implement rememberme functionality

Added a checkbox on login or register to remember the current user. If
the login is successful, this sets a cookie with a random code (saved
in the DB). If they come back, and they aren't logged in "normally",
we check to see if they have a rememberme cookie. If so, we log them
in.

However, they can't change settings -- cookie theft is too prevalent.
So we mark a session as having a "real" (password or OpenID) login, or
not. In settings pages, we check to see if the login is "real", and if
not, we redirect to the login page.

darcs-hash:20080624025234-34904-ad20001bf35bf41fcb63a0c357fd929aacc55fdb.gz

4 files changed, 137 insertions, 52 deletions

diff --git a/lib/common.php b/lib/common.php
index d2e7e2ed5..18e4ed54a 100644
--- a/lib/common.php
+++ b/lib/common.php
@@ -90,3 +90,4 @@ require_once(INSTALLDIR.'/classes/Remote_profile.php');
 require_once(INSTALLDIR.'/classes/Subscription.php');
 require_once(INSTALLDIR.'/classes/User.php');
 require_once(INSTALLDIR.'/classes/Confirm_address.php');
+require_once(INSTALLDIR.'/classes/Remember_me.php');
diff --git a/lib/openid.php b/lib/openid.php
index 41102457a..11934138f 100644
--- a/lib/openid.php
+++ b/lib/openid.php
@@ -30,7 +30,7 @@ require_once('Auth/OpenID/MySQLStore.php');
 
 define('OPENID_COOKIE_EXPIRY', round(365.25 * 24 * 60 * 60));
 define('OPENID_COOKIE_KEY', 'lastusedopenid');
-	   
+
 function oid_store() {
     static $store = NULL;
 	if (!$store) {
@@ -53,21 +53,9 @@ function oid_clear_last() {
 }
 
 function oid_set_last($openid_url) {
-	
-	$path = common_config('site', 'path');
-	$server = common_config('site', 'server');
-
-	if ($path && ($path != '/')) {
-		$cookiepath = '/' . $path . '/';
-	} else {
-		$cookiepath = '/';
-	}
-	
-	setcookie(OPENID_COOKIE_KEY,
-			  $openid_url,
-			  time() + OPENID_COOKIE_EXPIRY,
-			  $cookiepath,
-			  $server);
+	common_set_cookie(OPENID_COOKIE_KEY,
+			         $openid_url,
+			         time() + OPENID_COOKIE_EXPIRY);
 }
 
 function oid_get_last() {
@@ -80,7 +68,7 @@ function oid_get_last() {
 }
 
 function oid_link_user($id, $canonical, $display) {
-	
+
 	$oid = new User_openid();
 	$oid->user_id = $id;
 	$oid->canonical = $canonical;
@@ -92,7 +80,7 @@ function oid_link_user($id, $canonical, $display) {
 		common_debug('DB error ' . $err->code . ': ' . $err->message, __FILE__);
 		return false;
 	}
-	
+
 	return true;
 }
 
@@ -113,13 +101,13 @@ function oid_check_immediate($openid_url, $backto=NULL) {
 		$backto = common_local_url($action, $args);
 	}
 	common_debug('going back to "' . $backto . '"', __FILE__);
-	
+
 	common_ensure_session();
-	
+
 	$_SESSION['openid_immediate_backto'] = $backto;
 	common_debug('passed-in variable is "' . $backto . '"', __FILE__);
 	common_debug('session variable is "' . $_SESSION['openid_immediate_backto'] . '"', __FILE__);
-	
+
 	oid_authenticate($openid_url,
 					 'finishimmediate',
 					 true);
@@ -128,23 +116,23 @@ function oid_check_immediate($openid_url, $backto=NULL) {
 function oid_authenticate($openid_url, $returnto, $immediate=false) {
 
 	$consumer = oid_consumer();
-	
+
 	if (!$consumer) {
 		common_server_error(_t('Cannot instantiate OpenID consumer object.'));
 		return false;
 	}
-	
+
 	common_ensure_session();
-	
+
 	$auth_request = $consumer->begin($openid_url);
-	
+
 	// Handle failure status return values.
 	if (!$auth_request) {
 		return _t('Not a valid OpenID.');
 	} else if (Auth_OpenID::isFailure($auth_request)) {
 		return _t('OpenID failure: ') . $auth_request->message;
 	}
-	
+
 	$sreg_request = Auth_OpenID_SRegRequest::build(// Required
 												   array(),
 												   // Optional
@@ -155,14 +143,14 @@ function oid_authenticate($openid_url, $returnto, $immediate=false) {
 														 'timezone',
 														 'postcode',
 														 'country'));
-	
+
 	if ($sreg_request) {
 		$auth_request->addExtension($sreg_request);
 	}
-	
+
 	$trust_root = common_local_url('public');
 	$process_url = common_local_url($returnto);
-	
+
 	if ($auth_request->shouldSendRedirect()) {
 		$redirect_url = $auth_request->redirectURL($trust_root,
 												   $process_url,
@@ -178,12 +166,12 @@ function oid_authenticate($openid_url, $returnto, $immediate=false) {
 		$form_id = 'openid_message';
 		$form_html = $auth_request->formMarkup($trust_root, $process_url,
 											   $immediate, array('id' => $form_id));
-		
+
 		# XXX: This is cheap, but things choke if we don't escape ampersands
 		# in the HTML attributes
-		
+
 		$form_html = preg_replace('/&/', '&', $form_html);
-		
+
 		// Display an error if the form markup couldn't be generated;
 		// otherwise, render the HTML.
 		if (Auth_OpenID::isFailure($form_html)) {
@@ -212,15 +200,15 @@ function _oid_print_instructions() {
 # update a user from sreg parameters
 
 function oid_update_user(&$user, &$sreg) {
-		
+
 	$profile = $user->getProfile();
-	
+
 	$orig_profile = clone($profile);
-	
+
 	if ($sreg['fullname'] && strlen($sreg['fullname']) <= 255) {
 		$profile->fullname = $sreg['fullname'];
 	}
-	
+
 	if ($sreg['country']) {
 		if ($sreg['postcode']) {
 			# XXX: use postcode to get city and region
@@ -230,25 +218,25 @@ function oid_update_user(&$user, &$sreg) {
 			$profile->location = $sreg['country'];
 		}
 	}
-	
+
 	# XXX save language if it's passed
 	# XXX save timezone if it's passed
-	
+
 	if (!$profile->update($orig_profile)) {
 		common_server_error(_t('Error saving the profile.'));
 		return false;
 	}
-	
+
 	$orig_user = clone($user);
-	
+
 	if ($sreg['email'] && Validate::email($sreg['email'], true)) {
 		$user->email = $sreg['email'];
 	}
-	
+
 	if (!$user->update($orig_user)) {
 		common_server_error(_t('Error saving the user.'));
 		return false;
 	}
-	
+
 	return true;
 }
diff --git a/lib/settingsaction.php b/lib/settingsaction.php
index fad6abaf1..2a80c0e31 100644
--- a/lib/settingsaction.php
+++ b/lib/settingsaction.php
@@ -26,6 +26,12 @@ class SettingsAction extends Action {
         if (!common_logged_in()) {
             common_user_error(_t('Not logged in.'));
             return;
+        } else if (!common_is_real_login()) {
+        	# Cookie theft means that automatic logins can't
+        	# change important settings or see private info, and
+        	# _all_ our settings are important
+            common_set_returnto($this->self_url());
+            common_redirect(common_local_url('login'));
         } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $this->handle_post();
         } else {
@@ -52,8 +58,8 @@ class SettingsAction extends Action {
     function settings_menu() {
         # action => array('prompt', 'title')
         static $menu =
-        array('profilesettings' => 
-              array('Profile', 
+        array('profilesettings' =>
+              array('Profile',
               		'Change your profile settings'),
             'avatar' =>
             array('Avatar',
@@ -62,12 +68,12 @@ class SettingsAction extends Action {
             array('Password',
                   'Change your password'),
             'openidsettings' =>
-            array('OpenID', 
+            array('OpenID',
                   'Add or remove OpenIDs'),
             'imsettings' =>
             array('IM',
                   'Updates by instant messenger (IM)'));
-                       
+
         $action = $this->trimmed('action');
         common_element_start('ul', array('id' => 'nav_views'));
         foreach ($menu as $menuaction => $menudesc) {
diff --git a/lib/util.php b/lib/util.php
index 014577345..2fa8e9f95 100644
--- a/lib/util.php
+++ b/lib/util.php
@@ -325,7 +325,7 @@ function common_checkbox($id, $label, $value='true',
 	common_element_start('p');
 	$attrs = array('name' => $id,
 				   'type' => 'checkbox',
-				   'id' => $id, 
+				   'id' => $id,
 				   'value' => $value);
 	if ($value) {
 		$attrs['value'] = htmlspecialchars($value);
@@ -432,16 +432,106 @@ function common_set_user($nickname) {
 	return false;
 }
 
+function commmon_set_cookie($key, $value, $expiration=0) {
+	$path = common_config('site', 'path');
+	$server = common_config('site', 'server');
+
+	if ($path && ($path != '/')) {
+		$cookiepath = '/' . $path . '/';
+	} else {
+		$cookiepath = '/';
+	}
+	return setcookie($key,
+	                 $value,
+	          		 $expiration,
+			  		 $cookiepath,
+			  	     $server);
+}
+
+define('REMEMBERME', 'rememberme');
+define('REMEMBERME_EXPIRY', round(30 * 24 * 60 * 60));
+
+function common_rememberme() {
+	$user = common_current_user();
+	if (!$user) {
+		return false;
+	}
+	$rm = new Remember_me();
+	$rm->code = common_good_rand(16);
+	$rm->user = $user->id();
+	if (!$rm->insert) {
+		common_log_db_error($rm, 'INSERT', __FILE__);
+		return false;
+	}
+	common_set_cookie(REMEMBERME,
+					  $rm->user . ':' . $rm->code,
+					  time() + REMEMBERME_EXPIRY);
+}
+
+function common_remembered_user() {
+	$user = NULL;
+	# Try to remember
+	$packed = $_COOKIE[REMEMBERME];
+	if ($packed) {
+		list($id, $code) = explode(':', $packed);
+		if ($id && $code) {
+			$rm = Remember_me::staticGet($code);
+			if ($rm && $rm->id == $id) {
+				$user = User::staticGet($rm->id);
+				if ($user) {
+					# successful!
+					$result = $rm->delete();
+					if (!$result) {
+						common_log_db_error($rm, 'DELETE', __FILE__);
+						$user = NULL;
+					} else {
+						common_set_user($user);
+						common_real_login(false);
+						common_rememberme();
+					}
+				}
+			}
+		}
+	}
+	return $user;
+}
+
+# must be called with a valid user!
+
+function common_forgetme() {
+	common_set_cookie(REMEMBERME, '', 0);
+}
+
 # who is the current user?
 function common_current_user() {
-	common_ensure_session();
-	$id = $_SESSION['userid'];
-	if ($id) {
-		$user = User::staticGet($id);
+
+	if (common_have_session()) {
+		$id = $_SESSION['userid'];
+		if ($id) {
+			# note: this should cache
+			$user = User::staticGet($id);
+			return $user;
+		}
 	}
+
+	# that didn't work; try to remember
+	$user = common_remembered_user();
 	return $user;
 }
 
+# Logins that are 'remembered' aren't 'real' -- they're subject to
+# cookie-stealing. So, we don't let them do certain things. New reg,
+# OpenID, and password logins _are_ real.
+
+function common_real_login($real=true) {
+	common_ensure_session();
+	$_SESSION['real_login'] = $real;
+}
+
+function common_is_real_login() {
+	return common_logged_in() && $_SESSION['real_login'];
+}
+
 # get canonical version of nickname for comparison
 function common_canonical_nickname($nickname) {
 	# XXX: UTF-8 canonicalization (like combining chars)
@@ -944,7 +1034,7 @@ function common_user_uri(&$user) {
 }
 
 function common_notice_uri(&$notice) {
-	return common_local_url('shownotice', 
+	return common_local_url('shownotice',
 		array('notice' => $notice->id));
 }