From 52b50073fc7db6cc193f551201c85617d020b1b3 Mon Sep 17 00:00:00 2001 From: Damyon Wiese Date: Wed, 29 Aug 2018 09:38:46 +0800 Subject: [PATCH] MDL-63183 auth: Login protection CSRF protection for the login form. The authenticate_user_login function was extended to validate the token (in \core\session\manager) but by default it does not perform the extra validation. Existing uses of this function from auth plugins and features like "change password" will continue to work without changes. New config value $CFG->disablelogintoken can bypass this check. --- auth/ldap/auth.php | 3 +- auth/shibboleth/index.php | 3 +- auth/upgrade.txt | 4 ++ blocks/login/block_login.php | 1 + config-dist.php | 5 ++ lib/classes/session/manager.php | 101 ++++++++++++++++++++++++++++++++ lib/moodlelib.php | 18 +++++- lib/tests/authlib_test.php | 53 +++++++++++++++++ login/change_password_form.php | 3 +- login/index.php | 3 +- login/index_form.html | 1 + login/token.php | 3 +- 12 files changed, 192 insertions(+), 6 deletions(-) diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php index b23c9ec99be..09c5ad42689 100644 --- a/auth/ldap/auth.php +++ b/auth/ldap/auth.php @@ -1762,7 +1762,8 @@ class auth_plugin_ldap extends auth_plugin_base { // Here we want to trigger the whole authentication machinery // to make sure no step is bypassed... - $user = authenticate_user_login($username, $key); + $reason = null; + $user = authenticate_user_login($username, $key, false, $reason, false); if ($user) { complete_user_login($user); diff --git a/auth/shibboleth/index.php b/auth/shibboleth/index.php index a8cbd03c78d..a47d3ba96dd 100644 --- a/auth/shibboleth/index.php +++ b/auth/shibboleth/index.php @@ -49,9 +49,10 @@ $frm->password = generate_password(8); /// Check if the user has actually submitted login data to us + $reason = null; if ($shibbolethauth->user_login($frm->username, $frm->password) - && $user = authenticate_user_login($frm->username, $frm->password)) { + && $user = authenticate_user_login($frm->username, $frm->password, false, $reason, false)) { complete_user_login($user); if (user_not_fully_set_up($USER, true)) { diff --git a/auth/upgrade.txt b/auth/upgrade.txt index 0024b81aad9..c9a55d968f5 100644 --- a/auth/upgrade.txt +++ b/auth/upgrade.txt @@ -1,6 +1,10 @@ This files describes API changes in /auth/* - plugins, information provided here is intended especially for developers. +=== 3.1.15 === + +* Login forms generated from Moodle must include a login token to protect automated logins. See \core\session\manager::get_login_token(). + === 3.0 === * login_signup_form::signup_captcha_enabled() now calls is_captcha_enabled() from the current auth plugin instead of from auth_email diff --git a/blocks/login/block_login.php b/blocks/login/block_login.php index 2c4eda4aa72..25fac7a0341 100644 --- a/blocks/login/block_login.php +++ b/blocks/login/block_login.php @@ -92,6 +92,7 @@ class block_login extends block_base { } $this->content->text .= '
'; + $this->content->text .= ''; $this->content->text .= "\n"; diff --git a/config-dist.php b/config-dist.php index caf0f1c19ec..a103dd72564 100644 --- a/config-dist.php +++ b/config-dist.php @@ -561,6 +561,11 @@ $CFG->admin = 'admin'; // // $CFG->upgradekey = 'put_some_password-like_value_here'; // +// Disable login token validation for login pages. Login token validation is enabled +// by default unless $CFG->alternateloginurl is set. +// +// $CFG->disablelogintoken = true; +// //========================================================================= // 7. SETTINGS FOR DEVELOPMENT SERVERS - not intended for production use!!! //========================================================================= diff --git a/lib/classes/session/manager.php b/lib/classes/session/manager.php index 9f0bbd5e387..b67f8d3804f 100644 --- a/lib/classes/session/manager.php +++ b/lib/classes/session/manager.php @@ -46,6 +46,9 @@ class manager { /** @var bool $sessionactive Is the session active? */ protected static $sessionactive = null; + /** @var string $logintokenkey Key used to get and store request protection for login form. */ + protected static $logintokenkey = 'core_auth_login'; + /** * Start user session. * @@ -906,4 +909,102 @@ class manager { ))); } + /** + * Generate a new login token and store it in the session. + * + * @return array The current login state. + */ + private static function create_login_token() { + global $SESSION; + + $state = [ + 'token' => random_string(32), + 'created' => time() // Server time - not user time. + ]; + + if (!isset($SESSION->logintoken)) { + $SESSION->logintoken = []; + } + + // Overwrite any previous values. + $SESSION->logintoken[self::$logintokenkey] = $state; + + return $state; + } + + /** + * Get the current login token or generate a new one. + * + * All login forms generated from Moodle must include a login token + * named "logintoken" with the value being the result of this function. + * Logins will be rejected if they do not include this token as well as + * the username and password fields. + * + * @return string The current login token. + */ + public static function get_login_token() { + global $CFG, $SESSION; + + $state = false; + + if (!isset($SESSION->logintoken)) { + $SESSION->logintoken = []; + } + + if (array_key_exists(self::$logintokenkey, $SESSION->logintoken)) { + $state = $SESSION->logintoken[self::$logintokenkey]; + } + if (empty($state)) { + $state = self::create_login_token(); + } + + // Check token lifespan. + if ($state['created'] < (time() - $CFG->sessiontimeout)) { + $state = self::create_login_token(); + } + + // Return the current session login token. + if (array_key_exists('token', $state)) { + return $state['token']; + } else { + return false; + } + } + + /** + * Check the submitted value against the stored login token. + * + * @param mixed $token The value submitted in the login form that we are validating. + * If false is passed for the token, this function will always return true. + * @return boolean If the submitted token is valid. + */ + public static function validate_login_token($token = false) { + global $CFG; + + if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) { + // An external login page cannot generate the login token we need to protect CSRF on + // login requests. + // Other custom login workflows may skip this check by setting disablelogintoken in config. + return true; + } + if ($token === false) { + // authenticate_user_login is a core function was extended to validate tokens. + // For existing uses other than the login form it does not + // validate that a token was generated. + // Some uses that do not validate the token are login/token.php, + // or an auth plugin like auth/ldap/auth.php. + return true; + } + + $currenttoken = self::get_login_token(); + + // We need to clean the login token so the old one is not valid again. + self::create_login_token(); + + if ($currenttoken !== $token) { + // Fail the login. + return false; + } + return true; + } } diff --git a/lib/moodlelib.php b/lib/moodlelib.php index 00df35da94c..71a93d70084 100644 --- a/lib/moodlelib.php +++ b/lib/moodlelib.php @@ -2441,6 +2441,9 @@ function dayofweek($day, $month, $year) { /** * Returns full login url. * + * Any form submissions for authentication to this URL must include username, + * password as well as a logintoken generated by \core\session\manager::get_login_token(). + * * @return string login url */ function get_login_url() { @@ -4141,9 +4144,10 @@ function guest_user() { * @param string $password User's password * @param bool $ignorelockout useful when guessing is prevented by other mechanism such as captcha or SSO * @param int $failurereason login failure reason, can be used in renderers (it may disclose if account exists) + * @param mixed logintoken If this is set to a string it is validated against the login token for the session. * @return stdClass|false A {@link $USER} object or false if error */ -function authenticate_user_login($username, $password, $ignorelockout=false, &$failurereason=null) { +function authenticate_user_login($username, $password, $ignorelockout=false, &$failurereason=null, $logintoken=false) { global $CFG, $DB; require_once("$CFG->libdir/authlib.php"); @@ -4165,6 +4169,18 @@ function authenticate_user_login($username, $password, $ignorelockout=false, &$f } } + // Make sure this request came from the login form. + if (!\core\session\manager::validate_login_token($logintoken)) { + $failurereason = AUTH_LOGIN_FAILED; + + // Trigger login failed event. + $event = \core\event\user_login_failed::create(array('userid' => $user->id, + 'other' => array('username' => $username, 'reason' => $failurereason))); + $event->trigger(); + error_log('[client '.getremoteaddr()."] $CFG->wwwroot Invalid Login Token: $username ".$_SERVER['HTTP_USER_AGENT']); + return false; + } + $authsenabled = get_enabled_auth_plugins(); if ($user) { diff --git a/lib/tests/authlib_test.php b/lib/tests/authlib_test.php index 53ad3076306..e59e3833296 100644 --- a/lib/tests/authlib_test.php +++ b/lib/tests/authlib_test.php @@ -200,6 +200,59 @@ class core_authlib_testcase extends advanced_testcase { $this->assertSame($eventdata['other']['reason'], AUTH_LOGIN_FAILED); $this->assertEventContextNotUsed($event); + // Capture failed login token. + unset($CFG->alternateloginurl); + unset($CFG->disablelogintoken); + $sink = $this->redirectEvents(); + $result = authenticate_user_login('username1', 'password1', false, $reason, 'invalidtoken'); + $events = $sink->get_events(); + $sink->close(); + $event = array_pop($events); + + $this->assertFalse($result); + $this->assertEquals(AUTH_LOGIN_FAILED, $reason); + // Test Event. + $this->assertInstanceOf('\core\event\user_login_failed', $event); + $expectedlogdata = array(SITEID, 'login', 'error', 'index.php', 'username1'); + $this->assertEventLegacyLogData($expectedlogdata, $event); + $eventdata = $event->get_data(); + $this->assertSame($eventdata['other']['username'], 'username1'); + $this->assertSame($eventdata['other']['reason'], AUTH_LOGIN_FAILED); + $this->assertEventContextNotUsed($event); + + // Login should work with invalid token if CFG login token settings override it. + $CFG->alternateloginurl = 'http://localhost/'; + $sink = $this->redirectEvents(); + $result = authenticate_user_login('username1', 'password1', false, $reason, 'invalidtoken'); + $events = $sink->get_events(); + $sink->close(); + $this->assertEmpty($events); + $this->assertInstanceOf('stdClass', $result); + $this->assertEquals(AUTH_LOGIN_OK, $reason); + + unset($CFG->alternateloginurl); + $CFG->disablelogintoken = true; + + $sink = $this->redirectEvents(); + $result = authenticate_user_login('username1', 'password1', false, $reason, 'invalidtoken'); + $events = $sink->get_events(); + $sink->close(); + $this->assertEmpty($events); + $this->assertInstanceOf('stdClass', $result); + $this->assertEquals(AUTH_LOGIN_OK, $reason); + + unset($CFG->disablelogintoken); + // Normal login with valid token. + $reason = null; + $token = \core\session\manager::get_login_token(); + $sink = $this->redirectEvents(); + $result = authenticate_user_login('username1', 'password1', false, $reason, $token); + $events = $sink->get_events(); + $sink->close(); + $this->assertEmpty($events); + $this->assertInstanceOf('stdClass', $result); + $this->assertEquals(AUTH_LOGIN_OK, $reason); + $reason = null; // Capture failed login event. $sink = $this->redirectEvents(); diff --git a/login/change_password_form.php b/login/change_password_form.php index 589b45b668d..5b62a1380e0 100644 --- a/login/change_password_form.php +++ b/login/change_password_form.php @@ -80,9 +80,10 @@ class login_change_password_form extends moodleform { function validation($data, $files) { global $USER; $errors = parent::validation($data, $files); + $reason = null; // ignore submitted username - if (!$user = authenticate_user_login($USER->username, $data['password'], true)) { + if (!$user = authenticate_user_login($USER->username, $data['password'], true, $reason, false)) { $errors['password'] = get_string('invalidlogin'); return $errors; } diff --git a/login/index.php b/login/index.php index b158b37d651..2b482c37fff 100644 --- a/login/index.php +++ b/login/index.php @@ -38,6 +38,7 @@ redirect_if_major_upgrade_required(); $testsession = optional_param('testsession', 0, PARAM_INT); // test session works properly $cancel = optional_param('cancel', 0, PARAM_BOOL); // redirect to frontpage, needed for loginhttps $anchor = optional_param('anchor', '', PARAM_RAW); // Used to restore hash anchor to wantsurl. +$logintoken = optional_param('logintoken', '', PARAM_RAW); // Used to validate the request. if ($cancel) { redirect(new moodle_url('/')); @@ -151,7 +152,7 @@ if ($frm and isset($frm->username)) { // Login WITH $frm = false; } else { if (empty($errormsg)) { - $user = authenticate_user_login($frm->username, $frm->password, false, $errorcode); + $user = authenticate_user_login($frm->username, $frm->password, false, $errorcode, $logintoken); } } diff --git a/login/index_form.html b/login/index_form.html index 3b8ae587fe9..11f568ae9d7 100644 --- a/login/index_form.html +++ b/login/index_form.html @@ -57,6 +57,7 @@ if (empty($CFG->authloginviaemail)) { " />
+