirements. |
| 33 | * @uses isPasswordAccepted() Validate if the provided password mets the structure requirements. |
| 34 | * @uses hashMask() Mask the password with the chosen hash algorithm. |
| 35 | */ |
| 36 | public function __construct($username, $password, $ip = null) |
| 37 | { |
| 38 | // tries to recover username and password through HTTP BASIC AUTH headers |
| 39 | if (!$username && !$password) |
| 40 | { |
| 41 | // access server superglobal |
| 42 | $server = JFactory::getApplication()->input->server; |
| 43 | |
| 44 | // try to extract username and password from headers |
| 45 | $username = $server->getString('PHP_AUTH_USER'); |
| 46 | $password = $server->getString('PHP_AUTH_PW'); |
| 47 | } |
| 48 | |
| 49 | // dispatch parent |
| 50 | parent::__construct($username, $password, $ip); |
| 51 | } |
| 52 | |
| 53 | /** |
| 54 | * Check if the user is able to perform the event provided. |
| 55 | * The authorisations of the users are stored in the database. |
| 56 | * |
| 57 | * @param VAPApiEvent $event The event to authorise. |
| 58 | * |
| 59 | * @return boolean True if the event can be performed, otherwise false. |
| 60 | */ |
| 61 | public function authorise(VAPApiEvent $event) |
| 62 | { |
| 63 | // if user is not connected and the event is null : not authorised |
| 64 | if (!$this->id() || $event === null) |
| 65 | { |
| 66 | return false; |
| 67 | } |
| 68 | |
| 69 | // if the event is always allowed (see connection ping) : authorise |
| 70 | if ($event->alwaysAllowed()) |
| 71 | { |
| 72 | return true; |
| 73 | } |
| 74 | |
| 75 | // otherwise check rules in user settings |
| 76 | |
| 77 | $dbo = JFactory::getDbo(); |
| 78 | |
| 79 | $q = $dbo->getQuery(true); |
| 80 | |
| 81 | $q->select($dbo->qn('denied')) |
| 82 | ->from($dbo->qn('#__vikappointments_api_login')) |
| 83 | ->where($dbo->qn('id') . ' = ' . $dbo->q($this->id())); |
| 84 | |
| 85 | $dbo->setQuery($q, 0, 1); |
| 86 | $denied_plugins = $dbo->loadResult(); |
| 87 | |
| 88 | if ($denied_plugins === null) |
| 89 | { |
| 90 | return false; |
| 91 | } |
| 92 | |
| 93 | // the database contains only the denied plugins |
| 94 | $denied_plugins = $denied_plugins ? json_decode($denied_plugins) : []; |
| 95 | |
| 96 | // make sure the specified event is not included in the list of the denied plugins |
| 97 | return !in_array($event->getName(), $denied_plugins); |
| 98 | } |
| 99 | |
| 100 | /** |
| 101 | * Return true if the given username owns a valid structure. |
| 102 | * The provided username is valid whether all the conditions below are verified: |
| 103 | * - it can contain only letters, numbers, underscores or dots (no white spaces) |
| 104 | * - its length is between 3 and 128 characters |
| 105 | * |
| 106 | * @param string $username The username to check. |
| 107 | * |
| 108 | * @return boolean True in case the username is valid. |
| 109 | */ |
| 110 | protected function isUsernameAccepted($username) |
| 111 | { |
| 112 | // [0-9A-Za-z._] - accepted characters |
| 113 | // {3,128} - have to be 3-128 characters |
| 114 | // 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._ |
| 115 | return preg_match("/^[0-9A-Za-z._]{3,128}$/", $username); |
| 116 | } |
| 117 | |
| 118 | /** |
| 119 | * Return true if the given password owns a valid structure. |
| 120 | * The provided password is valid whether all the conditions below are verified: |
| 121 | * - it can contain only letters, numbers or these !?@#$%{}[]()_-. symbols |
| 122 | * - its length is between 8 and 128 characters |
| 123 | * - it contains at least one number |
| 124 | * - it contains at least one letter |
| 125 | * |
| 126 | * @param string $password The password to check. |
| 127 | * |
| 128 | * @return boolean True in case the password is valid. |
| 129 | */ |
| 130 | protected function isPasswordAccepted($password) |
| 131 | { |
| 132 | // (?=.*\d) - at least one number |
| 133 | // (?=.*[A-Za-z]) - at least one letter |
| 134 | // [0-9A-Za-z!@#$%{}[]()_-.] - accepted characters |
| 135 | // {8,128} - have to be 8-128 characters |
| 136 | // 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!?@#$%{}[]()_-. |
| 137 | return preg_match('/^(?=.*\d)(?=.*[A-Za-z])[0-9A-Za-z!?@#$%_.\-{\[()\]}]{8,128}$/', $password); |
| 138 | } |
| 139 | |
| 140 | /** |
| 141 | * Return the specified password without changes. |
| 142 | * Do NOT apply any hash because the password must be stored as it is. |
| 143 | * |
| 144 | * @param string $password The password to mask. |
| 145 | * |
| 146 | * @return string The same provided password. |
| 147 | */ |
| 148 | protected function hashMask($password) |
| 149 | { |
| 150 | // example return md5($password); |
| 151 | |
| 152 | // no hash mask is applied |
| 153 | return $password; |
| 154 | } |
| 155 | } |
| 156 |