TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:00 +02:00
commit f9941541b7
1178 changed files with 135377 additions and 0 deletions
@@ -0,0 +1,216 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Backend\Controller;
+
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use TYPO3\CMS\Backend\Attribute\AsController;
+use TYPO3\CMS\Core\Authentication\AbstractUserAuthentication;
+use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
+use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderPropertyManager;
+use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderRegistry;
+use TYPO3\CMS\Core\Http\JsonResponse;
+use TYPO3\CMS\Core\Localization\LanguageService;
+use TYPO3\CMS\Core\Messaging\FlashMessage;
+use TYPO3\CMS\Core\Messaging\FlashMessageQueue;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+use TYPO3\CMS\Frontend\Authentication\FrontendUserAuthentication;
+
+/**
+ * Controller to manipulate MFA providers via AJAX in the backend
+ *
+ * @internal This class is a specific Backend controller implementation and is not considered part of the Public TYPO3 API.
+ */
+#[AsController]
+class MfaAjaxController
+{
+    private const array ALLOWED_ACTIONS = ['deactivate'];
+
+    protected MfaProviderRegistry $mfaProviderRegistry;
+
+    public function __construct(MfaProviderRegistry $mfaProviderRegistry)
+    {
+        $this->mfaProviderRegistry = $mfaProviderRegistry;
+    }
+
+    /**
+     * Main entry point, checking prerequisite and dispatching to the requested action
+     */
+    public function handleRequest(ServerRequestInterface $request): ResponseInterface
+    {
+        $action = (string)($request->getQueryParams()['action'] ?? $request->getParsedBody()['action'] ?? '');
+
+        if (!in_array($action, self::ALLOWED_ACTIONS, true)) {
+            return new JsonResponse($this->getResponseData(false, $this->getLanguageService()->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.invalidRequest')));
+        }
+
+        $userId = (int)($request->getParsedBody()['userId'] ?? 0);
+        $tableName = (string)($request->getParsedBody()['tableName'] ?? '');
+
+        if (!$userId || !in_array($tableName, ['be_users', 'fe_users'], true)) {
+            return new JsonResponse($this->getResponseData(false, $this->getLanguageService()->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.invalidRequest')));
+        }
+
+        $user = $this->initializeUser($userId, $tableName);
+
+        if (!$this->isAllowedToPerformAction($action, $user)) {
+            return new JsonResponse($this->getResponseData(false, $this->getLanguageService()->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.insufficientPermissions')));
+        }
+
+        return new JsonResponse($this->{$action . 'Action'}($request, $user));
+    }
+
+    /**
+     * Deactivate MFA providers
+     * If the request contains a provider, it will be deactivated.
+     * Otherwise all active providers are deactivated.
+     */
+    protected function deactivateAction(ServerRequestInterface $request, AbstractUserAuthentication $user): array
+    {
+        $lang = $this->getLanguageService();
+        $userName = $user->getUserName() ?? '';
+        $providerToDeactivate = (string)($request->getParsedBody()['provider'] ?? '');
+
+        if ($providerToDeactivate === '') {
+            // In case no provider is given, try to deactivate all active providers
+            $providersToDeactivate = $this->mfaProviderRegistry->getActiveProviders($user);
+            if ($providersToDeactivate === []) {
+                return $this->getResponseData(
+                    false,
+                    $lang->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.deactivate.providersNotDeactivated'),
+                    $user
+                );
+            }
+            foreach ($providersToDeactivate as $provider) {
+                $propertyManager = MfaProviderPropertyManager::create($provider, $user);
+                if (!$provider->deactivate($request, $propertyManager)) {
+                    return $this->getResponseData(
+                        false,
+                        sprintf($lang->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.deactivate.providerNotDeactivated'), $lang->sL($provider->getTitle())),
+                        $user
+                    );
+                }
+            }
+            return $this->getResponseData(
+                true,
+                sprintf($lang->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.deactivate.providersDeactivated'), $userName),
+                $user
+            );
+        }
+
+        if (!$this->mfaProviderRegistry->hasProvider($providerToDeactivate)) {
+            return $this->getResponseData(
+                false,
+                sprintf($lang->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.deactivate.providerNotFound'), $providerToDeactivate),
+                $user
+            );
+        }
+
+        $provider = $this->mfaProviderRegistry->getProvider($providerToDeactivate);
+        $propertyManager = MfaProviderPropertyManager::create($provider, $user);
+
+        if (!$provider->isActive($propertyManager) || !$provider->deactivate($request, $propertyManager)) {
+            return $this->getResponseData(
+                false,
+                sprintf($lang->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.deactivate.providerNotDeactivated'), $lang->sL($provider->getTitle())),
+                $user
+            );
+        }
+
+        return $this->getResponseData(
+            true,
+            sprintf($lang->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.deactivate.providerDeactivated'), $lang->sL($provider->getTitle()), $userName),
+            $user
+        );
+    }
+
+    /**
+     * Initialize a user based on the table name
+     */
+    protected function initializeUser(int $userId, string $tableName): AbstractUserAuthentication
+    {
+        $user = $tableName === 'be_users'
+            ? GeneralUtility::makeInstance(BackendUserAuthentication::class)
+            : GeneralUtility::makeInstance(FrontendUserAuthentication::class);
+
+        $user->enablecolumns = ['deleted' => true];
+        $user->setBeUserByUid($userId);
+
+        return $user;
+    }
+
+    /**
+     * Prepare response data for a JSON response
+     */
+    protected function getResponseData(bool $success, string $message, ?AbstractUserAuthentication $user = null): array
+    {
+        $flashMessageQueue = new FlashMessageQueue('backend');
+        $flashMessageQueue->enqueue(
+            new FlashMessage(
+                $message,
+                $this->getLanguageService()->sL('LLL:EXT:backend/Resources/Private/Language/locallang_mfa.xlf:ajax.' . ($success ? 'success' : 'error'))
+            )
+        );
+        $payload = [
+            'success' => $success,
+            'status' => $flashMessageQueue,
+        ];
+
+        if ($user !== null) {
+            $payload['remaining'] = count($this->mfaProviderRegistry->getActiveProviders($user));
+        }
+
+        return $payload;
+    }
+
+    /**
+     * Check if the current logged in user is allowed to perform
+     * the requested action on the selected user.
+     */
+    protected function isAllowedToPerformAction(string $action, AbstractUserAuthentication $user): bool
+    {
+        if ($action === 'deactivate') {
+            $currentBackendUser = $this->getBackendUser();
+            // Only admins are allowed to deactivate providers
+            if (!$currentBackendUser->isAdmin()) {
+                return false;
+            }
+            // Providers from system maintainers can only be deactivated by system maintainers.
+            // However, this check is only necessary if the target is a backend user.
+            if (($user instanceof BackendUserAuthentication)
+                && $user->isSystemMaintainer(true)
+                && !$this->getBackendUser()->isSystemMaintainer()
+            ) {
+                return false;
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    protected function getBackendUser(): BackendUserAuthentication
+    {
+        return $GLOBALS['BE_USER'];
+    }
+
+    protected function getLanguageService(): LanguageService
+    {
+        return $GLOBALS['LANG'];
+    }
+}