1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
<?php
namespace Kanboard\Subscriber;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Kanboard\Core\Security\AuthenticationManager;
use Kanboard\Core\Session\SessionManager;
use Kanboard\Event\AuthSuccessEvent;
use Kanboard\Event\AuthFailureEvent;
/**
* Authentication Subscriber
*
* @package subscriber
* @author Frederic Guillot
*/
class AuthSubscriber extends BaseSubscriber implements EventSubscriberInterface
{
/**
* Get event listeners
*
* @static
* @access public
* @return array
*/
public static function getSubscribedEvents()
{
return array(
AuthenticationManager::EVENT_SUCCESS => 'afterLogin',
AuthenticationManager::EVENT_FAILURE => 'onLoginFailure',
SessionManager::EVENT_DESTROY => 'afterLogout',
);
}
/**
* After Login callback
*
* @access public
* @param AuthSuccessEvent $event
*/
public function afterLogin(AuthSuccessEvent $event)
{
$this->logger->debug('Subscriber executed: '.__METHOD__);
$userAgent = $this->request->getUserAgent();
$ipAddress = $this->request->getIpAddress();
$this->userLockingModel->resetFailedLogin($this->userSession->getUsername());
$this->lastLoginModel->create(
$event->getAuthType(),
$this->userSession->getId(),
$ipAddress,
$userAgent
);
if ($event->getAuthType() === 'RememberMe') {
$this->userSession->validatePostAuthentication();
}
if (session_is_true('hasRememberMe')) {
$session = $this->rememberMeSessionModel->create($this->userSession->getId(), $ipAddress, $userAgent);
$this->rememberMeCookie->write($session['token'], $session['sequence'], $session['expiration']);
}
}
/**
* Destroy RememberMe session on logout
*
* @access public
*/
public function afterLogout()
{
$this->logger->debug('Subscriber executed: '.__METHOD__);
$credentials = $this->rememberMeCookie->read();
if ($credentials !== false) {
$session = $this->rememberMeSessionModel->find($credentials['token'], $credentials['sequence']);
if (! empty($session)) {
$this->rememberMeSessionModel->remove($session['id']);
}
$this->rememberMeCookie->remove();
}
}
/**
* Increment failed login counter
*
* @access public
* @param AuthFailureEvent $event
*/
public function onLoginFailure(AuthFailureEvent $event)
{
$this->logger->debug('Subscriber executed: '.__METHOD__);
$username = $event->getUsername();
if (! empty($username)) {
// log login failure in web server log to allow fail2ban usage
error_log('Kanboard: user '.$username.' authentication failure');
$this->userLockingModel->incrementFailedLogin($username);
if ($this->userLockingModel->getFailedLogin($username) > BRUTEFORCE_LOCKDOWN) {
$this->userLockingModel->lock($username, BRUTEFORCE_LOCKDOWN_DURATION);
}
}
else {
// log login failure in web server log to allow fail2ban usage
error_log('Kanboard: user Unknown authentication failure');
}
}
}
|
