251 lines
9.8 KiB
PHP
251 lines
9.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* This file is part of the TYPO3 CMS project.
|
|
*
|
|
* It is free software; you can redistribute it and/or modify it under
|
|
* the terms of the GNU General Public License, either version 2
|
|
* of the License, or any later version.
|
|
*
|
|
* For the full copyright and license information, please read the
|
|
* LICENSE.txt file that was distributed with this source code.
|
|
*
|
|
* The TYPO3 project - inspiring people to share!
|
|
*/
|
|
|
|
namespace TYPO3\CMS\Backend\Controller\Security;
|
|
|
|
use Psr\EventDispatcher\EventDispatcherInterface;
|
|
use Psr\Http\Message\ResponseInterface;
|
|
use Psr\Http\Message\ServerRequestInterface;
|
|
use Psr\Http\Message\UriInterface;
|
|
use Psr\Log\LoggerInterface;
|
|
use TYPO3\CMS\Backend\Attribute\AsController;
|
|
use TYPO3\CMS\Backend\Routing\UriBuilder;
|
|
use TYPO3\CMS\Backend\Security\SudoMode\Access\AccessClaim;
|
|
use TYPO3\CMS\Backend\Security\SudoMode\Access\AccessFactory;
|
|
use TYPO3\CMS\Backend\Security\SudoMode\Access\AccessStorage;
|
|
use TYPO3\CMS\Backend\Security\SudoMode\Event\SudoModeVerifyEvent;
|
|
use TYPO3\CMS\Backend\Security\SudoMode\Exception\RequestGrantedException;
|
|
use TYPO3\CMS\Backend\Security\SudoMode\PasswordVerification;
|
|
use TYPO3\CMS\Backend\Template\ModuleTemplateFactory;
|
|
use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
|
|
use TYPO3\CMS\Core\Context\Context;
|
|
use TYPO3\CMS\Core\Crypto\HashAlgo;
|
|
use TYPO3\CMS\Core\Crypto\HashService;
|
|
use TYPO3\CMS\Core\Http\JsonResponse;
|
|
use TYPO3\CMS\Core\Http\RedirectResponse;
|
|
use TYPO3\CMS\Core\Localization\LanguageService;
|
|
use TYPO3\CMS\Core\Page\PageRenderer;
|
|
use TYPO3\CMS\Core\Routing\BackendEntryPointResolver;
|
|
use TYPO3\CMS\Core\Utility\GeneralUtility;
|
|
|
|
/**
|
|
* Handling visual sudo mode verification for configured routes/modules.
|
|
*
|
|
* @internal
|
|
*/
|
|
#[AsController]
|
|
final readonly class SudoModeController
|
|
{
|
|
private const string ROUTE_PATH_MODULE = '/sudo-mode/module';
|
|
private const string ROUTE_PATH_APPLY = '/sudo-mode/apply';
|
|
private const string ROUTE_PATH_ERROR = '/sudo-mode/error';
|
|
private const string ROUTE_PATH_VERIFY = '/ajax/sudo-mode/verify';
|
|
|
|
public function __construct(
|
|
private PageRenderer $pageRenderer,
|
|
private UriBuilder $uriBuilder,
|
|
private AccessFactory $factory,
|
|
private AccessStorage $storage,
|
|
private PasswordVerification $passwordVerification,
|
|
private ModuleTemplateFactory $moduleTemplateFactory,
|
|
private BackendEntryPointResolver $backendEntryPointResolver,
|
|
private EventDispatcherInterface $eventDispatcher,
|
|
private HashService $hashService,
|
|
private LoggerInterface $logger,
|
|
) {}
|
|
|
|
public function buildModuleActionUriForClaim(AccessClaim $claim): UriInterface
|
|
{
|
|
return $this->uriBuilder->buildUriFromRoutePath(
|
|
self::ROUTE_PATH_MODULE,
|
|
$this->buildUriParametersForClaim($claim, 'module')
|
|
);
|
|
}
|
|
|
|
public function buildVerifyActionUriForClaim(AccessClaim $claim): UriInterface
|
|
{
|
|
return $this->uriBuilder->buildUriFromRoutePath(
|
|
self::ROUTE_PATH_VERIFY,
|
|
$this->buildUriParametersForClaim($claim, 'verify')
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Renders the module backend markup, including the `<typo3-backend-security-sudo-mode>` element.
|
|
*/
|
|
public function moduleAction(ServerRequestInterface $request): ResponseInterface
|
|
{
|
|
$this->pageRenderer->getJavaScriptRenderer()->addGlobalAssignment([
|
|
'TYPO3' => [
|
|
'configuration' => [
|
|
'username' => htmlspecialchars($this->getBackendUser()->user['username']),
|
|
],
|
|
],
|
|
]);
|
|
|
|
$claim = $this->resolveClaimFromRequest($request, 'module');
|
|
if ($claim === null) {
|
|
return $this->redirectToErrorAction();
|
|
}
|
|
|
|
$view = $this->moduleTemplateFactory->create($request);
|
|
$view->assignMultiple([
|
|
'verifyActionUri' => $this->buildVerifyActionUriForClaim($claim),
|
|
'allowInstallToolPassword' => $this->getBackendUser()->isSystemMaintainer(),
|
|
'labels' => $this->getLanguageService()->getLabelsFromResource('EXT:backend/Resources/Private/Language/SudoMode.xlf'),
|
|
]);
|
|
return $view->renderResponse('SudoMode/Module');
|
|
}
|
|
|
|
/**
|
|
* Called from JavaScript web-component, throwing an exception that is handled by `SudoModeInterceptor` middleware.
|
|
*/
|
|
public function applyAction(ServerRequestInterface $request): ResponseInterface
|
|
{
|
|
// @todo security: action is not signed and can be by-passed easily
|
|
$claim = $this->resolveClaimFromRequest($request, 'apply');
|
|
if ($claim === null) {
|
|
return $this->redirectToErrorAction();
|
|
}
|
|
|
|
$this->storage->removeClaim($claim);
|
|
throw (new RequestGrantedException('Replay request', 1605873757))
|
|
->withInstruction($claim->instruction);
|
|
}
|
|
|
|
/**
|
|
* Renders markup with error messages in case `AccessClaim` could not be resolved (e.g. when expired).
|
|
*/
|
|
public function errorAction(ServerRequestInterface $request): ResponseInterface
|
|
{
|
|
$view = $this->moduleTemplateFactory->create($request);
|
|
$view->assignMultiple([
|
|
'cancelUri' => $this->backendEntryPointResolver->getPathFromRequest($request),
|
|
'cancelTarget' => '_top',
|
|
'labels' => $this->getLanguageService()->getLabelsFromResource('EXT:backend/Resources/Private/Language/SudoMode.xlf'),
|
|
]);
|
|
return $view->renderResponse('SudoMode/Error');
|
|
}
|
|
|
|
/**
|
|
* Verifies the provided password, called via AJAX from JavaScript web-component.
|
|
*/
|
|
public function verifyAction(ServerRequestInterface $request): ResponseInterface
|
|
{
|
|
$claim = $this->resolveClaimFromRequest($request, 'verify');
|
|
if ($claim === null) {
|
|
return new JsonResponse(['message' => 'bad-request'], 400);
|
|
}
|
|
|
|
$password = (string)($request->getParsedBody()['password'] ?? '');
|
|
$useInstallToolPassword = (bool)($request->getParsedBody()['useInstallToolPassword'] ?? false);
|
|
// Only system maintainers are allowed to use the installtool password for sudo mode operations
|
|
if (!$this->getBackendUser()->isSystemMaintainer()) {
|
|
$useInstallToolPassword = false;
|
|
}
|
|
$loggerContext = $this->buildLoggerContext($claim);
|
|
|
|
$redirect = [
|
|
'uri' => (string)$this->uriBuilder->buildUriFromRoutePath(
|
|
self::ROUTE_PATH_APPLY,
|
|
$this->buildUriParametersForClaim($claim, 'apply')
|
|
),
|
|
];
|
|
$event = $this->eventDispatcher->dispatch(new SudoModeVerifyEvent($claim, $password, $useInstallToolPassword));
|
|
if ($event->isVerified()) {
|
|
$this->logger->info('Passed by PSR-14 SudoModeVerifyEvent', $loggerContext);
|
|
$this->grantClaim($claim);
|
|
return new JsonResponse(['message' => 'accessGranted', 'redirect' => $redirect]);
|
|
}
|
|
if ($useInstallToolPassword && $this->passwordVerification->verifyInstallToolPassword($password)) {
|
|
$this->logger->info('Verified with install tool password', $loggerContext);
|
|
$this->grantClaim($claim);
|
|
return new JsonResponse(['message' => 'accessGranted', 'redirect' => $redirect]);
|
|
}
|
|
if (!$useInstallToolPassword && $this->passwordVerification->verifyBackendUserPassword($password, $this->getBackendUser())) {
|
|
$this->logger->info('Verified with user password', $loggerContext);
|
|
$this->grantClaim($claim);
|
|
return new JsonResponse(['message' => 'accessGranted', 'redirect' => $redirect]);
|
|
}
|
|
return new JsonResponse(['message' => 'invalidPassword'], 403);
|
|
}
|
|
|
|
private function redirectToErrorAction(): ResponseInterface
|
|
{
|
|
$uri = $this->uriBuilder->buildUriFromRoutePath(self::ROUTE_PATH_ERROR);
|
|
return new RedirectResponse($uri);
|
|
}
|
|
|
|
/**
|
|
* @param string $additionalPepper used to create a specific signature (e.g. on the action)
|
|
*/
|
|
private function buildUriParametersForClaim(AccessClaim $claim, string $additionalPepper): array
|
|
{
|
|
$additionalPeppers = [self::class, $additionalPepper];
|
|
return [
|
|
'claim' => $claim->id,
|
|
'hash' => $this->hashService->hmac($claim->id, json_encode($additionalPeppers), HashAlgo::SHA3_256),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @param string $additionalPepper used to create a specific signature (e.g. on the action)
|
|
*/
|
|
private function resolveClaimFromRequest(ServerRequestInterface $request, string $additionalPepper): ?AccessClaim
|
|
{
|
|
$claimId = (string)($request->getQueryParams()['claim'] ?? '');
|
|
$claimHash = (string)($request->getQueryParams()['hash'] ?? '');
|
|
$additionalPeppers = [self::class, $additionalPepper];
|
|
$expectedHash = $this->hashService->hmac($claimId, json_encode($additionalPeppers), HashAlgo::SHA3_256);
|
|
if ($claimId === '' || $claimHash === '' || !hash_equals($expectedHash, $claimHash)) {
|
|
return null;
|
|
}
|
|
return $this->storage->findClaimById($claimId);
|
|
}
|
|
|
|
private function grantClaim(AccessClaim $claim): void
|
|
{
|
|
foreach ($claim->subjects as $subject) {
|
|
$grant = $this->factory->buildGrantForSubject($subject);
|
|
$this->storage->addGrant($grant);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return array<string, int|string>
|
|
*/
|
|
private function buildLoggerContext(AccessClaim $claim): array
|
|
{
|
|
$backendUserAspect = GeneralUtility::makeInstance(Context::class)
|
|
->getAspect('backend.user');
|
|
return [
|
|
'claim' => $claim->id,
|
|
'user' => $backendUserAspect->get('id'),
|
|
];
|
|
}
|
|
|
|
private function getBackendUser(): BackendUserAuthentication
|
|
{
|
|
return $GLOBALS['BE_USER'];
|
|
}
|
|
|
|
private function getLanguageService(): LanguageService
|
|
{
|
|
return $GLOBALS['LANG'];
|
|
}
|
|
}
|