-
-
Notifications
You must be signed in to change notification settings - Fork 0
/
auth.php
352 lines (314 loc) · 11.2 KB
/
auth.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Plugin class for auth antihammer
*
* File auth.php
* Encoding UTF-8
*
* @package auth_antihammer
*
* @copyright Sebsoft.nl
* @author R.J. van Dongen <rogier@sebsoft.nl>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
defined('MOODLE_INTERNAL') || die();
require_once($CFG->libdir . '/authlib.php');
/**
* Plugin for no authentication.
*
* @copyright Sebsoft.nl
* @author R.J. van Dongen <rogier@sebsoft.nl>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class auth_plugin_antihammer extends auth_plugin_base {
/**
* @var string
*/
protected $currentip;
/**
* @var auth_antihammer\antihammer
*/
protected $iphammer;
/**
* @var auth_antihammer\repeatoffender
*/
protected $repeatoffender;
/**
* @var auth_antihammer\antihammer
*/
protected $userhammer;
/**
* Constructor.
*/
public function __construct() {
$this->authtype = 'antihammer';
$this->config = get_config('auth_antihammer');
$this->currentip = getremoteaddr();
}
/**
* Returns true if the username and password work or don't exist and false
* if the user exists and the password is wrong.
*
* @param string $username The username
* @param string $password The password
* @return bool Authentication success or failure.
*/
public function user_login($username, $password) {
return false;
}
/**
* Updates the user's password.
*
* called when the user password is updated.
*
* @param object $user User table object
* @param string $newpassword Plaintext password
* @return boolean result
*
*/
public function user_update_password($user, $newpassword) {
return false;
}
/**
* Indicates if password hashes should be stored in local moodle database.
* @return bool true means md5 password hash stored in user table, false means flag 'not_cached' stored there instead
*/
public function prevent_local_passwords() {
return false;
}
/**
* Returns true if this authentication plugin is 'internal'.
*
* @return bool
*/
public function is_internal() {
return false;
}
/**
* Returns true if this authentication plugin can change the user's
* password.
*
* @return bool
*/
public function can_change_password() {
return false;
}
/**
* Returns the URL for changing the user's pw, or empty if the default can
* be used.
*
* @return moodle_url
*/
public function change_password_url() {
return null;
}
/**
* Returns true if plugin allows resetting of internal password.
*
* @return bool
*/
public function can_reset_password() {
return false;
}
/**
* Hook for overriding behaviour of login page.
* This method is called from login/index.php page for all enabled auth plugins.
*
*/
public function loginpage_hook() {
global $frm;
// First, cleanup old crap.
\auth_antihammer\antihammer::clean_ip_hammering($this->config);
\auth_antihammer\antihammer::clean_user_hammering($this->config);
// If IP is in whitelist, don't do anything.
if (auth_antihammer\util::in_whitelist($this->currentip)) {
return;
}
// Pre load IP hammer. If we're already blocked, redirect.
$this->load_ip_hammer();
if ($this->iphammer->blocked) {
// Redirect to error page, do not notify or log.
if (!empty($this->config->blockpage)) {
redirect(new moodle_url($this->config->blockpage));
} else {
redirect(new moodle_url('/auth/antihammer/blocked.php'));
}
}
// Detect hammering and/or blocks.
try {
// Do we already have submitted data?
$frm = data_submitted();
if (isset($frm->username) && isset($frm->password)) {
if (strlen($frm->username) > 0 && strlen($frm->password) > 0) {
// IP hammering block BEFORE username blocks.
$this->detect_ip_hammering();
$this->detect_user_hammering($frm->username);
}
}
} catch (\auth_antihammer\exception $lex) {
// Log object and message.
$error = get_string('log:info:blocked', 'auth_antihammer', $lex->getMessage());
$data = '';
if ((bool) $this->iphammer->blocked) {
$data = serialize($this->iphammer);
} else if ((bool) $this->userhammer->blocked) {
$data = serialize($this->userhammer);
}
\auth_antihammer\logmessage::log_info($error, 'auth/antihammer', 'blocked', $data, $lex->getCode());
// Process messages if needed.
$a = new stdClass();
$a->ip = $this->currentip;
$a->username = '-';
if (!empty($this->userhammer) && (bool) $this->userhammer->blocked) {
$a->username = $this->userhammer->username;
}
\auth_antihammer\messaging::message_notifyblocking($a, $this->config);
// Redirect or display error.
if (!empty($this->config->blockpage)) {
redirect(new moodle_url($this->config->blockpage));
} else {
redirect(new moodle_url('/auth/antihammer/blocked.php'));
}
}
}
/**
* Hook for overriding behaviour of logout page.
* This method is called from login/logout.php page for all enabled auth plugins.
*
*/
public function logoutpage_hook() {
global $USER; // Use $USER->auth to find the plugin used for login.
global $redirect; // Can be used to override redirect after logout.
}
/**
* Returns true if plugin allows resetting of internal password.
*
* @return bool
*/
public function can_signup() {
return false;
}
/**
* Returns the URL for editing the users' profile, or empty if the default
* URL can be used.
*
* This method is used if can_edit_profile() returns true.
* This method is called only when user is logged in, it may use global $USER.
*
* @return moodle_url url of the profile page or null if standard used
*/
public function edit_profile_url() {
return null;
}
/**
* Load IP hammer
*/
protected function load_ip_hammer() {
$params = array();
$params['type'] = \auth_antihammer\antihammer::TYPE_IP;
$params['ip'] = $this->currentip;
$this->iphammer = \auth_antihammer\antihammer::find($params);
// Add to repeat offenders if enabled.
if ($this->config->enablerepeatoffenders) {
$this->repeatoffender = \auth_antihammer\repeatoffender::append_to_ip_record($this->currentip);
}
}
/**
* Detect/insert hammering records (this is done by IP address and hence will
* only take IP address based hammering into account if configured)
*
* @return boolean
* @throws \auth_antihammer\exception
*/
protected function detect_ip_hammering() {
if (!(bool) $this->config->blockip) {
return false;
}
// Check if already blocked.
if ($this->iphammer->blocked) {
throw new \auth_antihammer\exception('err:blocked:ip', '', $this->iphammer);
}
$this->iphammer->ip = $this->currentip;
$this->iphammer->count++;
// Now check if to be blocked.
if ($this->config->enablerepeatoffenders) {
$blockduration = $this->repeatoffender->get_block_duration($this->config->ip_attemptcounter);
} else {
$blockduration = $this->config->ip_attemptcounter;
}
$timecheck = $this->iphammer->firstattempt + $blockduration;
if ((time() <= $timecheck) && ($this->iphammer->count >= $this->config->ip_attempts)) {
// Set blocked.
$this->iphammer->blocked = 1;
$this->iphammer->blocktime = time();
} else if ((time() > $timecheck)) {
// Reset firstattempt (to prevent messing up in case cleanup is disabled).
$this->iphammer->firstattempt = time();
}
$this->iphammer->save();
if ($this->iphammer->blocked) {
// Add to repeat offender?
if ($this->config->enablerepeatoffenders) {
$this->repeatoffender->blockcounter++;
$this->repeatoffender->save();
}
// Add to globals?
if ((bool)$this->config->addcfgipblock) {
auth_antihammer\antihammer::add_blocked_ip_to_global($this->iphammer->ip);
}
throw new \auth_antihammer\exception('err:blocked:ip', '', $this->iphammer);
}
}
/**
* Detect hammering status for a moodle user and insert/update database record
*
* @param string $username moodle username
* @return boolean
* @throws \auth_antihammer\exception
*/
protected function detect_user_hammering($username) {
if (!(bool) $this->config->blockusername) {
return false;
}
$params = array();
$params['type'] = \auth_antihammer\antihammer::TYPE_USER;
$params['ip'] = $this->currentip;
$params['username'] = $username;
$this->userhammer = \auth_antihammer\antihammer::find($params);
// Check if already blocked.
if ($this->userhammer->blocked) {
throw new \auth_antihammer\exception('err:blocked:user', '', $this->userhammer);
}
$this->userhammer->username = $username;
$this->userhammer->ip = $this->currentip;
$this->userhammer->count++;
// Now check if to be blocked.
$timecheck = $this->userhammer->firstattempt + $this->config->attemptcounter;
if ((time() <= $timecheck) && ($this->userhammer->count >= $this->config->attempts)) {
// Set blocked.
$this->userhammer->blocked = 1;
$this->userhammer->blocktime = time();
} else if ((time() > $timecheck)) {
// Reset firstattempt (to prevent messing up in case cleanup is disabled).
$this->userhammer->firstattempt = time();
}
$this->userhammer->save();
if ($this->userhammer->blocked) {
throw new \auth_antihammer\exception('err:blocked:user', '', $this->userhammer);
}
}
}