/**
* This checks for the correct response to authorising a user
*
* @return void
* @dataProvider casesAuthorise
*/
public function testAuthorise($input, $expect, $message)
{
$this->assertEquals($expect, JAuthentication::authorise($input), $message);
}
/**
* This checks for the correct response to authorising a user
*
* @param string $input User name
* @param string $expect Expected user id
* @param string $message Expected error info
*
* @return void
*
* @dataProvider casesAuthorise
* @since 11.1
* @covers JAuthentication::authorise
*/
public function testAuthorise($input, $expect, $message)
{
$this->assertEquals($expect, $this->object->authorise($input), $message);
}
/**
* If a detection has been successful then it will try to
* authenticate with the onUserAuthorisation method
* in any of the authentication plugins.
*
* @param string $username String containing detected username.
* @param array $options An array containing action, autoregister and detection name.
*
* @return JAuthenticationResponse Response from the authorise.
*
* @since 1.0
*/
public function authorise($username, $options)
{
$response = new JAuthenticationResponse();
$response->username = $username;
// Check for user attributes and set them into the authentication response if they exist
if (isset($options['attributes'])) {
if (isset($options['attributes']['email'])) {
$response->email = $options['attributes']['email'];
}
if (isset($options['attributes']['fullname'])) {
$response->fullname = $options['attributes']['fullname'];
}
}
// Import the authentication and user plug-ins in case they havent already
// J! Pull Request: https://github.com/joomla/joomla-platform/pull/1305
JPluginHelper::importPlugin('user');
JPluginHelper::importPlugin('authentication');
// We need to authorise our username to an authentication plugin
$authorisations = JAuthentication::authorise($response, $options);
foreach ($authorisations as $authorisation) {
if ($authorisation->status === JAuthentication::STATUS_SUCCESS) {
// This username is authorised to use the system
$response->status = JAuthentication::STATUS_SUCCESS;
return $response;
}
}
// No authorises found
$response->status = JAuthentication::STATUS_FAILURE;
return $response;
}
/**
* Login authentication function.
*
* Username and encoded password are passed the onUserLogin event which
* is responsible for the user validation. A successful validation updates
* the current session record with the user's details.
*
* Username and encoded password are sent as credentials (along with other
* possibilities) to each observer (authentication plugin) for user
* validation. Successful validation will update the current session with
* the user details.
*
* @param array $credentials Array('username' => string, 'password' => string)
* @param array $options Array('remember' => boolean)
*
* @return boolean True on success.
*
* @since 11.1
*/
public function login($credentials, $options = array())
{
// Get the global JAuthentication object.
jimport('joomla.user.authentication');
$response = JAuthentication::authenticate($credentials, $options);
if ($response->status === JAuthentication::STATUS_SUCCESS)
{
// validate that the user should be able to login (different to being authenticated)
// this permits authentication plugins blocking the user
$authorisations = JAuthentication::authorise($response, $options);
foreach ($authorisation as $authorisation)
{
$denied_states = Array(JAuthentication::STATUS_EXPIRED, JAuthentication::STATUS_DENIED);
if (in_array($authorisation->status, $denied_states))
{
// Trigger onUserAuthorisationFailure Event.
$this->triggerEvent('onUserAuthorisationFailure', array((array) $authorisation));
// If silent is set, just return false.
if (isset($options['silent']) && $options['silent'])
{
return false;
}
// Return the error.
switch ($authorisation->status)
{
case JAuthentication::STATUS_EXPIRED:
return JError::raiseWarning('102002', JText::_('JLIB_LOGIN_EXPIRED'));
break;
case JAuthentication::STATUS_DENIED:
return JError::raiseWarning('102003', JText::_('JLIB_LOGIN_DENIED'));
break;
default:
return JError::raiseWarning('102004', JText::_('JLIB_LOGIN_AUTHORISATION'));
break;
}
}
}
// Import the user plugin group.
JPluginHelper::importPlugin('user');
// OK, the credentials are authenticated and user is authorised. Lets fire the onLogin event.
$results = $this->triggerEvent('onUserLogin', array((array) $response, $options));
/*
* If any of the user plugins did not successfully complete the login routine
* then the whole method fails.
*
* Any errors raised should be done in the plugin as this provides the ability
* to provide much more information about why the routine may have failed.
*/
if (!in_array(false, $results, true))
{
// Set the remember me cookie if enabled.
if (isset($options['remember']) && $options['remember'])
{
jimport('joomla.utilities.simplecrypt');
jimport('joomla.utilities.utility');
// Create the encryption key, apply extra hardening using the user agent string.
$key = JUtility::getHash(@$_SERVER['HTTP_USER_AGENT']);
$crypt = new JSimpleCrypt($key);
$rcookie = $crypt->encrypt(serialize($credentials));
$lifetime = time() + 365 * 24 * 60 * 60;
// Use domain and path set in config for cookie if it exists.
$cookie_domain = $this->getCfg('cookie_domain', '');
$cookie_path = $this->getCfg('cookie_path', '/');
setcookie(JUtility::getHash('JLOGIN_REMEMBER'), $rcookie, $lifetime, $cookie_path, $cookie_domain);
}
return true;
}
}
// Trigger onUserLoginFailure Event.
$this->triggerEvent('onUserLoginFailure', array((array) $response));
// If silent is set, just return false.
if (isset($options['silent']) && $options['silent'])
{
return false;
}
// If status is success, any error will have been raised by the user plugin
if ($response->status !== JAuthentication::STATUS_SUCCESS)
{
JError::raiseWarning('102001', JText::_('JLIB_LOGIN_AUTHENTICATE'));
}
return false;
}
