4 * Created on Sep 19, 2006
6 * API for MediaWiki 1.8+
8 * Copyright (C) 2006-2007 Yuri Astrakhan <Firstname><Lastname>@gmail.com,
9 * Daniel Cannon (cannon dot danielc at gmail dot com)
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 * http://www.gnu.org/copyleft/gpl.html
27 if (!defined('MEDIAWIKI')) {
28 // Eclipse helper - will be ignored in production
29 require_once ('ApiBase.php');
33 * Unit to authenticate log-in attempts to the current wiki.
37 class ApiLogin extends ApiBase {
39 public function __construct($main, $action) {
40 parent :: __construct($main, $action, 'lg');
44 * Executes the log-in attempt using the parameters passed. If
45 * the log-in succeeeds, it attaches a cookie to the session
46 * and outputs the user id, username, and session token. If a
47 * log-in fails, as the result of a bad password, a nonexistent
48 * user, or any other reason, the host is cached with an expiry
49 * and no log-in attempts will be accepted until that expiry
50 * is reached. The expiry is $this->mLoginThrottle.
54 public function execute() {
55 $params = $this->extractRequestParams();
59 $req = new FauxRequest(array (
60 'wpName' => $params['name'],
61 'wpPassword' => $params['password'],
62 'wpDomain' => $params['domain'],
63 'wpLoginToken' => $params['token'],
67 // Init session if necessary
68 if( session_id() == '' ) {
72 $loginForm = new LoginForm($req);
73 switch ($authRes = $loginForm->authenticateUserData()) {
74 case LoginForm :: SUCCESS :
75 global $wgUser, $wgCookiePrefix;
77 $wgUser->setOption('rememberpassword', 1);
78 $wgUser->setCookies();
80 // Run hooks. FIXME: split back and frontend from this hook.
81 // FIXME: This hook should be placed in the backend
83 wfRunHooks('UserLoginComplete', array(&$wgUser, &$injected_html));
85 $result['result'] = 'Success';
86 $result['lguserid'] = intval($wgUser->getId());
87 $result['lgusername'] = $wgUser->getName();
88 $result['lgtoken'] = $wgUser->getToken();
89 $result['cookieprefix'] = $wgCookiePrefix;
90 $result['sessionid'] = session_id();
93 case LoginForm::NEED_TOKEN:
94 global $wgCookiePrefix;
95 $result['result'] = 'NeedToken';
96 $result['token'] = $loginForm->getLoginToken();
97 $result['cookieprefix'] = $wgCookiePrefix;
98 $result['sessionid'] = session_id();
101 case LoginForm::WRONG_TOKEN:
102 $result['result'] = 'WrongToken';
105 case LoginForm :: NO_NAME :
106 $result['result'] = 'NoName';
108 case LoginForm :: ILLEGAL :
109 $result['result'] = 'Illegal';
111 case LoginForm :: WRONG_PLUGIN_PASS :
112 $result['result'] = 'WrongPluginPass';
114 case LoginForm :: NOT_EXISTS :
115 $result['result'] = 'NotExists';
117 case LoginForm :: WRONG_PASS :
118 $result['result'] = 'WrongPass';
120 case LoginForm :: EMPTY_PASS :
121 $result['result'] = 'EmptyPass';
123 case LoginForm :: CREATE_BLOCKED :
124 $result['result'] = 'CreateBlocked';
125 $result['details'] = 'Your IP address is blocked from account creation';
127 case LoginForm :: THROTTLED :
128 global $wgPasswordAttemptThrottle;
129 $result['result'] = 'Throttled';
130 $result['wait'] = intval($wgPasswordAttemptThrottle['seconds']);
133 ApiBase :: dieDebug(__METHOD__, "Unhandled case value: {$authRes}");
136 $this->getResult()->addValue(null, 'login', $result);
139 public function mustBePosted() { return true; }
141 public function isReadMode() {
145 public function getAllowedParams() {
154 public function getParamDescription() {
156 'name' => 'User Name',
157 'password' => 'Password',
158 'domain' => 'Domain (optional)',
159 'token' => 'Login token obtained in first request',
163 public function getDescription() {
165 'This module is used to login and get the authentication tokens. ',
166 'In the event of a successful log-in, a cookie will be attached',
167 'to your session. In the event of a failed log-in, you will not ',
168 'be able to attempt another log-in through this method for 5 seconds.',
169 'This is to prevent password guessing by automated password crackers.'
173 protected function getExamples() {
175 'api.php?action=login&lgname=user&lgpassword=password'
179 public function getVersion() {
180 return __CLASS__ . ': $Id: ApiLogin.php 69990 2010-07-27 08:44:08Z tstarling $';