TwoFactorMiddleware.php 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Christoph Wurst <christoph@owncloud.com>
  6. * @author Joas Schilling <coding@schilljs.com>
  7. * @author Lukas Reschke <lukas@statuscode.ch>
  8. * @author Roeland Jago Douma <roeland@famdouma.nl>
  9. *
  10. * @license AGPL-3.0
  11. *
  12. * This code is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License, version 3,
  14. * as published by the Free Software Foundation.
  15. *
  16. * This program is distributed in the hope that it will be useful,
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. * GNU Affero General Public License for more details.
  20. *
  21. * You should have received a copy of the GNU Affero General Public License, version 3,
  22. * along with this program. If not, see <http://www.gnu.org/licenses/>
  23. *
  24. */
  25. namespace OC\Core\Middleware;
  26. use Exception;
  27. use OC\Authentication\Exceptions\TwoFactorAuthRequiredException;
  28. use OC\Authentication\Exceptions\UserAlreadyLoggedInException;
  29. use OC\Authentication\TwoFactorAuth\Manager;
  30. use OC\Core\Controller\LoginController;
  31. use OC\Core\Controller\TwoFactorChallengeController;
  32. use OC\User\Session;
  33. use OCP\AppFramework\Controller;
  34. use OCP\AppFramework\Http\RedirectResponse;
  35. use OCP\AppFramework\Middleware;
  36. use OCP\AppFramework\Utility\IControllerMethodReflector;
  37. use OCP\Authentication\TwoFactorAuth\ALoginSetupController;
  38. use OCP\IRequest;
  39. use OCP\ISession;
  40. use OCP\IURLGenerator;
  41. use OCP\IUser;
  42. class TwoFactorMiddleware extends Middleware {
  43. /** @var Manager */
  44. private $twoFactorManager;
  45. /** @var Session */
  46. private $userSession;
  47. /** @var ISession */
  48. private $session;
  49. /** @var IURLGenerator */
  50. private $urlGenerator;
  51. /** @var IControllerMethodReflector */
  52. private $reflector;
  53. /** @var IRequest */
  54. private $request;
  55. /**
  56. * @param Manager $twoFactorManager
  57. * @param Session $userSession
  58. * @param ISession $session
  59. * @param IURLGenerator $urlGenerator
  60. */
  61. public function __construct(Manager $twoFactorManager, Session $userSession, ISession $session,
  62. IURLGenerator $urlGenerator, IControllerMethodReflector $reflector, IRequest $request) {
  63. $this->twoFactorManager = $twoFactorManager;
  64. $this->userSession = $userSession;
  65. $this->session = $session;
  66. $this->urlGenerator = $urlGenerator;
  67. $this->reflector = $reflector;
  68. $this->request = $request;
  69. }
  70. /**
  71. * @param Controller $controller
  72. * @param string $methodName
  73. */
  74. public function beforeController($controller, $methodName) {
  75. if ($this->reflector->hasAnnotation('PublicPage')) {
  76. // Don't block public pages
  77. return;
  78. }
  79. if ($controller instanceof ALoginSetupController
  80. && $this->userSession->getUser() !== null
  81. && $this->twoFactorManager->needsSecondFactor($this->userSession->getUser())) {
  82. return;
  83. }
  84. if ($controller instanceof LoginController && $methodName === 'logout') {
  85. // Don't block the logout page, to allow canceling the 2FA
  86. return;
  87. }
  88. if ($this->userSession->isLoggedIn()) {
  89. $user = $this->userSession->getUser();
  90. if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
  91. $this->checkTwoFactor($controller, $methodName, $user);
  92. } else if ($controller instanceof TwoFactorChallengeController) {
  93. // Allow access to the two-factor controllers only if two-factor authentication
  94. // is in progress.
  95. throw new UserAlreadyLoggedInException();
  96. }
  97. }
  98. // TODO: dont check/enforce 2FA if a auth token is used
  99. }
  100. private function checkTwoFactor(Controller $controller, $methodName, IUser $user) {
  101. // If two-factor auth is in progress disallow access to any controllers
  102. // defined within "LoginController".
  103. $needsSecondFactor = $this->twoFactorManager->needsSecondFactor($user);
  104. $twoFactor = $controller instanceof TwoFactorChallengeController;
  105. // Disallow access to any controller if 2FA needs to be checked
  106. if ($needsSecondFactor && !$twoFactor) {
  107. throw new TwoFactorAuthRequiredException();
  108. }
  109. // Allow access to the two-factor controllers only if two-factor authentication
  110. // is in progress.
  111. if (!$needsSecondFactor && $twoFactor) {
  112. throw new UserAlreadyLoggedInException();
  113. }
  114. }
  115. public function afterException($controller, $methodName, Exception $exception) {
  116. if ($exception instanceof TwoFactorAuthRequiredException) {
  117. $params = [];
  118. if (isset($this->request->server['REQUEST_URI'])) {
  119. $params['redirect_url'] = $this->request->server['REQUEST_URI'];
  120. }
  121. return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge', $params));
  122. }
  123. if ($exception instanceof UserAlreadyLoggedInException) {
  124. return new RedirectResponse($this->urlGenerator->linkToRoute('files.view.index'));
  125. }
  126. throw $exception;
  127. }
  128. }