Online PHP editor | perf for LSWbZ

<?php /** * @file classes/security/Validation.inc.php * * Copyright (c) 2013-2015 Simon Fraser University Library * Copyright (c) 2003-2015 John Willinsky * Distributed under the GNU GPL v2. For full terms see the file docs/COPYING. * * @class Validation * @ingroup security * * @brief Class providing user validation/authentication operations. */ import('classes.security.Role'); import('classes.security.password'); class Validation { /** * Authenticate user credentials and mark the user as logged in in the current session. * @param $username string * @param $password string unencrypted password * @param $reason string reference to string to receive the reason an account was disabled; null otherwise * @param $remember boolean remember a user's session past the current browser session * @return User the User associated with the login credentials, or false if the credentials are invalid */ function &login($username, $password, &$reason, $remember = false) { $implicitAuth = Config::getVar('security', 'implicit_auth'); $reason = null; $valid = false; $userDao =& DAORegistry::getDAO('UserDAO'); if ($implicitAuth) { // Implicit auth if (!Validation::isLoggedIn()) { PluginRegistry::loadCategory('implicitAuth'); // Call the implicitAuth hook. It will set user. HookRegistry::call('ImplicitAuthPlugin::implicitAuth', array(&$user)); $valid=true; } } else { // Regular Auth $user =& $userDao->getByUsername($username, true); if (!isset($user)) { // User does not exist return $valid; } if ($user->getAuthId()) { $authDao =& DAORegistry::getDAO('AuthSourceDAO'); $auth =& $authDao->getPlugin($user->getAuthId()); } if (isset($auth)) { // Validate against remote authentication source $valid = $auth->authenticate($username, $password); if ($valid) { $oldEmail = $user->getEmail(); $auth->doGetUserInfo($user); if ($user->getEmail() != $oldEmail) { // FIXME OJS requires email addresses to be unique; if changed email already exists, ignore if ($userDao->userExistsByEmail($user->getEmail())) { $user->setEmail($oldEmail); } } } } else { // Validate against OJS user database $valid = Validation::verifyPassword($username, $password, $user->getPassword(), $rehash); if ($valid && !empty($rehash)) { // update to new hashing algorithm $user->setPassword($rehash); } } } if (!$valid) { // Login credentials are invalid return $valid; } else { if ($user->getDisabled()) { // The user has been disabled. $reason = $user->getDisabledReason(); if ($reason === null) $reason = ''; $valid = false; return $valid; } // The user is valid, mark user as logged in in current session $sessionManager =& SessionManager::getManager(); // Regenerate session ID first $sessionManager->regenerateSessionId(); $session =& $sessionManager->getUserSession(); $session->setSessionVar('userId', $user->getId()); $session->setUserId($user->getId()); $session->setSessionVar('username', $user->getUsername()); $session->setRemember($remember); if ($remember && Config::getVar('general', 'session_lifetime') > 0) { // Update session expiration time $sessionManager->updateSessionLifetime(time() + Config::getVar('general', 'session_lifetime') * 86400); } $user->setDateLastLogin(Core::getCurrentDate()); $userDao->updateObject($user); return $user; } } /** * verify if the input password is correct * * @param string $username the string username * @param string $password the plaintext password * @param string $hash the password hash from the database * @param string &$rehash if password needs rehash, this variable is used * @return boolean */ function verifyPassword($username, $password, $hash, &$rehash) { if (LEGACY_ENCRYPTION) { // BCRYPT not supported return $hash === Validation::encryptCredentials($username, $password, false, true); } else if (password_needs_rehash($hash, PASSWORD_BCRYPT)) { // update to new hashing algorithm $oldHash = Validation::encryptCredentials($username, $password, false, true); if ($oldHash === $hash) { // update hash $rehash = Validation::encryptCredentials($username, $password); return true; } } else if (password_verify($password, $hash)) { return true; } return false; } /** * Mark the user as logged out in the current session. * @return boolean */ function logout() { $sessionManager =& SessionManager::getManager(); $session =& $sessionManager->getUserSession(); $session->unsetSessionVar('userId'); $session->unsetSessionVar('signedInAs'); $session->setUserId(null); if ($session->getRemember()) { $session->setRemember(0); $sessionManager->updateSessionLifetime(0); } $sessionDao =& DAORegistry::getDAO('SessionDAO'); $sessionDao->updateObject($session); return true; } /** * Redirect to the login page, appending the current URL as the source. * @param $message string Optional name of locale key to add to login page */ function redirectLogin($message = null) { $args = array(); if (isset($_SERVER['REQUEST_URI'])) { $args['source'] = $_SERVER['REQUEST_URI']; } if ($message !== null) { $args['loginMessage'] = $message; } Request::redirect(null, 'login', null, null, $args); } /** * Check if a user's credentials are valid. * @param $username string username * @param $password string unencrypted password * @return boolean */ function checkCredentials($username, $password) { $userDao =& DAORegistry::getDAO('UserDAO'); $user =& $userDao->getByUsername($username, false); $valid = false; if (isset($user)) { if ($user->getAuthId()) { $authDao =& DAORegistry::getDAO('AuthSourceDAO'); $auth =& $authDao->getPlugin($user->getAuthId()); } if (isset($auth)) { $valid = $auth->authenticate($username, $password); } else { // Validate against OJS user database $valid = Validation::verifyPassword($username, $password, $user->getPassword(), $rehash); if ($valid && !empty($rehash)) { // update to new hashing algorithm $user->setPassword($rehash); // save new password hash to database $userDao->updateObject($user); } } } return $valid; } /** * Check if a user is authorized to access the specified role in the specified journal. * @param $roleId int * @param $journalId optional (e.g., for global site admin role), the ID of the journal * @return boolean */ function isAuthorized($roleId, $journalId = 0) { if (!Validation::isLoggedIn()) { return false; } if ($journalId === -1) { // Get journal ID from request $journal =& Request::getJournal(); $journalId = $journal == null ? 0 : $journal->getId(); } $sessionManager =& SessionManager::getManager(); $session =& $sessionManager->getUserSession(); $user =& $session->getUser(); $roleDao =& DAORegistry::getDAO('RoleDAO'); return $roleDao->userHasRole($journalId, $user->getId(), $roleId); } /** * Encrypt user passwords for database storage. * The username is used as a unique salt to make dictionary * attacks against a compromised database more difficult. * @param $username string username (kept for backwards compatibility) * @param $password string unencrypted password * @param $encryption string optional encryption algorithm to use, defaulting to the value from the site configuration * @param $legacy boolean if true, use legacy hashing technique for backwards compatibility * @return string encrypted password */ function encryptCredentials($username, $password, $encryption = false, $legacy = LEGACY_ENCRYPTION) { if ($legacy || LEGACY_ENCRYPTION) { $valueToEncrypt = $username . $password; if ($encryption == false) { $encryption = Config::getVar('security', 'encryption'); } switch ($encryption) { case 'sha1': if (function_exists('sha1')) { return sha1($valueToEncrypt); } case 'md5': default: return md5($valueToEncrypt); } } else { return password_hash($password, PASSWORD_BCRYPT); } } /** * Generate a random password. * Assumes the random number generator has already been seeded. * @param $length int the length of the password to generate (default 8) * @return string */ function generatePassword($length = 8) { $letters = 'abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'; $numbers = '23456789'; $password = ""; for ($i=0; $i<$length; $i++) { $password .= mt_rand(1, 4) == 4 ? $numbers[mt_rand(0,strlen($numbers)-1)] : $letters[mt_rand(0, strlen($letters)-1)]; } return $password; } /** * Generate a hash value to use for confirmation to reset a password. * @param $userId int * @return string (boolean false if user is invalid) */ function generatePasswordResetHash($userId) { $userDao =& DAORegistry::getDAO('UserDAO'); if (($user = $userDao->getUser($userId)) == null) { // No such user return false; } // create hash payload $salt = Config::getVar('security', 'salt'); // use last login time to create a basic expiry coeffecient $lastLogin = strtotime($user->getDateLastLogin()); $time = time(); $normalised = ($time - ($time % 3600)) + 7200; $diff = floor(($normalised - $lastLogin) / 3600); $data = $user->getUsername() . $user->getPassword() . $lastLogin . $diff; switch (true) { case function_exists('hash_hmac'): // always use HMAC SHA256 if available return hash_hmac('sha256', $data, $salt); case function_exists('sha1'); // use SHA1 is HMAC not available return sha1($data . $salt); default: // fallback to MD5 return md5($data . $salt); } } /** * Suggest a username given the first and last names. * @return string */ function suggestUsername($firstName, $lastName) { $initial = String::substr($firstName, 0, 1); $suggestion = String::regexp_replace('/[^a-zA-Z0-9_-]/', '', String::strtolower($initial . $lastName)); $userDao =& DAORegistry::getDAO('UserDAO'); for ($i = ''; $userDao->userExistsByUsername($suggestion . $i); $i++); return $suggestion . $i; } /** * Check if the user must change their password in order to log in. * @return boolean */ function isLoggedIn() { $sessionManager =& SessionManager::getManager(); $session =& $sessionManager->getUserSession(); $userId = $session->getUserId(); return isset($userId) && !empty($userId); } /** * Shortcut for checking authorization as site admin. * @return boolean */ function isSiteAdmin() { return Validation::isAuthorized(ROLE_ID_SITE_ADMIN); } /** * Shortcut for checking authorization as journal manager. * @param $journalId int * @return boolean */ function isJournalManager($journalId = -1) { return Validation::isAuthorized(ROLE_ID_JOURNAL_MANAGER, $journalId); } /** * Shortcut for checking authorization as editor. * @param $journalId int * @return boolean */ function isEditor($journalId = -1) { return Validation::isAuthorized(ROLE_ID_EDITOR, $journalId); } /** * Shortcut for checking authorization as section editor. * @param $journalId int * @return boolean */ function isSectionEditor($journalId = -1) { return Validation::isAuthorized(ROLE_ID_SECTION_EDITOR, $journalId); } /** * Shortcut for checking authorization as layout editor. * @param $journalId int * @return boolean */ function isLayoutEditor($journalId = -1) { return Validation::isAuthorized(ROLE_ID_LAYOUT_EDITOR, $journalId); } /** * Shortcut for checking authorization as reviewer. * @param $journalId int * @return boolean */ function isReviewer($journalId = -1) { return Validation::isAuthorized(ROLE_ID_REVIEWER, $journalId); } /** * Shortcut for checking authorization as copyeditor. * @param $journalId int * @return boolean */ function isCopyeditor($journalId = -1) { return Validation::isAuthorized(ROLE_ID_COPYEDITOR, $journalId); } /** * Shortcut for checking authorization as proofreader. * @param $journalId int * @return boolean */ function isProofreader($journalId = -1) { return Validation::isAuthorized(ROLE_ID_PROOFREADER, $journalId); } /** * Shortcut for checking authorization as author. * @param $journalId int * @return boolean */ function isAuthor($journalId = -1) { return Validation::isAuthorized(ROLE_ID_AUTHOR, $journalId); } /** * Shortcut for checking authorization as reader. * @param $journalId int * @return boolean */ function isReader($journalId = -1) { return Validation::isAuthorized(ROLE_ID_READER, $journalId); } /** * Shortcut for checking authorization as subscription manager. * @param $journalId int * @return boolean */ function isSubscriptionManager($journalId = -1) { return Validation::isAuthorized(ROLE_ID_SUBSCRIPTION_MANAGER, $journalId); } /** * Check whether a user is allowed to administer another user. * @param $journalId int * @param $userId int * @return boolean */ function canAdminister($journalId, $userId) { if (Validation::isSiteAdmin()) return true; if (!Validation::isJournalManager($journalId)) return false; // Check for roles in other journals that this user // doesn't have administrative rights over. $roleDao =& DAORegistry::getDAO('RoleDAO'); $roles =& $roleDao->getRolesByUserId($userId); foreach ($roles as $role) { if ($role->getRoleId() == ROLE_ID_SITE_ADMIN) return false; if ( $role->getJournalId() != $journalId && !Validation::isJournalManager($role->getJournalId()) ) return false; } // There were no conflicting roles. return true; } } ?>

Version	System time (s)	User time (s)	Memory (MiB)
7.2.6	0.003	0.014	16.51
7.2.0	0.006	0.010	19.06
7.1.20	0.004	0.011	15.37
7.1.10	0.009	0.009	17.80
7.1.7	0.003	0.014	17.01
7.1.6	0.003	0.021	19.42
7.1.5	0.012	0.012	16.88
7.1.0	0.003	0.077	22.48
7.0.20	0.020	0.003	16.54
7.0.9	0.013	0.093	20.09
7.0.8	0.000	0.047	20.07
7.0.7	0.003	0.077	20.02
7.0.6	0.013	0.073	20.01
7.0.5	0.003	0.087	20.45
7.0.4	0.007	0.080	20.04
7.0.3	0.007	0.047	20.16
7.0.2	0.007	0.040	20.03
7.0.1	0.000	0.050	20.03
7.0.0	0.013	0.073	19.99
5.6.28	0.007	0.053	21.20
5.6.24	0.010	0.077	20.76
5.6.23	0.010	0.040	20.63
5.6.22	0.017	0.077	20.58
5.6.21	0.007	0.040	20.69
5.6.20	0.003	0.050	21.04
5.6.19	0.003	0.093	21.14
5.6.18	0.000	0.050	21.20
5.6.17	0.007	0.060	21.06
5.6.16	0.010	0.073	21.09
5.6.15	0.007	0.077	21.06
5.6.14	0.013	0.060	21.20
5.6.13	0.013	0.037	21.14
5.6.12	0.010	0.060	21.04
5.6.11	0.017	0.073	21.16
5.6.10	0.007	0.083	21.09
5.6.9	0.007	0.057	21.14
5.6.8	0.007	0.077	20.59
5.6.7	0.007	0.040	20.55
5.6.6	0.010	0.070	20.60
5.6.5	0.000	0.063	20.57
5.6.4	0.007	0.080	20.57
5.6.3	0.013	0.073	20.56
5.6.2	0.007	0.050	20.40
5.6.1	0.000	0.043	20.51
5.6.0	0.010	0.070	20.51
5.5.38	0.007	0.090	20.43
5.5.37	0.003	0.073	20.49
5.5.36	0.010	0.077	20.49
5.5.35	0.003	0.073	20.51
5.5.34	0.003	0.087	21.00
5.5.33	0.010	0.067	20.98
5.5.32	0.003	0.073	21.02
5.5.31	0.000	0.047	20.93
5.5.30	0.007	0.077	20.92
5.5.29	0.010	0.080	21.00
5.5.28	0.013	0.077	21.01
5.5.27	0.003	0.077	20.95
5.5.26	0.007	0.047	21.01
5.5.25	0.007	0.053	20.68
5.5.24	0.003	0.050	20.35
5.5.23	0.000	0.050	20.25
5.5.22	0.007	0.067	20.20
5.5.21	0.003	0.080	20.23
5.5.20	0.007	0.037	20.25
5.5.19	0.007	0.080	20.18
5.5.18	0.007	0.053	20.35
5.5.16	0.010	0.040	20.32
5.5.15	0.003	0.080	20.24
5.5.14	0.017	0.070	20.25
5.5.13	0.003	0.083	20.25
5.5.12	0.007	0.050	20.30
5.5.11	0.003	0.043	20.21
5.5.10	0.003	0.057	20.17
5.5.9	0.007	0.077	20.25
5.5.8	0.017	0.067	20.07
5.5.7	0.003	0.087	20.16
5.5.6	0.013	0.073	20.25
5.5.5	0.000	0.060	20.25
5.5.4	0.010	0.080	20.15
5.5.3	0.007	0.040	20.15
5.5.2	0.000	0.043	20.25
5.5.1	0.007	0.043	20.09
5.5.0	0.000	0.057	20.07
5.4.45	0.003	0.077	19.38
5.4.44	0.003	0.053	19.21
5.4.43	0.007	0.040	19.53
5.4.42	0.007	0.037	19.56
5.4.41	0.010	0.070	19.26
5.4.40	0.003	0.080	19.21
5.4.39	0.000	0.080	18.90
5.4.38	0.013	0.073	19.23
5.4.37	0.003	0.043	19.06
5.4.36	0.007	0.053	19.16
5.4.35	0.013	0.033	19.05
5.4.34	0.007	0.067	19.09
5.4.32	0.010	0.070	19.00
5.4.31	0.010	0.077	18.93
5.4.30	0.003	0.040	19.06
5.4.29	0.013	0.063	19.21
5.4.28	0.007	0.073	19.21
5.4.27	0.007	0.040	19.07
5.4.26	0.000	0.047	18.91
5.4.25	0.013	0.063	19.20
5.4.24	0.003	0.053	19.09
5.4.23	0.007	0.070	19.22
5.4.22	0.003	0.077	19.09
5.4.21	0.010	0.070	19.21
5.4.20	0.007	0.073	19.23
5.4.19	0.000	0.040	19.20
5.4.18	0.007	0.037	18.91
5.4.17	0.003	0.037	19.08
5.4.16	0.007	0.040	19.03
5.4.15	0.003	0.040	19.12
5.4.14	0.003	0.057	16.49
5.4.13	0.003	0.040	16.42
5.4.12	0.010	0.033	16.46
5.4.11	0.000	0.040	16.54
5.4.10	0.007	0.037	16.41
5.4.9	0.003	0.040	16.54
5.4.8	0.007	0.033	16.55
5.4.7	0.007	0.037	16.38
5.4.6	0.007	0.033	16.51
5.4.5	0.007	0.037	16.37
5.4.4	0.000	0.040	16.55
5.4.3	0.003	0.037	16.37
5.4.2	0.007	0.030	16.50
5.4.1	0.007	0.030	16.42
5.4.0	0.013	0.067	15.72