owncloud /
core
Complex classes like Session often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes. You can also have a look at the cohesion graph to spot any un-connected, or weakly-connected components.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use Session, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 71 | class Session implements IUserSession, Emitter { |
||
| 72 | |||
| 73 | /** @var IUserManager $manager */ |
||
| 74 | private $manager; |
||
| 75 | |||
| 76 | /** @var ISession $session */ |
||
| 77 | private $session; |
||
| 78 | |||
| 79 | /** @var ITimeFactory */ |
||
| 80 | private $timeFacory; |
||
| 81 | |||
| 82 | /** @var IProvider */ |
||
| 83 | private $tokenProvider; |
||
| 84 | |||
| 85 | /** @var IConfig */ |
||
| 86 | private $config; |
||
| 87 | |||
| 88 | /** @var User $activeUser */ |
||
| 89 | protected $activeUser; |
||
| 90 | |||
| 91 | /** |
||
| 92 | * @param IUserManager $manager |
||
| 93 | * @param ISession $session |
||
| 94 | * @param ITimeFactory $timeFacory |
||
| 95 | * @param IProvider $tokenProvider |
||
| 96 | * @param IConfig $config |
||
| 97 | */ |
||
| 98 | public function __construct(IUserManager $manager, ISession $session, ITimeFactory $timeFacory, $tokenProvider, IConfig $config) { |
||
| 99 | $this->manager = $manager; |
||
| 100 | $this->session = $session; |
||
| 101 | $this->timeFacory = $timeFacory; |
||
| 102 | $this->tokenProvider = $tokenProvider; |
||
| 103 | $this->config = $config; |
||
| 104 | } |
||
| 105 | |||
| 106 | /** |
||
| 107 | * @param IProvider $provider |
||
| 108 | */ |
||
| 109 | public function setTokenProvider(IProvider $provider) { |
||
| 112 | |||
| 113 | /** |
||
| 114 | * @param string $scope |
||
| 115 | * @param string $method |
||
| 116 | * @param callable $callback |
||
| 117 | */ |
||
| 118 | public function listen($scope, $method, callable $callback) { |
||
| 121 | |||
| 122 | /** |
||
| 123 | * @param string $scope optional |
||
| 124 | * @param string $method optional |
||
| 125 | * @param callable $callback optional |
||
| 126 | */ |
||
| 127 | public function removeListener($scope = null, $method = null, callable $callback = null) { |
||
| 130 | |||
| 131 | /** |
||
| 132 | * get the manager object |
||
| 133 | * |
||
| 134 | * @return Manager |
||
| 135 | */ |
||
| 136 | public function getManager() { |
||
| 139 | |||
| 140 | /** |
||
| 141 | * get the session object |
||
| 142 | * |
||
| 143 | * @return ISession |
||
| 144 | */ |
||
| 145 | public function getSession() { |
||
| 148 | |||
| 149 | /** |
||
| 150 | * set the session object |
||
| 151 | * |
||
| 152 | * @param ISession $session |
||
| 153 | */ |
||
| 154 | public function setSession(ISession $session) { |
||
| 161 | |||
| 162 | /** |
||
| 163 | * set the currently active user |
||
| 164 | * |
||
| 165 | * @param User|null $user |
||
| 166 | */ |
||
| 167 | public function setUser($user) { |
||
| 175 | |||
| 176 | /** |
||
| 177 | * get the current active user |
||
| 178 | * |
||
| 179 | * @return IUser|null Current user, otherwise null |
||
| 180 | */ |
||
| 181 | public function getUser() { |
||
| 200 | |||
| 201 | protected function validateSession(IUser $user) { |
||
| 202 | try { |
||
| 203 | $sessionId = $this->session->getId(); |
||
| 204 | } catch (SessionNotAvailableException $ex) { |
||
| 205 | return; |
||
| 206 | } |
||
| 207 | try { |
||
| 208 | $token = $this->tokenProvider->getToken($sessionId); |
||
| 209 | } catch (InvalidTokenException $ex) { |
||
| 210 | // Session was invalidated |
||
| 211 | $this->logout(); |
||
| 212 | return; |
||
| 213 | } |
||
| 214 | |||
| 215 | // Check whether login credentials are still valid and the user was not disabled |
||
| 216 | // This check is performed each 5 minutes |
||
| 217 | $lastCheck = $this->session->get('last_login_check') ? : 0; |
||
| 218 | $now = $this->timeFacory->getTime(); |
||
| 219 | if ($lastCheck < ($now - 60 * 5)) { |
||
| 220 | try { |
||
| 221 | $pwd = $this->tokenProvider->getPassword($token, $sessionId); |
||
| 222 | } catch (InvalidTokenException $ex) { |
||
| 223 | // An invalid token password was used -> log user out |
||
| 224 | $this->logout(); |
||
| 225 | return; |
||
| 226 | } catch (PasswordlessTokenException $ex) { |
||
| 227 | // Token has no password, nothing to check |
||
| 228 | $this->session->set('last_login_check', $now); |
||
| 229 | return; |
||
| 230 | } |
||
| 231 | |||
| 232 | if ($this->manager->checkPassword($token->getLoginName(), $pwd) === false |
||
| 233 | || !$user->isEnabled()) { |
||
| 234 | // Password has changed or user was disabled -> log user out |
||
| 235 | $this->logout(); |
||
| 236 | return; |
||
| 237 | } |
||
| 238 | $this->session->set('last_login_check', $now); |
||
| 239 | } |
||
| 240 | |||
| 241 | // Session is valid, so the token can be refreshed |
||
| 242 | $this->updateToken($token); |
||
| 243 | } |
||
| 244 | |||
| 245 | /** |
||
| 246 | * Checks whether the user is logged in |
||
| 247 | * |
||
| 248 | * @return bool if logged in |
||
| 249 | */ |
||
| 250 | public function isLoggedIn() { |
||
| 251 | $user = $this->getUser(); |
||
| 252 | if (is_null($user)) { |
||
| 253 | return false; |
||
| 254 | } |
||
| 255 | |||
| 256 | return $user->isEnabled(); |
||
| 257 | } |
||
| 258 | |||
| 259 | /** |
||
| 260 | * set the login name |
||
| 261 | * |
||
| 262 | * @param string|null $loginName for the logged in user |
||
| 263 | */ |
||
| 264 | public function setLoginName($loginName) { |
||
| 265 | if (is_null($loginName)) { |
||
| 266 | $this->session->remove('loginname'); |
||
| 267 | } else { |
||
| 268 | $this->session->set('loginname', $loginName); |
||
| 269 | } |
||
| 270 | } |
||
| 271 | |||
| 272 | /** |
||
| 273 | * get the login name of the current user |
||
| 274 | * |
||
| 275 | * @return string |
||
| 276 | */ |
||
| 277 | public function getLoginName() { |
||
| 278 | if ($this->activeUser) { |
||
| 279 | return $this->session->get('loginname'); |
||
| 280 | } else { |
||
| 281 | $uid = $this->session->get('user_id'); |
||
| 282 | if ($uid) { |
||
| 283 | $this->activeUser = $this->manager->get($uid); |
||
| 284 | return $this->session->get('loginname'); |
||
| 285 | } else { |
||
| 286 | return null; |
||
| 287 | } |
||
| 288 | } |
||
| 289 | } |
||
| 290 | |||
| 291 | /** |
||
| 292 | * try to log in with the provided credentials |
||
| 293 | * |
||
| 294 | * @param string $uid |
||
| 295 | * @param string $password |
||
| 296 | * @return boolean|null |
||
| 297 | * @throws LoginException |
||
| 298 | */ |
||
| 299 | public function login($uid, $password) { |
||
| 300 | $this->session->regenerateId(); |
||
| 301 | if ($this->validateToken($password)) { |
||
| 302 | $user = $this->getUser(); |
||
| 303 | |||
| 304 | // When logging in with token, the password must be decrypted first before passing to login hook |
||
| 305 | try { |
||
| 306 | $token = $this->tokenProvider->getToken($password); |
||
| 307 | try { |
||
| 308 | $password = $this->tokenProvider->getPassword($token, $password); |
||
| 309 | $this->manager->emit('\OC\User', 'preLogin', array($uid, $password)); |
||
| 310 | } catch (PasswordlessTokenException $ex) { |
||
| 311 | $this->manager->emit('\OC\User', 'preLogin', array($uid, '')); |
||
| 312 | } |
||
| 313 | } catch (InvalidTokenException $ex) { |
||
| 314 | // Invalid token, nothing to do |
||
| 315 | } |
||
| 316 | } else { |
||
| 317 | $this->manager->emit('\OC\User', 'preLogin', array($uid, $password)); |
||
| 318 | $user = $this->manager->checkPassword($uid, $password); |
||
| 319 | } |
||
| 320 | if ($user !== false) { |
||
| 321 | if (!is_null($user)) { |
||
| 322 | if ($user->isEnabled()) { |
||
| 323 | $this->setUser($user); |
||
| 324 | $this->setLoginName($uid); |
||
| 325 | $this->manager->emit('\OC\User', 'postLogin', array($user, $password)); |
||
| 326 | if ($this->isLoggedIn()) { |
||
| 327 | $this->prepareUserLogin(); |
||
| 328 | return true; |
||
| 329 | } else { |
||
| 330 | // injecting l10n does not work - there is a circular dependency between session and \OCP\L10N\IFactory |
||
| 331 | $message = \OC::$server->getL10N('lib')->t('Login canceled by app'); |
||
| 332 | throw new LoginException($message); |
||
| 333 | } |
||
| 334 | } else { |
||
| 335 | // injecting l10n does not work - there is a circular dependency between session and \OCP\L10N\IFactory |
||
| 336 | $message = \OC::$server->getL10N('lib')->t('User disabled'); |
||
| 337 | throw new LoginException($message); |
||
| 338 | } |
||
| 339 | } |
||
| 340 | } |
||
| 341 | return false; |
||
| 342 | } |
||
| 343 | |||
| 344 | /** |
||
| 345 | * Tries to log in a client |
||
| 346 | * |
||
| 347 | * Checks token auth enforced |
||
| 348 | * Checks 2FA enabled |
||
| 349 | * |
||
| 350 | * @param string $user |
||
| 351 | * @param string $password |
||
| 352 | * @param IRequest $request |
||
| 353 | * @throws LoginException |
||
| 354 | * @throws PasswordLoginForbiddenException |
||
| 355 | * @return boolean |
||
| 356 | */ |
||
| 357 | public function logClientIn($user, $password, IRequest $request) { |
||
| 358 | $isTokenPassword = $this->isTokenPassword($password); |
||
| 359 | if (!$isTokenPassword && $this->isTokenAuthEnforced()) { |
||
| 360 | throw new PasswordLoginForbiddenException(); |
||
| 361 | } |
||
| 362 | if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) { |
||
| 363 | throw new PasswordLoginForbiddenException(); |
||
| 364 | } |
||
| 365 | if (!$this->login($user, $password) ) { |
||
| 366 | $users = $this->manager->getByEmail($user); |
||
| 367 | if (count($users) === 1) { |
||
| 368 | return $this->login($users[0]->getUID(), $password); |
||
| 369 | } |
||
| 370 | return false; |
||
| 371 | } |
||
| 372 | |||
| 373 | if ($this->supportsCookies($request)) { |
||
| 374 | $this->createSessionToken($request, $this->getUser()->getUID(), $user, $password); |
||
| 375 | } |
||
| 376 | |||
| 377 | return true; |
||
| 378 | } |
||
| 379 | |||
| 380 | protected function supportsCookies(IRequest $request) { |
||
| 387 | |||
| 388 | private function isTokenAuthEnforced() { |
||
| 391 | |||
| 392 | protected function isTwoFactorEnforced($username) { |
||
| 393 | Util::emitHook( |
||
| 394 | '\OCA\Files_Sharing\API\Server2Server', |
||
| 395 | 'preLoginNameUsedAsUserName', |
||
| 396 | array('uid' => &$username) |
||
| 397 | ); |
||
| 398 | $user = $this->manager->get($username); |
||
| 399 | if (is_null($user)) { |
||
| 400 | $users = $this->manager->getByEmail($username); |
||
| 401 | if (count($users) !== 1) { |
||
| 402 | return true; |
||
| 403 | } |
||
| 404 | $user = $users[0]; |
||
| 405 | } |
||
| 406 | // DI not possible due to cyclic dependencies :'-/ |
||
| 407 | return OC::$server->getTwoFactorAuthManager()->isTwoFactorAuthenticated($user); |
||
| 408 | } |
||
| 409 | |||
| 410 | /** |
||
| 411 | * Check if the given 'password' is actually a device token |
||
| 412 | * |
||
| 413 | * @param string $password |
||
| 414 | * @return boolean |
||
| 415 | */ |
||
| 416 | public function isTokenPassword($password) { |
||
| 424 | |||
| 425 | protected function prepareUserLogin() { |
||
| 435 | |||
| 436 | /** |
||
| 437 | * Tries to login the user with HTTP Basic Authentication |
||
| 438 | * |
||
| 439 | * @todo do not allow basic auth if the user is 2FA enforced |
||
| 440 | * @param IRequest $request |
||
| 441 | * @return boolean if the login was successful |
||
| 442 | */ |
||
| 443 | public function tryBasicAuthLogin(IRequest $request) { |
||
| 465 | |||
| 466 | private function loginWithToken($uid) { |
||
| 483 | |||
| 484 | /** |
||
| 485 | * Create a new session token for the given user credentials |
||
| 486 | * |
||
| 487 | * @param IRequest $request |
||
| 488 | * @param string $uid user UID |
||
| 489 | * @param string $loginName login name |
||
| 490 | * @param string $password |
||
| 491 | * @return boolean |
||
| 492 | */ |
||
| 493 | public function createSessionToken(IRequest $request, $uid, $loginName, $password = null) { |
||
| 510 | |||
| 511 | /** |
||
| 512 | * Checks if the given password is a token. |
||
| 513 | * If yes, the password is extracted from the token. |
||
| 514 | * If no, the same password is returned. |
||
| 515 | * |
||
| 516 | * @param string $password either the login password or a device token |
||
| 517 | * @return string|null the password or null if none was set in the token |
||
| 518 | */ |
||
| 519 | private function getPassword($password) { |
||
| 535 | |||
| 536 | /** |
||
| 537 | * @param string $token |
||
| 538 | * @return boolean |
||
| 539 | */ |
||
| 540 | private function validateToken($token) { |
||
| 556 | |||
| 557 | /** |
||
| 558 | * @param IToken $token |
||
| 559 | */ |
||
| 560 | private function updateToken(IToken $token) { |
||
| 569 | |||
| 570 | /** |
||
| 571 | * Tries to login the user with auth token header |
||
| 572 | * |
||
| 573 | * @todo check remember me cookie |
||
| 574 | * @return boolean |
||
| 575 | */ |
||
| 576 | public function tryTokenLogin(IRequest $request) { |
||
| 591 | |||
| 592 | /** |
||
| 593 | * perform login using the magic cookie (remember login) |
||
| 594 | * |
||
| 595 | * @param string $uid the username |
||
| 596 | * @param string $currentToken |
||
| 597 | * @return bool |
||
| 598 | */ |
||
| 599 | public function loginWithCookie($uid, $currentToken) { |
||
| 625 | |||
| 626 | /** |
||
| 627 | * logout the user from the session |
||
| 628 | */ |
||
| 629 | public function logout() { |
||
| 644 | |||
| 645 | /** |
||
| 646 | * Set cookie value to use in next page load |
||
| 647 | * |
||
| 648 | * @param string $username username to be set |
||
| 649 | * @param string $token |
||
| 650 | */ |
||
| 651 | public function setMagicInCookie($username, $token) { |
||
| 658 | |||
| 659 | /** |
||
| 660 | * Remove cookie for "remember username" |
||
| 661 | */ |
||
| 662 | public function unsetMagicInCookie() { |
||
| 678 | |||
| 679 | /** |
||
| 680 | * Update password of the browser session token if there is one |
||
| 681 | * |
||
| 682 | * @param string $password |
||
| 683 | */ |
||
| 684 | public function updateSessionTokenPassword($password) { |
||
| 695 | |||
| 696 | } |
||
| 697 |
Loading history...
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.
For example, imagine you have a variable
$accountIdthat can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to theidproperty of an instance of theAccountclass. This class holds a proper account, so the id value must no longer be false.Either this assignment is in error or a type check should be added for that assignment.