TwoFactorMiddleware.php 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Christoph Wurst <christoph@owncloud.com>
  6. * @author Joas Schilling <coding@schilljs.com>
  7. * @author Lukas Reschke <lukas@statuscode.ch>
  8. * @author Roeland Jago Douma <roeland@famdouma.nl>
  9. *
  10. * @license AGPL-3.0
  11. *
  12. * This code is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License, version 3,
  14. * as published by the Free Software Foundation.
  15. *
  16. * This program is distributed in the hope that it will be useful,
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. * GNU Affero General Public License for more details.
  20. *
  21. * You should have received a copy of the GNU Affero General Public License, version 3,
  22. * along with this program. If not, see <http://www.gnu.org/licenses/>
  23. *
  24. */
  25. namespace OC\Core\Middleware;
  26. use Exception;
  27. use OC\Authentication\Exceptions\TwoFactorAuthRequiredException;
  28. use OC\Authentication\Exceptions\UserAlreadyLoggedInException;
  29. use OC\Authentication\TwoFactorAuth\Manager;
  30. use OC\Core\Controller\LoginController;
  31. use OC\Core\Controller\TwoFactorChallengeController;
  32. use OC\User\Session;
  33. use OCP\AppFramework\Controller;
  34. use OCP\AppFramework\Http\RedirectResponse;
  35. use OCP\AppFramework\Middleware;
  36. use OCP\AppFramework\Utility\IControllerMethodReflector;
  37. use OCP\IRequest;
  38. use OCP\ISession;
  39. use OCP\IURLGenerator;
  40. use OCP\IUser;
  41. class TwoFactorMiddleware extends Middleware {
  42. /** @var Manager */
  43. private $twoFactorManager;
  44. /** @var Session */
  45. private $userSession;
  46. /** @var ISession */
  47. private $session;
  48. /** @var IURLGenerator */
  49. private $urlGenerator;
  50. /** @var IControllerMethodReflector */
  51. private $reflector;
  52. /** @var IRequest */
  53. private $request;
  54. /**
  55. * @param Manager $twoFactorManager
  56. * @param Session $userSession
  57. * @param ISession $session
  58. * @param IURLGenerator $urlGenerator
  59. */
  60. public function __construct(Manager $twoFactorManager, Session $userSession, ISession $session,
  61. IURLGenerator $urlGenerator, IControllerMethodReflector $reflector, IRequest $request) {
  62. $this->twoFactorManager = $twoFactorManager;
  63. $this->userSession = $userSession;
  64. $this->session = $session;
  65. $this->urlGenerator = $urlGenerator;
  66. $this->reflector = $reflector;
  67. $this->request = $request;
  68. }
  69. /**
  70. * @param Controller $controller
  71. * @param string $methodName
  72. */
  73. public function beforeController($controller, $methodName) {
  74. if ($this->reflector->hasAnnotation('PublicPage')) {
  75. // Don't block public pages
  76. return;
  77. }
  78. if ($controller instanceof LoginController && $methodName === 'logout') {
  79. // Don't block the logout page, to allow canceling the 2FA
  80. return;
  81. }
  82. if ($this->userSession->isLoggedIn()) {
  83. $user = $this->userSession->getUser();
  84. if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
  85. $this->checkTwoFactor($controller, $methodName, $user);
  86. } else if ($controller instanceof TwoFactorChallengeController) {
  87. // Allow access to the two-factor controllers only if two-factor authentication
  88. // is in progress.
  89. throw new UserAlreadyLoggedInException();
  90. }
  91. }
  92. // TODO: dont check/enforce 2FA if a auth token is used
  93. }
  94. private function checkTwoFactor(Controller $controller, $methodName, IUser $user) {
  95. // If two-factor auth is in progress disallow access to any controllers
  96. // defined within "LoginController".
  97. $needsSecondFactor = $this->twoFactorManager->needsSecondFactor($user);
  98. $twoFactor = $controller instanceof TwoFactorChallengeController;
  99. // Disallow access to any controller if 2FA needs to be checked
  100. if ($needsSecondFactor && !$twoFactor) {
  101. throw new TwoFactorAuthRequiredException();
  102. }
  103. // Allow access to the two-factor controllers only if two-factor authentication
  104. // is in progress.
  105. if (!$needsSecondFactor && $twoFactor) {
  106. throw new UserAlreadyLoggedInException();
  107. }
  108. }
  109. public function afterException($controller, $methodName, Exception $exception) {
  110. if ($exception instanceof TwoFactorAuthRequiredException) {
  111. $params = [];
  112. if (isset($this->request->server['REQUEST_URI'])) {
  113. $params['redirect_url'] = $this->request->server['REQUEST_URI'];
  114. }
  115. return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge', $params));
  116. }
  117. if ($exception instanceof UserAlreadyLoggedInException) {
  118. return new RedirectResponse($this->urlGenerator->linkToRoute('files.view.index'));
  119. }
  120. throw $exception;
  121. }
  122. }