AuditHook::invalidToken() - Code Metrics - Inspection of "[WIP] Add logging hooks for MFA" - silverstripe/silverstripe-auditor - Measure and Improve Code Quality continuously with Scrutinizer

Passed
Pull Request — master (#27)

by Simon
created 2019-01-11 01:27 UTC
AuditHook::invalidToken() A

↳ Parent: AuditHook
Complexity

Conditions	1
Paths	1
Size

Total Lines	5
Code Lines	3
Duplication

Lines	0
Ratio	0 %
Importance

Changes
Metric	Value
eloc	3
dl	0
loc	5
rs	10
c	0
b	0
f	0
cc	1
nc	1
nop	1
<?php

namespace SilverStripe\Auditor;

use SilverStripe\Control\Email\Email;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\ORM\Connect\Database;
use SilverStripe\ORM\DataExtension;
use SilverStripe\ORM\DataObject;
use SilverStripe\ORM\DataObjectSchema;
use SilverStripe\ORM\DB;
use SilverStripe\Security\Group;
use SilverStripe\Security\Member;
use SilverStripe\Security\PermissionRole;
use SilverStripe\Security\Security;

/**
 * Provides logging hooks that are inserted into Framework objects.
 */
class AuditHook extends DataExtension
{
    protected function getAuditLogger()
    {
        // We cannot use the 'dependencies' private property, because this will prevent us
        // from injecting a mock logger for testing. This is because by the time the testing framework
        // is instantiated, the part of the object graph where AuditLogger lives has already been created.
        // In other words, Framework does not permit hooking in early enough to adjust the graph when
        // 'dependencies' is used :-(
        return Injector::inst()->get('AuditLogger');
    }

    /**
     * This will bind a new class dynamically so we can hook into manipulation
     * and capture it. It creates a new PHP file in the temp folder, then
     * loads it and sets it as the active DB class.
     *
     * @deprecated 2.1...3.0 Please use ProxyDBExtension with the tractorcow/silverstripe-proxy-db module instead
     */
    public static function bind_manipulation_capture()
    {
        $current = DB::get_conn();
        if (!$current || !$current->getConnector()->getSelectedDatabase() || @$current->isManipulationLoggingCapture) {

            return;
        } // If not yet set, or its already captured, just return

        $type = get_class($current);
        $sanitisedType = str_replace('\\', '_', $type);
        $file = TEMP_FOLDER . "/.cache.CLC.$sanitisedType";
        $dbClass = 'AuditLoggerManipulateCapture_' . $sanitisedType;

        if (!is_file($file)) {
            file_put_contents($file, "<?php
				class $dbClass extends $type
                {
					public \$isManipulationLoggingCapture = true;

					public function manipulate(\$manipulation)
                    {
						\SilverStripe\Auditor\AuditHook::handle_manipulation(\$manipulation);
						return parent::manipulate(\$manipulation);
					}
				}
			");
        }

        require_once $file;

        /** @var Database $captured */
        $captured = new $dbClass();

        $captured->setConnector($current->getConnector());
        $captured->setQueryBuilder($current->getQueryBuilder());
        $captured->setSchemaManager($current->getSchemaManager());

        // The connection might have had it's name changed (like if we're currently in a test)
        $captured->selectDatabase($current->getConnector()->getSelectedDatabase());

        DB::set_conn($captured);
    }

    public static function handle_manipulation($manipulation)
    {
        $auditLogger = Injector::inst()->get('AuditLogger');

        $currentMember = Security::getCurrentUser();
        if (!($currentMember && $currentMember->exists())) {
            return false;
        }

        /** @var DataObjectSchema $schema */
        $schema = DataObject::getSchema();

        // The tables that we watch for manipulation on
        $watchedTables = [
            $schema->tableName(Member::class),
            $schema->tableName(Group::class),
            $schema->tableName(PermissionRole::class),
        ];

        foreach ($manipulation as $table => $details) {
            if (!in_array($details['command'], array('update', 'insert'))) {
                continue;
            }

            // logging writes to specific tables (just not when logging in, as it's noise)
            if (in_array($table, $watchedTables)
                && !preg_match('/Security/', @$_SERVER['REQUEST_URI'])
            ) {
                $className = $schema->tableClass($table);

                $data = $className::get()->byId($details['id']);
                if (!$data) {
                    continue;
                }
                $actionText = 'modified '.$table;

                $extendedText = '';
                if ($table === $schema->tableName(Group::class)) {
                    $extendedText = sprintf(
                        'Effective permissions: %s',
                        implode($data->Permissions()->column('Code'), ', ')
                        implode($data->Permissions()->column('Code'), /** @scrutinizer ignore-type */ ', ')
                    );
                }
                if ($table === $schema->tableName(PermissionRole::class)) {
                    $extendedText = sprintf(
                        'Effective groups: %s, Effective permissions: %s',
                        implode($data->Groups()->column('Title'), ', '),
                        implode($data->Codes()->column('Code'), ', ')
                    );
                }
                if ($table === $schema->tableName(Member::class)) {
                    $extendedText = sprintf(
                        'Effective groups: %s',
                        implode($data->Groups()->column('Title'), ', ')
                    );
                }

                $auditLogger->info(sprintf(
                    '"%s" (ID: %s) %s (ID: %s, ClassName: %s, Title: "%s", %s)',
                    $currentMember->Email ?: $currentMember->Title,
                    $currentMember->ID,
                    $actionText,
                    $details['id'],
                    $data->ClassName,
                    $data->Title,
                    $extendedText
                ));
            }

            // log PermissionRole being added to a Group
            if ($table === $schema->tableName(Group::class) . '_Roles') {
                $role = PermissionRole::get()->byId($details['fields']['PermissionRoleID']);
                $group = Group::get()->byId($details['fields']['GroupID']);

                // if the permission role isn't already applied to the group
                if (!DB::query(sprintf(
                    'SELECT "ID" FROM "Group_Roles" WHERE "GroupID" = %s AND "PermissionRoleID" = %s',
                    $details['fields']['GroupID'],
                    $details['fields']['PermissionRoleID']
                ))->value()) {
                    $auditLogger->info(sprintf(
                        '"%s" (ID: %s) added PermissionRole "%s" (ID: %s) to Group "%s" (ID: %s)',
                        $currentMember->Email ?: $currentMember->Title,
                        $currentMember->ID,
                        $role->Title,
                        $role->ID,
                        $group->Title,
                        $group->ID
                    ));
                }
            }

            // log Member added to a Group
            if ($table === $schema->tableName(Group::class) . '_Members') {
                $member = Member::get()->byId($details['fields']['MemberID']);
                $group = Group::get()->byId($details['fields']['GroupID']);

                // if the user isn't already in the group, log they've been added
                if (!DB::query(sprintf(
                    'SELECT "ID" FROM "Group_Members" WHERE "GroupID" = %s AND "MemberID" = %s',
                    $details['fields']['GroupID'],
                    $details['fields']['MemberID']
                ))->value()) {
                    $auditLogger->info(sprintf(
                        '"%s" (ID: %s) added Member "%s" (ID: %s) to Group "%s" (ID: %s)',
                        $currentMember->Email ?: $currentMember->Title,
                        $currentMember->ID,
                        $member->Email ?: $member->Title,
                        $member->ID,
                        $group->Title,
                        $group->ID
                    ));
                }
            }
        }
    }

    /**
     * Log a record being published.
     */
    public function onAfterPublish(&$original)
    {
        $member = Security::getCurrentUser();
        if (!$member || !$member->exists()) {

            return false;
        }

        $effectiveViewerGroups = '';
        if ($this->owner->CanViewType === 'OnlyTheseUsers') {
            $originalViewerGroups = $original ? $original->ViewerGroups()->column('Title') : [];
            $effectiveViewerGroups = implode(', ', $originalViewerGroups);
        }
        if (!$effectiveViewerGroups) {
            $effectiveViewerGroups = $this->owner->CanViewType;
        }

        $effectiveEditorGroups = '';
        if ($this->owner->CanEditType === 'OnlyTheseUsers') {
            $originalEditorGroups =  $original ? $original->EditorGroups()->column('Title') : [];
            $effectiveEditorGroups = implode(', ', $originalEditorGroups);
        }
        if (!$effectiveEditorGroups) {
            $effectiveEditorGroups = $this->owner->CanEditType;
        }

        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) published %s "%s" (ID: %s, Version: %s, ClassName: %s, Effective ViewerGroups: %s, '
            . 'Effective EditorGroups: %s)',
            $member->Email ?: $member->Title,
            $member->ID,
            $this->owner->singular_name(),
            $this->owner->Title,
            $this->owner->ID,
            $this->owner->Version,
            $this->owner->ClassName,
            $effectiveViewerGroups,
            $effectiveEditorGroups
        ));
    }

    /**
     * Log a record being unpublished.
     */
    public function onAfterUnpublish()
    {
        $member = Security::getCurrentUser();
        if (!$member || !$member->exists()) {

            return false;
        }

        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) unpublished %s "%s" (ID: %s)',
            $member->Email ?: $member->Title,
            $member->ID,
            $this->owner->singular_name(),
            $this->owner->Title,
            $this->owner->ID
        ));
    }

    /**
     * Log a record being reverted to live.
     */
    public function onAfterRevertToLive()
    {
        $member = Security::getCurrentUser();
        if (!$member || !$member->exists()) {

            return false;
        }

        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) reverted %s "%s" (ID: %s) to it\'s live version (#%d)',
            $member->Email ?: $member->Title,
            $member->ID,
            $this->owner->singular_name(),
            $this->owner->Title,
            $this->owner->ID,
            $this->owner->Version
        ));
    }

    /**
     * Log a record being duplicated.
     */
    public function onAfterDuplicate()
    {
        $member = Security::getCurrentUser();
        if (!$member || !$member->exists()) {

            return false;
        }

        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) duplicated %s "%s" (ID: %s)',
            $member->Email ?: $member->Title,
            $member->ID,
            $this->owner->singular_name(),
            $this->owner->Title,
            $this->owner->ID
        ));
    }

    /**
     * Log a record being deleted.
     */
    public function onAfterDelete()
    {
        $member = Security::getCurrentUser();
        if (!$member || !$member->exists()) {

            return false;
        }

        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) deleted %s "%s" (ID: %s)',
            $member->Email ?: $member->Title,
            $member->ID,
            $this->owner->singular_name(),
            $this->owner->Title,
            $this->owner->ID
        ));
    }

    /**
     * Log a record being restored to stage.
     */
    public function onAfterRestoreToStage()
    {
        $member = Security::getCurrentUser();
        if (!$member || !$member->exists()) {

            return false;
        }

        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) restored %s "%s" to stage (ID: %s)',
            $member->Email ?: $member->Title,
            $member->ID,
            $this->owner->singular_name(),
            $this->owner->Title,
            $this->owner->ID
        ));
    }

    /**
     * Log successful login attempts.
     */
    public function afterMemberLoggedIn()
    {
        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) successfully logged in',
            $this->owner->Email ?: $this->owner->Title,
            $this->owner->ID
        ));
    }

    /**
     * Log successfully restored sessions from "remember me" cookies ("auto login").
     */
    public function memberAutoLoggedIn()
    {
        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) successfully restored autologin session',
            $this->owner->Email ?: $this->owner->Title,
            $this->owner->ID
        ));
    }

    /**
     * Log failed login attempts.
     */
    public function authenticationFailed($data)
    {
        // LDAP authentication uses a "Login" POST field instead of Email.
        $login = isset($data['Login'])
            ? $data['Login']
            : (isset($data[Email::class]) ? $data[Email::class] : '');

        if (empty($login)) {
            return $this->getAuditLogger()->warning(
                'Could not determine username/email of failed authentication. '.
                'This could be due to login form not using Email or Login field for POST data.'
            );
        }

        $this->getAuditLogger()->info(sprintf('Failed login attempt using email "%s"', $login));
    }

    /**
     * Login during grace period
     * @param Member $member
     */
    public function gracePeriodLogin($member)
    {
        $this->getAuditLogger()->info(sprintf(
            '%s (ID: %s) Successfully logged in while in grace period',
            $member->Email ?: $member->Title,
            $member->ID
        ));
    }

    /**
     * Successful pre-MFA authentication
     * @param Member $member
     */
    public function mfaPreLoginSuccess($member)
    {
        $this->getAuditLogger()->info(sprintf(
            '%s (ID: %s) Successfully completed first step of MFA login',
            $member->Email ?: $member->Title,
            $member->ID
        ));
    }

    /**
     * Member session expired
     */
    public function staleSession()
    {
        $this->getAuditLogger()->info('Member waited too long before entering MFA');
    }

    /**
     * @param string $method
     * @param Member $member
     */
    public function invalidAuthenticationMethod($method, $member)
    {
        $this->getAuditLogger()->warning(sprintf(
            '%s (ID: %s) Attempted to log in with invalid authenticator %s',
            $member->Email ?: $member->Title,
            $member->ID,
            $method
        ));
    }

    /**
     * @param string $method
     * @param Member $member
     */
    public function afterMFALogin($method, $member)
    {
        $this->getAuditLogger()->info(sprintf(
            '%s (ID: %s) Successful log in with MFA authenticator %s',
            $member->Email ?: $member->Title,
            $member->ID,
            $method
        ));
    }

    /**
     * @param string $method
     * @param Member $member
     */
    public function failedMFALogin($method, $member)
    {
        $this->getAuditLogger()->warning(sprintf(
            '%s (ID: %s) Failed to log in with MFA authenticator %s',
            $member->Email ?: $member->Title,
            $member->ID,
            $method
        ));
    }

    /**
     * @param string $method
     */
    public function invalidToken($method)
    {
        $this->getAuditLogger()->warning(sprintf(
            'Security token expired for MFA login with authenticator %s',
            $method
        ));
    }

    public function invalidAuthenticator($method)
    {
        $this->getAuditLogger()->warning(sprintf(
            'Attempted MFA login with invalid authenticator %s',
            $method
        ));
    }

    /**
     * @deprecated 2.1...3.0 Use tractorcow/silverstripe-proxy-db instead
     */
    public function onBeforeInit()
    {
        // no-op
    }

    /**
     * Log permission failures (where the status is set after init of page).
     */
    public function onAfterInit()
    {
        // Suppress errors if dev/build necessary
        if (!Security::database_is_ready()) {
            return false;
        }
        $currentMember = Security::getCurrentUser();
        if (!$currentMember || !$currentMember->exists()) {

            return false;
        }

        $statusCode = $this->owner->getResponse()->getStatusCode();

        if (substr($statusCode, 0, 1) == '4') {
            $this->logPermissionDenied($statusCode, $currentMember);
        }
    }

    protected function logPermissionDenied($statusCode, $member)
    {
        $this->getAuditLogger()->info(sprintf(
            'HTTP code %s - "%s" (ID: %s) is denied access to %s',
            $statusCode,
            $member->Email ?: $member->Title,
            $member->ID,
            $_SERVER['REQUEST_URI']
        ));
    }

    /**
     * Log successful logout.
     */
    public function afterMemberLoggedOut()
    {
        $this->getAuditLogger()->info(sprintf(
            '"%s" (ID: %s) successfully logged out',
            $this->owner->Email ?: $this->owner->Title,
            $this->owner->ID
        ));
    }
}

silverstripe / silverstripe-auditor

Pull Request — master (#27)

AuditHook::invalidToken() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like
