src/Module/Security/Login.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2021, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Module\Security;
  23
  24 use Friendica\BaseModule;
  25 use Friendica\Core\Hook;
  26 use Friendica\Core\Renderer;
  27 use Friendica\Core\Session;
  28 use Friendica\DI;
  29 use Friendica\Module\Register;
  30 use Friendica\Util\Strings;
  31
  32 /**
  33  * Login module
  34  */
  35 class Login extends BaseModule
  36 {
  37         public static function content(array $parameters = [])
  38         {
  39                 $return_path = $_REQUEST['return_path'] ?? '' ;
  40
  41                 if (local_user()) {
  42                         DI::baseUrl()->redirect($return_path);
  43                 } elseif (!empty($return_path)) {
  44                         Session::set('return_path', $return_path);
  45                 }
  46
  47                 return self::form(Session::get('return_path'), intval(DI::config()->get('config', 'register_policy')) !== \Friendica\Module\Register::CLOSED);
  48         }
  49
  50         public static function post(array $parameters = [])
  51         {
  52                 $return_path = Session::get('return_path');
  53                 Session::clear();
  54                 Session::set('return_path', $return_path);
  55
  56                 // OpenId Login
  57                 if (
  58                         empty($_POST['password'])
  59                         && (!empty($_POST['openid_url'])
  60                                 || !empty($_POST['username']))
  61                 ) {
  62                         $openid_url = trim(($_POST['openid_url'] ?? '') ?: $_POST['username']);
  63
  64                         DI::auth()->withOpenId($openid_url, !empty($_POST['remember']));
  65                 }
  66
  67                 if (!empty($_POST['auth-params']) && $_POST['auth-params'] === 'login') {
  68                         DI::auth()->withPassword(
  69                                 DI::app(),
  70                                 trim($_POST['username']),
  71                                 trim($_POST['password']),
  72                                 !empty($_POST['remember'])
  73                         );
  74                 }
  75         }
  76
  77         /**
  78          * Wrapper for adding a login box.
  79          *
  80          * @param string $return_path  The path relative to the base the user should be sent
  81          *                             back to after login completes
  82          * @param bool   $register     If $register == true provide a registration link.
  83          *                             This will most always depend on the value of config.register_policy.
  84          * @param array  $hiddens      optional
  85          *
  86          * @return string Returns the complete html for inserting into the page
  87          *
  88          * @throws \Friendica\Network\HTTPException\InternalServerErrorException
  89          * @hooks 'login_hook' string $o
  90          */
  91         public static function form($return_path = null, $register = false, $hiddens = [])
  92         {
  93                 $o = '';
  94
  95                 $noid = DI::config()->get('system', 'no_openid');
  96
  97                 if ($noid) {
  98                         Session::remove('openid_identity');
  99                         Session::remove('openid_attributes');
 100                 }
 101
 102                 $reg = false;
 103                 if ($register && intval(DI::config()->get('config', 'register_policy')) !== Register::CLOSED) {
 104                         $reg = [
 105                                 'title' => DI::l10n()->t('Create a New Account'),
 106                                 'desc' => DI::l10n()->t('Register'),
 107                                 'url' => self::getRegisterURL()
 108                         ];
 109                 }
 110
 111                 if (is_null($return_path)) {
 112                         $return_path = DI::args()->getQueryString();
 113                 }
 114
 115                 if (local_user()) {
 116                         $tpl = Renderer::getMarkupTemplate('logout.tpl');
 117                 } else {
 118                         DI::page()['htmlhead'] .= Renderer::replaceMacros(
 119                                 Renderer::getMarkupTemplate('login_head.tpl'),
 120                                 [
 121                                         '$baseurl' => DI::baseUrl()->get(true)
 122                                 ]
 123                         );
 124
 125                         $tpl = Renderer::getMarkupTemplate('login.tpl');
 126                         $_SESSION['return_path'] = $return_path;
 127                 }
 128
 129                 if (!empty(Session::get('openid_identity'))) {
 130                         $openid_title = DI::l10n()->t('Your OpenID: ');
 131                         $openid_readonly = true;
 132                         $identity = Session::get('openid_identity');
 133                         $username_desc = DI::l10n()->t('Please enter your username and password to add the OpenID to your existing account.');
 134                 } else {
 135                         $openid_title = DI::l10n()->t('Or login using OpenID: ');
 136                         $openid_readonly = false;
 137                         $identity = '';
 138                         $username_desc = '';
 139                 }
 140
 141                 $o .= Renderer::replaceMacros(
 142                         $tpl,
 143                         [
 144                                 '$dest_url'     => DI::baseUrl()->get(true) . '/login',
 145                                 '$logout'       => DI::l10n()->t('Logout'),
 146                                 '$login'        => DI::l10n()->t('Login'),
 147
 148                                 '$lname'        => ['username', DI::l10n()->t('Nickname or Email: '), '', $username_desc],
 149                                 '$lpassword'    => ['password', DI::l10n()->t('Password: '), '', ''],
 150                                 '$lremember'    => ['remember', DI::l10n()->t('Remember me'), 0,  ''],
 151
 152                                 '$openid'       => !$noid,
 153                                 '$lopenid'      => ['openid_url', $openid_title, $identity, '', $openid_readonly],
 154
 155                                 '$hiddens'      => $hiddens,
 156
 157                                 '$register'     => $reg,
 158
 159                                 '$lostpass'     => DI::l10n()->t('Forgot your password?'),
 160                                 '$lostlink'     => DI::l10n()->t('Password Reset'),
 161
 162                                 '$tostitle'     => DI::l10n()->t('Website Terms of Service'),
 163                                 '$toslink'      => DI::l10n()->t('terms of service'),
 164
 165                                 '$privacytitle' => DI::l10n()->t('Website Privacy Policy'),
 166                                 '$privacylink'  => DI::l10n()->t('privacy policy'),
 167                         ]
 168                 );
 169
 170                 Hook::callAll('login_hook', $o);
 171
 172                 return $o;
 173         }
 174
 175         /**
 176          * Get the URL to the register page and add OpenID parameters to it
 177          */
 178         private static function getRegisterURL()
 179         {
 180                 if (empty(Session::get('openid_identity'))) {
 181                         return 'register';
 182                 }
 183
 184                 $args = [];
 185                 $attr = Session::get('openid_attributes', []);
 186
 187                 if (is_array($attr) && count($attr)) {
 188                         foreach ($attr as $k => $v) {
 189                                 if ($k === 'namePerson/friendly') {
 190                                         $nick = Strings::escapeTags(trim($v));
 191                                 }
 192                                 if ($k === 'namePerson/first') {
 193                                         $first = Strings::escapeTags(trim($v));
 194                                 }
 195                                 if ($k === 'namePerson') {
 196                                         $args['username'] = Strings::escapeTags(trim($v));
 197                                 }
 198                                 if ($k === 'contact/email') {
 199                                         $args['email'] = Strings::escapeTags(trim($v));
 200                                 }
 201                                 if ($k === 'media/image/aspect11') {
 202                                         $photosq = bin2hex(trim($v));
 203                                 }
 204                                 if ($k === 'media/image/default') {
 205                                         $photo = bin2hex(trim($v));
 206                                 }
 207                         }
 208                 }
 209
 210                 if (!empty($nick)) {
 211                         $args['nickname'] = $nick;
 212                 } elseif (!empty($first)) {
 213                         $args['nickname'] = $first;
 214                 }
 215
 216                 if (!empty($photosq)) {
 217                         $args['photo'] = $photosq;
 218                 } elseif (!empty($photo)) {
 219                         $args['photo'] = $photo;
 220                 }
 221
 222                 $args['openid_url'] = Strings::escapeTags(trim(Session::get('openid_identity')));
 223
 224                 return 'register?' . http_build_query($args);
 225         }
 226 }