mirror of
https://github.com/the-djmaze/snappymail.git
synced 2024-11-10 09:02:45 +08:00
269 lines
8.4 KiB
PHP
269 lines
8.4 KiB
PHP
<?php
|
|
|
|
use RainLoop\Exceptions\ClientException;
|
|
use SnappyMail\SensitiveString;
|
|
|
|
class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
|
|
{
|
|
const
|
|
NAME = 'Change Password',
|
|
VERSION = '2.38',
|
|
RELEASE = '2024-04-22',
|
|
REQUIRED = '2.36.1',
|
|
CATEGORY = 'Security',
|
|
DESCRIPTION = 'Extension to allow users to change their passwords';
|
|
|
|
// \RainLoop\Notifications\
|
|
const
|
|
CouldNotSaveNewPassword = 130,
|
|
CurrentPasswordIncorrect = 131,
|
|
NewPasswordShort = 132,
|
|
NewPasswordWeak = 133,
|
|
NewPasswordHibp = 134;
|
|
|
|
public function Init() : void
|
|
{
|
|
$this->UseLangs(true); // start use langs folder
|
|
|
|
// $this->addCss('style.css');
|
|
$this->addJs('js/ChangePasswordUserSettings.js'); // add js file
|
|
$this->addJsonHook('ChangePassword', 'ChangePassword');
|
|
$this->addTemplate('templates/SettingsChangePassword.html');
|
|
}
|
|
|
|
protected function getSupportedDrivers(bool $all = false) : iterable
|
|
{
|
|
if ($phar_file = \Phar::running()) {
|
|
$phar = new \Phar($phar_file, \FilesystemIterator::CURRENT_AS_FILEINFO | \FilesystemIterator::KEY_AS_FILENAME);
|
|
foreach (new \RecursiveIteratorIterator($phar) as $file) {
|
|
if (\preg_match('#/drivers/([a-z]+)\\.php$#Di', $file, $m)) {
|
|
$class = 'ChangePasswordDriver' . $m[1];
|
|
try
|
|
{
|
|
if ($all || $this->Config()->Get('plugin', "driver_{$m[1]}_enabled", false)) {
|
|
require_once $file;
|
|
if ($class::isSupported()) {
|
|
yield $m[1] => $class;
|
|
}
|
|
}
|
|
}
|
|
catch (\Throwable $oException)
|
|
{
|
|
\trigger_error("ERROR {$class}: " . $oException->getMessage());
|
|
}
|
|
}
|
|
}
|
|
} else {
|
|
foreach (\glob(__DIR__ . '/drivers/*.php') as $file) {
|
|
$name = \basename($file, '.php');
|
|
$class = 'ChangePasswordDriver' . $name;
|
|
try
|
|
{
|
|
if ($all || $this->Config()->Get('plugin', "driver_{$name}_enabled", false)) {
|
|
require_once $file;
|
|
if ($class::isSupported()) {
|
|
yield $name => $class;
|
|
}
|
|
}
|
|
}
|
|
catch (\Throwable $oException)
|
|
{
|
|
\trigger_error("ERROR {$class}: " . $oException->getMessage());
|
|
}
|
|
}
|
|
}
|
|
|
|
foreach (\glob(__DIR__ . '/../change-password-*', GLOB_ONLYDIR) as $file) {
|
|
$name = \str_replace('change-password-', '', \basename($file));
|
|
$class = "ChangePassword{$name}Driver";
|
|
$file .= '/driver.php';
|
|
try
|
|
{
|
|
if (\is_readable($file) && ($all || $this->Config()->Get('plugin', "driver_{$name}_enabled", false))) {
|
|
require_once $file;
|
|
if ($class::isSupported()) {
|
|
yield $name => $class;
|
|
}
|
|
}
|
|
}
|
|
catch (\Throwable $oException)
|
|
{
|
|
\trigger_error("ERROR {$class}: " . $oException->getMessage());
|
|
}
|
|
}
|
|
}
|
|
|
|
public function Supported() : string
|
|
{
|
|
foreach ($this->getSupportedDrivers() as $class) {
|
|
return '';
|
|
}
|
|
return 'There are no change-password drivers enabled';
|
|
}
|
|
|
|
public function configMapping() : array
|
|
{
|
|
$result = [
|
|
\RainLoop\Plugins\Property::NewInstance('pass_min_length')
|
|
->SetLabel('Password minimum length')
|
|
->SetType(\RainLoop\Enumerations\PluginPropertyType::INT)
|
|
->SetDescription('Minimum length of the password')
|
|
->SetDefaultValue(10)
|
|
->SetAllowedInJs(true),
|
|
\RainLoop\Plugins\Property::NewInstance('pass_min_strength')
|
|
->SetLabel('Password minimum strength')
|
|
->SetType(\RainLoop\Enumerations\PluginPropertyType::INT)
|
|
->SetDescription('Minimum strength of the password in %')
|
|
->SetDefaultValue(70)
|
|
->SetAllowedInJs(true),
|
|
\RainLoop\Plugins\Property::NewInstance('check_hibp')
|
|
->SetLabel('Check Have I Been Pwned')
|
|
->SetType(\RainLoop\Enumerations\PluginPropertyType::BOOL)
|
|
->SetDescription('Check if new passphrase is in a data breach')
|
|
->SetDefaultValue(false),
|
|
];
|
|
foreach ($this->getSupportedDrivers(true) as $name => $class) {
|
|
$group = new \RainLoop\Plugins\PropertyCollection($name);
|
|
$props = [
|
|
\RainLoop\Plugins\Property::NewInstance("driver_{$name}_enabled")
|
|
->SetLabel('Enable ' . $class::NAME)
|
|
->SetType(\RainLoop\Enumerations\PluginPropertyType::BOOL)
|
|
->SetDescription($class::DESCRIPTION)
|
|
->SetDefaultValue(false),
|
|
\RainLoop\Plugins\Property::NewInstance("driver_{$name}_allowed_emails")
|
|
->SetLabel('Allowed emails')
|
|
->SetType(\RainLoop\Enumerations\PluginPropertyType::STRING_TEXT)
|
|
->SetDescription('Allowed emails, space as delimiter, wildcard supported. Example: user1@example.net user2@example1.net *@example2.net')
|
|
->SetDefaultValue('*')
|
|
];
|
|
$group->exchangeArray(\array_merge($props, \call_user_func("{$class}::configMapping")));
|
|
$result[] = $group;
|
|
}
|
|
return $result;
|
|
}
|
|
|
|
public function ChangePassword()
|
|
{
|
|
$oActions = $this->Manager()->Actions();
|
|
$oAccount = $oActions->GetAccount();
|
|
|
|
if (!$oAccount->Email()) {
|
|
\trigger_error('ChangePassword failed: empty email address');
|
|
throw new ClientException(static::CouldNotSaveNewPassword);
|
|
}
|
|
|
|
$sPrevPassword = $this->jsonParam('PrevPassword');
|
|
if ($sPrevPassword !== $oAccount->IncPassword()) {
|
|
throw new ClientException(static::CurrentPasswordIncorrect, null, $oActions->StaticI18N('NOTIFICATIONS/CURRENT_PASSWORD_INCORRECT'));
|
|
}
|
|
$oPrevPassword = new \SnappyMail\SensitiveString($sPrevPassword);
|
|
|
|
$sNewPassword = $this->jsonParam('NewPassword');
|
|
if ($this->Config()->Get('plugin', 'pass_min_length', 10) > \strlen($sNewPassword)) {
|
|
throw new ClientException(static::NewPasswordShort, null, $oActions->StaticI18N('NOTIFICATIONS/NEW_PASSWORD_SHORT'));
|
|
}
|
|
if ($this->Config()->Get('plugin', 'pass_min_strength', 70) > static::PasswordStrength($sNewPassword)) {
|
|
throw new ClientException(static::NewPasswordWeak, null, $oActions->StaticI18N('NOTIFICATIONS/NEW_PASSWORD_WEAK'));
|
|
}
|
|
$oNewPassword = new \SnappyMail\SensitiveString($sNewPassword);
|
|
if ($this->Config()->Get('plugin', 'check_hibp', false) && \SnappyMail\Hibp::password($oNewPassword)) {
|
|
throw new ClientException(static::NewPasswordHibp, null, $oActions->StaticI18N('NOTIFICATIONS/NEW_PASSWORD_HIBP'));
|
|
}
|
|
|
|
$bResult = false;
|
|
$oConfig = $this->Config();
|
|
foreach ($this->getSupportedDrivers() as $name => $class) {
|
|
if (\RainLoop\Plugins\Helper::ValidateWildcardValues($oAccount->Email(), $oConfig->Get('plugin', "driver_{$name}_allowed_emails"))) {
|
|
$name = $class::NAME;
|
|
$oLogger = $oActions->Logger();
|
|
try
|
|
{
|
|
$oDriver = new $class(
|
|
$oConfig,
|
|
$oLogger
|
|
);
|
|
if (!$oDriver->ChangePassword($oAccount, $oPrevPassword, $oNewPassword)) {
|
|
throw new ClientException(static::CouldNotSaveNewPassword);
|
|
}
|
|
$bResult = true;
|
|
if ($oLogger) {
|
|
$oLogger->Write("{$name} password changed for {$oAccount->Email()}");
|
|
}
|
|
}
|
|
catch (\Throwable $oException)
|
|
{
|
|
\trigger_error("{$class} failed: {$oException->getMessage()}");
|
|
if ($oLogger) {
|
|
$oLogger->Write("ERROR: {$name} password change for {$oAccount->Email()} failed");
|
|
$oLogger->WriteException($oException);
|
|
// $oLogger->WriteException($oException, \LOG_WARNING, $name);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!$bResult) {
|
|
\trigger_error("ChangePassword failed");
|
|
throw new ClientException(static::CouldNotSaveNewPassword);
|
|
}
|
|
|
|
$oAccount->SetPassword($oNewPassword);
|
|
if ($oAccount instanceof \RainLoop\Model\MainAccount) {
|
|
$oActions->SetAuthToken($oAccount);
|
|
$oAccount->resealCryptKey($oPrevPassword);
|
|
}
|
|
|
|
return $this->jsonResponse(__FUNCTION__, $oActions->AppData(false));
|
|
}
|
|
|
|
public static function encrypt(string $algo, SensitiveString $password)
|
|
{
|
|
switch (\strtolower($algo))
|
|
{
|
|
case 'argon2i':
|
|
return \password_hash($password, PASSWORD_ARGON2I);
|
|
|
|
case 'argon2id':
|
|
return \password_hash($password, PASSWORD_ARGON2ID);
|
|
|
|
case 'bcrypt':
|
|
return \password_hash($password, PASSWORD_BCRYPT);
|
|
|
|
case 'sha256-crypt':
|
|
return \crypt($password,'$5$'.\substr(\base64_encode(\random_bytes(32)), 0, 16));
|
|
|
|
case 'sha512-crypt':
|
|
return \crypt($password,'$6$'.\substr(\base64_encode(\random_bytes(32)), 0, 16));
|
|
|
|
default:
|
|
break;
|
|
}
|
|
|
|
return $password;
|
|
}
|
|
|
|
private static function PasswordStrength(string $sPassword) : int
|
|
{
|
|
$i = \strlen($sPassword);
|
|
$max = \min(100, $i * 8);
|
|
$s = 0;
|
|
while (--$i) {
|
|
$s += ($sPassword[$i] != $sPassword[$i-1] ? 1 : -0.5);
|
|
}
|
|
$c = 0;
|
|
$re = [ '/[^0-9A-Za-z]+/', '/[0-9]+/', '/[A-Z]+/', '/[a-z]+/' ];
|
|
foreach ($re as $regex) {
|
|
if (\preg_match_all($regex, $sPassword, $m)) {
|
|
++$c;
|
|
foreach ($m[0] as $str) {
|
|
if (5 > \strlen($str)) {
|
|
++$s;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return \intval(\max(0, \min($max, $s * $c * 1.5)));
|
|
}
|
|
|
|
}
|