Search moodle.org's
Developer Documentation
Developer Documentation
- Bug fixes for general core bugs in 3.11.x will end 14 Nov 2022 (12 months plus 6 months extension).
- Bug fixes for security issues in 3.11.x will end 13 Nov 2023 (18 months plus 12 months extension).
- PHP version: minimum PHP 7.3.0 Note: minimum PHP version has increased since Moodle 3.10. PHP 7.4.x is supported too.
/lib/ -> authlib.php (source)
Differences Between: [Versions 310 and 311] [Versions 311 and 401] [Versions 311 and 402] [Versions 311 and 403] [Versions 39 and 311]
1 <?php 2 3 // This file is part of Moodle - http://moodle.org/ 4 // 5 // Moodle is free software: you can redistribute it and/or modify 6 // it under the terms of the GNU General Public License as published by 7 // the Free Software Foundation, either version 3 of the License, or 8 // (at your option) any later version. 9 // 10 // Moodle is distributed in the hope that it will be useful, 11 // but WITHOUT ANY WARRANTY; without even the implied warranty of 12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 // GNU General Public License for more details. 14 // 15 // You should have received a copy of the GNU General Public License 16 // along with Moodle. If not, see <http://www.gnu.org/licenses/>. 17 18 /** 19 * Multiple plugin authentication Support library 20 * 21 * 2006-08-28 File created, AUTH return values defined. 22 * 23 * @package core 24 * @subpackage auth 25 * @copyright 1999 onwards Martin Dougiamas http://dougiamas.com 26 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later 27 */ 28 29 defined('MOODLE_INTERNAL') || die(); 30 31 /** 32 * Returned when the login was successful. 33 */ 34 define('AUTH_OK', 0); 35 36 /** 37 * Returned when the login was unsuccessful. 38 */ 39 define('AUTH_FAIL', 1); 40 41 /** 42 * Returned when the login was denied (a reason for AUTH_FAIL). 43 */ 44 define('AUTH_DENIED', 2); 45 46 /** 47 * Returned when some error occurred (a reason for AUTH_FAIL). 48 */ 49 define('AUTH_ERROR', 4); 50 51 /** 52 * Authentication - error codes for user confirm 53 */ 54 define('AUTH_CONFIRM_FAIL', 0); 55 define('AUTH_CONFIRM_OK', 1); 56 define('AUTH_CONFIRM_ALREADY', 2); 57 define('AUTH_CONFIRM_ERROR', 3); 58 59 # MDL-14055 60 define('AUTH_REMOVEUSER_KEEP', 0); 61 define('AUTH_REMOVEUSER_SUSPEND', 1); 62 define('AUTH_REMOVEUSER_FULLDELETE', 2); 63 64 /** Login attempt successful. */ 65 define('AUTH_LOGIN_OK', 0); 66 67 /** Can not login because user does not exist. */ 68 define('AUTH_LOGIN_NOUSER', 1); 69 70 /** Can not login because user is suspended. */ 71 define('AUTH_LOGIN_SUSPENDED', 2); 72 73 /** Can not login, most probably password did not match. */ 74 define('AUTH_LOGIN_FAILED', 3); 75 76 /** Can not login because user is locked out. */ 77 define('AUTH_LOGIN_LOCKOUT', 4); 78 79 /** Can not login becauser user is not authorised. */ 80 define('AUTH_LOGIN_UNAUTHORISED', 5); 81 82 /** 83 * Abstract authentication plugin. 84 * 85 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later 86 * @package moodlecore 87 */ 88 class auth_plugin_base { 89 90 /** 91 * The configuration details for the plugin. 92 * @var object 93 */ 94 var $config; 95 96 /** 97 * Authentication plugin type - the same as db field. 98 * @var string 99 */ 100 var $authtype; 101 /* 102 * The fields we can lock and update from/to external authentication backends 103 * @var array 104 */ 105 var $userfields = \core_user::AUTHSYNCFIELDS; 106 107 /** 108 * Moodle custom fields to sync with. 109 * @var array() 110 */ 111 var $customfields = null; 112 113 /** 114 * The tag we want to prepend to any error log messages. 115 * 116 * @var string 117 */ 118 protected $errorlogtag = ''; 119 120 /** 121 * This is the primary method that is used by the authenticate_user_login() 122 * function in moodlelib.php. 123 * 124 * This method should return a boolean indicating 125 * whether or not the username and password authenticate successfully. 126 * 127 * Returns true if the username and password work and false if they are 128 * wrong or don't exist. 129 * 130 * @param string $username The username (with system magic quotes) 131 * @param string $password The password (with system magic quotes) 132 * 133 * @return bool Authentication success or failure. 134 */ 135 function user_login($username, $password) { 136 print_error('mustbeoveride', 'debug', '', 'user_login()' ); 137 } 138 139 /** 140 * Returns true if this authentication plugin can change the users' 141 * password. 142 * 143 * @return bool 144 */ 145 function can_change_password() { 146 //override if needed 147 return false; 148 } 149 150 /** 151 * Returns the URL for changing the users' passwords, or empty if the default 152 * URL can be used. 153 * 154 * This method is used if can_change_password() returns true. 155 * This method is called only when user is logged in, it may use global $USER. 156 * If you are using a plugin config variable in this method, please make sure it is set before using it, 157 * as this method can be called even if the plugin is disabled, in which case the config values won't be set. 158 * 159 * @return moodle_url url of the profile page or null if standard used 160 */ 161 function change_password_url() { 162 //override if needed 163 return null; 164 } 165 166 /** 167 * Returns true if this authentication plugin can edit the users' 168 * profile. 169 * 170 * @return bool 171 */ 172 function can_edit_profile() { 173 //override if needed 174 return true; 175 } 176 177 /** 178 * Returns the URL for editing the users' profile, or empty if the default 179 * URL can be used. 180 * 181 * This method is used if can_edit_profile() returns true. 182 * This method is called only when user is logged in, it may use global $USER. 183 * 184 * @return moodle_url url of the profile page or null if standard used 185 */ 186 function edit_profile_url() { 187 //override if needed 188 return null; 189 } 190 191 /** 192 * Returns true if this authentication plugin is "internal". 193 * 194 * Internal plugins use password hashes from Moodle user table for authentication. 195 * 196 * @return bool 197 */ 198 function is_internal() { 199 //override if needed 200 return true; 201 } 202 203 /** 204 * Returns false if this plugin is enabled but not configured. 205 * 206 * @return bool 207 */ 208 public function is_configured() { 209 return false; 210 } 211 212 /** 213 * Indicates if password hashes should be stored in local moodle database. 214 * @return bool true means md5 password hash stored in user table, false means flag 'not_cached' stored there instead 215 */ 216 function prevent_local_passwords() { 217 return !$this->is_internal(); 218 } 219 220 /** 221 * Indicates if moodle should automatically update internal user 222 * records with data from external sources using the information 223 * from get_userinfo() method. 224 * 225 * @return bool true means automatically copy data from ext to user table 226 */ 227 function is_synchronised_with_external() { 228 return !$this->is_internal(); 229 } 230 231 /** 232 * Updates the user's password. 233 * 234 * In previous versions of Moodle, the function 235 * auth_user_update_password accepted a username as the first parameter. The 236 * revised function expects a user object. 237 * 238 * @param object $user User table object 239 * @param string $newpassword Plaintext password 240 * 241 * @return bool True on success 242 */ 243 function user_update_password($user, $newpassword) { 244 //override if needed 245 return true; 246 } 247 248 /** 249 * Called when the user record is updated. 250 * Modifies user in external database. It takes olduser (before changes) and newuser (after changes) 251 * compares information saved modified information to external db. 252 * 253 * @param mixed $olduser Userobject before modifications (without system magic quotes) 254 * @param mixed $newuser Userobject new modified userobject (without system magic quotes) 255 * @return boolean true if updated or update ignored; false if error 256 * 257 */ 258 function user_update($olduser, $newuser) { 259 //override if needed 260 return true; 261 } 262 263 /** 264 * User delete requested - internal user record is mared as deleted already, username not present anymore. 265 * 266 * Do any action in external database. 267 * 268 * @param object $user Userobject before delete (without system magic quotes) 269 * @return void 270 */ 271 function user_delete($olduser) { 272 //override if needed 273 return; 274 } 275 276 /** 277 * Returns true if plugin allows resetting of internal password. 278 * 279 * @return bool 280 */ 281 function can_reset_password() { 282 //override if needed 283 return false; 284 } 285 286 /** 287 * Returns true if plugin allows resetting of internal password. 288 * 289 * @return bool 290 */ 291 function can_signup() { 292 //override if needed 293 return false; 294 } 295 296 /** 297 * Sign up a new user ready for confirmation. 298 * Password is passed in plaintext. 299 * 300 * @param object $user new user object 301 * @param boolean $notify print notice with link and terminate 302 */ 303 function user_signup($user, $notify=true) { 304 //override when can signup 305 print_error('mustbeoveride', 'debug', '', 'user_signup()' ); 306 } 307 308 /** 309 * Return a form to capture user details for account creation. 310 * This is used in /login/signup.php. 311 * @return moodle_form A form which edits a record from the user table. 312 */ 313 function signup_form() { 314 global $CFG; 315 316 require_once($CFG->dirroot.'/login/signup_form.php'); 317 return new login_signup_form(null, null, 'post', '', array('autocomplete'=>'on')); 318 } 319 320 /** 321 * Returns true if plugin allows confirming of new users. 322 * 323 * @return bool 324 */ 325 function can_confirm() { 326 //override if needed 327 return false; 328 } 329 330 /** 331 * Confirm the new user as registered. 332 * 333 * @param string $username 334 * @param string $confirmsecret 335 */ 336 function user_confirm($username, $confirmsecret) { 337 //override when can confirm 338 print_error('mustbeoveride', 'debug', '', 'user_confirm()' ); 339 } 340 341 /** 342 * Checks if user exists in external db 343 * 344 * @param string $username (with system magic quotes) 345 * @return bool 346 */ 347 function user_exists($username) { 348 //override if needed 349 return false; 350 } 351 352 /** 353 * return number of days to user password expires 354 * 355 * If userpassword does not expire it should return 0. If password is already expired 356 * it should return negative value. 357 * 358 * @param mixed $username username (with system magic quotes) 359 * @return integer 360 */ 361 function password_expire($username) { 362 return 0; 363 } 364 /** 365 * Sync roles for this user - usually creator 366 * 367 * @param $user object user object (without system magic quotes) 368 */ 369 function sync_roles($user) { 370 //override if needed 371 } 372 373 /** 374 * Read user information from external database and returns it as array(). 375 * Function should return all information available. If you are saving 376 * this information to moodle user-table you should honour synchronisation flags 377 * 378 * @param string $username username 379 * 380 * @return mixed array with no magic quotes or false on error 381 */ 382 function get_userinfo($username) { 383 //override if needed 384 return array(); 385 } 386 387 /** 388 * Prints a form for configuring this authentication plugin. 389 * 390 * This function is called from admin/auth.php, and outputs a full page with 391 * a form for configuring this plugin. 392 * 393 * @param object $config 394 * @param object $err 395 * @param array $user_fields 396 * @deprecated since Moodle 3.3 397 */ 398 function config_form($config, $err, $user_fields) { 399 debugging('Use of config.html files have been deprecated, please update your code to use the admin settings API.'); 400 //override if needed 401 } 402 403 /** 404 * A chance to validate form data, and last chance to 405 * do stuff before it is inserted in config_plugin 406 * @param object object with submitted configuration settings (without system magic quotes) 407 * @param array $err array of error messages 408 * @deprecated since Moodle 3.3 409 */ 410 function validate_form($form, &$err) { 411 debugging('Use of config.html files have been deprecated, please update your code to use the admin settings API.'); 412 //override if needed 413 } 414 415 /** 416 * Processes and stores configuration data for this authentication plugin. 417 * 418 * @param object object with submitted configuration settings (without system magic quotes) 419 * @deprecated since Moodle 3.3 420 */ 421 function process_config($config) { 422 debugging('Use of config.html files have been deprecated, please update your code to use the admin settings API.'); 423 //override if needed 424 return true; 425 } 426 427 /** 428 * Hook for overriding behaviour of login page. 429 * This method is called from login/index.php page for all enabled auth plugins. 430 * 431 * @global object 432 * @global object 433 */ 434 function loginpage_hook() { 435 global $frm; // can be used to override submitted login form 436 global $user; // can be used to replace authenticate_user_login() 437 438 //override if needed 439 } 440 441 /** 442 * Hook for overriding behaviour before going to the login page. 443 * 444 * This method is called from require_login from potentially any page for 445 * all enabled auth plugins and gives each plugin a chance to redirect 446 * directly to an external login page, or to instantly login a user where 447 * possible. 448 * 449 * If an auth plugin implements this hook, it must not rely on ONLY this 450 * hook in order to work, as there are many ways a user can browse directly 451 * to the standard login page. As a general rule in this case you should 452 * also implement the loginpage_hook as well. 453 * 454 */ 455 function pre_loginpage_hook() { 456 // override if needed, eg by redirecting to an external login page 457 // or logging in a user: 458 // complete_user_login($user); 459 } 460 461 /** 462 * Pre user_login hook. 463 * This method is called from authenticate_user_login() right after the user 464 * object is generated. This gives the auth plugins an option to make adjustments 465 * before the verification process starts. 466 * 467 * @param object $user user object, later used for $USER 468 */ 469 public function pre_user_login_hook(&$user) { 470 // Override if needed. 471 } 472 473 /** 474 * Post authentication hook. 475 * This method is called from authenticate_user_login() for all enabled auth plugins. 476 * 477 * @param object $user user object, later used for $USER 478 * @param string $username (with system magic quotes) 479 * @param string $password plain text password (with system magic quotes) 480 */ 481 function user_authenticated_hook(&$user, $username, $password) { 482 //override if needed 483 } 484 485 /** 486 * Pre logout hook. 487 * This method is called from require_logout() for all enabled auth plugins, 488 * 489 * @global object 490 */ 491 function prelogout_hook() { 492 global $USER; // use $USER->auth to find the plugin used for login 493 494 //override if needed 495 } 496 497 /** 498 * Hook for overriding behaviour of logout page. 499 * This method is called from login/logout.php page for all enabled auth plugins. 500 * 501 * @global object 502 * @global string 503 */ 504 function logoutpage_hook() { 505 global $USER; // use $USER->auth to find the plugin used for login 506 global $redirect; // can be used to override redirect after logout 507 508 //override if needed 509 } 510 511 /** 512 * Hook called before timing out of database session. 513 * This is useful for SSO and MNET. 514 * 515 * @param object $user 516 * @param string $sid session id 517 * @param int $timecreated start of session 518 * @param int $timemodified user last seen 519 * @return bool true means do not timeout session yet 520 */ 521 function ignore_timeout_hook($user, $sid, $timecreated, $timemodified) { 522 return false; 523 } 524 525 /** 526 * Return the properly translated human-friendly title of this auth plugin 527 * 528 * @todo Document this function 529 */ 530 function get_title() { 531 return get_string('pluginname', "auth_{$this->authtype}"); 532 } 533 534 /** 535 * Get the auth description (from core or own auth lang files) 536 * 537 * @return string The description 538 */ 539 function get_description() { 540 $authdescription = get_string("auth_{$this->authtype}description", "auth_{$this->authtype}"); 541 return $authdescription; 542 } 543 544 /** 545 * Returns whether or not the captcha element is enabled. 546 * 547 * @abstract Implement in child classes 548 * @return bool 549 */ 550 function is_captcha_enabled() { 551 return false; 552 } 553 554 /** 555 * Returns whether or not this authentication plugin can be manually set 556 * for users, for example, when bulk uploading users. 557 * 558 * This should be overriden by authentication plugins where setting the 559 * authentication method manually is allowed. 560 * 561 * @return bool 562 * @since Moodle 2.6 563 */ 564 function can_be_manually_set() { 565 // Override if needed. 566 return false; 567 } 568 569 /** 570 * Returns a list of potential IdPs that this authentication plugin supports. 571 * 572 * This is used to provide links on the login page and the login block. 573 * 574 * The parameter $wantsurl is typically used by the plugin to implement a 575 * return-url feature. 576 * 577 * The returned value is expected to be a list of associative arrays with 578 * string keys: 579 * 580 * - url => (moodle_url|string) URL of the page to send the user to for authentication 581 * - name => (string) Human readable name of the IdP 582 * - iconurl => (moodle_url|string) URL of the icon representing the IdP (since Moodle 3.3) 583 * 584 * For legacy reasons, pre-3.3 plugins can provide the icon via the key: 585 * 586 * - icon => (pix_icon) Icon representing the IdP 587 * 588 * @param string $wantsurl The relative url fragment the user wants to get to. 589 * @return array List of associative arrays with keys url, name, iconurl|icon 590 */ 591 function loginpage_idp_list($wantsurl) { 592 return array(); 593 } 594 595 /** 596 * Return custom user profile fields. 597 * 598 * @return array list of custom fields. 599 */ 600 public function get_custom_user_profile_fields() { 601 global $CFG; 602 require_once($CFG->dirroot . '/user/profile/lib.php'); 603 604 // If already retrieved then return. 605 if (!is_null($this->customfields)) { 606 return $this->customfields; 607 } 608 609 $this->customfields = array(); 610 if ($proffields = profile_get_custom_fields()) { 611 foreach ($proffields as $proffield) { 612 $this->customfields[] = 'profile_field_'.$proffield->shortname; 613 } 614 } 615 unset($proffields); 616 617 return $this->customfields; 618 } 619 620 /** 621 * Post logout hook. 622 * 623 * This method is used after moodle logout by auth classes to execute server logout. 624 * 625 * @param stdClass $user clone of USER object before the user session was terminated 626 */ 627 public function postlogout_hook($user) { 628 } 629 630 /** 631 * Update a local user record from an external source. 632 * This is a lighter version of the one in moodlelib -- won't do 633 * expensive ops such as enrolment. 634 * 635 * @param string $username username 636 * @param array $updatekeys fields to update, false updates all fields. 637 * @param bool $triggerevent set false if user_updated event should not be triggered. 638 * This will not affect user_password_updated event triggering. 639 * @param bool $suspenduser Should the user be suspended? 640 * @return stdClass|bool updated user record or false if there is no new info to update. 641 */ 642 protected function update_user_record($username, $updatekeys = false, $triggerevent = false, $suspenduser = false) { 643 global $CFG, $DB; 644 645 require_once($CFG->dirroot.'/user/profile/lib.php'); 646 647 // Just in case check text case. 648 $username = trim(core_text::strtolower($username)); 649 650 // Get the current user record. 651 $user = $DB->get_record('user', array('username' => $username, 'mnethostid' => $CFG->mnet_localhost_id)); 652 if (empty($user)) { // Trouble. 653 error_log($this->errorlogtag . get_string('auth_usernotexist', 'auth', $username)); 654 print_error('auth_usernotexist', 'auth', '', $username); 655 die; 656 } 657 658 // Protect the userid from being overwritten. 659 $userid = $user->id; 660 661 $needsupdate = false; 662 663 if ($newinfo = $this->get_userinfo($username)) { 664 $newinfo = truncate_userinfo($newinfo); 665 666 if (empty($updatekeys)) { // All keys? this does not support removing values. 667 $updatekeys = array_keys($newinfo); 668 } 669 670 if (!empty($updatekeys)) { 671 $newuser = new stdClass(); 672 $newuser->id = $userid; 673 // The cast to int is a workaround for MDL-53959. 674 $newuser->suspended = (int) $suspenduser; 675 // Load all custom fields. 676 $profilefields = (array) profile_user_record($user->id, false); 677 $newprofilefields = []; 678 679 foreach ($updatekeys as $key) { 680 if (isset($newinfo[$key])) { 681 $value = $newinfo[$key]; 682 } else { 683 $value = ''; 684 } 685 686 if (!empty($this->config->{'field_updatelocal_' . $key})) { 687 if (preg_match('/^profile_field_(.*)$/', $key, $match)) { 688 // Custom field. 689 $field = $match[1]; 690 $currentvalue = isset($profilefields[$field]) ? $profilefields[$field] : null; 691 $newprofilefields[$field] = $value; 692 } else { 693 // Standard field. 694 $currentvalue = isset($user->$key) ? $user->$key : null; 695 $newuser->$key = $value; 696 } 697 698 // Only update if it's changed. 699 if ($currentvalue !== $value) { 700 $needsupdate = true; 701 } 702 } 703 } 704 } 705 706 if ($needsupdate) { 707 user_update_user($newuser, false, $triggerevent); 708 profile_save_custom_fields($newuser->id, $newprofilefields); 709 return $DB->get_record('user', array('id' => $userid, 'deleted' => 0)); 710 } 711 } 712 713 return false; 714 } 715 716 /** 717 * Return the list of enabled identity providers. 718 * 719 * Each identity provider data contains the keys url, name and iconurl (or 720 * icon). See the documentation of {@link auth_plugin_base::loginpage_idp_list()} 721 * for detailed description of the returned structure. 722 * 723 * @param array $authsequence site's auth sequence (list of auth plugins ordered) 724 * @return array List of arrays describing the identity providers 725 */ 726 public static function get_identity_providers($authsequence) { 727 global $SESSION; 728 729 $identityproviders = []; 730 foreach ($authsequence as $authname) { 731 $authplugin = get_auth_plugin($authname); 732 $wantsurl = (isset($SESSION->wantsurl)) ? $SESSION->wantsurl : ''; 733 $identityproviders = array_merge($identityproviders, $authplugin->loginpage_idp_list($wantsurl)); 734 } 735 return $identityproviders; 736 } 737 738 /** 739 * Prepare a list of identity providers for output. 740 * 741 * @param array $identityproviders as returned by {@link self::get_identity_providers()} 742 * @param renderer_base $output 743 * @return array the identity providers ready for output 744 */ 745 public static function prepare_identity_providers_for_output($identityproviders, renderer_base $output) { 746 $data = []; 747 foreach ($identityproviders as $idp) { 748 if (!empty($idp['icon'])) { 749 // Pre-3.3 auth plugins provide icon as a pix_icon instance. New auth plugins (since 3.3) provide iconurl. 750 $idp['iconurl'] = $output->image_url($idp['icon']->pix, $idp['icon']->component); 751 } 752 if ($idp['iconurl'] instanceof moodle_url) { 753 $idp['iconurl'] = $idp['iconurl']->out(false); 754 } 755 unset($idp['icon']); 756 if ($idp['url'] instanceof moodle_url) { 757 $idp['url'] = $idp['url']->out(false); 758 } 759 $data[] = $idp; 760 } 761 return $data; 762 } 763 764 /** 765 * Returns information on how the specified user can change their password. 766 * 767 * @param stdClass $user A user object 768 * @return string[] An array of strings with keys subject and message 769 */ 770 public function get_password_change_info(stdClass $user) : array { 771 772 global $USER; 773 774 $site = get_site(); 775 $systemcontext = context_system::instance(); 776 777 $data = new stdClass(); 778 $data->firstname = $user->firstname; 779 $data->lastname = $user->lastname; 780 $data->username = $user->username; 781 $data->sitename = format_string($site->fullname); 782 $data->admin = generate_email_signoff(); 783 784 // This is a workaround as change_password_url() is designed to allow 785 // use of the $USER global. See MDL-66984. 786 $olduser = $USER; 787 $USER = $user; 788 if ($this->can_change_password() and $this->change_password_url()) { 789 // We have some external url for password changing. 790 $data->link = $this->change_password_url()->out(); 791 } else { 792 // No way to change password, sorry. 793 $data->link = ''; 794 } 795 $USER = $olduser; 796 797 if (!empty($data->link) and has_capability('moodle/user:changeownpassword', $systemcontext, $user->id)) { 798 $subject = get_string('emailpasswordchangeinfosubject', '', format_string($site->fullname)); 799 $message = get_string('emailpasswordchangeinfo', '', $data); 800 } else { 801 $subject = get_string('emailpasswordchangeinfosubject', '', format_string($site->fullname)); 802 $message = get_string('emailpasswordchangeinfofail', '', $data); 803 } 804 805 return [ 806 'subject' => $subject, 807 'message' => $message 808 ]; 809 } 810 } 811 812 /** 813 * Verify if user is locked out. 814 * 815 * @param stdClass $user 816 * @return bool true if user locked out 817 */ 818 function login_is_lockedout($user) { 819 global $CFG; 820 821 if ($user->mnethostid != $CFG->mnet_localhost_id) { 822 return false; 823 } 824 if (isguestuser($user)) { 825 return false; 826 } 827 828 if (empty($CFG->lockoutthreshold)) { 829 // Lockout not enabled. 830 return false; 831 } 832 833 if (get_user_preferences('login_lockout_ignored', 0, $user)) { 834 // This preference may be used for accounts that must not be locked out. 835 return false; 836 } 837 838 $locked = get_user_preferences('login_lockout', 0, $user); 839 if (!$locked) { 840 return false; 841 } 842 843 if (empty($CFG->lockoutduration)) { 844 // Locked out forever. 845 return true; 846 } 847 848 if (time() - $locked < $CFG->lockoutduration) { 849 return true; 850 } 851 852 login_unlock_account($user); 853 854 return false; 855 } 856 857 /** 858 * To be called after valid user login. 859 * @param stdClass $user 860 */ 861 function login_attempt_valid($user) { 862 global $CFG; 863 864 // Note: user_loggedin event is triggered in complete_user_login(). 865 866 if ($user->mnethostid != $CFG->mnet_localhost_id) { 867 return; 868 } 869 if (isguestuser($user)) { 870 return; 871 } 872 873 // Always unlock here, there might be some race conditions or leftovers when switching threshold. 874 login_unlock_account($user); 875 } 876 877 /** 878 * To be called after failed user login. 879 * @param stdClass $user 880 * @throws moodle_exception 881 */ 882 function login_attempt_failed($user) { 883 global $CFG; 884 885 if ($user->mnethostid != $CFG->mnet_localhost_id) { 886 return; 887 } 888 if (isguestuser($user)) { 889 return; 890 } 891 892 // Force user preferences cache reload to ensure the most up-to-date login_failed_count is fetched. 893 // This is perhaps overzealous but is the documented way of reloading the cache, as per the test method 894 // 'test_check_user_preferences_loaded'. 895 unset($user->preference); 896 897 $resource = 'user:' . $user->id; 898 $lockfactory = \core\lock\lock_config::get_lock_factory('core_failed_login_count_lock'); 899 900 // Get a new lock for the resource, waiting for it for a maximum of 10 seconds. 901 if ($lock = $lockfactory->get_lock($resource, 10)) { 902 try { 903 $count = get_user_preferences('login_failed_count', 0, $user); 904 $last = get_user_preferences('login_failed_last', 0, $user); 905 $sincescuccess = get_user_preferences('login_failed_count_since_success', $count, $user); 906 $sincescuccess = $sincescuccess + 1; 907 set_user_preference('login_failed_count_since_success', $sincescuccess, $user); 908 909 if (empty($CFG->lockoutthreshold)) { 910 // No threshold means no lockout. 911 // Always unlock here, there might be some race conditions or leftovers when switching threshold. 912 login_unlock_account($user); 913 $lock->release(); 914 return; 915 } 916 917 if (!empty($CFG->lockoutwindow) and time() - $last > $CFG->lockoutwindow) { 918 $count = 0; 919 } 920 921 $count = $count + 1; 922 923 set_user_preference('login_failed_count', $count, $user); 924 set_user_preference('login_failed_last', time(), $user); 925 926 if ($count >= $CFG->lockoutthreshold) { 927 login_lock_account($user); 928 } 929 930 // Release locks when we're done. 931 $lock->release(); 932 } catch (Exception $e) { 933 // Always release the lock on a failure. 934 $lock->release(); 935 } 936 } else { 937 // We did not get access to the resource in time, give up. 938 throw new moodle_exception('locktimeout'); 939 } 940 } 941 942 /** 943 * Lockout user and send notification email. 944 * 945 * @param stdClass $user 946 */ 947 function login_lock_account($user) { 948 global $CFG; 949 950 if ($user->mnethostid != $CFG->mnet_localhost_id) { 951 return; 952 } 953 if (isguestuser($user)) { 954 return; 955 } 956 957 if (get_user_preferences('login_lockout_ignored', 0, $user)) { 958 // This user can not be locked out. 959 return; 960 } 961 962 $alreadylockedout = get_user_preferences('login_lockout', 0, $user); 963 964 set_user_preference('login_lockout', time(), $user); 965 966 if ($alreadylockedout == 0) { 967 $secret = random_string(15); 968 set_user_preference('login_lockout_secret', $secret, $user); 969 970 $oldforcelang = force_current_language($user->lang); 971 972 $site = get_site(); 973 $supportuser = core_user::get_support_user(); 974 975 $data = new stdClass(); 976 $data->firstname = $user->firstname; 977 $data->lastname = $user->lastname; 978 $data->username = $user->username; 979 $data->sitename = format_string($site->fullname); 980 $data->link = $CFG->wwwroot.'/login/unlock_account.php?u='.$user->id.'&s='.$secret; 981 $data->admin = generate_email_signoff(); 982 983 $message = get_string('lockoutemailbody', 'admin', $data); 984 $subject = get_string('lockoutemailsubject', 'admin', format_string($site->fullname)); 985 986 if ($message) { 987 // Directly email rather than using the messaging system to ensure its not routed to a popup or jabber. 988 email_to_user($user, $supportuser, $subject, $message); 989 } 990 991 force_current_language($oldforcelang); 992 } 993 } 994 995 /** 996 * Unlock user account and reset timers. 997 * 998 * @param stdClass $user 999 */ 1000 function login_unlock_account($user) { 1001 unset_user_preference('login_lockout', $user); 1002 unset_user_preference('login_failed_count', $user); 1003 unset_user_preference('login_failed_last', $user); 1004 1005 // Note: do not clear the lockout secret because user might click on the link repeatedly. 1006 } 1007 1008 /** 1009 * Returns whether or not the captcha element is enabled, and the admin settings fulfil its requirements. 1010 * @return bool 1011 */ 1012 function signup_captcha_enabled() { 1013 global $CFG; 1014 $authplugin = get_auth_plugin($CFG->registerauth); 1015 return !empty($CFG->recaptchapublickey) && !empty($CFG->recaptchaprivatekey) && $authplugin->is_captcha_enabled(); 1016 } 1017 1018 /** 1019 * Validates the standard sign-up data (except recaptcha that is validated by the form element). 1020 * 1021 * @param array $data the sign-up data 1022 * @param array $files files among the data 1023 * @return array list of errors, being the key the data element name and the value the error itself 1024 * @since Moodle 3.2 1025 */ 1026 function signup_validate_data($data, $files) { 1027 global $CFG, $DB; 1028 1029 $errors = array(); 1030 $authplugin = get_auth_plugin($CFG->registerauth); 1031 1032 if ($DB->record_exists('user', array('username' => $data['username'], 'mnethostid' => $CFG->mnet_localhost_id))) { 1033 $errors['username'] = get_string('usernameexists'); 1034 } else { 1035 // Check allowed characters. 1036 if ($data['username'] !== core_text::strtolower($data['username'])) { 1037 $errors['username'] = get_string('usernamelowercase'); 1038 } else { 1039 if ($data['username'] !== core_user::clean_field($data['username'], 'username')) { 1040 $errors['username'] = get_string('invalidusername'); 1041 } 1042 1043 } 1044 } 1045 1046 // Check if user exists in external db. 1047 // TODO: maybe we should check all enabled plugins instead. 1048 if ($authplugin->user_exists($data['username'])) { 1049 $errors['username'] = get_string('usernameexists'); 1050 } 1051 1052 if (! validate_email($data['email'])) { 1053 $errors['email'] = get_string('invalidemail'); 1054 1055 } else if (empty($CFG->allowaccountssameemail)) { 1056 // Emails in Moodle as case-insensitive and accents-sensitive. Such a combination can lead to very slow queries 1057 // on some DBs such as MySQL. So we first get the list of candidate users in a subselect via more effective 1058 // accent-insensitive query that can make use of the index and only then we search within that limited subset. 1059 $sql = "SELECT 'x' 1060 FROM {user} 1061 WHERE " . $DB->sql_equal('email', ':email1', false, true) . " 1062 AND id IN (SELECT id 1063 FROM {user} 1064 WHERE " . $DB->sql_equal('email', ':email2', false, false) . " 1065 AND mnethostid = :mnethostid)"; 1066 1067 $params = array( 1068 'email1' => $data['email'], 1069 'email2' => $data['email'], 1070 'mnethostid' => $CFG->mnet_localhost_id, 1071 ); 1072 1073 // If there are other user(s) that already have the same email, show an error. 1074 if ($DB->record_exists_sql($sql, $params)) { 1075 $forgotpasswordurl = new moodle_url('/login/forgot_password.php'); 1076 $forgotpasswordlink = html_writer::link($forgotpasswordurl, get_string('emailexistshintlink')); 1077 $errors['email'] = get_string('emailexists') . ' ' . get_string('emailexistssignuphint', 'moodle', $forgotpasswordlink); 1078 } 1079 } 1080 if (empty($data['email2'])) { 1081 $errors['email2'] = get_string('missingemail'); 1082 1083 } else if (core_text::strtolower($data['email2']) != core_text::strtolower($data['email'])) { 1084 $errors['email2'] = get_string('invalidemail'); 1085 } 1086 if (!isset($errors['email'])) { 1087 if ($err = email_is_not_allowed($data['email'])) { 1088 $errors['email'] = $err; 1089 } 1090 } 1091 1092 // Construct fake user object to check password policy against required information. 1093 $tempuser = new stdClass(); 1094 $tempuser->id = 1; 1095 $tempuser->username = $data['username']; 1096 $tempuser->firstname = $data['firstname']; 1097 $tempuser->lastname = $data['lastname']; 1098 $tempuser->email = $data['email']; 1099 1100 $errmsg = ''; 1101 if (!check_password_policy($data['password'], $errmsg, $tempuser)) { 1102 $errors['password'] = $errmsg; 1103 } 1104 1105 // Validate customisable profile fields. (profile_validation expects an object as the parameter with userid set). 1106 $dataobject = (object)$data; 1107 $dataobject->id = 0; 1108 $errors += profile_validation($dataobject, $files); 1109 1110 return $errors; 1111 } 1112 1113 /** 1114 * Add the missing fields to a user that is going to be created 1115 * 1116 * @param stdClass $user the new user object 1117 * @return stdClass the user filled 1118 * @since Moodle 3.2 1119 */ 1120 function signup_setup_new_user($user) { 1121 global $CFG; 1122 1123 $user->confirmed = 0; 1124 $user->lang = current_language(); 1125 $user->firstaccess = 0; 1126 $user->timecreated = time(); 1127 $user->mnethostid = $CFG->mnet_localhost_id; 1128 $user->secret = random_string(15); 1129 $user->auth = $CFG->registerauth; 1130 // Initialize alternate name fields to empty strings. 1131 $namefields = array_diff(\core_user\fields::get_name_fields(), useredit_get_required_name_fields()); 1132 foreach ($namefields as $namefield) { 1133 $user->$namefield = ''; 1134 } 1135 return $user; 1136 } 1137 1138 /** 1139 * Check if user confirmation is enabled on this site and return the auth plugin handling registration if enabled. 1140 * 1141 * @return stdClass the current auth plugin handling user registration or false if registration not enabled 1142 * @since Moodle 3.2 1143 */ 1144 function signup_get_user_confirmation_authplugin() { 1145 global $CFG; 1146 1147 if (empty($CFG->registerauth)) { 1148 return false; 1149 } 1150 $authplugin = get_auth_plugin($CFG->registerauth); 1151 1152 if (!$authplugin->can_confirm()) { 1153 return false; 1154 } 1155 return $authplugin; 1156 } 1157 1158 /** 1159 * Check if sign-up is enabled in the site. If is enabled, the function will return the authplugin instance. 1160 * 1161 * @return mixed false if sign-up is not enabled, the authplugin instance otherwise. 1162 * @since Moodle 3.2 1163 */ 1164 function signup_is_enabled() { 1165 global $CFG; 1166 1167 if (!empty($CFG->registerauth)) { 1168 $authplugin = get_auth_plugin($CFG->registerauth); 1169 if ($authplugin->can_signup()) { 1170 return $authplugin; 1171 } 1172 } 1173 return false; 1174 } 1175 1176 /** 1177 * Helper function used to print locking for auth plugins on admin pages. 1178 * @param stdclass $settings Moodle admin settings instance 1179 * @param string $auth authentication plugin shortname 1180 * @param array $userfields user profile fields 1181 * @param string $helptext help text to be displayed at top of form 1182 * @param boolean $mapremotefields Map fields or lock only. 1183 * @param boolean $updateremotefields Allow remote updates 1184 * @param array $customfields list of custom profile fields 1185 * @since Moodle 3.3 1186 */ 1187 function display_auth_lock_options($settings, $auth, $userfields, $helptext, $mapremotefields, $updateremotefields, $customfields = array()) { 1188 global $CFG; 1189 require_once($CFG->dirroot . '/user/profile/lib.php'); 1190 1191 // Introductory explanation and help text. 1192 if ($mapremotefields) { 1193 $settings->add(new admin_setting_heading($auth.'/data_mapping', new lang_string('auth_data_mapping', 'auth'), $helptext)); 1194 } else { 1195 $settings->add(new admin_setting_heading($auth.'/auth_fieldlocks', new lang_string('auth_fieldlocks', 'auth'), $helptext)); 1196 } 1197 1198 // Generate the list of options. 1199 $lockoptions = array ('unlocked' => get_string('unlocked', 'auth'), 1200 'unlockedifempty' => get_string('unlockedifempty', 'auth'), 1201 'locked' => get_string('locked', 'auth')); 1202 $updatelocaloptions = array('oncreate' => get_string('update_oncreate', 'auth'), 1203 'onlogin' => get_string('update_onlogin', 'auth')); 1204 $updateextoptions = array('0' => get_string('update_never', 'auth'), 1205 '1' => get_string('update_onupdate', 'auth')); 1206 1207 // Generate the list of profile fields to allow updates / lock. 1208 if (!empty($customfields)) { 1209 $userfields = array_merge($userfields, $customfields); 1210 $allcustomfields = profile_get_custom_fields(); 1211 $customfieldname = array_combine(array_column($allcustomfields, 'shortname'), $allcustomfields); 1212 } 1213 1214 foreach ($userfields as $field) { 1215 // Define the fieldname we display to the user. 1216 // this includes special handling for some profile fields. 1217 $fieldname = $field; 1218 $fieldnametoolong = false; 1219 if ($fieldname === 'lang') { 1220 $fieldname = get_string('language'); 1221 } else if (!empty($customfields) && in_array($field, $customfields)) { 1222 // If custom field then pick name from database. 1223 $fieldshortname = str_replace('profile_field_', '', $fieldname); 1224 $fieldname = $customfieldname[$fieldshortname]->name; 1225 if (core_text::strlen($fieldshortname) > 67) { 1226 // If custom profile field name is longer than 67 characters we will not be able to store the setting 1227 // such as 'field_updateremote_profile_field_NOTSOSHORTSHORTNAME' in the database because the character 1228 // limit for the setting name is 100. 1229 $fieldnametoolong = true; 1230 } 1231 } else { 1232 $fieldname = get_string($fieldname); 1233 } 1234 1235 // Generate the list of fields / mappings. 1236 if ($fieldnametoolong) { 1237 // Display a message that the field can not be mapped because it's too long. 1238 $url = new moodle_url('/user/profile/index.php'); 1239 $a = (object)['fieldname' => s($fieldname), 'shortname' => s($field), 'charlimit' => 67, 'link' => $url->out()]; 1240 $settings->add(new admin_setting_heading($auth.'/field_not_mapped_'.sha1($field), '', 1241 get_string('cannotmapfield', 'auth', $a))); 1242 } else if ($mapremotefields) { 1243 // We are mapping to a remote field here. 1244 // Mapping. 1245 $settings->add(new admin_setting_configtext("auth_{$auth}/field_map_{$field}", 1246 get_string('auth_fieldmapping', 'auth', $fieldname), '', '', PARAM_RAW, 30)); 1247 1248 // Update local. 1249 $settings->add(new admin_setting_configselect("auth_{$auth}/field_updatelocal_{$field}", 1250 get_string('auth_updatelocalfield', 'auth', $fieldname), '', 'oncreate', $updatelocaloptions)); 1251 1252 // Update remote. 1253 if ($updateremotefields) { 1254 $settings->add(new admin_setting_configselect("auth_{$auth}/field_updateremote_{$field}", 1255 get_string('auth_updateremotefield', 'auth', $fieldname), '', 0, $updateextoptions)); 1256 } 1257 1258 // Lock fields. 1259 $settings->add(new admin_setting_configselect("auth_{$auth}/field_lock_{$field}", 1260 get_string('auth_fieldlockfield', 'auth', $fieldname), '', 'unlocked', $lockoptions)); 1261 1262 } else { 1263 // Lock fields Only. 1264 $settings->add(new admin_setting_configselect("auth_{$auth}/field_lock_{$field}", 1265 get_string('auth_fieldlockfield', 'auth', $fieldname), '', 'unlocked', $lockoptions)); 1266 } 1267 } 1268 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
