sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 5.0.0 beta 1

Browse Source
This commit is contained in:
Neo committed 2025-12-19 16:27:35 -08:00
1 parent 25ddeb65d6
commit 15c7beabc5
6736 files changed
+627902 -497943
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

system/Login/Login.php
+187 -144
View File
@@ -12,17 +12,51 @@
namespace IPS;
/* To prevent PHP errors (extending class does not exist) revealing path */
if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
use DateInterval;
use IPS\Data\Store;
use IPS\Events\Event;
use IPS\Extensions\SSOAbstract;
use IPS\Http\Url;
use IPS\Login\Exception;
use IPS\Login\Exception as LoginException;
use IPS\Login\Handler;
use IPS\Login\Success;
use IPS\Member\Device;
use IPS\Session\Front;
use OutOfRangeException;
use function count;
use function defined;
use function function_exists;
use function get_class;
use function in_array;
use function is_array;
use function is_string;
use function ord;
use function strlen;
use function substr;
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
header( ( $_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.0' ) . ' 403 Forbidden' );
exit;
}
/**
* Login Handler
*/
class _Login
class Login
{
/**
* @brief Using username for login
*/
const AUTH_TYPE_USERNAME = 1;
/**
* @brief Using email for login
*/
const AUTH_TYPE_EMAIL = 2;
/**
* @brief Front end login form
*/
@@ -48,16 +82,6 @@ class _Login
*/
const LOGIN_UCP = 5;
/**
* @brief Using username for login
*/
const AUTH_TYPE_USERNAME = 1;
/**
* @brief Using email for login
*/
const AUTH_TYPE_EMAIL = 2;
/**
* @brief Username/password form
*/
@@ -71,33 +95,33 @@ class _Login
/**
* @brief URL
*/
public $url;
public ?Url $url = NULL;
/**
* @brief Login form type
*/
public $type;
public ?int $type = NULL;
/**
* @brief Reauthenticating member
*/
public $reauthenticateAs;
public ?Member $reauthenticateAs = null;
/**
* Constructor
*
* @param \IPS\Http\Url $url The URL page for the login screen
* @param int $type One of the LOGIN_* constants
* @param Url|null $url The URL page for the login screen
* @param int $type One of the LOGIN_* constants
* @return void
*/
public function __construct( \IPS\Http\Url $url = NULL, $type=1 )
public function __construct( Url $url = NULL, int $type=1 )
{
$this->url = $url;
$this->type = $type;
if ( $type === static::LOGIN_REAUTHENTICATE or $type === static::LOGIN_UCP )
{
$this->reauthenticateAs = \IPS\Member::loggedIn();
$this->reauthenticateAs = Member::loggedIn();
}
}
@@ -108,16 +132,16 @@ class _Login
*
* @return array
*/
public static function methods()
public static function methods(): array
{
$return = array();
foreach ( static::getStore() as $row )
{
try
{
$return[ $row['login_id'] ] = \IPS\Login\Handler::constructFromData( $row );
$return[ $row['login_id'] ] = Handler::constructFromData( $row );
}
catch ( \OutOfRangeException $e ) { }
catch ( OutOfRangeException $e ) { }
}
return $return;
}
@@ -127,14 +151,14 @@ class _Login
*
* @return array
*/
public static function getStore()
public static function getStore(): array
{
if ( !isset( \IPS\Data\Store::i()->loginMethods ) )
if ( !isset( Store::i()->loginMethods ) )
{
\IPS\Data\Store::i()->loginMethods = iterator_to_array( \IPS\Db::i()->select( '*', 'core_login_methods', array( 'login_enabled=1' ), 'login_order' )->setKeyField( 'login_id' ) );
Store::i()->loginMethods = iterator_to_array( Db::i()->select( '*', 'core_login_methods', array( 'login_enabled=1' ), 'login_order' )->setKeyField( 'login_id' ) );
}
return \IPS\Data\Store::i()->loginMethods;
return Store::i()->loginMethods;
}
/**
@@ -142,7 +166,7 @@ class _Login
*
* @return array
*/
protected function _methods()
protected function _methods(): array
{
$methods = array();
foreach ( static::methods() as $k => $method )
@@ -152,7 +176,7 @@ class _Login
or ( $this->type === static::LOGIN_UCP and $method->front )
or ( $this->type === static::LOGIN_ACP and $method->acp )
or ( $this->type === static::LOGIN_REGISTRATION_FORM and $method->register )
or ( $this->type === static::LOGIN_REAUTHENTICATE and $method->canProcess( $this->reauthenticateAs ) and !( $method instanceof \IPS\Login\LoginAbstract ) )
or ( $this->type === static::LOGIN_REAUTHENTICATE and $method->canProcess( $this->reauthenticateAs ) and !( $method instanceof Handler ) )
) {
$methods[ $k ] = $method;
}
@@ -166,7 +190,7 @@ class _Login
*
* @return array
*/
public function usernamePasswordMethods()
public function usernamePasswordMethods(): array
{
$return = array();
foreach ( $this->_methods() as $method )
@@ -179,27 +203,12 @@ class _Login
return $return;
}
/**
* Should the username/password form ask for username or email address?
*
* @return array
*/
public function authType()
{
$authType = 0;
foreach ( $this->usernamePasswordMethods() as $method )
{
$authType = $authType | $method->authType();
}
return $authType;
}
/**
* Get methods which use a button
*
* @return array
*/
public function buttonMethods()
public function buttonMethods(): array
{
$return = array();
foreach ( $this->_methods() as $method )
@@ -211,26 +220,44 @@ class _Login
}
return $return;
}
/**
* Return front SSO login URL
*
* @return string|null
*/
public function frontSsoUrl(): ?string
{
foreach( Application::allExtensions( 'core', 'SSO', FALSE ) as $ext )
{
/* @var SSOAbstract $ext */
if( $ext->isEnabled() AND $url = $ext->loginUrl() )
{
return $url;
}
}
return NULL;
}
/* !Authentication */
/**
* Authenticate
*
* @param \IPS\Login\Handler\NULL $onlyCheck If provided, will only check the given method
* @return \IPS\Login\Success|NULL
* @throws \IPS\Login\Exception
* @param Handler|null $onlyCheck If provided, will only check the given method
* @return Success|NULL
* @throws \Exception
*/
public function authenticate( \IPS\Login\Handler $onlyCheck = NULL )
public function authenticate( Handler $onlyCheck = NULL ): ?Success
{
try
{
if ( isset( \IPS\Request::i()->_processLogin ) )
if ( isset( Request::i()->_processLogin ) )
{
\IPS\Session::i()->csrfCheck();
Session::i()->csrfCheck();
/* Username/Password */
if ( \IPS\Request::i()->_processLogin === 'usernamepassword' )
if ( Request::i()->_processLogin === 'usernamepassword' )
{
$leastOffensiveException = NULL;
$success = NULL;
@@ -245,18 +272,18 @@ class _Login
{
if ( $this->type === static::LOGIN_REAUTHENTICATE )
{
if ( $method->authenticatePasswordForMember( $this->reauthenticateAs, \IPS\Request::i()->protect('password') ) )
if ( $method->authenticatePasswordForMember( $this->reauthenticateAs, Request::i()->protect('password') ) )
{
$member = $this->reauthenticateAs;
}
else
{
throw new \IPS\Login\Exception( \IPS\Member::loggedIn()->language()->addToStack( 'login_err_bad_password', FALSE, array( 'pluralize' => array( $this->authType() ) ) ), \IPS\Login\Exception::BAD_PASSWORD, NULL, $this->reauthenticateAs );
throw new Exception( Member::loggedIn()->language()->addToStack( 'login_err_bad_password', FALSE ), Exception::BAD_PASSWORD, NULL, $this->reauthenticateAs );
}
}
else
{
$member = $method->authenticateUsernamePassword( $this, \IPS\Request::i()->auth, \IPS\Request::i()->protect('password') );
$member = $method->authenticateUsernamePassword( $this, Request::i()->auth, Request::i()->protect('password') );
if ( $member === TRUE )
{
$member = $this->reauthenticateAs;
@@ -265,18 +292,18 @@ class _Login
if ( $member )
{
static::checkIfAccountIsLocked( $member, TRUE );
$success = new Login\Success( $member, $method, isset( \IPS\Request::i()->remember_me ) );
static::checkIfAccountIsLocked($member, TRUE);
$success = new Login\Success( $member, $method, isset( Request::i()->remember_me ) );
break;
}
}
catch ( \IPS\Login\Exception $e )
catch ( Exception $e )
{
if ( $e->getCode() === \IPS\Login\Exception::BAD_PASSWORD and $e->member )
if ( $e->getCode() === Exception::BAD_PASSWORD and $e->member )
{
$fails[ $e->member->member_id ] = $e->member;
}
elseif( $e->getCode() === \IPS\Login\Exception::NO_ACCOUNT and $e->member AND $e->member->email )
elseif( $e->getCode() === Exception::NO_ACCOUNT and $e->member AND $e->member->email )
{
$failsNoAccount[ $e->member->email ] = $e->member;
}
@@ -315,58 +342,60 @@ class _Login
}
else
{
throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::NO_ACCOUNT );
throw new Exception( 'generic_error', Exception::NO_ACCOUNT );
}
}
/* Buttons */
elseif ( isset( $this->buttonMethods()[ \IPS\Request::i()->_processLogin ] ) and ( !$onlyCheck or $onlyCheck->id == $this->buttonMethods()[ \IPS\Request::i()->_processLogin ]->id ) )
elseif ( isset( $this->buttonMethods()[ Request::i()->_processLogin ] ) and ( !$onlyCheck or $onlyCheck->id == $this->buttonMethods()[ Request::i()->_processLogin ]->id ) )
{
$method = $this->_methods()[ \IPS\Request::i()->_processLogin ];
$method = $this->_methods()[ Request::i()->_processLogin ];
if ( $member = $method->authenticateButton( $this ) )
{
if ( $this->type === static::LOGIN_REAUTHENTICATE and $member !== $this->reauthenticateAs )
{
throw new \IPS\Login\Exception( 'login_err_wrong_account', \IPS\Login\Exception::BAD_PASSWORD );
throw new Exception( 'login_err_wrong_account', Exception::BAD_PASSWORD );
}
static::checkIfAccountIsLocked( $member, TRUE );
static::checkIfAccountIsLocked($member, TRUE);
return new Login\Success( $member, $method );
}
}
}
/* Backwards Compatibility for login handlers created before 4.3 */
elseif ( isset( \IPS\Request::i()->loginProcess ) )
elseif ( isset( Request::i()->loginProcess ) )
{
foreach ( $this->buttonMethods() as $method )
{
if ( $method instanceof \IPS\Login\LoginAbstract and \get_class( $method ) === 'IPS\Login\\' . mb_ucfirst( \IPS\Request::i()->loginProcess ) and ( !$onlyCheck or $method->id == $onlyCheck->id ) )
if ( $method instanceof Handler and get_class( $method ) === 'IPS\Login\\' . IPS::mb_ucfirst( Request::i()->loginProcess ) and ( !$onlyCheck or $method->id == $onlyCheck->id ) )
{
if ( $member = $method->authenticateButton( $this ) )
{
static::checkIfAccountIsLocked( $member, TRUE );
return new Login\Success( $member, $method, isset( \IPS\Request::i()->remember_me ) );
static::checkIfAccountIsLocked($member, TRUE);
return new Login\Success( $member, $method, isset( Request::i()->remember_me ) );
}
}
}
}
}
catch ( \IPS\Login\Exception $e )
catch ( Exception $e )
{
/* If we're about to say the password is incorrect, check if the account is locked and throw that error rather than a bad password error first */
if ( $e->getCode() === \IPS\Login\Exception::BAD_PASSWORD and $e->member )
if ( $e->getCode() === Exception::BAD_PASSWORD and $e->member )
{
static::checkIfAccountIsLocked( $e->member );
static::checkIfAccountIsLocked($e->member);
}
/* Or if the account doesn't exist but we've tried the brute-force number of times, show the account is locked even though it doesn't exist */
elseif( $e->getCode() === \IPS\Login\Exception::NO_ACCOUNT and $e->member AND $e->member->email )
elseif( $e->getCode() === Exception::NO_ACCOUNT and $e->member AND $e->member->email )
{
static::checkIfAccountIsLocked( $e->member );
static::checkIfAccountIsLocked($e->member);
}
/* If we're still here, throw the error we got */
throw $e;
}
return NULL;
}
/* !Account Management Utility Methods */
@@ -375,24 +404,24 @@ class _Login
* After authentication (successful or failed) but before
* processing the login, check if the account is locked
*
* @param \IPS\Member $member The account
* @param bool $success Boolean value indicating if the login was successful. If TRUE, and the account is not locked, failed logins will be removed.
* @param Member $member The account
* @param bool $success Boolean value indicating if the login was successful. If TRUE, and the account is not locked, failed logins will be removed.
* @note The $member object may be a guest object with an email address set
* @return void
* @throws \Exception
*/
public static function checkIfAccountIsLocked( $member, $success = FALSE )
public static function checkIfAccountIsLocked( Member $member, bool $success=FALSE ) : void
{
/* Global attempts */
if( \IPS\Settings::i()->bruteforce_global_attempts )
if( Settings::i()->bruteforce_global_attempts )
{
$fromTimestamp = ( new \IPS\DateTime )->sub( new \DateInterval( 'PT' . \IPS\Settings::i()->bruteforce_global_period .'M' ) )->getTimestamp();
$globalFailures = \IPS\Db::i()->select( 'count(*) as total', 'core_login_failures', [ 'login_date>? AND login_ip_address=?', $fromTimestamp, \IPS\Request::i()->ipAddress() ] )->first();
$fromTimestamp = ( new DateTime )->sub( new DateInterval( 'PT' . Settings::i()->bruteforce_global_period .'M' ) )->getTimestamp();
$globalFailures = Db::i()->select( 'count(*) as total', 'core_login_failures', [ 'login_date>? AND login_ip_address=?', $fromTimestamp, Request::i()->ipAddress() ] )->first();
/* Potential password-spraying activity */
if( $globalFailures >= (int) \IPS\Settings::i()->bruteforce_global_attempts )
if( $globalFailures >= (int) Settings::i()->bruteforce_global_attempts )
{
throw new \IPS\Login\Exception( 'login_err_locked_nounlock', \IPS\Login\Exception::ACCOUNT_LOCKED );
throw new LoginException( 'login_err_locked_nounlock', LoginException::ACCOUNT_LOCKED );
}
}
@@ -400,39 +429,39 @@ class _Login
if ( $unlockTime !== FALSE )
{
/* Notify the member if they've been locked */
if( $member->failedLoginCount( \IPS\Request::i()->ipAddress() ) == \IPS\Settings::i()->ipb_bruteforce_attempts )
if( $member->failedLoginCount( Request::i()->ipAddress() ) == Settings::i()->ipb_bruteforce_attempts )
{
/* Can we get a physical location */
try
{
$location = \IPS\GeoLocation::getRequesterLocation();
$location = GeoLocation::getRequesterLocation();
}
catch ( \Exception $e )
{
$location = \IPS\Request::i()->ipAddress();
$location = Request::i()->ipAddress();
}
if( $member->member_id )
{
\IPS\Email::buildFromTemplate( 'core', 'account_locked', array( $member, $location, isset( $unlockTime ) ? $unlockTime : NULL ), \IPS\Email::TYPE_TRANSACTIONAL )->send( $member );
$member->logHistory( 'core', 'login', array( 'type' => 'lock', 'count' => $member->failedLoginCount( \IPS\Request::i()->ipAddress() ), 'unlockTime' => isset( $unlockTime ) ? $unlockTime->getTimestamp() : NULL ) );
Email::buildFromTemplate( 'core', 'account_locked', array( $member, $location, $unlockTime ?? NULL ), Email::TYPE_TRANSACTIONAL )->send( $member );
$member->logHistory( 'core', 'login', array( 'type' => 'lock', 'count' => $member->failedLoginCount( Request::i()->ipAddress() ), 'unlockTime' => $unlockTime?->getTimestamp() ) );
}
}
if ( \IPS\Settings::i()->ipb_bruteforce_period and \IPS\Settings::i()->ipb_bruteforce_unlock )
if ( Settings::i()->ipb_bruteforce_period and Settings::i()->ipb_bruteforce_unlock )
{
$diffValue = $unlockTime->diff( new DateTime() )->format('%i') ?: 1;
throw new \IPS\Login\Exception( \IPS\Member::loggedIn()->language()->addToStack( 'login_err_locked_unlock', FALSE, array( 'pluralize' => array( $diffValue ) ) ), \IPS\Login\Exception::ACCOUNT_LOCKED );
throw new Exception( Member::loggedIn()->language()->addToStack( 'login_err_locked_unlock', FALSE, array( 'pluralize' => array( $diffValue ) ) ), Exception::ACCOUNT_LOCKED );
}
else
{
throw new \IPS\Login\Exception( 'login_err_locked_nounlock', \IPS\Login\Exception::ACCOUNT_LOCKED );
throw new Exception( 'login_err_locked_nounlock', Exception::ACCOUNT_LOCKED );
}
}
elseif ( $success )
{
\IPS\Db::i()->delete( 'core_login_failures', [ 'login_member_id=? AND login_ip_address=?', $member->member_id, \IPS\Request::i()->ipAddress() ] );
Db::i()->delete( 'core_login_failures', [ 'login_member_id=? AND login_ip_address=?', $member->member_id, Request::i()->ipAddress() ] );
}
}
@@ -444,7 +473,7 @@ class _Login
*/
public static function usernameIsAllowed( string $username ): bool
{
if( \IPS\Settings::i()->username_characters and !preg_match( \IPS\Settings::i()->username_characters, $username ) )
if( Settings::i()->username_characters and !preg_match( Settings::i()->username_characters, $username ) )
{
return FALSE;
}
@@ -455,18 +484,18 @@ class _Login
* Check if a given username is in use
* Returns string with error message or FALSE if not in use
*
* @param string $username Desired username
* @param \IPS\Member $exclude If provided, that member will be excluded from the check
* @param \IPS\Member $admin Boolean value indicating if error message can include details about which login method has claimed it
* @param string $username Desired username
* @param Member|null $exclude If provided, that member will be excluded from the check
* @param bool|Member $admin Boolean value indicating if error message can include details about which login method has claimed it
* @return string|false
*/
public static function usernameIsInUse( $username, $exclude = NULL, $admin = FALSE )
public static function usernameIsInUse(string $username, Member $exclude = NULL, bool|Member $admin = FALSE ): bool|string
{
/* Check locally */
$existingMember = \IPS\Member::load( $username, 'name' );
$existingMember = Member::load( $username, 'name' );
if ( $existingMember->member_id and ( !$exclude or $exclude->member_id != $existingMember->member_id ) )
{
return \IPS\Member::loggedIn()->language()->addToStack('member_name_exists');
return Member::loggedIn()->language()->addToStack('member_name_exists');
}
/* Check each handler */
@@ -476,11 +505,11 @@ class _Login
{
if( $admin )
{
return \IPS\Member::loggedIn()->language()->addToStack( 'member_name_exists_admin', FALSE, array('sprintf' => array( $handler->_title ) ) );
return Member::loggedIn()->language()->addToStack( 'member_name_exists_admin', FALSE, array('sprintf' => array( $handler->_title ) ) );
}
else
{
return \IPS\Member::loggedIn()->language()->addToStack('member_name_exists');
return Member::loggedIn()->language()->addToStack('member_name_exists');
}
}
}
@@ -493,19 +522,19 @@ class _Login
* Check if a given email address is in use
* Returns string with error message or FALSE if not in use
*
* @param string $email Desired email address
* @param \IPS\Member $exclude If provided, that member will be excluded from the check
* @param \IPS\Member $admin Boolean value indicating if error message can include details about which login method has claimed it
* @param string $email Desired email address
* @param Member|null $exclude If provided, that member will be excluded from the check
* @param bool|Member $admin Boolean value indicating if error message can include details about which login method has claimed it
* @return string|false
*/
public static function emailIsInUse( $email, $exclude = NULL, $admin = FALSE )
public static function emailIsInUse(string $email, Member $exclude = NULL, bool|Member $admin = FALSE ): bool|string
{
/* Check locally */
$existingMember = \IPS\Member::load( $email, 'email' );
$existingMember = Member::load( $email, 'email' );
if ( $existingMember->member_id and ( !$exclude or $exclude->member_id != $existingMember->member_id ) )
{
$url = \IPS\Http\Url::internal( "app=core&module=system&controller=lostpass", "front", "lostpassword" );
return \IPS\Member::loggedIn()->language()->addToStack( 'member_email_exists', FALSE, array( 'sprintf' => array( (string) $url ) ) );
$url = Url::internal( "app=core&module=system&controller=lostpass", "front", "lostpassword" );
return Member::loggedIn()->language()->addToStack( 'member_email_exists', FALSE, array( 'sprintf' => array( (string) $url ) ) );
}
/* Check each handler */
@@ -515,12 +544,12 @@ class _Login
{
if( $admin )
{
return \IPS\Member::loggedIn()->language()->addToStack( 'member_email_exists_admin', FALSE, array('sprintf' => array( $handler->_title ) ) );
return Member::loggedIn()->language()->addToStack( 'member_email_exists_admin', FALSE, array('sprintf' => array( $handler->_title ) ) );
}
else
{
$url = \IPS\Http\Url::internal( "app=core&module=system&controller=lostpass", "front", "lostpassword" );
return \IPS\Member::loggedIn()->language()->addToStack( 'member_email_exists', FALSE, array( 'sprintf' => array( (string) $url ) ) );
$url = Url::internal( "app=core&module=system&controller=lostpass", "front", "lostpassword" );
return Member::loggedIn()->language()->addToStack( 'member_email_exists', FALSE, array( 'sprintf' => array( (string) $url ) ) );
}
}
}
@@ -534,19 +563,19 @@ class _Login
/**
* Compare hashes in fixed length, time constant manner.
*
* @param string $expected The expected hash
* @param string $provided The provided input
* @param string|null $expected The expected hash
* @param string|null $provided The provided input
* @return boolean
*/
public static function compareHashes( $expected, $provided )
public static function compareHashes( string $expected=NULL, string $provided=NULL ): bool
{
if ( !\is_string( $expected ) || !\is_string( $provided ) || $expected === '*0' || $expected === '*1' || $provided === '*0' || $provided === '*1' ) // *0 and *1 are failures from crypt() - if we have ended up with an invalid hash anywhere, we will reject it to prevent a possible vulnerability from deliberately generating invalid hashes
if ( !is_string( $expected ) || !is_string( $provided ) || $expected === '*0' || $expected === '*1' || $provided === '*0' || $provided === '*1' ) // *0 and *1 are failures from crypt() - if we have ended up with an invalid hash anywhere, we will reject it to prevent a possible vulnerability from deliberately generating invalid hashes
{
return FALSE;
}
$len = \strlen( $expected );
if ( $len !== \strlen( $provided ) )
$len = strlen( $expected );
if ( $len !== strlen( $provided ) )
{
return FALSE;
}
@@ -554,7 +583,7 @@ class _Login
$status = 0;
for ( $i = 0; $i < $len; $i++ )
{
$status |= \ord( $expected[ $i ] ) ^ \ord( $provided[ $i ] );
$status |= ord( $expected[ $i ] ) ^ ord( $provided[ $i ] );
}
return $status === 0;
@@ -563,26 +592,26 @@ class _Login
/**
* Return a random string
*
* @param int $length The length of the final string
* @param int $length The length of the final string
* @return string
*/
public static function generateRandomString( $length=32 )
public static function generateRandomString( int $length=32 ): string
{
$return = '';
if ( \function_exists( 'random_bytes' ) )
if ( function_exists( 'random_bytes' ) )
{
$return = \substr( bin2hex( random_bytes( $length ) ), 0, $length );
$return = substr( bin2hex( random_bytes( $length ) ), 0, $length );
}
elseif( \function_exists( 'openssl_random_pseudo_bytes' ) )
elseif( function_exists( 'openssl_random_pseudo_bytes' ) )
{
$return = \substr( bin2hex( openssl_random_pseudo_bytes( ceil( $length / 2 ) ) ), 0, $length );
$return = substr( bin2hex( openssl_random_pseudo_bytes( ceil( $length / 2 ) ) ), 0, $length );
}
/* Fallback JUST IN CASE */
if( !$return OR \strlen( $return ) != $length )
if( !$return OR strlen( $return ) != $length )
{
$return = \substr( md5( uniqid( '', true ) ) . md5( uniqid( '', true ) ), 0, $length );
$return = substr( md5( uniqid( '', true ) ) . md5( uniqid( '', true ) ), 0, $length );
}
return $return;
@@ -591,21 +620,21 @@ class _Login
/**
* @brief Cached registration type
*/
protected static $_registrationType = NULL;
protected static ?string $_registrationType = NULL;
/**
* Registration Type
*
* @return string
* @return string|null
*/
public static function registrationType()
public static function registrationType(): ?string
{
if ( static::$_registrationType === NULL )
{
/* If registrations are enabled */
if ( \IPS\Settings::i()->allow_reg )
if ( Settings::i()->allow_reg )
{
switch( \IPS\Settings::i()->allow_reg )
switch( Settings::i()->allow_reg )
{
// just kept this here for legacy reasons, even if we have an upgrade step to change this now
case 1 :
@@ -613,7 +642,7 @@ class _Login
static::$_registrationType ='full';
break;
default:
return \IPS\Settings::i()->allow_reg;
return Settings::i()->allow_reg;
}
}
else
@@ -621,7 +650,7 @@ class _Login
static::$_registrationType = 'disabled';
}
if ( \in_array( static::$_registrationType, array( 'normal', 'full' ) ) and !\IPS\Login\Handler::findMethod( 'IPS\Login\Handler\Standard' ) )
if ( in_array( static::$_registrationType, array( 'normal', 'full' ) ) and !Handler::findMethod( 'IPS\Login\Handler\Standard' ) )
{
static::$_registrationType = 'disabled';
}
@@ -629,29 +658,29 @@ class _Login
return static::$_registrationType;
}
/**
* Log a user out
*
* @param \IPS\Http\Url $redirectUrl The URL the user will be redirected to after logging out
* @return void
* @param Url|null $redirectUrl The URL the user will be redirected to after logging out
* @return void
*/
public static function logout( \IPS\Http\Url $redirectUrl = NULL )
public static function logout( Url $redirectUrl = NULL ) : void
{
/* Do not allow the login_key to be re-used */
if ( isset( \IPS\Request::i()->cookie['device_key'] ) )
if ( isset( Request::i()->cookie['device_key'] ) )
{
try
{
$device = \IPS\Member\Device::loadAndAuthenticate( \IPS\Request::i()->cookie['device_key'], \IPS\Member::loggedIn() );
$device = Device::loadAndAuthenticate( Request::i()->cookie['device_key'], Member::loggedIn() );
$device->login_key = NULL;
$device->save();
}
catch ( \OutOfRangeException $e ) { }
catch ( OutOfRangeException $e ) { }
}
/* Clear cookies */
\IPS\Request::i()->clearLoginCookies();
Request::i()->clearLoginCookies();
/* Destroy the session (we have to explicitly reset the session cookie, see http://php.net/manual/en/function.session-destroy.php) */
$_SESSION = array();
@@ -661,6 +690,20 @@ class _Login
session_start();
/* Member sync callback */
\IPS\Member::loggedIn()->memberSync( 'onLogout', array( $redirectUrl ?: \IPS\Http\Url::internal('') ) );
Event::fire( 'onLogout', Member::loggedIn(), array( $redirectUrl ?: Url::internal('') ) );
/* Check SSO Extensions for overloads */
if( Session::i() instanceof Front )
{
foreach ( Application::allExtensions( 'core', 'SSO', FALSE ) as $ext )
{
/* @var SSOAbstract $ext */
if ( $ext->isEnabled() AND $url = $ext->logoutUrl( $redirectUrl ?: Url::internal('') ) )
{
Output::i()->redirect( $url );
exit;
}
}
}
}
}