[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Part of the Joomla Framework Authentication Package
   4   *
   5   * @copyright  Copyright (C) 2005 - 2021 Open Source Matters, Inc. All rights reserved.
   6   * @license    GNU General Public License version 2 or later; see LICENSE
   7   */
   8  
   9  namespace Joomla\Authentication\Strategies;
  10  
  11  use Joomla\Authentication\AbstractUsernamePasswordAuthenticationStrategy;
  12  use Joomla\Authentication\Authentication;
  13  use Joomla\Authentication\Password\HandlerInterface;
  14  use Joomla\Database\DatabaseInterface;
  15  use Joomla\Input\Input;
  16  
  17  /**
  18   * Joomla Framework Database Strategy Authentication class
  19   *
  20   * @since  1.1.0
  21   */
  22  class DatabaseStrategy extends AbstractUsernamePasswordAuthenticationStrategy
  23  {
  24      /**
  25       * DatabaseInterface object
  26       *
  27       * @var    DatabaseInterface
  28       * @since  1.1.0
  29       */
  30      private $db;
  31  
  32      /**
  33       * Database connection options
  34       *
  35       * @var    array
  36       * @since  1.1.0
  37       */
  38      private $dbOptions;
  39  
  40      /**
  41       * The Input object
  42       *
  43       * @var    Input
  44       * @since  1.1.0
  45       */
  46      private $input;
  47  
  48      /**
  49       * Strategy Constructor
  50       *
  51       * @param   Input              $input            The input object from which to retrieve the request credentials.
  52       * @param   DatabaseInterface  $database         DatabaseDriver for retrieving user credentials.
  53       * @param   array              $options          Optional options array for configuring the credential storage connection.
  54       * @param   HandlerInterface   $passwordHandler  The password handler.
  55       *
  56       * @since   1.1.0
  57       */
  58  	public function __construct(Input $input, DatabaseInterface $database, array $options = [], ?HandlerInterface $passwordHandler = null)
  59      {
  60          parent::__construct($passwordHandler);
  61  
  62          $this->input = $input;
  63          $this->db    = $database;
  64  
  65          $options['database_table']  = $options['database_table'] ?? '#__users';
  66          $options['username_column'] = $options['username_column'] ?? 'username';
  67          $options['password_column'] = $options['password_column'] ?? 'password';
  68  
  69          $this->dbOptions = $options;
  70      }
  71  
  72      /**
  73       * Attempt to authenticate the username and password pair.
  74       *
  75       * @return  string|boolean  A string containing a username if authentication is successful, false otherwise.
  76       *
  77       * @since   1.1.0
  78       */
  79  	public function authenticate()
  80      {
  81          $username = $this->input->get('username', false, 'username');
  82          $password = $this->input->get('password', false, 'raw');
  83  
  84          if (!$username || !$password)
  85          {
  86              $this->status = Authentication::NO_CREDENTIALS;
  87  
  88              return false;
  89          }
  90  
  91          return $this->doAuthenticate($username, $password);
  92      }
  93  
  94      /**
  95       * Retrieve the hashed password for the specified user.
  96       *
  97       * @param   string  $username  Username to lookup.
  98       *
  99       * @return  string|boolean  Hashed password on success or boolean false on failure.
 100       *
 101       * @since   1.1.0
 102       */
 103  	protected function getHashedPassword($username)
 104      {
 105          try
 106          {
 107              $password = $this->db->setQuery(
 108                  $this->db->getQuery(true)
 109                      ->select($this->db->quoteName($this->dbOptions['password_column']))
 110                      ->from($this->db->quoteName($this->dbOptions['database_table']))
 111                      ->where($this->db->quoteName($this->dbOptions['username_column']) . ' = ?')
 112                      ->bind(1, $username)
 113              )->loadResult();
 114          }
 115          catch (\RuntimeException $exception)
 116          {
 117              return false;
 118          }
 119  
 120          if (!$password)
 121          {
 122              return false;
 123          }
 124  
 125          return $password;
 126      }
 127  }