TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:00 +02:00
commit f9941541b7
1178 changed files with 135377 additions and 0 deletions
@@ -0,0 +1,115 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Backend\Controller;
+
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
+use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderManifestInterface;
+use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderRegistry;
+use TYPO3\CMS\Core\Localization\LanguageService;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+
+/**
+ * Abstract class for mfa controllers (configuration and authentication)
+ *
+ * @internal This class is a specific Backend controller implementation and is not considered part of the Public TYPO3 API.
+ */
+abstract class AbstractMfaController
+{
+    protected MfaProviderRegistry $mfaProviderRegistry;
+    protected array $mfaTsConfig;
+    protected bool $mfaRequired;
+    protected array $allowedProviders;
+    protected array $allowedActions = [];
+
+    public function injectMfaProviderRegistry(MfaProviderRegistry $mfaProviderRegistry): void
+    {
+        $this->mfaProviderRegistry = $mfaProviderRegistry;
+    }
+
+    /**
+     * Main action for handling the request and returning the response
+     */
+    abstract public function handleRequest(ServerRequestInterface $request): ResponseInterface;
+
+    protected function isActionAllowed(string $action): bool
+    {
+        return in_array($action, $this->allowedActions, true);
+    }
+
+    protected function isProviderAllowed(string $identifier): bool
+    {
+        return isset($this->allowedProviders[$identifier]);
+    }
+
+    protected function isValidIdentifier(string $identifier): bool
+    {
+        return $identifier !== ''
+            && $this->isProviderAllowed($identifier)
+            && $this->mfaProviderRegistry->hasProvider($identifier);
+    }
+
+    /**
+     * Initialize MFA configuration based on TSconfig and global configuration
+     */
+    protected function initializeMfaConfiguration(): void
+    {
+        $backendUser = $this->getBackendUser();
+        $this->mfaTsConfig = $backendUser->getTSConfig()['auth.']['mfa.'] ?? [];
+        $this->mfaRequired = $backendUser->isMfaSetupRequired();
+
+        // Set up allowed providers based on user TSconfig and user groupData
+        $this->allowedProviders = array_filter($this->mfaProviderRegistry->getProviders(), function (string $identifier) use ($backendUser): bool {
+            return $backendUser->check('mfa_providers', $identifier)
+                && !GeneralUtility::inList(($this->mfaTsConfig['disableProviders'] ?? ''), $identifier);
+        }, ARRAY_FILTER_USE_KEY);
+    }
+
+    /**
+     * Get the recommended provider
+     */
+    protected function getRecommendedProvider(): ?MfaProviderManifestInterface
+    {
+        $recommendedProviderIdentifier = (string)($this->mfaTsConfig['recommendedProvider'] ?? '');
+        // Check if valid and allowed to be default provider, which is obviously a prerequisite
+        if (!$this->isValidIdentifier($recommendedProviderIdentifier)
+            || !$this->mfaProviderRegistry->getProvider($recommendedProviderIdentifier)->isDefaultProviderAllowed()
+        ) {
+            // If the provider, defined in user TSconfig is not valid or is not set, check the globally defined
+            $recommendedProviderIdentifier = (string)($GLOBALS['TYPO3_CONF_VARS']['BE']['recommendedMfaProvider'] ?? '');
+            if (!$this->isValidIdentifier($recommendedProviderIdentifier)
+                || !$this->mfaProviderRegistry->getProvider($recommendedProviderIdentifier)->isDefaultProviderAllowed()
+            ) {
+                // If also not valid or not set, return
+                return null;
+            }
+        }
+        return $this->mfaProviderRegistry->getProvider($recommendedProviderIdentifier);
+    }
+
+    protected function getBackendUser(): BackendUserAuthentication
+    {
+        return $GLOBALS['BE_USER'];
+    }
+
+    protected function getLanguageService(): LanguageService
+    {
+        return $GLOBALS['LANG'];
+    }
+}