git.squeep.com Git - akkoma/blob - lib/pleroma/plugs/authentication_plug.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Plugs.AuthenticationPlug do
   6   alias Pleroma.Plugs.OAuthScopesPlug
   7   alias Pleroma.User
   8
   9   import Plug.Conn
  10
  11   require Logger
  12
  13   def init(options), do: options
  14
  15   def checkpw(password, "$6" <> _ = password_hash) do
  16     :crypt.crypt(password, password_hash) == password_hash
  17   end
  18
  19   def checkpw(password, "$2" <> _ = password_hash) do
  20     # Handle bcrypt passwords for Mastodon migration
  21     Bcrypt.verify_pass(password, password_hash)
  22   end
  23
  24   def checkpw(password, "$pbkdf2" <> _ = password_hash) do
  25     Pbkdf2.verify_pass(password, password_hash)
  26   end
  27
  28   def checkpw(_password, _password_hash) do
  29     Logger.error("Password hash not recognized")
  30     false
  31   end
  32
  33   def maybe_update_password(%User{password_hash: "$2" <> _} = user, password) do
  34     do_update_password(user, password)
  35   end
  36
  37   def maybe_update_password(%User{password_hash: "$6" <> _} = user, password) do
  38     do_update_password(user, password)
  39   end
  40
  41   def maybe_update_password(user, _), do: {:ok, user}
  42
  43   defp do_update_password(user, password) do
  44     user
  45     |> User.password_update_changeset(%{
  46       "password" => password,
  47       "password_confirmation" => password
  48     })
  49     |> Pleroma.Repo.update()
  50   end
  51
  52   def call(%{assigns: %{user: %User{}}} = conn, _), do: conn
  53
  54   def call(
  55         %{
  56           assigns: %{
  57             auth_user: %{password_hash: password_hash} = auth_user,
  58             auth_credentials: %{password: password}
  59           }
  60         } = conn,
  61         _
  62       ) do
  63     if checkpw(password, password_hash) do
  64       {:ok, auth_user} = maybe_update_password(auth_user, password)
  65
  66       conn
  67       |> assign(:user, auth_user)
  68       |> OAuthScopesPlug.skip_plug()
  69     else
  70       conn
  71     end
  72   end
  73
  74   def call(%{assigns: %{auth_credentials: %{password: _}}} = conn, _) do
  75     Pbkdf2.no_user_verify()
  76     conn
  77   end
  78
  79   def call(conn, _), do: conn
  80 end