typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php

   1 <?php
   2 namespace TYPO3\CMS\Core\Authentication;
   3
   4 /*
   5  * This file is part of the TYPO3 CMS project.
   6  *
   7  * It is free software; you can redistribute it and/or modify it under
   8  * the terms of the GNU General Public License, either version 2
   9  * of the License, or any later version.
  10  *
  11  * For the full copyright and license information, please read the
  12  * LICENSE.txt file that was distributed with this source code.
  13  *
  14  * The TYPO3 project - inspiring people to share!
  15  */
  16
  17 use TYPO3\CMS\Backend\Utility\BackendUtility;
  18 use TYPO3\CMS\Core\Crypto\Random;
  19 use TYPO3\CMS\Core\Database\Connection;
  20 use TYPO3\CMS\Core\Database\ConnectionPool;
  21 use TYPO3\CMS\Core\Database\Query\QueryHelper;
  22 use TYPO3\CMS\Core\Database\Query\Restriction\DefaultRestrictionContainer;
  23 use TYPO3\CMS\Core\Database\Query\Restriction\DeletedRestriction;
  24 use TYPO3\CMS\Core\Database\Query\Restriction\EndTimeRestriction;
  25 use TYPO3\CMS\Core\Database\Query\Restriction\HiddenRestriction;
  26 use TYPO3\CMS\Core\Database\Query\Restriction\QueryRestrictionContainerInterface;
  27 use TYPO3\CMS\Core\Database\Query\Restriction\RootLevelRestriction;
  28 use TYPO3\CMS\Core\Database\Query\Restriction\StartTimeRestriction;
  29 use TYPO3\CMS\Core\Exception;
  30 use TYPO3\CMS\Core\Session\Backend\Exception\SessionNotFoundException;
  31 use TYPO3\CMS\Core\Session\Backend\SessionBackendInterface;
  32 use TYPO3\CMS\Core\Session\SessionManager;
  33 use TYPO3\CMS\Core\Utility\GeneralUtility;
  34 use TYPO3\CMS\Core\Utility\MathUtility;
  35 use TYPO3\CMS\Sv\AuthenticationService;
  36
  37 /**
  38  * Authentication of users in TYPO3
  39  *
  40  * This class is used to authenticate a login user.
  41  * The class is used by both the frontend and backend.
  42  * In both cases this class is a parent class to BackendUserAuthentication and FrontenUserAuthentication
  43  *
  44  * See Inside TYPO3 for more information about the API of the class and internal variables.
  45  */
  46 abstract class AbstractUserAuthentication
  47 {
  48     /**
  49      * Session/Cookie name
  50      * @var string
  51      */
  52     public $name = '';
  53
  54     /**
  55      * Session/GET-var name
  56      * @var string
  57      */
  58     public $get_name = '';
  59
  60     /**
  61      * Table in database with user data
  62      * @var string
  63      */
  64     public $user_table = '';
  65
  66     /**
  67      * Table in database with user groups
  68      * @var string
  69      */
  70     public $usergroup_table = '';
  71
  72     /**
  73      * Column for login-name
  74      * @var string
  75      */
  76     public $username_column = '';
  77
  78     /**
  79      * Column for password
  80      * @var string
  81      */
  82     public $userident_column = '';
  83
  84     /**
  85      * Column for user-id
  86      * @var string
  87      */
  88     public $userid_column = '';
  89
  90     /**
  91      * Column for user group information
  92      * @var string
  93      */
  94     public $usergroup_column = '';
  95
  96     /**
  97      * Column name for last login timestamp
  98      * @var string
  99      */
 100     public $lastLogin_column = '';
 101
 102     /**
 103      * Enable field columns of user table
 104      * @var array
 105      */
 106     public $enablecolumns = [
 107         'rootLevel' => '',
 108         // Boolean: If TRUE, 'AND pid=0' will be a part of the query...
 109         'disabled' => '',
 110         'starttime' => '',
 111         'endtime' => '',
 112         'deleted' => '',
 113     ];
 114
 115     /**
 116      * @var bool
 117      */
 118     public $showHiddenRecords = false;
 119
 120     /**
 121      * Form field with login-name
 122      * @var string
 123      */
 124     public $formfield_uname = '';
 125
 126     /**
 127      * Form field with password
 128      * @var string
 129      */
 130     public $formfield_uident = '';
 131
 132     /**
 133      * Form field with status: *'login', 'logout'. If empty login is not verified.
 134      * @var string
 135      */
 136     public $formfield_status = '';
 137
 138     /**
 139      * Session timeout (on the server)
 140      *
 141      * If >0: session-timeout in seconds.
 142      * If <=0: Instant logout after login.
 143      *
 144      * @var int
 145      */
 146     public $sessionTimeout = 0;
 147
 148     /**
 149      * Name for a field to fetch the server session timeout from.
 150      * If not empty this is a field name from the user table where the timeout can be found.
 151      * @var string
 152      */
 153     public $auth_timeout_field = '';
 154
 155     /**
 156      * Lifetime for the session-cookie (on the client)
 157      *
 158      * If >0: permanent cookie with given lifetime
 159      * If 0: session-cookie
 160      * Session-cookie means the browser will remove it when the browser is closed.
 161      *
 162      * @var int
 163      */
 164     public $lifetime = 0;
 165
 166     /**
 167      * GarbageCollection
 168      * Purge all server session data older than $gc_time seconds.
 169      * 0 = default to $this->sessionTimeout or use 86400 seconds (1 day) if $this->sessionTimeout == 0
 170      * @var int
 171      */
 172     public $gc_time = 0;
 173
 174     /**
 175      * Probability for garbage collection to be run (in percent)
 176      * @var int
 177      */
 178     public $gc_probability = 1;
 179
 180     /**
 181      * Decides if the writelog() function is called at login and logout
 182      * @var bool
 183      */
 184     public $writeStdLog = false;
 185
 186     /**
 187      * Log failed login attempts
 188      * @var bool
 189      */
 190     public $writeAttemptLog = false;
 191
 192     /**
 193      * Send no-cache headers
 194      * @var bool
 195      */
 196     public $sendNoCacheHeaders = true;
 197
 198     /**
 199      * If this is set, authentication is also accepted by $_GET.
 200      * Notice that the identification is NOT 128bit MD5 hash but reduced.
 201      * This is done in order to minimize the size for mobile-devices, such as WAP-phones
 202      * @var bool
 203      */
 204     public $getFallBack = false;
 205
 206     /**
 207      * The ident-hash is normally 32 characters and should be!
 208      * But if you are making sites for WAP-devices or other low-bandwidth stuff,
 209      * you may shorten the length.
 210      * Never let this value drop below 6!
 211      * A length of 6 would give you more than 16 mio possibilities.
 212      * @var int
 213      */
 214     public $hash_length = 32;
 215
 216     /**
 217      * Setting this flag TRUE lets user-authentication happen from GET_VARS if
 218      * POST_VARS are not set. Thus you may supply username/password with the URL.
 219      * @var bool
 220      */
 221     public $getMethodEnabled = false;
 222
 223     /**
 224      * If set to 4, the session will be locked to the user's IP address (all four numbers).
 225      * Reducing this to 1-3 means that only the given number of parts of the IP address is used.
 226      * @var int
 227      */
 228     public $lockIP = 4;
 229
 230     /**
 231      * @var string
 232      */
 233     public $warningEmail = '';
 234
 235     /**
 236      * Time span (in seconds) within the number of failed logins are collected
 237      * @var int
 238      */
 239     public $warningPeriod = 3600;
 240
 241     /**
 242      * The maximum accepted number of warnings before an email to $warningEmail is sent
 243      * @var int
 244      */
 245     public $warningMax = 3;
 246
 247     /**
 248      * If set, the user-record must be stored at the page defined by $checkPid_value
 249      * @var bool
 250      */
 251     public $checkPid = true;
 252
 253     /**
 254      * The page id the user record must be stored at
 255      * @var int
 256      */
 257     public $checkPid_value = 0;
 258
 259     /**
 260      * session_id (MD5-hash)
 261      * @var string
 262      * @internal
 263      */
 264     public $id;
 265
 266     /**
 267      * Indicates if an authentication was started but failed
 268      * @var bool
 269      */
 270     public $loginFailure = false;
 271
 272     /**
 273      * Will be set to TRUE if the login session is actually written during auth-check.
 274      * @var bool
 275      */
 276     public $loginSessionStarted = false;
 277
 278     /**
 279      * @var array|NULL contains user- AND session-data from database (joined tables)
 280      * @internal
 281      */
 282     public $user = null;
 283
 284     /**
 285      * Will be added to the url (eg. '&login=ab7ef8d...')
 286      * GET-auth-var if getFallBack is TRUE. Should be inserted in links!
 287      * @var string
 288      * @internal
 289      */
 290     public $get_URL_ID = '';
 291
 292     /**
 293      * Will be set to TRUE if a new session ID was created
 294      * @var bool
 295      */
 296     public $newSessionID = false;
 297
 298     /**
 299      * Will force the session cookie to be set every time (lifetime must be 0)
 300      * @var bool
 301      */
 302     public $forceSetCookie = false;
 303
 304     /**
 305      * Will prevent the setting of the session cookie (takes precedence over forceSetCookie)
 306      * @var bool
 307      */
 308     public $dontSetCookie = false;
 309
 310     /**
 311      * @var bool
 312      */
 313     protected $cookieWasSetOnCurrentRequest = false;
 314
 315     /**
 316      * Login type, used for services.
 317      * @var string
 318      */
 319     public $loginType = '';
 320
 321     /**
 322      * "auth" services configuration array from $GLOBALS['TYPO3_CONF_VARS']['SVCONF']['auth']
 323      * @var array
 324      */
 325     public $svConfig = [];
 326
 327     /**
 328      * Write messages to the devlog
 329      * @var bool
 330      */
 331     public $writeDevLog = false;
 332
 333     /**
 334      * @var array
 335      */
 336     public $uc;
 337
 338     /**
 339      * @var SessionBackendInterface
 340      */
 341     protected $sessionBackend;
 342
 343     /**
 344      * Holds deserialized data from session records.
 345      * 'Reserved' keys are:
 346      *   - 'recs': (DEPRECATED) Array: Used to 'register' records, eg in a shopping basket. Structure: [recs][tablename][record_uid]=number
 347      *   - 'sys': Reserved for TypoScript standard code.
 348      * @var array
 349      */
 350     protected $sessionData = [];
 351
 352     /**
 353      * Initialize some important variables
 354      */
 355     public function __construct()
 356     {
 357         // This function has to stay even if it's empty
 358         // Implementations of that abstract class might call parent::__construct();
 359     }
 360
 361     /**
 362      * Starts a user session
 363      * Typical configurations will:
 364      * a) check if session cookie was set and if not, set one,
 365      * b) check if a password/username was sent and if so, try to authenticate the user
 366      * c) Lookup a session attached to a user and check timeout etc.
 367      * d) Garbage collection, setting of no-cache headers.
 368      * If a user is authenticated the database record of the user (array) will be set in the ->user internal variable.
 369      *
 370      * @throws Exception
 371      * @return void
 372      */
 373     public function start()
 374     {
 375         // Backend or frontend login - used for auth services
 376         if (empty($this->loginType)) {
 377             throw new Exception('No loginType defined, should be set explicitly by subclass', 1476045345);
 378         }
 379         // Enable dev logging if set
 380         if ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['writeDevLog']) {
 381             $this->writeDevLog = true;
 382         }
 383         if ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['writeDevLog' . $this->loginType]) {
 384             $this->writeDevLog = true;
 385         }
 386         if (TYPO3_DLOG) {
 387             $this->writeDevLog = true;
 388         }
 389         if ($this->writeDevLog) {
 390             GeneralUtility::devLog('## Beginning of auth logging.', self::class);
 391         }
 392         // Init vars.
 393         $mode = '';
 394         $this->newSessionID = false;
 395         // $id is set to ses_id if cookie is present. Else set to FALSE, which will start a new session
 396         $id = $this->getCookie($this->name);
 397         $this->svConfig = $GLOBALS['TYPO3_CONF_VARS']['SVCONF']['auth'];
 398
 399         // If fallback to get mode....
 400         if (!$id && $this->getFallBack && $this->get_name) {
 401             $id = isset($_GET[$this->get_name]) ? GeneralUtility::_GET($this->get_name) : '';
 402             if (strlen($id) != $this->hash_length) {
 403                 $id = '';
 404             }
 405             $mode = 'get';
 406         }
 407
 408         // If new session or client tries to fix session...
 409         if (!$id || !$this->isExistingSessionRecord($id)) {
 410             // New random session-$id is made
 411             $id = $this->createSessionId();
 412             // New session
 413             $this->newSessionID = true;
 414         }
 415         // Internal var 'id' is set
 416         $this->id = $id;
 417         // If fallback to get mode....
 418         if ($mode === 'get' && $this->getFallBack && $this->get_name) {
 419             $this->get_URL_ID = '&' . $this->get_name . '=' . $id;
 420         }
 421         // Make certain that NO user is set initially
 422         $this->user = null;
 423         // Set all possible headers that could ensure that the script is not cached on the client-side
 424         if ($this->sendNoCacheHeaders && !(TYPO3_REQUESTTYPE & TYPO3_REQUESTTYPE_CLI)) {
 425             header('Expires: 0');
 426             header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
 427             $cacheControlHeader = 'no-cache, must-revalidate';
 428             $pragmaHeader = 'no-cache';
 429             // Prevent error message in IE when using a https connection
 430             // see http://forge.typo3.org/issues/24125
 431             $clientInfo = GeneralUtility::clientInfo();
 432             if ($clientInfo['BROWSER'] === 'msie' && GeneralUtility::getIndpEnv('TYPO3_SSL')) {
 433                 // Some IEs can not handle no-cache
 434                 // see http://support.microsoft.com/kb/323308/en-us
 435                 $cacheControlHeader = 'must-revalidate';
 436                 // IE needs "Pragma: private" if SSL connection
 437                 $pragmaHeader = 'private';
 438             }
 439             header('Cache-Control: ' . $cacheControlHeader);
 440             header('Pragma: ' . $pragmaHeader);
 441         }
 442         // Load user session, check to see if anyone has submitted login-information and if so authenticate
 443         // the user with the session. $this->user[uid] may be used to write log...
 444         $this->checkAuthentication();
 445         // Setting cookies
 446         if (!$this->dontSetCookie) {
 447             $this->setSessionCookie();
 448         }
 449         // Hook for alternative ways of filling the $this->user array (is used by the "timtaw" extension)
 450         if (is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postUserLookUp'])) {
 451             foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postUserLookUp'] as $funcName) {
 452                 $_params = [
 453                     'pObj' => $this,
 454                 ];
 455                 GeneralUtility::callUserFunction($funcName, $_params, $this);
 456             }
 457         }
 458         // Set $this->gc_time if not explicitly specified
 459         if ($this->gc_time === 0) {
 460             // Default to 86400 seconds (1 day) if $this->sessionTimeout is 0
 461             $this->gc_time = $this->sessionTimeout === 0 ? 86400 : $this->sessionTimeout;
 462         }
 463         // If we're lucky we'll get to clean up old sessions
 464         if (rand() % 100 <= $this->gc_probability) {
 465             $this->gc();
 466         }
 467     }
 468
 469     /**
 470      * Sets the session cookie for the current disposal.
 471      *
 472      * @return void
 473      * @throws Exception
 474      */
 475     protected function setSessionCookie()
 476     {
 477         $isSetSessionCookie = $this->isSetSessionCookie();
 478         $isRefreshTimeBasedCookie = $this->isRefreshTimeBasedCookie();
 479         if ($isSetSessionCookie || $isRefreshTimeBasedCookie) {
 480             $settings = $GLOBALS['TYPO3_CONF_VARS']['SYS'];
 481             // Get the domain to be used for the cookie (if any):
 482             $cookieDomain = $this->getCookieDomain();
 483             // If no cookie domain is set, use the base path:
 484             $cookiePath = $cookieDomain ? '/' : GeneralUtility::getIndpEnv('TYPO3_SITE_PATH');
 485             // If the cookie lifetime is set, use it:
 486             $cookieExpire = $isRefreshTimeBasedCookie ? $GLOBALS['EXEC_TIME'] + $this->lifetime : 0;
 487             // Use the secure option when the current request is served by a secure connection:
 488             $cookieSecure = (bool)$settings['cookieSecure'] && GeneralUtility::getIndpEnv('TYPO3_SSL');
 489             // Do not set cookie if cookieSecure is set to "1" (force HTTPS) and no secure channel is used:
 490             if ((int)$settings['cookieSecure'] !== 1 || GeneralUtility::getIndpEnv('TYPO3_SSL')) {
 491                 setcookie($this->name, $this->id, $cookieExpire, $cookiePath, $cookieDomain, $cookieSecure, true);
 492                 $this->cookieWasSetOnCurrentRequest = true;
 493             } else {
 494                 throw new Exception('Cookie was not set since HTTPS was forced in $TYPO3_CONF_VARS[SYS][cookieSecure].', 1254325546);
 495             }
 496             if ($this->writeDevLog) {
 497                 $devLogMessage = ($isRefreshTimeBasedCookie ? 'Updated Cookie: ' : 'Set Cookie: ') . $this->id;
 498                 GeneralUtility::devLog($devLogMessage . ($cookieDomain ? ', ' . $cookieDomain : ''), self::class);
 499             }
 500         }
 501     }
 502
 503     /**
 504      * Gets the domain to be used on setting cookies.
 505      * The information is taken from the value in $GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieDomain'].
 506      *
 507      * @return string The domain to be used on setting cookies
 508      */
 509     protected function getCookieDomain()
 510     {
 511         $result = '';
 512         $cookieDomain = $GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieDomain'];
 513         // If a specific cookie domain is defined for a given TYPO3_MODE,
 514         // use that domain
 515         if (!empty($GLOBALS['TYPO3_CONF_VARS'][$this->loginType]['cookieDomain'])) {
 516             $cookieDomain = $GLOBALS['TYPO3_CONF_VARS'][$this->loginType]['cookieDomain'];
 517         }
 518         if ($cookieDomain) {
 519             if ($cookieDomain[0] === '/') {
 520                 $match = [];
 521                 $matchCnt = @preg_match($cookieDomain, GeneralUtility::getIndpEnv('TYPO3_HOST_ONLY'), $match);
 522                 if ($matchCnt === false) {
 523                     GeneralUtility::sysLog('The regular expression for the cookie domain (' . $cookieDomain . ') contains errors. The session is not shared across sub-domains.', 'core', GeneralUtility::SYSLOG_SEVERITY_ERROR);
 524                 } elseif ($matchCnt) {
 525                     $result = $match[0];
 526                 }
 527             } else {
 528                 $result = $cookieDomain;
 529             }
 530         }
 531         return $result;
 532     }
 533
 534     /**
 535      * Get the value of a specified cookie.
 536      *
 537      * @param string $cookieName The cookie ID
 538      * @return string The value stored in the cookie
 539      */
 540     protected function getCookie($cookieName)
 541     {
 542         return isset($_COOKIE[$cookieName]) ? stripslashes($_COOKIE[$cookieName]) : '';
 543     }
 544
 545     /**
 546      * Determine whether a session cookie needs to be set (lifetime=0)
 547      *
 548      * @return bool
 549      * @internal
 550      */
 551     public function isSetSessionCookie()
 552     {
 553         return ($this->newSessionID || $this->forceSetCookie) && $this->lifetime == 0;
 554     }
 555
 556     /**
 557      * Determine whether a non-session cookie needs to be set (lifetime>0)
 558      *
 559      * @return bool
 560      * @internal
 561      */
 562     public function isRefreshTimeBasedCookie()
 563     {
 564         return $this->lifetime > 0;
 565     }
 566
 567     /**
 568      * Checks if a submission of username and password is present or use other authentication by auth services
 569      *
 570      * @throws \RuntimeException
 571      * @return void
 572      * @internal
 573      */
 574     public function checkAuthentication()
 575     {
 576         // No user for now - will be searched by service below
 577         $tempuserArr = [];
 578         $tempuser = false;
 579         // User is not authenticated by default
 580         $authenticated = false;
 581         // User want to login with passed login data (name/password)
 582         $activeLogin = false;
 583         // Indicates if an active authentication failed (not auto login)
 584         $this->loginFailure = false;
 585         if ($this->writeDevLog) {
 586             GeneralUtility::devLog('Login type: ' . $this->loginType, self::class);
 587         }
 588         // The info array provide additional information for auth services
 589         $authInfo = $this->getAuthInfoArray();
 590         // Get Login/Logout data submitted by a form or params
 591         $loginData = $this->getLoginFormData();
 592         if ($this->writeDevLog) {
 593             GeneralUtility::devLog('Login data: ' . GeneralUtility::arrayToLogString($loginData), self::class);
 594         }
 595         // Active logout (eg. with "logout" button)
 596         if ($loginData['status'] === 'logout') {
 597             if ($this->writeStdLog) {
 598                 // $type,$action,$error,$details_nr,$details,$data,$tablename,$recuid,$recpid
 599                 $this->writelog(255, 2, 0, 2, 'User %s logged out', [$this->user['username']], '', 0, 0);
 600             }
 601             // Logout written to log
 602             if ($this->writeDevLog) {
 603                 GeneralUtility::devLog('User logged out. Id: ' . $this->id, self::class, -1);
 604             }
 605             $this->logoff();
 606         }
 607         // Determine whether we need to skip session update.
 608         // This is used mainly for checking session timeout in advance without refreshing the current session's timeout.
 609         $skipSessionUpdate = (bool)GeneralUtility::_GP('skipSessionUpdate');
 610         $haveSession = false;
 611         $anonymousSession = false;
 612         if (!$this->newSessionID) {
 613             // Read user session
 614             $authInfo['userSession'] = $this->fetchUserSession($skipSessionUpdate);
 615             $haveSession = is_array($authInfo['userSession']);
 616             if ($haveSession && !empty($authInfo['userSession']['ses_anonymous'])) {
 617                 $anonymousSession = true;
 618             }
 619         }
 620
 621         // Active login (eg. with login form).
 622         if (!$haveSession && $loginData['status'] === 'login') {
 623             $activeLogin = true;
 624             if ($this->writeDevLog) {
 625                 GeneralUtility::devLog('Active login (eg. with login form)', self::class);
 626             }
 627             // check referrer for submitted login values
 628             if ($this->formfield_status && $loginData['uident'] && $loginData['uname']) {
 629                 $httpHost = GeneralUtility::getIndpEnv('TYPO3_HOST_ONLY');
 630                 if (!$this->getMethodEnabled && ($httpHost != $authInfo['refInfo']['host'] && !$GLOBALS['TYPO3_CONF_VARS']['SYS']['doNotCheckReferer'])) {
 631                     throw new \RuntimeException('TYPO3 Fatal Error: Error: This host address ("' . $httpHost . '") and the referer host ("' . $authInfo['refInfo']['host'] . '") mismatches! ' .
 632                         'It is possible that the environment variable HTTP_REFERER is not passed to the script because of a proxy. ' .
 633                         'The site administrator can disable this check in the "All Configuration" section of the Install Tool (flag: TYPO3_CONF_VARS[SYS][doNotCheckReferer]).', 1270853930);
 634                 }
 635                 // Delete old user session if any
 636                 $this->logoff();
 637             }
 638             // Refuse login for _CLI users, if not processing a CLI request type
 639             // (although we shouldn't be here in case of a CLI request type)
 640             if (strtoupper(substr($loginData['uname'], 0, 5)) === '_CLI_' && !(TYPO3_REQUESTTYPE & TYPO3_REQUESTTYPE_CLI)) {
 641                 throw new \RuntimeException('TYPO3 Fatal Error: You have tried to login using a CLI user. Access prohibited!', 1270853931);
 642             }
 643         }
 644
 645         // Cause elevation of privilege, make sure regenerateSessionId is called later on
 646         if ($anonymousSession && $loginData['status'] === 'login') {
 647             $activeLogin = true;
 648         }
 649
 650         if ($this->writeDevLog) {
 651             if ($haveSession) {
 652                 GeneralUtility::devLog('User session found: ' . GeneralUtility::arrayToLogString($authInfo['userSession'], [$this->userid_column, $this->username_column]), self::class, 0);
 653             } else {
 654                 GeneralUtility::devLog('No user session found.', self::class, 2);
 655             }
 656             if (is_array($this->svConfig['setup'])) {
 657                 GeneralUtility::devLog('SV setup: ' . GeneralUtility::arrayToLogString($this->svConfig['setup']), self::class, 0);
 658             }
 659         }
 660
 661         // Fetch user if ...
 662         if (
 663             $activeLogin || $this->svConfig['setup'][$this->loginType . '_alwaysFetchUser']
 664             || !$haveSession && $this->svConfig['setup'][$this->loginType . '_fetchUserIfNoSession']
 665         ) {
 666             // Use 'auth' service to find the user
 667             // First found user will be used
 668             $subType = 'getUser' . $this->loginType;
 669             /** @var AuthenticationService $serviceObj */
 670             foreach ($this->getAuthServices($subType, $loginData, $authInfo) as $serviceObj) {
 671                 if ($row = $serviceObj->getUser()) {
 672                     $tempuserArr[] = $row;
 673                     if ($this->writeDevLog) {
 674                         GeneralUtility::devLog('User found: ' . GeneralUtility::arrayToLogString($row, [$this->userid_column, $this->username_column]), self::class, 0);
 675                     }
 676                     // User found, just stop to search for more if not configured to go on
 677                     if (!$this->svConfig['setup'][$this->loginType . '_fetchAllUsers']) {
 678                         break;
 679                     }
 680                 }
 681             }
 682
 683             if ($this->writeDevLog && $this->svConfig['setup'][$this->loginType . '_alwaysFetchUser']) {
 684                 GeneralUtility::devLog($this->loginType . '_alwaysFetchUser option is enabled', self::class);
 685             }
 686             if ($this->writeDevLog && empty($tempuserArr)) {
 687                 GeneralUtility::devLog('No user found by services', self::class);
 688             }
 689             if ($this->writeDevLog && !empty($tempuserArr)) {
 690                 GeneralUtility::devLog(count($tempuserArr) . ' user records found by services', self::class);
 691             }
 692         }
 693
 694         // If no new user was set we use the already found user session
 695         if (empty($tempuserArr) && $haveSession && !$anonymousSession) {
 696             $tempuserArr[] = $authInfo['userSession'];
 697             $tempuser = $authInfo['userSession'];
 698             // User is authenticated because we found a user session
 699             $authenticated = true;
 700             if ($this->writeDevLog) {
 701                 GeneralUtility::devLog('User session used: ' . GeneralUtility::arrayToLogString($authInfo['userSession'], [$this->userid_column, $this->username_column]), self::class);
 702             }
 703         }
 704         // Re-auth user when 'auth'-service option is set
 705         if ($this->svConfig['setup'][$this->loginType . '_alwaysAuthUser']) {
 706             $authenticated = false;
 707             if ($this->writeDevLog) {
 708                 GeneralUtility::devLog('alwaysAuthUser option is enabled', self::class);
 709             }
 710         }
 711         // Authenticate the user if needed
 712         if (!empty($tempuserArr) && !$authenticated) {
 713             foreach ($tempuserArr as $tempuser) {
 714                 // Use 'auth' service to authenticate the user
 715                 // If one service returns FALSE then authentication failed
 716                 // a service might return 100 which means there's no reason to stop but the user can't be authenticated by that service
 717                 if ($this->writeDevLog) {
 718                     GeneralUtility::devLog('Auth user: ' . GeneralUtility::arrayToLogString($tempuser), self::class);
 719                 }
 720                 $subType = 'authUser' . $this->loginType;
 721
 722                 foreach ($this->getAuthServices($subType, $loginData, $authInfo) as $serviceObj) {
 723                     if (($ret = $serviceObj->authUser($tempuser)) > 0) {
 724                         // If the service returns >=200 then no more checking is needed - useful for IP checking without password
 725                         if ((int)$ret >= 200) {
 726                             $authenticated = true;
 727                             break;
 728                         } elseif ((int)$ret >= 100) {
 729                         } else {
 730                             $authenticated = true;
 731                         }
 732                     } else {
 733                         $authenticated = false;
 734                         break;
 735                     }
 736                 }
 737
 738                 if ($authenticated) {
 739                     // Leave foreach() because a user is authenticated
 740                     break;
 741                 }
 742             }
 743         }
 744
 745         // If user is authenticated a valid user is in $tempuser
 746         if ($authenticated) {
 747             // Reset failure flag
 748             $this->loginFailure = false;
 749             // Insert session record if needed:
 750             if (!$haveSession || $anonymousSession || $tempuser['ses_id'] != $this->id && $tempuser['uid'] != $authInfo['userSession']['ses_userid']) {
 751                 $sessionData = $this->createUserSession($tempuser);
 752
 753                 // Preserve session data on login
 754                 if ($anonymousSession) {
 755                     $sessionData = $this->getSessionBackend()->update(
 756                         $this->id,
 757                         ['ses_data' => $authInfo['userSession']['ses_data']]
 758                     );
 759                 }
 760
 761                 $this->user = array_merge(
 762                     $tempuser,
 763                     $sessionData
 764                 );
 765                 // The login session is started.
 766                 $this->loginSessionStarted = true;
 767                 if ($this->writeDevLog && is_array($this->user)) {
 768                     GeneralUtility::devLog('User session finally read: ' . GeneralUtility::arrayToLogString($this->user, [$this->userid_column, $this->username_column]), self::class, -1);
 769                 }
 770             } elseif ($haveSession) {
 771                 // if we come here the current session is for sure not anonymous as this is a pre-condition for $authenticated = true
 772                 $this->user = $authInfo['userSession'];
 773             }
 774
 775             if ($activeLogin && !$this->newSessionID) {
 776                 $this->regenerateSessionId();
 777             }
 778
 779             // User logged in - write that to the log!
 780             if ($this->writeStdLog && $activeLogin) {
 781                 $this->writelog(255, 1, 0, 1, 'User %s logged in from %s (%s)', [$tempuser[$this->username_column], GeneralUtility::getIndpEnv('REMOTE_ADDR'), GeneralUtility::getIndpEnv('REMOTE_HOST')], '', '', '');
 782             }
 783             if ($this->writeDevLog && $activeLogin) {
 784                 GeneralUtility::devLog('User ' . $tempuser[$this->username_column] . ' logged in from ' . GeneralUtility::getIndpEnv('REMOTE_ADDR') . ' (' . GeneralUtility::getIndpEnv('REMOTE_HOST') . ')', self::class, -1);
 785             }
 786             if ($this->writeDevLog && !$activeLogin) {
 787                 GeneralUtility::devLog('User ' . $tempuser[$this->username_column] . ' authenticated from ' . GeneralUtility::getIndpEnv('REMOTE_ADDR') . ' (' . GeneralUtility::getIndpEnv('REMOTE_HOST') . ')', self::class, -1);
 788             }
 789         } elseif ($anonymousSession) {
 790             // User was not authenticated, so we should reuse the existing anonymous session
 791             $this->user = $authInfo['userSession'];
 792         } elseif ($activeLogin || !empty($tempuserArr)) {
 793             $this->loginFailure = true;
 794             if ($this->writeDevLog && empty($tempuserArr) && $activeLogin) {
 795                 GeneralUtility::devLog('Login failed: ' . GeneralUtility::arrayToLogString($loginData), self::class, 2);
 796             }
 797             if ($this->writeDevLog && !empty($tempuserArr)) {
 798                 GeneralUtility::devLog('Login failed: ' . GeneralUtility::arrayToLogString($tempuser, [$this->userid_column, $this->username_column]), self::class, 2);
 799             }
 800         }
 801
 802         // If there were a login failure, check to see if a warning email should be sent:
 803         if ($this->loginFailure && $activeLogin) {
 804             if ($this->writeDevLog) {
 805                 GeneralUtility::devLog('Call checkLogFailures: ' . GeneralUtility::arrayToLogString(['warningEmail' => $this->warningEmail, 'warningPeriod' => $this->warningPeriod, 'warningMax' => $this->warningMax]), self::class, -1);
 806             }
 807
 808             // Hook to implement login failure tracking methods
 809             if (
 810                 !empty($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postLoginFailureProcessing'])
 811                 && is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postLoginFailureProcessing'])
 812             ) {
 813                 $_params = [];
 814                 foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['postLoginFailureProcessing'] as $_funcRef) {
 815                     GeneralUtility::callUserFunction($_funcRef, $_params, $this);
 816                 }
 817             } else {
 818                 // If no hook is implemented, wait for 5 seconds
 819                 sleep(5);
 820             }
 821
 822             $this->checkLogFailures($this->warningEmail, $this->warningPeriod, $this->warningMax);
 823         }
 824     }
 825
 826     /**
 827      * Creates a new session ID.
 828      *
 829      * @return string The new session ID
 830      */
 831     public function createSessionId()
 832     {
 833         return GeneralUtility::makeInstance(Random::class)->generateRandomHexString($this->hash_length);
 834     }
 835
 836     /**
 837      * Initializes authentication services to be used in a foreach loop
 838      *
 839      * @param string $subType e.g. getUserFE
 840      * @param array $loginData
 841      * @param array $authInfo
 842      * @return \Traversable A generator of service objects
 843      */
 844     protected function getAuthServices(string $subType, array $loginData, array $authInfo): \Traversable
 845     {
 846         $serviceChain = '';
 847         while (is_object($serviceObj = GeneralUtility::makeInstanceService('auth', $subType, $serviceChain))) {
 848             $serviceChain .= ',' . $serviceObj->getServiceKey();
 849             $serviceObj->initAuth($subType, $loginData, $authInfo, $this);
 850             yield $serviceObj;
 851         }
 852         if ($this->writeDevLog && $serviceChain) {
 853             GeneralUtility::devLog($subType . ' auth services called: ' . $serviceChain, self::class);
 854         }
 855     }
 856
 857     /**
 858      * Regenerate the session ID and transfer the session to new ID
 859      * Call this method whenever a user proceeds to a higher authorization level
 860      * e.g. when an anonymous session is now authenticated.
 861      *
 862      * @param array $existingSessionRecord If given, this session record will be used instead of fetching again
 863      * @param bool $anonymous If true session will be regenerated as anonymous session
 864      */
 865     protected function regenerateSessionId(array $existingSessionRecord = [], bool $anonymous = false)
 866     {
 867         if (empty($existingSessionRecord)) {
 868             $existingSessionRecord = $this->getSessionBackend()->get($this->id);
 869         }
 870
 871         // Update session record with new ID
 872         $oldSessionId = $this->id;
 873         $this->id = $this->createSessionId();
 874         $updatedSession = $this->getSessionBackend()->set($this->id, $existingSessionRecord);
 875         $this->sessionData = unserialize($updatedSession['ses_data']);
 876         // Merge new session data into user/session array
 877         $this->user = array_merge($this->user ?? [], $updatedSession);
 878         $this->getSessionBackend()->remove($oldSessionId);
 879         $this->newSessionID = true;
 880     }
 881
 882     /*************************
 883      *
 884      * User Sessions
 885      *
 886      *************************/
 887
 888     /**
 889      * Creates a user session record and returns its values.
 890      *
 891      * @param array $tempuser User data array
 892      *
 893      * @return array The session data for the newly created session.
 894      */
 895     public function createUserSession($tempuser)
 896     {
 897         if ($this->writeDevLog) {
 898             GeneralUtility::devLog('Create session ses_id = ' . $this->id, self::class);
 899         }
 900         // Delete any session entry first
 901         $this->getSessionBackend()->remove($this->id);
 902         // Re-create session entry
 903         $sessionRecord = $this->getNewSessionRecord($tempuser);
 904         $sessionRecord = $this->getSessionBackend()->set($this->id, $sessionRecord);
 905         // Updating lastLogin_column carrying information about last login.
 906         $this->updateLoginTimestamp($tempuser[$this->userid_column]);
 907         return $sessionRecord;
 908     }
 909
 910     /**
 911      * Updates the last login column in the user with the given id
 912      *
 913      * @param int $userId
 914      */
 915     protected function updateLoginTimestamp(int $userId)
 916     {
 917         if ($this->lastLogin_column) {
 918             $connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable($this->user_table);
 919             $connection->update(
 920                 $this->user_table,
 921                 [$this->lastLogin_column => $GLOBALS['EXEC_TIME']],
 922                 [$this->userid_column => $userId]
 923             );
 924         }
 925     }
 926
 927     /**
 928      * Returns a new session record for the current user for insertion into the DB.
 929      * This function is mainly there as a wrapper for inheriting classes to override it.
 930      *
 931      * @param array $tempuser
 932      * @return array User session record
 933      */
 934     public function getNewSessionRecord($tempuser)
 935     {
 936         $sessionIpLock = '[DISABLED]';
 937         if ($this->lockIP && empty($tempuser['disableIPlock'])) {
 938             $sessionIpLock = $this->ipLockClause_remoteIPNumber($this->lockIP);
 939         }
 940
 941         return [
 942             'ses_id' => $this->id,
 943             'ses_iplock' => $sessionIpLock,
 944             'ses_userid' => $tempuser[$this->userid_column] ?? 0,
 945             'ses_tstamp' => $GLOBALS['EXEC_TIME'],
 946             'ses_data' => '',
 947         ];
 948     }
 949
 950     /**
 951      * Read the user session from db.
 952      *
 953      * @param bool $skipSessionUpdate
 954      * @return array|bool User session data, false if $this->id does not represent valid session
 955      */
 956     public function fetchUserSession($skipSessionUpdate = false)
 957     {
 958         if ($this->writeDevLog) {
 959             GeneralUtility::devLog('Fetch session ses_id = ' . $this->id, self::class);
 960         }
 961         try {
 962             $sessionRecord = $this->getSessionBackend()->get($this->id);
 963         } catch (SessionNotFoundException $e) {
 964             return false;
 965         }
 966
 967         // Fail if user session is not in current IPLock Range
 968         if ($sessionRecord['ses_iplock'] !== $this->ipLockClause_remoteIPNumber($this->lockIP) && $sessionRecord['ses_iplock'] !== '[DISABLED]') {
 969             return false;
 970         }
 971
 972         $this->sessionData = unserialize($sessionRecord['ses_data']);
 973         // Session is anonymous so no need to fetch user
 974         if ($sessionRecord['ses_anonymous']) {
 975             return $sessionRecord;
 976         }
 977
 978         // Fetch the user from the DB
 979         $userRecord = $this->getRawUserByUid((int)$sessionRecord['ses_userid']);
 980         if ($userRecord) {
 981             $userRecord = array_merge($sessionRecord, $userRecord);
 982             // A user was found
 983             $userRecord['ses_tstamp'] = (int)$userRecord['ses_tstamp'];
 984             $userRecord['is_online'] = (int)$userRecord['ses_tstamp'];
 985
 986             if (!empty($this->auth_timeout_field)) {
 987                 // Get timeout-time from usertable
 988                 $timeout = (int)$userRecord[$this->auth_timeout_field];
 989             } else {
 990                 $timeout = $this->sessionTimeout;
 991             }
 992             // If timeout > 0 (TRUE) and current time has not exceeded the latest sessions-time plus the timeout in seconds then accept user
 993             // Use a gracetime-value to avoid updating a session-record too often
 994             if ($timeout > 0 && $GLOBALS['EXEC_TIME'] < $userRecord['ses_tstamp'] + $timeout) {
 995                 $sessionUpdateGracePeriod = 61;
 996                 if (!$skipSessionUpdate && $GLOBALS['EXEC_TIME'] > ($userRecord['ses_tstamp'] + $sessionUpdateGracePeriod)) {
 997                     // Update the session timestamp by writing a dummy update. (Backend will update the timestamp)
 998                     $updatesSession = $this->getSessionBackend()->update($this->id, []);
 999                     $userRecord = array_merge($userRecord, $updatesSession);
1000                 }
1001             } else {
1002                 // Delete any user set...
1003                 $this->logoff();
1004                 $userRecord = false;
1005             }
1006         }
1007         return $userRecord;
1008     }
1009
1010     /**
1011      * Log out current user!
1012      * Removes the current session record, sets the internal ->user array to a blank string;
1013      * Thereby the current user (if any) is effectively logged out!
1014      *
1015      * @return void
1016      */
1017     public function logoff()
1018     {
1019         if ($this->writeDevLog) {
1020             GeneralUtility::devLog('logoff: ses_id = ' . $this->id, self::class);
1021         }
1022         // Release the locked records
1023         BackendUtility::lockRecords();
1024         if (is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_pre_processing'])) {
1025             $_params = [];
1026             foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_pre_processing'] as $_funcRef) {
1027                 if ($_funcRef) {
1028                     GeneralUtility::callUserFunction($_funcRef, $_params, $this);
1029                 }
1030             }
1031         }
1032         $this->performLogoff();
1033         if (is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_post_processing'])) {
1034             $_params = [];
1035             foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauth.php']['logoff_post_processing'] as $_funcRef) {
1036                 if ($_funcRef) {
1037                     GeneralUtility::callUserFunction($_funcRef, $_params, $this);
1038                 }
1039             }
1040         }
1041     }
1042
1043     /**
1044      * Perform the logoff action. Called from logoff() as a way to allow subclasses to override
1045      * what happens when a user logs off, without needing to reproduce the hook calls and logging
1046      * that happens in the public logoff() API method.
1047      *
1048      * @return void
1049      */
1050     protected function performLogoff()
1051     {
1052         if ($this->id) {
1053             $this->getSessionBackend()->remove($this->id);
1054         }
1055         $this->user = null;
1056     }
1057
1058     /**
1059      * Empty / unset the cookie
1060      *
1061      * @param string $cookieName usually, this is $this->name
1062      * @return void
1063      */
1064     public function removeCookie($cookieName)
1065     {
1066         $cookieDomain = $this->getCookieDomain();
1067         // If no cookie domain is set, use the base path
1068         $cookiePath = $cookieDomain ? '/' : GeneralUtility::getIndpEnv('TYPO3_SITE_PATH');
1069         setcookie($cookieName, null, -1, $cookiePath, $cookieDomain);
1070     }
1071
1072     /**
1073      * Determine whether there's an according session record to a given session_id.
1074      * Don't care if session record is still valid or not.
1075      *
1076      * @param string $id Claimed Session ID
1077      * @return bool Returns TRUE if a corresponding session was found in the database
1078      */
1079     public function isExistingSessionRecord($id)
1080     {
1081         try {
1082             return !empty($this->getSessionBackend()->get($id));
1083         } catch (SessionNotFoundException $e) {
1084             return false;
1085         }
1086     }
1087
1088     /**
1089      * Returns whether this request is going to set a cookie
1090      * or a cookie was already found in the system
1091      *
1092      * @return bool Returns TRUE if a cookie is set
1093      */
1094     public function isCookieSet()
1095     {
1096         return $this->cookieWasSetOnCurrentRequest || $this->getCookie($this->name);
1097     }
1098
1099     /*************************
1100      *
1101      * SQL Functions
1102      *
1103      *************************/
1104     /**
1105      * This returns the restrictions needed to select the user respecting
1106      * enable columns and flags like deleted, hidden, starttime, endtime
1107      * and rootLevel
1108      *
1109      * @return QueryRestrictionContainerInterface
1110      * @internal
1111      */
1112     protected function userConstraints(): QueryRestrictionContainerInterface
1113     {
1114         $restrictionContainer = GeneralUtility::makeInstance(DefaultRestrictionContainer::class);
1115
1116         if (empty($this->enablecolumns['disabled'])) {
1117             $restrictionContainer->removeByType(HiddenRestriction::class);
1118         }
1119
1120         if (empty($this->enablecolumns['deleted'])) {
1121             $restrictionContainer->removeByType(DeletedRestriction::class);
1122         }
1123
1124         if (empty($this->enablecolumns['starttime'])) {
1125             $restrictionContainer->removeByType(StartTimeRestriction::class);
1126         }
1127
1128         if (empty($this->enablecolumns['endtime'])) {
1129             $restrictionContainer->removeByType(EndTimeRestriction::class);
1130         }
1131
1132         if (!empty($this->enablecolumns['rootLevel'])) {
1133             $restrictionContainer->add(GeneralUtility::makeInstance(RootLevelRestriction::class, [$this->user_table]));
1134         }
1135
1136         return $restrictionContainer;
1137     }
1138
1139     /**
1140      * This returns the where-clause needed to select the user
1141      * with respect flags like deleted, hidden, starttime, endtime
1142      *
1143      * @return string
1144      * @access private
1145      * @deprecated since TYPO3 v8, will be removed in TYPO3 v9
1146      */
1147     protected function user_where_clause()
1148     {
1149         GeneralUtility::logDeprecatedFunction();
1150
1151         $whereClause = '';
1152         if ($this->enablecolumns['rootLevel']) {
1153             $whereClause .= ' AND ' . $this->user_table . '.pid=0 ';
1154         }
1155         if ($this->enablecolumns['disabled']) {
1156             $whereClause .= ' AND ' . $this->user_table . '.' . $this->enablecolumns['disabled'] . '=0';
1157         }
1158         if ($this->enablecolumns['deleted']) {
1159             $whereClause .= ' AND ' . $this->user_table . '.' . $this->enablecolumns['deleted'] . '=0';
1160         }
1161         if ($this->enablecolumns['starttime']) {
1162             $whereClause .= ' AND (' . $this->user_table . '.' . $this->enablecolumns['starttime'] . '<=' . $GLOBALS['EXEC_TIME'] . ')';
1163         }
1164         if ($this->enablecolumns['endtime']) {
1165             $whereClause .= ' AND (' . $this->user_table . '.' . $this->enablecolumns['endtime'] . '=0 OR '
1166                 . $this->user_table . '.' . $this->enablecolumns['endtime'] . '>' . $GLOBALS['EXEC_TIME'] . ')';
1167         }
1168         return $whereClause;
1169     }
1170
1171     /**
1172      * Returns the IP address to lock to.
1173      * The IP address may be partial based on $parts.
1174      *
1175      * @param int $parts 1-4: Indicates how many parts of the IP address to return. 4 means all, 1 means only first number.
1176      * @return string (Partial) IP address for REMOTE_ADDR
1177      */
1178     protected function ipLockClause_remoteIPNumber($parts)
1179     {
1180         $IP = GeneralUtility::getIndpEnv('REMOTE_ADDR');
1181         if ($parts >= 4) {
1182             return $IP;
1183         } else {
1184             $parts = MathUtility::forceIntegerInRange($parts, 1, 3);
1185             $IPparts = explode('.', $IP);
1186             for ($a = 4; $a > $parts; $a--) {
1187                 unset($IPparts[$a - 1]);
1188             }
1189             return implode('.', $IPparts);
1190         }
1191     }
1192
1193     /**
1194      * VeriCode returns 10 first chars of a md5 hash of the session cookie AND the encryptionKey from TYPO3_CONF_VARS.
1195      * This code is used as an alternative verification when the JavaScript interface executes cmd's to
1196      * tce_db.php from eg. MSIE 5.0 because the proper referer is not passed with this browser...
1197      *
1198      * @return string
1199      * @deprecated since TYPO3 v8, will be removed in TYPO3 v9
1200      */
1201     public function veriCode()
1202     {
1203         GeneralUtility::logDeprecatedFunction();
1204         return substr(md5($this->id . $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey']), 0, 10);
1205     }
1206
1207     /*************************
1208      *
1209      * Session and Configuration Handling
1210      *
1211      *************************/
1212     /**
1213      * This writes $variable to the user-record. This is a way of providing session-data.
1214      * You can fetch the data again through $this->uc in this class!
1215      * If $variable is not an array, $this->uc is saved!
1216      *
1217      * @param array|string $variable An array you want to store for the user as session data. If $variable is not supplied (is null), the internal variable, ->uc, is stored by default
1218      * @return void
1219      */
1220     public function writeUC($variable = '')
1221     {
1222         if (is_array($this->user) && $this->user[$this->userid_column]) {
1223             if (!is_array($variable)) {
1224                 $variable = $this->uc;
1225             }
1226             if ($this->writeDevLog) {
1227                 GeneralUtility::devLog(
1228                     'writeUC: ' . $this->userid_column . '=' . (int)$this->user[$this->userid_column],
1229                     self::class
1230                 );
1231             }
1232             GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable($this->user_table)->update(
1233                 $this->user_table,
1234                 ['uc' => serialize($variable)],
1235                 [$this->userid_column => (int)$this->user[$this->userid_column]],
1236                 ['uc' => Connection::PARAM_LOB]
1237             );
1238         }
1239     }
1240
1241     /**
1242      * Sets $theUC as the internal variable ->uc IF $theUC is an array.
1243      * If $theUC is FALSE, the 'uc' content from the ->user array will be unserialized and restored in ->uc
1244      *
1245      * @param mixed $theUC If an array, then set as ->uc, otherwise load from user record
1246      * @return void
1247      */
1248     public function unpack_uc($theUC = '')
1249     {
1250         if (!$theUC && isset($this->user['uc'])) {
1251             $theUC = unserialize($this->user['uc']);
1252         }
1253         if (is_array($theUC)) {
1254             $this->uc = $theUC;
1255         }
1256     }
1257
1258     /**
1259      * Stores data for a module.
1260      * The data is stored with the session id so you can even check upon retrieval
1261      * if the module data is from a previous session or from the current session.
1262      *
1263      * @param string $module Is the name of the module ($MCONF['name'])
1264      * @param mixed $data Is the data you want to store for that module (array, string, ...)
1265      * @param bool|int $noSave If $noSave is set, then the ->uc array (which carries all kinds of user data) is NOT written immediately, but must be written by some subsequent call.
1266      * @return void
1267      */
1268     public function pushModuleData($module, $data, $noSave = 0)
1269     {
1270         $this->uc['moduleData'][$module] = $data;
1271         $this->uc['moduleSessionID'][$module] = $this->id;
1272         if (!$noSave) {
1273             $this->writeUC();
1274         }
1275     }
1276
1277     /**
1278      * Gets module data for a module (from a loaded ->uc array)
1279      *
1280      * @param string $module Is the name of the module ($MCONF['name'])
1281      * @param string $type If $type = 'ses' then module data is returned only if it was stored in the current session, otherwise data from a previous session will be returned (if available).
1282      * @return mixed The module data if available: $this->uc['moduleData'][$module];
1283      */
1284     public function getModuleData($module, $type = '')
1285     {
1286         if ($type !== 'ses' || (isset($this->uc['moduleSessionID'][$module]) && $this->uc['moduleSessionID'][$module] == $this->id)) {
1287             return $this->uc['moduleData'][$module];
1288         }
1289         return null;
1290     }
1291
1292     /**
1293      * Returns the session data stored for $key.
1294      * The data will last only for this login session since it is stored in the user session.
1295      *
1296      * @param string $key The key associated with the session data
1297      * @return mixed
1298      */
1299     public function getSessionData($key)
1300     {
1301         return $this->sessionData[$key] ?? null;
1302     }
1303
1304     /**
1305      * Set session data by key.
1306      * The data will last only for this login session since it is stored in the user session.
1307      *
1308      * @param string $key A non empty string to store the data under
1309      * @param mixed $data Data store store in session
1310      * @return void
1311      */
1312     public function setSessionData($key, $data)
1313     {
1314         if (empty($key)) {
1315             throw new \InvalidArgumentException('Argument key must not be empty', 1484311516);
1316         }
1317         $this->sessionData[$key] = $data;
1318     }
1319
1320     /**
1321      * Sets the session data ($data) for $key and writes all session data (from ->user['ses_data']) to the database.
1322      * The data will last only for this login session since it is stored in the session table.
1323      *
1324      * @param string $key Pointer to an associative key in the session data array which is stored serialized in the field "ses_data" of the session table.
1325      * @param mixed $data The data to store in index $key
1326      * @return void
1327      */
1328     public function setAndSaveSessionData($key, $data)
1329     {
1330         $this->sessionData[$key] = $data;
1331         $this->user['ses_data'] = serialize($this->sessionData);
1332         if ($this->writeDevLog) {
1333             GeneralUtility::devLog('setAndSaveSessionData: ses_id = ' . $this->id, self::class);
1334         }
1335         $updatedSession = $this->getSessionBackend()->update(
1336             $this->id,
1337             ['ses_data' => $this->user['ses_data']]
1338         );
1339         $this->user = array_merge($this->user ?? [], $updatedSession);
1340     }
1341
1342     /*************************
1343      *
1344      * Misc
1345      *
1346      *************************/
1347     /**
1348      * Returns an info array with Login/Logout data submitted by a form or params
1349      *
1350      * @return array
1351      * @internal
1352      */
1353     public function getLoginFormData()
1354     {
1355         $loginData = [];
1356         $loginData['status'] = GeneralUtility::_GP($this->formfield_status);
1357         if ($this->getMethodEnabled) {
1358             $loginData['uname'] = GeneralUtility::_GP($this->formfield_uname);
1359             $loginData['uident'] = GeneralUtility::_GP($this->formfield_uident);
1360         } else {
1361             $loginData['uname'] = GeneralUtility::_POST($this->formfield_uname);
1362             $loginData['uident'] = GeneralUtility::_POST($this->formfield_uident);
1363         }
1364         // Only process the login data if a login is requested
1365         if ($loginData['status'] === 'login') {
1366             $loginData = $this->processLoginData($loginData);
1367         }
1368         $loginData = array_map('trim', $loginData);
1369         return $loginData;
1370     }
1371
1372     /**
1373      * Processes Login data submitted by a form or params depending on the
1374      * passwordTransmissionStrategy
1375      *
1376      * @param array $loginData Login data array
1377      * @param string $passwordTransmissionStrategy Alternative passwordTransmissionStrategy. Used when authentication services wants to override the default.
1378      * @return array
1379      * @internal
1380      */
1381     public function processLoginData($loginData, $passwordTransmissionStrategy = '')
1382     {
1383         $loginSecurityLevel = trim($GLOBALS['TYPO3_CONF_VARS'][$this->loginType]['loginSecurityLevel']) ?: 'normal';
1384         $passwordTransmissionStrategy = $passwordTransmissionStrategy ?: $loginSecurityLevel;
1385         if ($this->writeDevLog) {
1386             GeneralUtility::devLog('Login data before processing: ' . GeneralUtility::arrayToLogString($loginData), self::class);
1387         }
1388         $serviceChain = '';
1389         $subType = 'processLoginData' . $this->loginType;
1390         $authInfo = $this->getAuthInfoArray();
1391         $isLoginDataProcessed = false;
1392         $processedLoginData = $loginData;
1393         while (is_object($serviceObject = GeneralUtility::makeInstanceService('auth', $subType, $serviceChain))) {
1394             $serviceChain .= ',' . $serviceObject->getServiceKey();
1395             $serviceObject->initAuth($subType, $loginData, $authInfo, $this);
1396             $serviceResult = $serviceObject->processLoginData($processedLoginData, $passwordTransmissionStrategy);
1397             if (!empty($serviceResult)) {
1398                 $isLoginDataProcessed = true;
1399                 // If the service returns >=200 then no more processing is needed
1400                 if ((int)$serviceResult >= 200) {
1401                     unset($serviceObject);
1402                     break;
1403                 }
1404             }
1405             unset($serviceObject);
1406         }
1407         if ($isLoginDataProcessed) {
1408             $loginData = $processedLoginData;
1409             if ($this->writeDevLog) {
1410                 GeneralUtility::devLog('Processed login data: ' . GeneralUtility::arrayToLogString($processedLoginData), self::class);
1411             }
1412         }
1413         return $loginData;
1414     }
1415
1416     /**
1417      * Returns an info array which provides additional information for auth services
1418      *
1419      * @return array
1420      * @internal
1421      */
1422     public function getAuthInfoArray()
1423     {
1424         $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($this->user_table);
1425         $expressionBuilder = $queryBuilder->expr();
1426         $authInfo = [];
1427         $authInfo['loginType'] = $this->loginType;
1428         $authInfo['refInfo'] = parse_url(GeneralUtility::getIndpEnv('HTTP_REFERER'));
1429         $authInfo['HTTP_HOST'] = GeneralUtility::getIndpEnv('HTTP_HOST');
1430         $authInfo['REMOTE_ADDR'] = GeneralUtility::getIndpEnv('REMOTE_ADDR');
1431         $authInfo['REMOTE_HOST'] = GeneralUtility::getIndpEnv('REMOTE_HOST');
1432         $authInfo['showHiddenRecords'] = $this->showHiddenRecords;
1433         // Can be overidden in localconf by SVCONF:
1434         $authInfo['db_user']['table'] = $this->user_table;
1435         $authInfo['db_user']['userid_column'] = $this->userid_column;
1436         $authInfo['db_user']['username_column'] = $this->username_column;
1437         $authInfo['db_user']['userident_column'] = $this->userident_column;
1438         $authInfo['db_user']['usergroup_column'] = $this->usergroup_column;
1439         $authInfo['db_user']['enable_clause'] = $this->userConstraints()->buildExpression(
1440             [$this->user_table => ''],
1441             $expressionBuilder
1442         );
1443         if ($this->checkPid && $this->checkPid_value !== null) {
1444             $authInfo['db_user']['checkPidList'] = $this->checkPid_value;
1445             $authInfo['db_user']['check_pid_clause'] = $expressionBuilder->in(
1446                 'pid',
1447                 GeneralUtility::intExplode(',', $this->checkPid_value)
1448             );
1449         } else {
1450             $authInfo['db_user']['checkPidList'] = '';
1451             $authInfo['db_user']['check_pid_clause'] = '';
1452         }
1453         $authInfo['db_groups']['table'] = $this->usergroup_table;
1454         return $authInfo;
1455     }
1456
1457     /**
1458      * Check the login data with the user record data for builtin login methods
1459      *
1460      * @param array $user User data array
1461      * @param array $loginData Login data array
1462      * @param string $passwordCompareStrategy Alternative passwordCompareStrategy. Used when authentication services wants to override the default.
1463      * @return bool TRUE if login data matched
1464      */
1465     public function compareUident($user, $loginData, $passwordCompareStrategy = '')
1466     {
1467         return (string)$loginData['uident_text'] !== '' && (string)$loginData['uident_text'] === (string)$user[$this->userident_column];
1468     }
1469
1470     /**
1471      * Garbage collector, removing old expired sessions.
1472      *
1473      * @return void
1474      * @internal
1475      */
1476     public function gc()
1477     {
1478         $this->getSessionBackend()->collectGarbage($this->gc_time);
1479     }
1480
1481     /**
1482      * DUMMY: Writes to log database table (in some extension classes)
1483      *
1484      * @param int $type denotes which module that has submitted the entry. This is the current list:  1=tce_db; 2=tce_file; 3=system (eg. sys_history save); 4=modules; 254=Personal settings changed; 255=login / out action: 1=login, 2=logout, 3=failed login (+ errorcode 3), 4=failure_warning_email sent
1485      * @param int $action denotes which specific operation that wrote the entry (eg. 'delete', 'upload', 'update' and so on...). Specific for each $type. Also used to trigger update of the interface. (see the log-module for the meaning of each number !!)
1486      * @param int $error flag. 0 = message, 1 = error (user problem), 2 = System Error (which should not happen), 3 = security notice (admin)
1487      * @param int $details_nr The message number. Specific for each $type and $action. in the future this will make it possible to translate errormessages to other languages
1488      * @param string $details Default text that follows the message
1489      * @param array $data Data that follows the log. Might be used to carry special information. If an array the first 5 entries (0-4) will be sprintf'ed the details-text...
1490      * @param string $tablename Special field used by tce_main.php. These ($tablename, $recuid, $recpid) holds the reference to the record which the log-entry is about. (Was used in attic status.php to update the interface.)
1491      * @param int $recuid Special field used by tce_main.php. These ($tablename, $recuid, $recpid) holds the reference to the record which the log-entry is about. (Was used in attic status.php to update the interface.)
1492      * @param int $recpid Special field used by tce_main.php. These ($tablename, $recuid, $recpid) holds the reference to the record which the log-entry is about. (Was used in attic status.php to update the interface.)
1493      * @return void
1494      */
1495     public function writelog($type, $action, $error, $details_nr, $details, $data, $tablename, $recuid, $recpid)
1496     {
1497     }
1498
1499     /**
1500      * DUMMY: Check login failures (in some extension classes)
1501      *
1502      * @param string $email Email address
1503      * @param int $secondsBack Number of sections back in time to check. This is a kind of limit for how many failures an hour for instance
1504      * @param int $maxFailures Max allowed failures before a warning mail is sent
1505      * @return void
1506      * @ignore
1507      */
1508     public function checkLogFailures($email, $secondsBack, $maxFailures)
1509     {
1510     }
1511
1512     /**
1513      * Raw initialization of the be_user with uid=$uid
1514      * This will circumvent all login procedures and select a be_users record from the
1515      * database and set the content of ->user to the record selected.
1516      * Thus the BE_USER object will appear like if a user was authenticated - however without
1517      * a session id and the fields from the session table of course.
1518      * Will check the users for disabled, start/endtime, etc. ($this->user_where_clause())
1519      *
1520      * @param int $uid The UID of the backend user to set in ->user
1521      * @return void
1522      * @internal
1523      * @see SC_mod_tools_be_user_index::compareUsers(), \TYPO3\CMS\Setup\Controller\SetupModuleController::simulateUser(), freesite_admin::startCreate()
1524      */
1525     public function setBeUserByUid($uid)
1526     {
1527         $this->user = $this->getRawUserByUid($uid);
1528     }
1529
1530     /**
1531      * Raw initialization of the be_user with username=$name
1532      *
1533      * @param string $name The username to look up.
1534      * @return void
1535      * @see \TYPO3\CMS\Core\Authentication\AbstractUserAuthentication::setBeUserByUid()
1536      * @internal
1537      */
1538     public function setBeUserByName($name)
1539     {
1540         $this->user = $this->getRawUserByName($name);
1541     }
1542
1543     /**
1544      * Fetching raw user record with uid=$uid
1545      *
1546      * @param int $uid The UID of the backend user to set in ->user
1547      * @return array user record or FALSE
1548      * @internal
1549      */
1550     public function getRawUserByUid($uid)
1551     {
1552         $query = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($this->user_table);
1553         $query->setRestrictions($this->userConstraints());
1554         $query->select('*')
1555             ->from($this->user_table)
1556             ->where($query->expr()->eq('uid', $query->createNamedParameter($uid, \PDO::PARAM_INT)));
1557
1558         return $query->execute()->fetch();
1559     }
1560
1561     /**
1562      * Fetching raw user record with username=$name
1563      *
1564      * @param string $name The username to look up.
1565      * @return array user record or FALSE
1566      * @see \TYPO3\CMS\Core\Authentication\AbstractUserAuthentication::getUserByUid()
1567      * @internal
1568      */
1569     public function getRawUserByName($name)
1570     {
1571         $query = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($this->user_table);
1572         $query->setRestrictions($this->userConstraints());
1573         $query->select('*')
1574             ->from($this->user_table)
1575             ->where($query->expr()->eq('username', $query->createNamedParameter($name, \PDO::PARAM_STR)));
1576
1577         return $query->execute()->fetch();
1578     }
1579
1580     /**
1581      * Get a user from DB by username
1582      * provided for usage from services
1583      *
1584      * @param array $dbUser User db table definition: $this->db_user
1585      * @param string $username user name
1586      * @param string $extraWhere Additional WHERE clause: " AND ...
1587      * @return mixed User array or FALSE
1588      */
1589     public function fetchUserRecord($dbUser, $username, $extraWhere = '')
1590     {
1591         $user = false;
1592         if ($username || $extraWhere) {
1593             $query = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($dbUser['table']);
1594             $query->getRestrictions()->removeAll()
1595                 ->add(GeneralUtility::makeInstance(DeletedRestriction::class));
1596
1597             $constraints = array_filter([
1598                 QueryHelper::stripLogicalOperatorPrefix($dbUser['check_pid_clause']),
1599                 QueryHelper::stripLogicalOperatorPrefix($dbUser['enable_clause']),
1600                 QueryHelper::stripLogicalOperatorPrefix($extraWhere),
1601             ]);
1602
1603             if (!empty($username)) {
1604                 array_unshift(
1605                     $constraints,
1606                     $query->expr()->eq(
1607                         $dbUser['username_column'],
1608                         $query->createNamedParameter($username, \PDO::PARAM_STR)
1609                     )
1610                 );
1611             }
1612
1613             $user = $query->select('*')
1614                 ->from($dbUser['table'])
1615                 ->where(...$constraints)
1616                 ->execute()
1617                 ->fetch();
1618         }
1619
1620         return $user;
1621     }
1622
1623     /**
1624      * @internal
1625      * @return string
1626      */
1627     public function getSessionId() : string
1628     {
1629         return $this->id;
1630     }
1631
1632     /**
1633      * @internal
1634      * @return string
1635      */
1636     public function getLoginType() : string
1637     {
1638         return $this->loginType;
1639     }
1640
1641     /**
1642      * Returns initialized session backend. Returns same session backend if called multiple times
1643      *
1644      * @return SessionBackendInterface
1645      */
1646     protected function getSessionBackend()
1647     {
1648         if (!isset($this->sessionBackend)) {
1649             $this->sessionBackend = GeneralUtility::makeInstance(SessionManager::class)->getSessionBackend($this->loginType);
1650         }
1651         return $this->sessionBackend;
1652     }
1653 }