4 * Created on Sep 19, 2006
6 * API for MediaWiki 1.8+
8 * Copyright (C) 2006-2007 Yuri Astrakhan <Firstname><Lastname>@gmail.com,
9 * Daniel Cannon (cannon dot danielc at gmail dot com)
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 * http://www.gnu.org/copyleft/gpl.html
27 if (!defined('MEDIAWIKI')) {
28 // Eclipse helper - will be ignored in production
29 require_once ('ApiBase.php');
33 * Unit to authenticate log-in attempts to the current wiki.
37 class ApiLogin extends ApiBase {
39 public function __construct($main, $action) {
40 parent :: __construct($main, $action, 'lg');
44 * Executes the log-in attempt using the parameters passed. If
45 * the log-in succeeeds, it attaches a cookie to the session
46 * and outputs the user id, username, and session token. If a
47 * log-in fails, as the result of a bad password, a nonexistent
48 * user, or any other reason, the host is cached with an expiry
49 * and no log-in attempts will be accepted until that expiry
50 * is reached. The expiry is $this->mLoginThrottle.
54 public function execute() {
55 $params = $this->extractRequestParams();
59 $req = new FauxRequest(array (
60 'wpName' => $params['name'],
61 'wpPassword' => $params['password'],
62 'wpDomain' => $params['domain'],
63 'wpLoginToken' => $params['token'],
67 // Init session if necessary
68 if( session_id() == '' ) {
72 $loginForm = new LoginForm($req);
73 switch ($authRes = $loginForm->authenticateUserData()) {
74 case LoginForm :: SUCCESS :
75 global $wgUser, $wgCookiePrefix;
77 $wgUser->setOption('rememberpassword', 1);
78 $wgUser->setCookies();
80 // Run hooks. FIXME: split back and frontend from this hook.
81 // FIXME: This hook should be placed in the backend
83 wfRunHooks('UserLoginComplete', array(&$wgUser, &$injected_html));
85 $result['result'] = 'Success';
86 $result['lguserid'] = intval($wgUser->getId());
87 $result['lgusername'] = $wgUser->getName();
88 $result['lgtoken'] = $wgUser->getToken();
89 $result['cookieprefix'] = $wgCookiePrefix;
90 $result['sessionid'] = session_id();
93 case LoginForm::NEED_TOKEN:
94 $result['result'] = 'NeedToken';
95 $result['token'] = $loginForm->getLoginToken();
98 case LoginForm::WRONG_TOKEN:
99 $result['result'] = 'WrongToken';
102 case LoginForm :: NO_NAME :
103 $result['result'] = 'NoName';
105 case LoginForm :: ILLEGAL :
106 $result['result'] = 'Illegal';
108 case LoginForm :: WRONG_PLUGIN_PASS :
109 $result['result'] = 'WrongPluginPass';
111 case LoginForm :: NOT_EXISTS :
112 $result['result'] = 'NotExists';
114 case LoginForm :: WRONG_PASS :
115 $result['result'] = 'WrongPass';
117 case LoginForm :: EMPTY_PASS :
118 $result['result'] = 'EmptyPass';
120 case LoginForm :: CREATE_BLOCKED :
121 $result['result'] = 'CreateBlocked';
122 $result['details'] = 'Your IP address is blocked from account creation';
124 case LoginForm :: THROTTLED :
125 global $wgPasswordAttemptThrottle;
126 $result['result'] = 'Throttled';
127 $result['wait'] = intval($wgPasswordAttemptThrottle['seconds']);
130 ApiBase :: dieDebug(__METHOD__, "Unhandled case value: {$authRes}");
133 $this->getResult()->addValue(null, 'login', $result);
136 public function mustBePosted() { return true; }
138 public function isReadMode() {
142 public function getAllowedParams() {
151 public function getParamDescription() {
153 'name' => 'User Name',
154 'password' => 'Password',
155 'domain' => 'Domain (optional)',
156 'token' => 'Login token obtained in first request',
160 public function getDescription() {
162 'This module is used to login and get the authentication tokens. ',
163 'In the event of a successful log-in, a cookie will be attached',
164 'to your session. In the event of a failed log-in, you will not ',
165 'be able to attempt another log-in through this method for 5 seconds.',
166 'This is to prevent password guessing by automated password crackers.'
170 protected function getExamples() {
172 'api.php?action=login&lgname=user&lgpassword=password'
176 public function getVersion() {
177 return __CLASS__ . ': $Id: ApiLogin.php 64680 2010-04-07 00:13:46Z tstarling $';