sessions.php

Go to the documentation of this file.

<?php

use Elgg\SystemMessagesService;
use Elgg\Di\ServiceProvider;

function elgg_get_session() {
    return elgg()->session;
}

function elgg_get_logged_in_user_entity() {
    return elgg()->session->getLoggedInUser();
}

function elgg_get_logged_in_user_guid() {
    return elgg()->session->getLoggedInUserGuid();
}

function elgg_is_logged_in() {
    return elgg()->session->isLoggedIn();
}

function elgg_is_admin_logged_in() {
    return elgg()->session->isAdminLoggedIn();
}

function elgg_is_admin_user($user_guid) {
    
    $user_guid = (int) $user_guid;

    $entity = get_user($user_guid);
    if (!$entity) {
        return false;
    }
    
    return $entity->isAdmin();
}

function elgg_authenticate($username, $password) {
    $pam = new \ElggPAM('user');
    $credentials = ['username' => $username, 'password' => $password];
    $result = $pam->authenticate($credentials);
    if (!$result) {
        return $pam->getFailureMessage();
    }
    return true;
}

function pam_auth_userpass(array $credentials = []) {

    if (!isset($credentials['username']) || !isset($credentials['password'])) {
        return false;
    }

    $user = get_user_by_username($credentials['username']);
    if (!$user) {
        throw new \LoginException(_elgg_services()->translator->translate('LoginException:UsernameFailure'));
    }

    $password_svc = _elgg_services()->passwords;
    $password = $credentials['password'];
    $hash = $user->password_hash;

    if (check_rate_limit_exceeded($user->guid)) {
        throw new \LoginException(_elgg_services()->translator->translate('LoginException:AccountLocked'));
    }

    if (!$password_svc->verify($password, $hash)) {
        log_login_failure($user->guid);
        throw new \LoginException(_elgg_services()->translator->translate('LoginException:PasswordFailure'));
    }

    if ($password_svc->needsRehash($hash)) {
        $password_svc->forcePasswordReset($user, $password);
    }

    return true;
}

function log_login_failure($user_guid) {
    return elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function() use ($user_guid) {
        $user_guid = (int) $user_guid;
        $user = get_entity($user_guid);

        if (($user_guid) && ($user) && ($user instanceof \ElggUser)) {
            $fails = (int) $user->getPrivateSetting("login_failures");
            $fails++;

            $user->setPrivateSetting("login_failures", $fails);
            $user->setPrivateSetting("login_failure_$fails", time());

            return true;
        }

        return false;
    });
}

function reset_login_failure_count($user_guid) {
    return elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function() use ($user_guid) {
        $user_guid = (int) $user_guid;

        $user = get_entity($user_guid);

        if (($user_guid) && ($user) && ($user instanceof \ElggUser)) {
            $fails = (int) $user->getPrivateSetting("login_failures");

            if ($fails) {
                for ($n = 1; $n <= $fails; $n++) {
                    $user->removePrivateSetting("login_failure_$n");
                }

                $user->removePrivateSetting("login_failures");

                return true;
            }

            // nothing to reset
            return true;
        }

        return false;
    });
}

function check_rate_limit_exceeded($user_guid) {
    return elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function() use ($user_guid) {
        // 5 failures in 5 minutes causes temporary block on logins
        $limit = 5;
        $user_guid = (int) $user_guid;
        $user = get_entity($user_guid);

        if (($user_guid) && ($user) && ($user instanceof \ElggUser)) {
            $fails = (int) $user->getPrivateSetting("login_failures");
            if ($fails >= $limit) {
                $cnt = 0;
                $time = time();
                for ($n = $fails; $n > 0; $n--) {
                    $f = $user->getPrivateSetting("login_failure_$n");
                    if ($f > $time - (60 * 5)) {
                        $cnt++;
                    }

                    if ($cnt == $limit) {
                        // Limit reached
                        return true;
                    }
                }
            }
        }

        return false;
    });
}

function elgg_set_cookie(\ElggCookie $cookie) {
    return _elgg_services()->responseFactory->setCookie($cookie);
}

function login(\ElggUser $user, $persistent = false) {
    if ($user->isBanned()) {
        throw new \LoginException(elgg_echo('LoginException:BannedUser'));
    }

    $session = elgg()->session;

    // give plugins a chance to reject the login of this user (no user in session!)
    if (!elgg_trigger_before_event('login', 'user', $user)) {
        throw new \LoginException(elgg_echo('LoginException:Unknown'));
    }

    // #5933: set logged in user early so code in login event will be able to
    // use elgg_get_logged_in_user_entity().
    $session->setLoggedInUser($user);

    // re-register at least the core language file for users with language other than site default
    elgg()->translator->registerTranslations(\Elgg\Project\Paths::elgg() . 'languages/');

    // if remember me checked, set cookie with token and store hash(token) for user
    if ($persistent) {
        _elgg_services()->persistentLogin->makeLoginPersistent($user);
    }

    // User's privilege has been elevated, so change the session id (prevents session fixation)
    $session->migrate();

    $user->setLastLogin();
    reset_login_failure_count($user->guid);

    elgg_trigger_after_event('login', 'user', $user);

    return true;
}

function logout() {
    $session = elgg()->session;
    $user = $session->getLoggedInUser();
    if (!$user) {
        return false;
    }

    if (!elgg_trigger_before_event('logout', 'user', $user)) {
        return false;
    }

    _elgg_services()->persistentLogin->removePersistentLogin();

    // pass along any messages into new session
    $old_msg = $session->get(SystemMessagesService::SESSION_KEY, []);
    $session->invalidate();
    $session->set(SystemMessagesService::SESSION_KEY, $old_msg);

    elgg_trigger_after_event('logout', 'user', $user);

    return true;
}

function _elgg_get_login_forward_url(\Elgg\Request $request, \ElggUser $user) {

    $session = elgg_get_session();
    if ($session->has('last_forward_from')) {
        $forward_url = $session->get('last_forward_from');
        $session->remove('last_forward_from');
        $forward_source = 'last_forward_from';
    } elseif ($request->getParam('returntoreferer')) {
        $forward_url = REFERER;
        $forward_source = 'return_to_referer';
    } else {
        // forward to main index page
        $forward_url = '';
        $forward_source = null;
    }

    $params = [
        'request' => $request,
        'user' => $user,
        'source' => $forward_source,
    ];

    return elgg_trigger_plugin_hook('login:forward', 'user', $params, $forward_url);

}

function _elgg_session_cleanup_persistent_login(\Elgg\Hook $hook) {
    
    $time = (int) $hook->getParam('time', time());
    _elgg_services()->persistentLogin->removeExpiredTokens($time);
}

function _elgg_session_boot(ServiceProvider $services) {
    $services->timer->begin([__FUNCTION__]);

    $session = $services->session;
    $session->start();

    // test whether we have a user session
    if ($session->has('guid')) {
        $user = $services->entityTable->get($session->get('guid'), 'user');
        if (!$user) {
            // OMG user has been deleted.
            $session->invalidate();
            forward('');
        }

        $services->persistentLogin->replaceLegacyToken($user);
    } else {
        $user = $services->persistentLogin->bootSession();
        if ($user) {
            $services->persistentLogin->updateTokenUsage($user);
        }
    }

    if ($user) {
        $session->setLoggedInUser($user);
        $user->setLastAction();

        // logout a user with open session who has been banned
        if ($user->isBanned()) {
            logout();
            return false;
        }
    }

    $services->timer->end([__FUNCTION__]);
    return true;
}

return function(\Elgg\EventsService $events, \Elgg\HooksRegistrationService $hooks) {
    register_pam_handler('pam_auth_userpass');
    
    $hooks->registerHandler('cron', 'daily', '_elgg_session_cleanup_persistent_login');
};