sessions.php

Go to the documentation of this file.

<?php
use Elgg\Di\InternalContainer;
use Elgg\Exceptions\LoginException;
use Elgg\SystemMessagesService;

function elgg_get_session() {
    return _elgg_services()->session;
}

function elgg_get_logged_in_user_entity() {
    return _elgg_services()->session->getLoggedInUser();
}

function elgg_get_logged_in_user_guid() {
    return _elgg_services()->session->getLoggedInUserGuid();
}

function elgg_is_logged_in() {
    return _elgg_services()->session->isLoggedIn();
}

function elgg_is_admin_logged_in() {
    return _elgg_services()->session->isAdminLoggedIn();
}

function elgg_authenticate($username, $password) {
    $pam = new \ElggPAM('user');
    $credentials = ['username' => $username, 'password' => $password];
    $result = $pam->authenticate($credentials);
    if (!$result) {
        return $pam->getFailureMessage();
    }
    return true;
}

function pam_auth_userpass(array $credentials = []) {

    if (!isset($credentials['username']) || !isset($credentials['password'])) {
        return false;
    }

    return elgg_call(ELGG_SHOW_DISABLED_ENTITIES, function() use ($credentials) {
        $user = get_user_by_username($credentials['username']);
        if (!$user) {
            throw new LoginException(_elgg_services()->translator->translate('LoginException:UsernameFailure'));
        }

        $password_svc = _elgg_services()->passwords;
        $password = $credentials['password'];
        $hash = $user->password_hash;

        if (check_rate_limit_exceeded($user->guid)) {
            throw new LoginException(_elgg_services()->translator->translate('LoginException:AccountLocked'));
        }
        if (!$password_svc->verify($password, $hash)) {
            log_login_failure($user->guid);
            throw new LoginException(_elgg_services()->translator->translate('LoginException:PasswordFailure'));
        }

        if ($password_svc->needsRehash($hash)) {
            $password_svc->forcePasswordReset($user, $password);
        }

        return true;
    });
}

function log_login_failure($user_guid) {
    return elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function() use ($user_guid) {
        $user_guid = (int) $user_guid;
        $user = get_entity($user_guid);

        if (($user_guid) && ($user) && ($user instanceof \ElggUser)) {
            $fails = (int) $user->getPrivateSetting("login_failures");
            $fails++;

            $user->setPrivateSetting("login_failures", $fails);
            $user->setPrivateSetting("login_failure_$fails", time());

            return true;
        }

        return false;
    });
}

function reset_login_failure_count($user_guid) {
    return elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function() use ($user_guid) {
        $user_guid = (int) $user_guid;

        $user = get_entity($user_guid);

        if (($user_guid) && ($user) && ($user instanceof \ElggUser)) {
            $fails = (int) $user->getPrivateSetting("login_failures");

            if ($fails) {
                for ($n = 1; $n <= $fails; $n++) {
                    $user->removePrivateSetting("login_failure_$n");
                }

                $user->removePrivateSetting("login_failures");

                return true;
            }

            // nothing to reset
            return true;
        }

        return false;
    });
}

function check_rate_limit_exceeded($user_guid) {
    return elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function() use ($user_guid) {
        // 5 failures in 5 minutes causes temporary block on logins
        $limit = 5;
        $user_guid = (int) $user_guid;
        $user = get_entity($user_guid);

        if (($user_guid) && ($user) && ($user instanceof \ElggUser)) {
            $fails = (int) $user->getPrivateSetting("login_failures");
            if ($fails >= $limit) {
                $cnt = 0;
                $time = time();
                for ($n = $fails; $n > 0; $n--) {
                    $f = $user->getPrivateSetting("login_failure_$n");
                    if ($f > $time - (60 * 5)) {
                        $cnt++;
                    }

                    if ($cnt == $limit) {
                        // Limit reached
                        return true;
                    }
                }
            }
        }

        return false;
    });
}

function elgg_set_cookie(\ElggCookie $cookie) {
    return _elgg_services()->responseFactory->setCookie($cookie);
}

function login(\ElggUser $user, $persistent = false) {
    if ($user->isBanned()) {
        throw new LoginException(elgg_echo('LoginException:BannedUser'));
    }

    // give plugins a chance to reject the login of this user (no user in session!)
    if (!elgg_trigger_before_event('login', 'user', $user)) {
        throw new LoginException(elgg_echo('LoginException:Unknown'));
    }

    if (!$user->isEnabled()) {
        throw new LoginException(elgg_echo('LoginException:DisabledUser'));
    }

    // #5933: set logged in user early so code in login event will be able to
    // use elgg_get_logged_in_user_entity().
    $session = _elgg_services()->session;
    $session->setLoggedInUser($user);

    // re-register at least the core language file for users with language other than site default
    _elgg_services()->translator->registerTranslations(\Elgg\Project\Paths::elgg() . 'languages/');

    // if remember me checked, set cookie with token and store hash(token) for user
    if ($persistent) {
        _elgg_services()->persistentLogin->makeLoginPersistent($user);
    }

    // User's privilege has been elevated, so change the session id (prevents session fixation)
    $session->migrate();

    // check before updating last login to determine first login
    $first_login = empty($user->last_login);
    
    $user->setLastLogin();
    reset_login_failure_count($user->guid);

    elgg_trigger_after_event('login', 'user', $user);
    
    if ($first_login) {
        elgg_trigger_event('login:first', 'user', $user);
        $user->first_login = time();
    }

    return true;
}

function logout() {
    $session = _elgg_services()->session;
    $user = $session->getLoggedInUser();
    if (!$user) {
        return false;
    }

    if (!elgg_trigger_before_event('logout', 'user', $user)) {
        return false;
    }

    _elgg_services()->persistentLogin->removePersistentLogin();

    // pass along any messages into new session
    $old_msg = $session->get(SystemMessagesService::SESSION_KEY, []);
    $session->invalidate();
    $session->set(SystemMessagesService::SESSION_KEY, $old_msg);

    elgg_trigger_after_event('logout', 'user', $user);

    return true;
}

function _elgg_get_login_forward_url(\Elgg\Request $request, \ElggUser $user) {

    $session = elgg_get_session();
    if ($session->has('last_forward_from')) {
        $forward_url = $session->get('last_forward_from');
        $session->remove('last_forward_from');
        $forward_source = 'last_forward_from';
    } elseif ($request->getParam('returntoreferer')) {
        $forward_url = REFERER;
        $forward_source = 'return_to_referer';
    } else {
        // forward to main index page
        $forward_url = '';
        $forward_source = null;
    }

    $params = [
        'request' => $request,
        'user' => $user,
        'source' => $forward_source,
    ];

    return elgg_trigger_plugin_hook('login:forward', 'user', $params, $forward_url);

}