116 lines
4.3 KiB
PHP
116 lines
4.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* This file is part of the TYPO3 CMS project.
|
|
*
|
|
* It is free software; you can redistribute it and/or modify it under
|
|
* the terms of the GNU General Public License, either version 2
|
|
* of the License, or any later version.
|
|
*
|
|
* For the full copyright and license information, please read the
|
|
* LICENSE.txt file that was distributed with this source code.
|
|
*
|
|
* The TYPO3 project - inspiring people to share!
|
|
*/
|
|
|
|
namespace TYPO3\CMS\Backend\Controller;
|
|
|
|
use Psr\Http\Message\ResponseInterface;
|
|
use Psr\Http\Message\ServerRequestInterface;
|
|
use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
|
|
use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderManifestInterface;
|
|
use TYPO3\CMS\Core\Authentication\Mfa\MfaProviderRegistry;
|
|
use TYPO3\CMS\Core\Localization\LanguageService;
|
|
use TYPO3\CMS\Core\Utility\GeneralUtility;
|
|
|
|
/**
|
|
* Abstract class for mfa controllers (configuration and authentication)
|
|
*
|
|
* @internal This class is a specific Backend controller implementation and is not considered part of the Public TYPO3 API.
|
|
*/
|
|
abstract class AbstractMfaController
|
|
{
|
|
protected MfaProviderRegistry $mfaProviderRegistry;
|
|
protected array $mfaTsConfig;
|
|
protected bool $mfaRequired;
|
|
protected array $allowedProviders;
|
|
protected array $allowedActions = [];
|
|
|
|
public function injectMfaProviderRegistry(MfaProviderRegistry $mfaProviderRegistry): void
|
|
{
|
|
$this->mfaProviderRegistry = $mfaProviderRegistry;
|
|
}
|
|
|
|
/**
|
|
* Main action for handling the request and returning the response
|
|
*/
|
|
abstract public function handleRequest(ServerRequestInterface $request): ResponseInterface;
|
|
|
|
protected function isActionAllowed(string $action): bool
|
|
{
|
|
return in_array($action, $this->allowedActions, true);
|
|
}
|
|
|
|
protected function isProviderAllowed(string $identifier): bool
|
|
{
|
|
return isset($this->allowedProviders[$identifier]);
|
|
}
|
|
|
|
protected function isValidIdentifier(string $identifier): bool
|
|
{
|
|
return $identifier !== ''
|
|
&& $this->isProviderAllowed($identifier)
|
|
&& $this->mfaProviderRegistry->hasProvider($identifier);
|
|
}
|
|
|
|
/**
|
|
* Initialize MFA configuration based on TSconfig and global configuration
|
|
*/
|
|
protected function initializeMfaConfiguration(): void
|
|
{
|
|
$backendUser = $this->getBackendUser();
|
|
$this->mfaTsConfig = $backendUser->getTSConfig()['auth.']['mfa.'] ?? [];
|
|
$this->mfaRequired = $backendUser->isMfaSetupRequired();
|
|
|
|
// Set up allowed providers based on user TSconfig and user groupData
|
|
$this->allowedProviders = array_filter($this->mfaProviderRegistry->getProviders(), function (string $identifier) use ($backendUser): bool {
|
|
return $backendUser->check('mfa_providers', $identifier)
|
|
&& !GeneralUtility::inList(($this->mfaTsConfig['disableProviders'] ?? ''), $identifier);
|
|
}, ARRAY_FILTER_USE_KEY);
|
|
}
|
|
|
|
/**
|
|
* Get the recommended provider
|
|
*/
|
|
protected function getRecommendedProvider(): ?MfaProviderManifestInterface
|
|
{
|
|
$recommendedProviderIdentifier = (string)($this->mfaTsConfig['recommendedProvider'] ?? '');
|
|
// Check if valid and allowed to be default provider, which is obviously a prerequisite
|
|
if (!$this->isValidIdentifier($recommendedProviderIdentifier)
|
|
|| !$this->mfaProviderRegistry->getProvider($recommendedProviderIdentifier)->isDefaultProviderAllowed()
|
|
) {
|
|
// If the provider, defined in user TSconfig is not valid or is not set, check the globally defined
|
|
$recommendedProviderIdentifier = (string)($GLOBALS['TYPO3_CONF_VARS']['BE']['recommendedMfaProvider'] ?? '');
|
|
if (!$this->isValidIdentifier($recommendedProviderIdentifier)
|
|
|| !$this->mfaProviderRegistry->getProvider($recommendedProviderIdentifier)->isDefaultProviderAllowed()
|
|
) {
|
|
// If also not valid or not set, return
|
|
return null;
|
|
}
|
|
}
|
|
return $this->mfaProviderRegistry->getProvider($recommendedProviderIdentifier);
|
|
}
|
|
|
|
protected function getBackendUser(): BackendUserAuthentication
|
|
{
|
|
return $GLOBALS['BE_USER'];
|
|
}
|
|
|
|
protected function getLanguageService(): LanguageService
|
|
{
|
|
return $GLOBALS['LANG'];
|
|
}
|
|
}
|