Phraseanet/lib/classes/Session/Authentication/Native.class.php

<?php

/*
 * This file is part of Phraseanet
 *
 * (c) 2005-2012 Alchemy
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

use Alchemy\Phrasea\Application;

/**
 * Native Authentication for Phraseanet (login/password)
 *
 * @package     Session
 * @license     http://opensource.org/licenses/gpl-3.0 GPLv3
 * @link        www.phraseanet.com
 */
class Session_Authentication_Native implements Session_Authentication_Interface
{
    /**
     *
     * @var Application
     */
    protected $app;

    /**
     *
     * @var boolean
     */
    protected $captcha_challenge_result;

    /**
     *
     * @var string
     */
    protected $login;

    /**
     *
     * @var password
     */
    protected $password;

    /**
     *
     * @var User_Adapter
     */
    protected $user;

    /**
     *
     * @param  Application                        $app
     * @param  string                        $login
     * @param  string                        $password
     * @return Session_Authentication_Native
     */
    public function __construct(Application $app, $login, $password)
    {
        $this->app = $app;
        $this->login = $login;
        $this->password = $password;

        try {
            $usr_id = User_Adapter::get_usr_id_from_login($this->app, $this->login);
            $this->user = User_Adapter::getInstance($usr_id, $this->app);
        } catch (Exception $e) {
            throw new Exception_Unauthorized('User does not exists anymore');
        }

        return $this;
    }

    /**
     *
     * @return User_Adapter
     */
    public function get_user()
    {
        return $this->user;
    }

    /**
     *
     * @param  boolean                       $captcha_challenge_result
     * @return Session_Authentication_Native
     */
    public function set_captcha_challenge($captcha_challenge_result)
    {
        $this->captcha_challenge_result = $captcha_challenge_result;

        return $this;
    }

    public function prelog()
    {
        return $this;
    }

    /**
     *
     * @return user_Adapter
     */
    public function signOn()
    {
        $browser = Browser::getInstance();
        $this->check_and_revoke_badlogs($browser->getIP());

        $this->check_bad_salinity()
            ->check_mail_locked()
            ->challenge_password($browser);

        return $this->user;
    }

    /**
     *
     * @return Session_Authentication_Native
     */
    public function postlog()
    {
        return $this;
    }

    /**
     * Verify if the current user has not verified is account by email
     *
     * @return Session_Authentication_Native
     */
    protected function check_mail_locked()
    {
        $conn = $this->app['phraseanet.appbox']->get_connection();

        $sql = 'SELECT mail_locked, usr_id
        FROM usr
        WHERE usr_id = :usr_id';
        $stmt = $conn->prepare($sql);
        $stmt->execute(array(':usr_id' => $this->user->get_id()));
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        $stmt->closeCursor();

        if ($row && $row['mail_locked'] == "1")
            throw new Exception_Session_MailLocked($this->user->get_id());

        return $this;
    }

    /**
     *
     * @param  Browser                       $browser
     * @return Session_Authentication_Native
     */
    public function challenge_password(Browser $browser = null)
    {
        $conn = $this->app['phraseanet.appbox']->get_connection();

        $sql = 'SELECT usr_id
      FROM usr
      WHERE usr_login = :login
        AND usr.usr_password = :password
        AND usr_login NOT IN ("invite","autoregister")
        AND usr_login NOT LIKE "(#deleted_%"
        AND salted_password = 1
        AND model_of="0" AND invite="0"';

        $salt = User_Adapter::salt_password($this->app, $this->password, $this->user->get_nonce());
        $stmt = $conn->prepare($sql);
        $stmt->execute(array(
            ':login'    => $this->login,
            ':password' => $salt
        ));

        $rs = $stmt->fetchAll(PDO::FETCH_ASSOC);
        $stmt->closeCursor();

        if (count($rs) == 0) {
            if ($browser instanceof Browser)
                $this->save_badlog($browser);
            throw new Exception_Unauthorized('Bad login/Password');
        }

        return $this;
    }

    /**
     *
     * @param  Browser                       $browser
     * @return Session_Authentication_Native
     */
    protected function save_badlog(Browser $browser)
    {
        $conn = $this->app['phraseanet.appbox']->get_connection();
        $date_obj = new DateTime('-5 month');

        $sql = 'DELETE FROM badlog WHERE  date < :date';
        $stmt = $conn->prepare($sql);
        $stmt->execute(array(':date' => $this->app['date-formatter']->format_mysql($date_obj)));
        $stmt->closeCursor();

        $sql = 'INSERT INTO badlog (date,login,pwd,ip,locked)
            VALUES (NOW(), :login, :password, :ip, "1")';

        $params = array(
            ':login'    => $this->login
            , ':password' => $this->password
            , ':ip'       => $browser->getIP()
        );

        $stmt = $conn->prepare($sql);
        $stmt->execute($params);
        $stmt->closeCursor();

        return $this;
    }

    /**
     *
     * @return Session_Authentication_Native
     */
    protected function check_bad_salinity()
    {
        $sql = 'SELECT salted_password
      FROM usr
      WHERE usr_login = :login AND usr_password = :password';

        $params = array(
            ':login'    => $this->login,
            ':password' => hash('sha256', $this->password)
        );

        $stmt = $this->app['phraseanet.appbox']->get_connection()->prepare($sql);
        $stmt->execute($params);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        $stmt->closeCursor();

        if ($row && $row['salted_password'] === '0')
            throw new Exception_Session_BadSalinity('Bad password salinity');

        return $this;
    }

    /**
     *
     * @param  string                        $ip
     * @return Session_Authentication_Native
     */
    protected function check_and_revoke_badlogs($ip)
    {
        $conn = $this->app['phraseanet.appbox']->get_connection();
        $registry = $this->app['phraseanet.registry'];

        $sql = 'SELECT id FROM badlog
            WHERE (login = :login OR ip = :ip) AND locked="1"';

        $params = array(':login' => $this->login, ':ip'    => $ip);

        $stmt = $conn->prepare($sql);
        $stmt->execute($params);
        $row_count = $stmt->rowCount();
        $stmt->closeCursor();

        if ($row_count == 0) {
            return $this;
        }

        if ($this->captcha_challenge_result === true) {
            $sql = 'UPDATE badlog SET locked="0" WHERE (login=:login OR ip=:ip)';
            $stmt = $conn->prepare($sql);
            $stmt->execute(array(':login' => $this->login, ':ip'    => $ip));
            $stmt->closeCursor();
        } elseif ($row_count > 9) {
            if ($this->is_captcha_activated($registry))
                throw new Exception_Session_RequireCaptcha('Require captcha');
        }

        return $this;
    }

    /**
     *
     * @param  registryInterface $registry
     * @return boolean
     */
    protected function is_captcha_activated(registryInterface $registry)
    {
        $registry = $this->app['phraseanet.registry'];

        return ($registry->get('GV_captchas')
            && trim($registry->get('GV_captcha_private_key')) !== ''
            && trim($registry->get('GV_captcha_public_key') !== ''));
    }
}