No OneTemporary
Actions

Size

66 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/resources/sql/autopatches/20140515.trust-emails.sql b/resources/sql/autopatches/20140515.trust-emails.sql
	new file mode 100644
	index 0000000000..8233f73542
	--- /dev/null
	+++ b/resources/sql/autopatches/20140515.trust-emails.sql
	@@ -0,0 +1,2 @@
	+ALTER TABLE {$NAMESPACE}_auth.auth_providerconfig
	+ ADD `shouldTrustEmails` tinyint(1) NOT NULL DEFAULT 0 AFTER shouldAllowUnlink;
	diff --git a/src/applications/auth/controller/PhabricatorAuthRegisterController.php b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	index 563f256cc5..ffcb42d642 100644
	--- a/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	@@ -1,583 +1,588 @@
	<?php

	final class PhabricatorAuthRegisterController
	extends PhabricatorAuthController {

	private $accountKey;

	public function shouldRequireLogin() {
	return false;
	}

	public function willProcessRequest(array $data) {
	$this->accountKey = idx($data, 'akey');
	}

	public function processRequest() {
	$request = $this->getRequest();

	if ($request->getUser()->isLoggedIn()) {
	return $this->renderError(pht('You are already logged in.'));
	}

	$is_setup = false;
	if (strlen($this->accountKey)) {
	$result = $this->loadAccountForRegistrationOrLinking($this->accountKey);
	list($account, $provider, $response) = $result;
	$is_default = false;
	} else if ($this->isFirstTimeSetup()) {
	list($account, $provider, $response) = $this->loadSetupAccount();
	$is_default = true;
	$is_setup = true;
	} else {
	list($account, $provider, $response) = $this->loadDefaultAccount();
	$is_default = true;
	}

	if ($response) {
	return $response;
	}

	if (!$provider->shouldAllowRegistration()) {

	// TODO: This is a routine error if you click "Login" on an external
	// auth source which doesn't allow registration. The error should be
	// more tailored.

	return $this->renderError(
	pht(
	'The account you are attempting to register with uses an '.
	'authentication provider ("%s") which does not allow registration. '.
	'An administrator may have recently disabled registration with this '.
	'provider.',
	$provider->getProviderName()));
	}

	$user = new PhabricatorUser();

	$default_username = $account->getUsername();
	$default_realname = $account->getRealName();

	$default_email = $account->getEmail();
	if (!PhabricatorUserEmail::isValidAddress($default_email)) {
	$default_email = null;
	}

	if ($default_email !== null) {
	// If the account source provided an email, but it's not allowed by
	// the configuration, roadblock the user. Previously, we let the user
	// pick a valid email address instead, but this does not align well with
	// user expectation and it's not clear the cases it enables are valuable.
	// See discussion in T3472.
	if (!PhabricatorUserEmail::isAllowedAddress($default_email)) {
	return $this->renderError(
	array(
	pht(
	'The account you are attempting to register with has an invalid '.
	'email address (%s). This Phabricator install only allows '.
	'registration with specific email addresses:',
	$default_email),
	phutil_tag('br'),
	phutil_tag('br'),
	PhabricatorUserEmail::describeAllowedAddresses(),
	));
	}

	// If the account source provided an email, but another account already
	// has that email, just pretend we didn't get an email.

	// TODO: See T3340.
	// TODO: See T3472.

	if ($default_email !== null) {
	$same_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$default_email);
	if ($same_email) {
	$default_email = null;
	}
	}
	}

	$profile = id(new PhabricatorRegistrationProfile())
	->setDefaultUsername($default_username)
	->setDefaultEmail($default_email)
	->setDefaultRealName($default_realname)
	->setCanEditUsername(true)
	->setCanEditEmail(($default_email === null))
	->setCanEditRealName(true)
	->setShouldVerifyEmail(false);

	$event_type = PhabricatorEventType::TYPE_AUTH_WILLREGISTERUSER;
	$event_data = array(
	'account' => $account,
	'profile' => $profile,
	);

	$event = id(new PhabricatorEvent($event_type, $event_data))
	->setUser($user);
	PhutilEventEngine::dispatchEvent($event);

	$default_username = $profile->getDefaultUsername();
	$default_email = $profile->getDefaultEmail();
	$default_realname = $profile->getDefaultRealName();

	$can_edit_username = $profile->getCanEditUsername();
	$can_edit_email = $profile->getCanEditEmail();
	$can_edit_realname = $profile->getCanEditRealName();

	$must_set_password = $provider->shouldRequireRegistrationPassword();

	$can_edit_anything = $profile->getCanEditAnything() \|\| $must_set_password;
	$force_verify = $profile->getShouldVerifyEmail();

	// Automatically verify the administrator's email address during first-time
	// setup.
	if ($is_setup) {
	$force_verify = true;
	}

	$value_username = $default_username;
	$value_realname = $default_realname;
	$value_email = $default_email;
	$value_password = null;

	$errors = array();

	$require_real_name = PhabricatorEnv::getEnvConfig('user.require-real-name');

	$e_username = strlen($value_username) ? null : true;
	$e_realname = $require_real_name ? true : null;
	$e_email = strlen($value_email) ? null : true;
	$e_password = true;
	$e_captcha = true;

	$min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
	$min_len = (int)$min_len;

	if ($request->isFormPost() \|\| !$can_edit_anything) {
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

	if ($must_set_password) {
	$e_captcha = pht('Again');

	$captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
	if (!$captcha_ok) {
	$errors[] = pht("Captcha response is incorrect, try again.");
	$e_captcha = pht('Invalid');
	}
	}

	if ($can_edit_username) {
	$value_username = $request->getStr('username');
	if (!strlen($value_username)) {
	$e_username = pht('Required');
	$errors[] = pht('Username is required.');
	} else if (!PhabricatorUser::validateUsername($value_username)) {
	$e_username = pht('Invalid');
	$errors[] = PhabricatorUser::describeValidUsername();
	} else {
	$e_username = null;
	}
	}

	if ($must_set_password) {
	$value_password = $request->getStr('password');
	$value_confirm = $request->getStr('confirm');
	if (!strlen($value_password)) {
	$e_password = pht('Required');
	$errors[] = pht('You must choose a password.');
	} else if ($value_password !== $value_confirm) {
	$e_password = pht('No Match');
	$errors[] = pht('Password and confirmation must match.');
	} else if (strlen($value_password) < $min_len) {
	$e_password = pht('Too Short');
	$errors[] = pht(
	'Password is too short (must be at least %d characters long).',
	$min_len);
	} else if (
	PhabricatorCommonPasswords::isCommonPassword($value_password)) {

	$e_password = pht('Very Weak');
	$errors[] = pht(
	'Password is pathologically weak. This password is one of the '.
	'most common passwords in use, and is extremely easy for '.
	'attackers to guess. You must choose a stronger password.');
	} else {
	$e_password = null;
	}
	}

	if ($can_edit_email) {
	$value_email = $request->getStr('email');
	if (!strlen($value_email)) {
	$e_email = pht('Required');
	$errors[] = pht('Email is required.');
	} else if (!PhabricatorUserEmail::isValidAddress($value_email)) {
	$e_email = pht('Invalid');
	$errors[] = PhabricatorUserEmail::describeValidAddresses();
	} else if (!PhabricatorUserEmail::isAllowedAddress($value_email)) {
	$e_email = pht('Disallowed');
	$errors[] = PhabricatorUserEmail::describeAllowedAddresses();
	} else {
	$e_email = null;
	}
	}

	if ($can_edit_realname) {
	$value_realname = $request->getStr('realName');
	if (!strlen($value_realname) && $require_real_name) {
	$e_realname = pht('Required');
	$errors[] = pht('Real name is required.');
	} else {
	$e_realname = null;
	}
	}

	if (!$errors) {
	$image = $this->loadProfilePicture($account);
	if ($image) {
	$user->setProfileImagePHID($image->getPHID());
	}

	try {
	if ($force_verify) {
	$verify_email = true;
	} else {
	$verify_email =
	($account->getEmailVerified()) &&
	($value_email === $default_email);
	}

	+ if ($provider->shouldTrustEmails() &&
	+ $value_email === $default_email) {
	+ $verify_email = true;
	+ }
	+
	$email_obj = id(new PhabricatorUserEmail())
	->setAddress($value_email)
	->setIsVerified((int)$verify_email);

	$user->setUsername($value_username);
	$user->setRealname($value_realname);

	if ($is_setup) {
	$must_approve = false;
	} else {
	$must_approve = PhabricatorEnv::getEnvConfig(
	'auth.require-approval');
	}

	if ($must_approve) {
	$user->setIsApproved(0);
	} else {
	$user->setIsApproved(1);
	}

	$user->openTransaction();

	$editor = id(new PhabricatorUserEditor())
	->setActor($user);

	$editor->createNewUser($user, $email_obj);
	if ($must_set_password) {
	$envelope = new PhutilOpaqueEnvelope($value_password);
	$editor->changePassword($user, $envelope);
	}

	if ($is_setup) {
	$editor->makeAdminUser($user, true);
	}

	$account->setUserPHID($user->getPHID());
	$provider->willRegisterAccount($account);
	$account->save();

	$user->saveTransaction();

	if (!$email_obj->getIsVerified()) {
	$email_obj->sendVerificationEmail($user);
	}

	if ($must_approve) {
	$this->sendWaitingForApprovalEmail($user);
	}

	return $this->loginUser($user);
	} catch (AphrontQueryDuplicateKeyException $exception) {
	$same_username = id(new PhabricatorUser())->loadOneWhere(
	'userName = %s',
	$user->getUserName());

	$same_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$value_email);

	if ($same_username) {
	$e_username = pht('Duplicate');
	$errors[] = pht('Another user already has that username.');
	}

	if ($same_email) {
	// TODO: See T3340.
	$e_email = pht('Duplicate');
	$errors[] = pht('Another user already has that email.');
	}

	if (!$same_username && !$same_email) {
	throw $exception;
	}
	}
	}

	unset($unguarded);
	}

	$form = id(new AphrontFormView())
	->setUser($request->getUser());

	if (!$is_default) {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('External Account'))
	->setValue(
	id(new PhabricatorAuthAccountView())
	->setUser($request->getUser())
	->setExternalAccount($account)
	->setAuthProvider($provider)));
	}


	if ($can_edit_username) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Phabricator Username'))
	->setName('username')
	->setValue($value_username)
	->setError($e_username));
	} else {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('Phabricator Username'))
	->setValue($value_username)
	->setError($e_username));
	}

	if ($must_set_password) {
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Password'))
	->setName('password')
	->setError($e_password)
	->setCaption(
	$min_len
	? pht('Minimum length of %d characters.', $min_len)
	: null));
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Confirm Password'))
	->setName('confirm')
	->setError($e_password));
	}

	if ($can_edit_email) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Email'))
	->setName('email')
	->setValue($value_email)
	->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
	->setError($e_email));
	}

	if ($can_edit_realname) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Real Name'))
	->setName('realName')
	->setValue($value_realname)
	->setError($e_realname));
	}

	if ($must_set_password) {
	$form->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setLabel(pht('Captcha'))
	->setError($e_captcha));
	}

	$submit = id(new AphrontFormSubmitControl());

	if ($is_setup) {
	$submit
	->setValue(pht('Create Admin Account'));
	} else {
	$submit
	->addCancelButton($this->getApplicationURI('start/'))
	->setValue(pht('Register Phabricator Account'));
	}


	$form->appendChild($submit);

	$crumbs = $this->buildApplicationCrumbs();

	if ($is_setup) {
	$crumbs->addTextCrumb(pht('Setup Admin Account'));
	$title = pht('Welcome to Phabricator');
	} else {
	$crumbs->addTextCrumb(pht('Register'));
	$crumbs->addTextCrumb($provider->getProviderName());
	$title = pht('Phabricator Registration');
	}

	$welcome_view = null;
	if ($is_setup) {
	$welcome_view = id(new AphrontErrorView())
	->setSeverity(AphrontErrorView::SEVERITY_NOTICE)
	->setTitle(pht('Welcome to Phabricator'))
	->appendChild(
	pht(
	'Installation is complete. Register your administrator account '.
	'below to log in. You will be able to configure options and add '.
	'other authentication mechanisms (like LDAP or OAuth) later on.'));
	}

	$object_box = id(new PHUIObjectBoxView())
	->setHeaderText($title)
	->setForm($form)
	->setFormErrors($errors);

	return $this->buildApplicationPage(
	array(
	$crumbs,
	$welcome_view,
	$object_box,
	),
	array(
	'title' => $title,
	'device' => true,
	));
	}

	private function loadDefaultAccount() {
	$providers = PhabricatorAuthProvider::getAllEnabledProviders();
	$account = null;
	$provider = null;
	$response = null;

	foreach ($providers as $key => $candidate_provider) {
	if (!$candidate_provider->shouldAllowRegistration()) {
	unset($providers[$key]);
	continue;
	}
	if (!$candidate_provider->isDefaultRegistrationProvider()) {
	unset($providers[$key]);
	}
	}

	if (!$providers) {
	$response = $this->renderError(
	pht(
	"There are no configured default registration providers."));
	return array($account, $provider, $response);
	} else if (count($providers) > 1) {
	$response = $this->renderError(
	pht(
	"There are too many configured default registration providers."));
	return array($account, $provider, $response);
	}

	$provider = head($providers);
	$account = $provider->getDefaultExternalAccount();

	return array($account, $provider, $response);
	}

	private function loadSetupAccount() {
	$provider = new PhabricatorAuthProviderPassword();
	$provider->attachProviderConfig(
	id(new PhabricatorAuthProviderConfig())
	->setShouldAllowRegistration(1)
	->setShouldAllowLogin(1)
	->setIsEnabled(true));

	$account = $provider->getDefaultExternalAccount();
	$response = null;
	return array($account, $provider, $response);
	}

	private function loadProfilePicture(PhabricatorExternalAccount $account) {
	$phid = $account->getProfileImagePHID();
	if (!$phid) {
	return null;
	}

	// NOTE: Use of omnipotent user is okay here because the registering user
	// can not control the field value, and we can't use their user object to
	// do meaningful policy checks anyway since they have not registered yet.
	// Reaching this means the user holds the account secret key and the
	// registration secret key, and thus has permission to view the image.

	$file = id(new PhabricatorFileQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withPHIDs(array($phid))
	->executeOne();
	if (!$file) {
	return null;
	}

	try {
	$xformer = new PhabricatorImageTransformer();
	return $xformer->executeProfileTransform(
	$file,
	$width = 50,
	$min_height = 50,
	$max_height = 50);
	} catch (Exception $ex) {
	phlog($ex);
	return null;
	}
	}

	protected function renderError($message) {
	return $this->renderErrorPage(
	pht('Registration Failed'),
	array($message));
	}

	private function sendWaitingForApprovalEmail(PhabricatorUser $user) {
	$title = '[Phabricator] '.pht(
	'New User "%s" Awaiting Approval',
	$user->getUsername());

	$body = new PhabricatorMetaMTAMailBody();

	$body->addRawSection(
	pht(
	'Newly registered user "%s" is awaiting account approval by an '.
	'administrator.',
	$user->getUsername()));

	$body->addTextSection(
	pht('APPROVAL QUEUE'),
	PhabricatorEnv::getProductionURI(
	'/people/query/approval/'));

	$body->addTextSection(
	pht('DISABLE APPROVAL QUEUE'),
	PhabricatorEnv::getProductionURI(
	'/config/edit/auth.require-approval/'));

	$admins = id(new PhabricatorPeopleQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withIsAdmin(true)
	->execute();

	if (!$admins) {
	return;
	}

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(mpull($admins, 'getPHID'))
	->setSubject($title)
	->setBody($body->render())
	->saveAndSend();
	}

	}
	diff --git a/src/applications/auth/controller/config/PhabricatorAuthEditController.php b/src/applications/auth/controller/config/PhabricatorAuthEditController.php
	index 99be761000..846225b8ef 100644
	--- a/src/applications/auth/controller/config/PhabricatorAuthEditController.php
	+++ b/src/applications/auth/controller/config/PhabricatorAuthEditController.php
	@@ -1,319 +1,342 @@
	<?php

	final class PhabricatorAuthEditController
	extends PhabricatorAuthProviderConfigController {

	private $providerClass;
	private $configID;

	public function willProcessRequest(array $data) {
	$this->providerClass = idx($data, 'className');
	$this->configID = idx($data, 'id');
	}

	public function processRequest() {
	$request = $this->getRequest();
	$viewer = $request->getUser();

	if ($this->configID) {
	$config = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer($viewer)
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->withIDs(array($this->configID))
	->executeOne();
	if (!$config) {
	return new Aphront404Response();
	}

	$provider = $config->getProvider();
	if (!$provider) {
	return new Aphront404Response();
	}

	$is_new = false;
	} else {
	$providers = PhabricatorAuthProvider::getAllBaseProviders();
	foreach ($providers as $candidate_provider) {
	if (get_class($candidate_provider) === $this->providerClass) {
	$provider = $candidate_provider;
	break;
	}
	}

	if (!$provider) {
	return new Aphront404Response();
	}

	// TODO: When we have multi-auth providers, support them here.

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer($viewer)
	->withProviderClasses(array(get_class($provider)))
	->execute();

	if ($configs) {
	$id = head($configs)->getID();
	$dialog = id(new AphrontDialogView())
	->setUser($viewer)
	->setMethod('GET')
	->setSubmitURI($this->getApplicationURI('config/edit/'.$id.'/'))
	->setTitle(pht('Provider Already Configured'))
	->appendChild(
	pht(
	'This provider ("%s") already exists, and you can not add more '.
	'than one instance of it. You can edit the existing provider, '.
	'or you can choose a different provider.',
	$provider->getProviderName()))
	->addCancelButton($this->getApplicationURI('config/new/'))
	->addSubmitButton(pht('Edit Existing Provider'));

	return id(new AphrontDialogResponse())->setDialog($dialog);
	}

	$config = $provider->getDefaultProviderConfig();
	$provider->attachProviderConfig($config);

	$is_new = true;
	}

	$errors = array();

	$v_registration = $config->getShouldAllowRegistration();
	$v_link = $config->getShouldAllowLink();
	$v_unlink = $config->getShouldAllowUnlink();
	+ $v_trust_email = $config->getShouldTrustEmails();

	if ($request->isFormPost()) {

	$properties = $provider->readFormValuesFromRequest($request);
	list($errors, $issues, $properties) = $provider->processEditForm(
	$request,
	$properties);

	$xactions = array();

	if (!$errors) {
	if ($is_new) {
	if (!strlen($config->getProviderType())) {
	$config->setProviderType($provider->getProviderType());
	}
	if (!strlen($config->getProviderDomain())) {
	$config->setProviderDomain($provider->getProviderDomain());
	}
	}

	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION)
	->setNewValue($request->getInt('allowRegistration', 0));

	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_LINK)
	->setNewValue($request->getInt('allowLink', 0));

	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK)
	->setNewValue($request->getInt('allowUnlink', 0));

	+ $xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	+ ->setTransactionType(
	+ PhabricatorAuthProviderConfigTransaction::TYPE_TRUST_EMAILS)
	+ ->setNewValue($request->getInt('trustEmails', 0));
	+
	foreach ($properties as $key => $value) {
	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_PROPERTY)
	->setMetadataValue('auth:property', $key)
	->setNewValue($value);
	}

	if ($is_new) {
	$config->save();
	}

	$editor = id(new PhabricatorAuthProviderConfigEditor())
	->setActor($viewer)
	->setContentSourceFromRequest($request)
	->setContinueOnNoEffect(true)
	->applyTransactions($config, $xactions);


	if ($provider->hasSetupStep() && $is_new) {
	$id = $config->getID();
	$next_uri = $this->getApplicationURI('config/edit/'.$id.'/');
	} else {
	$next_uri = $this->getApplicationURI();
	}

	return id(new AphrontRedirectResponse())->setURI($next_uri);
	}
	} else {
	$properties = $provider->readFormValuesFromProvider();
	$issues = array();
	}

	if ($is_new) {
	$button = pht('Add Provider');
	$crumb = pht('Add Provider');
	$title = pht('Add Authentication Provider');
	$cancel_uri = $this->getApplicationURI('/config/new/');
	} else {
	$button = pht('Save');
	$crumb = pht('Edit Provider');
	$title = pht('Edit Authentication Provider');
	$cancel_uri = $this->getApplicationURI();
	}

	$config_name = 'auth.email-domains';
	$config_href = '/config/edit/'.$config_name.'/';

	$email_domains = PhabricatorEnv::getEnvConfig($config_name);
	if ($email_domains) {
	$registration_warning = pht(
	"Users will only be able to register with a verified email address ".
	"at one of the configured [[ %s \| %s ]] domains: %s",
	$config_href,
	$config_name,
	implode(', ', $email_domains));
	} else {
	$registration_warning = pht(
	"NOTE: Any user who can browse to this install's login page will be ".
	"able to register a Phabricator account. To restrict who can register ".
	"an account, configure [[ %s \| %s ]].",
	$config_href,
	$config_name);
	}

	$str_registration = array(
	phutil_tag('strong', array(), pht('Allow Registration:')),
	' ',
	pht(
	'Allow users to register new Phabricator accounts using this '.
	'provider. If you disable registration, users can still use this '.
	'provider to log in to existing accounts, but will not be able to '.
	'create new accounts.'),
	);

	$str_link = hsprintf(
	'<strong>%s:</strong> %s',
	pht('Allow Linking Accounts'),
	pht(
	'Allow users to link account credentials for this provider to '.
	'existing Phabricator accounts. There is normally no reason to '.
	'disable this unless you are trying to move away from a provider '.
	'and want to stop users from creating new account links.'));

	$str_unlink = hsprintf(
	'<strong>%s:</strong> %s',
	pht('Allow Unlinking Accounts'),
	pht(
	'Allow users to unlink account credentials for this provider from '.
	'existing Phabricator accounts. If you disable this, Phabricator '.
	'accounts will be permanently bound to provider accounts.'));

	+ $str_trusted_email = hsprintf(
	+ '<strong>%s:</strong> %s',
	+ pht('Trust Email Addresses'),
	+ pht(
	+ 'Phabricator will skip email verification for accounts registered '.
	+ 'through this provider.'));
	+
	$status_tag = id(new PHUITagView())
	->setType(PHUITagView::TYPE_STATE);
	if ($is_new) {
	$status_tag
	->setName(pht('New Provider'))
	->setBackgroundColor('blue');
	} else if ($config->getIsEnabled()) {
	$status_tag
	->setName(pht('Enabled'))
	->setBackgroundColor('green');
	} else {
	$status_tag
	->setName(pht('Disabled'))
	->setBackgroundColor('red');
	}

	$form = id(new AphrontFormView())
	->setUser($viewer)
	->appendChild(
	id(new AphrontFormStaticControl())
	->setLabel(pht('Provider'))
	->setValue($provider->getProviderName()))
	->appendChild(
	id(new AphrontFormStaticControl())
	->setLabel(pht('Status'))
	->setValue($status_tag))
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->setLabel(pht('Allow'))
	->addCheckbox(
	'allowRegistration',
	1,
	$str_registration,
	$v_registration))
	->appendRemarkupInstructions($registration_warning)
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->addCheckbox(
	'allowLink',
	1,
	$str_link,
	$v_link))
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->addCheckbox(
	'allowUnlink',
	1,
	$str_unlink,
	$v_unlink));

	+ if ($provider->shouldAllowEmailTrustConfiguration()) {
	+ $form->appendChild(
	+ id(new AphrontFormCheckboxControl())
	+ ->addCheckbox(
	+ 'trustEmails',
	+ 1,
	+ $str_trusted_email,
	+ $v_trust_email));
	+ }
	+
	$provider->extendEditForm($request, $form, $properties, $issues);

	$form
	->appendChild(
	id(new AphrontFormSubmitControl())
	->addCancelButton($cancel_uri)
	->setValue($button));

	$help = $provider->getConfigurationHelp();
	if ($help) {
	$form->appendChild(id(new PHUIFormDividerControl()));
	$form->appendRemarkupInstructions($help);
	}

	$footer = $provider->renderConfigurationFooter();

	$crumbs = $this->buildApplicationCrumbs();
	$crumbs->addTextCrumb($crumb);

	$xaction_view = null;
	if (!$is_new) {
	$xactions = id(new PhabricatorAuthProviderConfigTransactionQuery())
	->withObjectPHIDs(array($config->getPHID()))
	->setViewer($viewer)
	->execute();

	foreach ($xactions as $xaction) {
	$xaction->setProvider($provider);
	}

	$xaction_view = id(new PhabricatorApplicationTransactionView())
	->setUser($viewer)
	->setObjectPHID($config->getPHID())
	->setTransactions($xactions);
	}

	$form_box = id(new PHUIObjectBoxView())
	->setHeaderText($title)
	->setFormErrors($errors)
	->setForm($form);

	return $this->buildApplicationPage(
	array(
	$crumbs,
	$form_box,
	$footer,
	$xaction_view,
	),
	array(
	'title' => $title,
	'device' => true,
	));
	}

	}
	diff --git a/src/applications/auth/editor/PhabricatorAuthProviderConfigEditor.php b/src/applications/auth/editor/PhabricatorAuthProviderConfigEditor.php
	index 5088519ce5..45f2106124 100644
	--- a/src/applications/auth/editor/PhabricatorAuthProviderConfigEditor.php
	+++ b/src/applications/auth/editor/PhabricatorAuthProviderConfigEditor.php
	@@ -1,99 +1,106 @@
	<?php

	final class PhabricatorAuthProviderConfigEditor
	extends PhabricatorApplicationTransactionEditor {

	public function getTransactionTypes() {
	$types = parent::getTransactionTypes();

	$types[] = PhabricatorAuthProviderConfigTransaction::TYPE_ENABLE;
	$types[] = PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION;
	$types[] = PhabricatorAuthProviderConfigTransaction::TYPE_LINK;
	$types[] = PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK;
	+ $types[] = PhabricatorAuthProviderConfigTransaction::TYPE_TRUST_EMAILS;
	$types[] = PhabricatorAuthProviderConfigTransaction::TYPE_PROPERTY;

	return $types;
	}

	protected function getCustomTransactionOldValue(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {

	switch ($xaction->getTransactionType()) {
	case PhabricatorAuthProviderConfigTransaction::TYPE_ENABLE:
	if ($object->getIsEnabled() === null) {
	return null;
	} else {
	return (int)$object->getIsEnabled();
	}
	case PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION:
	return (int)$object->getShouldAllowRegistration();
	case PhabricatorAuthProviderConfigTransaction::TYPE_LINK:
	return (int)$object->getShouldAllowLink();
	case PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK:
	return (int)$object->getShouldAllowUnlink();
	+ case PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK:
	+ return (int)$object->getShouldTrustEmails();
	case PhabricatorAuthProviderConfigTransaction::TYPE_PROPERTY:
	$key = $xaction->getMetadataValue(
	PhabricatorAuthProviderConfigTransaction::PROPERTY_KEY);
	return $object->getProperty($key);
	}
	}

	protected function getCustomTransactionNewValue(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {

	switch ($xaction->getTransactionType()) {
	case PhabricatorAuthProviderConfigTransaction::TYPE_ENABLE:
	case PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION:
	case PhabricatorAuthProviderConfigTransaction::TYPE_LINK:
	case PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK:
	+ case PhabricatorAuthProviderConfigTransaction::TYPE_TRUST_EMAILS:
	case PhabricatorAuthProviderConfigTransaction::TYPE_PROPERTY:
	return $xaction->getNewValue();
	}
	}

	protected function applyCustomInternalTransaction(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {
	$v = $xaction->getNewValue();
	switch ($xaction->getTransactionType()) {
	case PhabricatorAuthProviderConfigTransaction::TYPE_ENABLE:
	return $object->setIsEnabled($v);
	case PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION:
	return $object->setShouldAllowRegistration($v);
	case PhabricatorAuthProviderConfigTransaction::TYPE_LINK:
	return $object->setShouldAllowLink($v);
	case PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK:
	return $object->setShouldAllowUnlink($v);
	+ case PhabricatorAuthProviderConfigTransaction::TYPE_TRUST_EMAILS:
	+ return $object->setShouldTrustEmails($v);
	case PhabricatorAuthProviderConfigTransaction::TYPE_PROPERTY:
	$key = $xaction->getMetadataValue(
	PhabricatorAuthProviderConfigTransaction::PROPERTY_KEY);
	return $object->setProperty($key, $v);
	}
	}

	protected function applyCustomExternalTransaction(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {
	return;
	}

	protected function mergeTransactions(
	PhabricatorApplicationTransaction $u,
	PhabricatorApplicationTransaction $v) {

	$type = $u->getTransactionType();
	switch ($type) {
	case PhabricatorAuthProviderConfigTransaction::TYPE_ENABLE:
	case PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION:
	case PhabricatorAuthProviderConfigTransaction::TYPE_LINK:
	case PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK:
	+ case PhabricatorAuthProviderConfigTransaction::TYPE_TRUST_EMAILS:
	// For these types, last transaction wins.
	return $v;
	}

	return parent::mergeTransactions($u, $v);
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
	index ceb06fcfa7..9b44b294f3 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
	@@ -1,478 +1,492 @@
	<?php

	abstract class PhabricatorAuthProvider {

	private $providerConfig;

	public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
	$this->providerConfig = $config;
	return $this;
	}

	public function hasProviderConfig() {
	return (bool)$this->providerConfig;
	}

	public function getProviderConfig() {
	if ($this->providerConfig === null) {
	throw new Exception(
	"Call attachProviderConfig() before getProviderConfig()!");
	}
	return $this->providerConfig;
	}

	public function getConfigurationHelp() {
	return null;
	}

	public function getDefaultProviderConfig() {
	return id(new PhabricatorAuthProviderConfig())
	->setProviderClass(get_class($this))
	->setIsEnabled(1)
	->setShouldAllowLogin(1)
	->setShouldAllowRegistration(1)
	->setShouldAllowLink(1)
	->setShouldAllowUnlink(1);
	}

	public function getNameForCreate() {
	return $this->getProviderName();
	}

	public function getDescriptionForCreate() {
	return null;
	}

	public function getProviderKey() {
	return $this->getAdapter()->getAdapterKey();
	}

	public function getProviderType() {
	return $this->getAdapter()->getAdapterType();
	}

	public function getProviderDomain() {
	return $this->getAdapter()->getAdapterDomain();
	}

	public static function getAllBaseProviders() {
	static $providers;

	if ($providers === null) {
	$objects = id(new PhutilSymbolLoader())
	->setAncestorClass(__CLASS__)
	->loadObjects();
	$providers = $objects;
	}

	return $providers;
	}

	public static function getAllProviders() {
	static $providers;

	if ($providers === null) {
	$objects = self::getAllBaseProviders();

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->execute();

	$providers = array();
	foreach ($configs as $config) {
	if (!isset($objects[$config->getProviderClass()])) {
	// This configuration is for a provider which is not installed.
	continue;
	}

	$object = clone $objects[$config->getProviderClass()];
	$object->attachProviderConfig($config);

	$key = $object->getProviderKey();
	if (isset($providers[$key])) {
	throw new Exception(
	pht(
	"Two authentication providers use the same provider key ".
	"('%s'). Each provider must be identified by a unique ".
	"key.",
	$key));
	}
	$providers[$key] = $object;
	}
	}

	return $providers;
	}

	public static function getAllEnabledProviders() {
	$providers = self::getAllProviders();
	foreach ($providers as $key => $provider) {
	if (!$provider->isEnabled()) {
	unset($providers[$key]);
	}
	}
	return $providers;
	}

	public static function getEnabledProviderByKey($provider_key) {
	return idx(self::getAllEnabledProviders(), $provider_key);
	}

	abstract public function getProviderName();
	abstract public function getAdapter();

	public function isEnabled() {
	return $this->getProviderConfig()->getIsEnabled();
	}

	public function shouldAllowLogin() {
	return $this->getProviderConfig()->getShouldAllowLogin();
	}

	public function shouldAllowRegistration() {
	return $this->getProviderConfig()->getShouldAllowRegistration();
	}

	public function shouldAllowAccountLink() {
	return $this->getProviderConfig()->getShouldAllowLink();
	}

	public function shouldAllowAccountUnlink() {
	return $this->getProviderConfig()->getShouldAllowUnlink();
	}

	+ public function shouldTrustEmails() {
	+ return $this->shouldAllowEmailTrustConfiguration() &&
	+ $this->getProviderConfig()->getShouldTrustEmails();
	+ }
	+
	+ /**
	+ * Should we allow the adapter to be marked as "trusted"
	+ * This is true for all adapters except those that allow the user to type in
	+ * emails (@see PhabricatorAuthProviderPassword)
	+ */
	+ public function shouldAllowEmailTrustConfiguration() {
	+ return true;
	+ }
	+
	public function buildLoginForm(
	PhabricatorAuthStartController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
	}

	abstract public function processLoginRequest(
	PhabricatorAuthLoginController $controller);

	public function buildLinkForm(
	PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
	}

	public function shouldAllowAccountRefresh() {
	return true;
	}

	public function buildRefreshForm(
	PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'refresh');
	}

	protected function renderLoginForm(
	AphrontRequest $request,
	$mode) {
	throw new Exception("Not implemented!");
	}

	public function createProviders() {
	return array($this);
	}

	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	return;
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	return;
	}

	protected function loadOrCreateAccount($account_id) {
	if (!strlen($account_id)) {
	throw new Exception(
	"loadOrCreateAccount(...): empty account ID!");
	}

	$adapter = $this->getAdapter();
	$adapter_class = get_class($adapter);

	if (!strlen($adapter->getAdapterType())) {
	throw new Exception(
	"AuthAdapter (of class '{$adapter_class}') has an invalid ".
	"implementation: no adapter type.");
	}

	if (!strlen($adapter->getAdapterDomain())) {
	throw new Exception(
	"AuthAdapter (of class '{$adapter_class}') has an invalid ".
	"implementation: no adapter domain.");
	}

	$account = id(new PhabricatorExternalAccount())->loadOneWhere(
	'accountType = %s AND accountDomain = %s AND accountID = %s',
	$adapter->getAdapterType(),
	$adapter->getAdapterDomain(),
	$account_id);
	if (!$account) {
	$account = id(new PhabricatorExternalAccount())
	->setAccountType($adapter->getAdapterType())
	->setAccountDomain($adapter->getAdapterDomain())
	->setAccountID($account_id);
	}

	$account->setUsername($adapter->getAccountName());
	$account->setRealName($adapter->getAccountRealName());
	$account->setEmail($adapter->getAccountEmail());
	$account->setAccountURI($adapter->getAccountURI());

	$account->setProfileImagePHID(null);
	$image_uri = $adapter->getAccountImageURI();
	if ($image_uri) {
	try {
	$name = PhabricatorSlug::normalize($this->getProviderName());
	$name = $name.'-profile.jpg';

	// TODO: If the image has not changed, we do not need to make a new
	// file entry for it, but there's no convenient way to do this with
	// PhabricatorFile right now. The storage will get shared, so the impact
	// here is negligible.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$image_file = PhabricatorFile::newFromFileDownload(
	$image_uri,
	array(
	'name' => $name,
	));
	unset($unguarded);

	if ($image_file) {
	$account->setProfileImagePHID($image_file->getPHID());
	}
	} catch (Exception $ex) {
	// Log this but proceed, it's not especially important that we
	// be able to pull profile images.
	phlog($ex);
	}
	}

	$this->willSaveAccount($account);

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$account->save();
	unset($unguarded);

	return $account;
	}

	public function getLoginURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorApplicationAuth');
	return $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
	}

	public function getSettingsURI() {
	return '/settings/panel/external/';
	}

	public function getStartURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorApplicationAuth');
	$uri = $app->getApplicationURI('/start/');
	return $uri;
	}

	public function isDefaultRegistrationProvider() {
	return false;
	}

	public function shouldRequireRegistrationPassword() {
	return false;
	}

	public function getDefaultExternalAccount() {
	throw new Exception("Not implemented!");
	}

	public function getLoginOrder() {
	return '500-'.$this->getProviderName();
	}

	protected function getLoginIcon() {
	return 'Generic';
	}

	public function isLoginFormAButton() {
	return false;
	}

	public function renderConfigPropertyTransactionTitle(
	PhabricatorAuthProviderConfigTransaction $xaction) {

	return null;
	}

	public function readFormValuesFromProvider() {
	return array();
	}

	public function readFormValuesFromRequest(AphrontRequest $request) {
	return array();
	}

	public function processEditForm(
	AphrontRequest $request,
	array $values) {

	$errors = array();
	$issues = array();

	return array($errors, $issues, $values);
	}

	public function extendEditForm(
	AphrontRequest $request,
	AphrontFormView $form,
	array $values,
	array $issues) {
	return;
	}

	public function willRenderLinkedAccount(
	PhabricatorUser $viewer,
	PHUIObjectItemView $item,
	PhabricatorExternalAccount $account) {

	$account_view = id(new PhabricatorAuthAccountView())
	->setExternalAccount($account)
	->setAuthProvider($this);

	$item->appendChild(
	phutil_tag(
	'div',
	array(
	'class' => 'mmr mml mst mmb',
	),
	$account_view));
	}


	/**
	* Return true to use a two-step configuration (setup, configure) instead of
	* the default single-step configuration. In practice, this means that
	* creating a new provider instance will redirect back to the edit page
	* instead of the provider list.
	*
	* @return bool True if this provider uses two-step configuration.
	*/
	public function hasSetupStep() {
	return false;
	}


	/**
	* Render a standard login/register button element.
	*
	* The `$attributes` parameter takes these keys:
	*
	* - `uri`: URI the button should take the user to when clicked.
	* - `method`: Optional HTTP method the button should use, defaults to GET.
	*
	* @param AphrontRequest HTTP request.
	* @param string Request mode string.
	* @param map Additional parameters, see above.
	* @return wild Login button.
	*/
	protected function renderStandardLoginButton(
	AphrontRequest $request,
	$mode,
	array $attributes = array()) {

	PhutilTypeSpec::checkMap(
	$attributes,
	array(
	'method' => 'optional string',
	'uri' => 'string',
	'sigil' => 'optional string',
	));

	$viewer = $request->getUser();
	$adapter = $this->getAdapter();

	if ($mode == 'link') {
	$button_text = pht('Link External Account');
	} else if ($mode == 'refresh') {
	$button_text = pht('Refresh Account Link');
	} else if ($this->shouldAllowRegistration()) {
	$button_text = pht('Login or Register');
	} else {
	$button_text = pht('Login');
	}

	$icon = id(new PHUIIconView())
	->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
	->setSpriteIcon($this->getLoginIcon());

	$button = id(new PHUIButtonView())
	->setSize(PHUIButtonView::BIG)
	->setColor(PHUIButtonView::GREY)
	->setIcon($icon)
	->setText($button_text)
	->setSubtext($this->getProviderName());

	$uri = $attributes['uri'];
	$uri = new PhutilURI($uri);
	$params = $uri->getQueryParams();
	$uri->setQueryParams(array());

	$content = array($button);

	foreach ($params as $key => $value) {
	$content[] = phutil_tag(
	'input',
	array(
	'type' => 'hidden',
	'name' => $key,
	'value' => $value,
	));
	}

	return phabricator_form(
	$viewer,
	array(
	'method' => idx($attributes, 'method', 'GET'),
	'action' => (string)$uri,
	'sigil' => idx($attributes, 'sigil'),
	),
	$content);
	}

	public function renderConfigurationFooter() {
	return null;
	}

	protected function getAuthCSRFCode(AphrontRequest $request) {
	$phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
	if (!strlen($phcid)) {
	throw new Exception(
	pht(
	'Your browser did not submit a "%s" cookie with client state '.
	'information in the request. Check that cookies are enabled. '.
	'If this problem persists, you may need to clear your cookies.',
	PhabricatorCookies::COOKIE_CLIENTID));
	}

	return PhabricatorHash::digest($phcid);
	}

	protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
	$expect = $this->getAuthCSRFCode($request);

	if (!strlen($actual)) {
	throw new Exception(
	pht(
	'The authentication provider did not return a client state '.
	'parameter in its response, but one was expected. If this '.
	'problem persists, you may need to clear your cookies.'));
	}

	if ($actual !== $expect) {
	throw new Exception(
	pht(
	'The authentication provider did not return the correct client '.
	'state parameter in its response. If this problem persists, you may '.
	'need to clear your cookies.'));
	}
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProviderPassword.php b/src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	index c7005e8bc6..80799ecebf 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	@@ -1,353 +1,356 @@
	<?php

	final class PhabricatorAuthProviderPassword
	extends PhabricatorAuthProvider {

	private $adapter;

	public function getProviderName() {
	return pht('Username/Password');
	}

	public function getConfigurationHelp() {
	return pht(
	"(WARNING) Examine the table below for information on how password ".
	"hashes will be stored in the database.\n\n".
	"(NOTE) You can select a minimum password length by setting ".
	"`account.minimum-password-length` in configuration.");
	}

	public function renderConfigurationFooter() {
	$hashers = PhabricatorPasswordHasher::getAllHashers();
	$hashers = msort($hashers, 'getStrength');
	$hashers = array_reverse($hashers);

	$yes = phutil_tag(
	'strong',
	array(
	'style' => 'color: #009900',
	),
	pht('Yes'));

	$no = phutil_tag(
	'strong',
	array(
	'style' => 'color: #990000',
	),
	pht('Not Installed'));

	$best_hasher_name = null;
	try {
	$best_hasher = PhabricatorPasswordHasher::getBestHasher();
	$best_hasher_name = $best_hasher->getHashName();
	} catch (PhabricatorPasswordHasherUnavailableException $ex) {
	// There are no suitable hashers. The user might be able to enable some,
	// so we don't want to fatal here. We'll fatal when users try to actually
	// use this stuff if it isn't fixed before then. Until then, we just
	// don't highlight a row. In practice, at least one hasher should always
	// be available.
	}

	$rows = array();
	$rowc = array();
	foreach ($hashers as $hasher) {
	$is_installed = $hasher->canHashPasswords();

	$rows[] = array(
	$hasher->getHumanReadableName(),
	$hasher->getHashName(),
	$hasher->getHumanReadableStrength(),
	($is_installed ? $yes : $no),
	($is_installed ? null : $hasher->getInstallInstructions()),
	);
	$rowc[] = ($best_hasher_name == $hasher->getHashName())
	? 'highlighted'
	: null;
	}

	$table = new AphrontTableView($rows);
	$table->setRowClasses($rowc);
	$table->setHeaders(
	array(
	pht('Algorithm'),
	pht('Name'),
	pht('Strength'),
	pht('Installed'),
	pht('Install Instructions'),
	));

	$table->setColumnClasses(
	array(
	'',
	'',
	'',
	'',
	'wide',
	));

	$header = id(new PHUIHeaderView())
	->setHeader(pht('Password Hash Algorithms'))
	->setSubheader(
	pht(
	'Stronger algorithms are listed first. The highlighted algorithm '.
	'will be used when storing new hashes. Older hashes will be '.
	'upgraded to the best algorithm over time.'));

	return id(new PHUIObjectBoxView())
	->setHeader($header)
	->appendChild($table);
	}

	public function getDescriptionForCreate() {
	return pht(
	'Allow users to login or register using a username and password.');
	}

	public function getAdapter() {
	if (!$this->adapter) {
	$adapter = new PhutilAuthAdapterEmpty();
	$adapter->setAdapterType('password');
	$adapter->setAdapterDomain('self');
	$this->adapter = $adapter;
	}
	return $this->adapter;
	}

	public function getLoginOrder() {
	// Make sure username/password appears first if it is enabled.
	return '100-'.$this->getProviderName();
	}

	public function shouldAllowAccountLink() {
	return false;
	}

	public function shouldAllowAccountUnlink() {
	return false;
	}

	public function isDefaultRegistrationProvider() {
	return true;
	}

	public function buildLoginForm(
	PhabricatorAuthStartController $controller) {
	$request = $controller->getRequest();
	return $this->renderPasswordLoginForm($request);
	}

	public function buildLinkForm(
	PhabricatorAuthLinkController $controller) {
	throw new Exception("Password providers can't be linked.");
	}

	private function renderPasswordLoginForm(
	AphrontRequest $request,
	$require_captcha = false,
	$captcha_valid = false) {

	$viewer = $request->getUser();

	$dialog = id(new AphrontDialogView())
	->setSubmitURI($this->getLoginURI())
	->setUser($viewer)
	->setTitle(pht('Login to Phabricator'))
	->addSubmitButton(pht('Login'));

	if ($this->shouldAllowRegistration()) {
	$dialog->addCancelButton(
	'/auth/register/',
	pht('Register New Account'));
	}

	$dialog->addFooter(
	phutil_tag(
	'a',
	array(
	'href' => '/login/email/',
	),
	pht('Forgot your password?')));

	$v_user = nonempty(
	$request->getStr('username'),
	$request->getCookie(PhabricatorCookies::COOKIE_USERNAME));

	$e_user = null;
	$e_pass = null;
	$e_captcha = null;

	$errors = array();
	if ($require_captcha && !$captcha_valid) {
	if (AphrontFormRecaptchaControl::hasCaptchaResponse($request)) {
	$e_captcha = pht('Invalid');
	$errors[] = pht('CAPTCHA was not entered correctly.');
	} else {
	$e_captcha = pht('Required');
	$errors[] = pht('Too many login failures recently. You must '.
	'submit a CAPTCHA with your login request.');
	}
	} else if ($request->isHTTPPost()) {
	// NOTE: This is intentionally vague so as not to disclose whether a
	// given username or email is registered.
	$e_user = pht('Invalid');
	$e_pass = pht('Invalid');
	$errors[] = pht('Username or password are incorrect.');
	}

	if ($errors) {
	$errors = id(new AphrontErrorView())->setErrors($errors);
	}

	$form = id(new PHUIFormLayoutView())
	->setFullWidth(true)
	->appendChild($errors)
	->appendChild(
	id(new AphrontFormTextControl())
	->setLabel('Username or Email')
	->setName('username')
	->setValue($v_user)
	->setError($e_user))
	->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel('Password')
	->setName('password')
	->setError($e_pass));

	if ($require_captcha) {
	$form->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setError($e_captcha));
	}

	$dialog->appendChild($form);

	return $dialog;
	}

	public function processLoginRequest(
	PhabricatorAuthLoginController $controller) {

	$request = $controller->getRequest();
	$viewer = $request->getUser();

	$require_captcha = false;
	$captcha_valid = false;
	if (AphrontFormRecaptchaControl::isRecaptchaEnabled()) {
	$failed_attempts = PhabricatorUserLog::loadRecentEventsFromThisIP(
	PhabricatorUserLog::ACTION_LOGIN_FAILURE,
	60 * 15);
	if (count($failed_attempts) > 5) {
	$require_captcha = true;
	$captcha_valid = AphrontFormRecaptchaControl::processCaptcha($request);
	}
	}

	$response = null;
	$account = null;
	$log_user = null;

	if ($request->isFormPost()) {
	if (!$require_captcha \|\| $captcha_valid) {
	$username_or_email = $request->getStr('username');
	if (strlen($username_or_email)) {
	$user = id(new PhabricatorUser())->loadOneWhere(
	'username = %s',
	$username_or_email);

	if (!$user) {
	$user = PhabricatorUser::loadOneWithEmailAddress(
	$username_or_email);
	}

	if ($user) {
	$envelope = new PhutilOpaqueEnvelope($request->getStr('password'));
	if ($user->comparePassword($envelope)) {
	$account = $this->loadOrCreateAccount($user->getPHID());
	$log_user = $user;

	// If the user's password is stored using a less-than-optimal
	// hash, upgrade them to the strongest available hash.

	$hash_envelope = new PhutilOpaqueEnvelope(
	$user->getPasswordHash());
	if (PhabricatorPasswordHasher::canUpgradeHash($hash_envelope)) {
	$user->setPassword($envelope);

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$user->save();
	unset($unguarded);
	}
	}
	}
	}
	}
	}

	if (!$account) {
	if ($request->isFormPost()) {
	$log = PhabricatorUserLog::initializeNewLog(
	null,
	$log_user ? $log_user->getPHID() : null,
	PhabricatorUserLog::ACTION_LOGIN_FAILURE);
	$log->save();
	}

	$request->clearCookie(PhabricatorCookies::COOKIE_USERNAME);

	$response = $controller->buildProviderPageResponse(
	$this,
	$this->renderPasswordLoginForm(
	$request,
	$require_captcha,
	$captcha_valid));
	}

	return array($account, $response);
	}

	public function shouldRequireRegistrationPassword() {
	return true;
	}

	public function getDefaultExternalAccount() {
	$adapter = $this->getAdapter();

	return id(new PhabricatorExternalAccount())
	->setAccountType($adapter->getAdapterType())
	->setAccountDomain($adapter->getAdapterDomain());
	}

	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	parent::willSaveAccount($account);
	$account->setUserPHID($account->getAccountID());
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	parent::willRegisterAccount($account);
	$account->setAccountID($account->getUserPHID());
	}

	public static function getPasswordProvider() {
	$providers = self::getAllEnabledProviders();

	foreach ($providers as $provider) {
	if ($provider instanceof PhabricatorAuthProviderPassword) {
	return $provider;
	}
	}

	return null;
	}

	public function willRenderLinkedAccount(
	PhabricatorUser $viewer,
	PHUIObjectItemView $item,
	PhabricatorExternalAccount $account) {
	return;
	}

	public function shouldAllowAccountRefresh() {
	return false;
	}

	+ public function shouldAllowEmailTrustConfiguration() {
	+ return false;
	+ }
	}
	diff --git a/src/applications/auth/storage/PhabricatorAuthProviderConfig.php b/src/applications/auth/storage/PhabricatorAuthProviderConfig.php
	index 4678e2b170..a5ecffd58d 100644
	--- a/src/applications/auth/storage/PhabricatorAuthProviderConfig.php
	+++ b/src/applications/auth/storage/PhabricatorAuthProviderConfig.php
	@@ -1,88 +1,89 @@
	<?php

	final class PhabricatorAuthProviderConfig extends PhabricatorAuthDAO
	implements PhabricatorPolicyInterface {

	protected $providerClass;
	protected $providerType;
	protected $providerDomain;

	protected $isEnabled;
	protected $shouldAllowLogin = 0;
	protected $shouldAllowRegistration = 0;
	protected $shouldAllowLink = 0;
	protected $shouldAllowUnlink = 0;
	+ protected $shouldTrustEmails = 0;

	protected $properties = array();

	private $provider;

	public function generatePHID() {
	return PhabricatorPHID::generateNewPHID(
	PhabricatorPHIDConstants::PHID_TYPE_AUTH);
	}

	public function getConfiguration() {
	return array(
	self::CONFIG_AUX_PHID => true,
	self::CONFIG_SERIALIZATION => array(
	'properties' => self::SERIALIZATION_JSON,
	),
	) + parent::getConfiguration();
	}

	public function getProperty($key, $default = null) {
	return idx($this->properties, $key, $default);
	}

	public function setProperty($key, $value) {
	$this->properties[$key] = $value;
	return $this;
	}

	public function getProvider() {
	if (!$this->provider) {
	$base = PhabricatorAuthProvider::getAllBaseProviders();
	$found = null;
	foreach ($base as $provider) {
	if (get_class($provider) == $this->providerClass) {
	$found = $provider;
	break;
	}
	}
	if ($found) {
	$this->provider = id(clone $found)->attachProviderConfig($this);
	}
	}
	return $this->provider;
	}


	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	);
	}

	public function getPolicy($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_VIEW:
	return PhabricatorPolicies::POLICY_USER;
	case PhabricatorPolicyCapability::CAN_EDIT:
	return PhabricatorPolicies::POLICY_ADMIN;
	}
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	return false;
	}

	public function describeAutomaticCapability($capability) {
	return null;
	}

	}
	diff --git a/src/applications/auth/storage/PhabricatorAuthProviderConfigTransaction.php b/src/applications/auth/storage/PhabricatorAuthProviderConfigTransaction.php
	index bb02531e1c..f9cf6879d4 100644
	--- a/src/applications/auth/storage/PhabricatorAuthProviderConfigTransaction.php
	+++ b/src/applications/auth/storage/PhabricatorAuthProviderConfigTransaction.php
	@@ -1,142 +1,154 @@
	<?php

	final class PhabricatorAuthProviderConfigTransaction
	extends PhabricatorApplicationTransaction {

	const TYPE_ENABLE = 'config:enable';
	const TYPE_REGISTRATION = 'config:registration';
	const TYPE_LINK = 'config:link';
	const TYPE_UNLINK = 'config:unlink';
	+ const TYPE_TRUST_EMAILS = "config:trustEmails";
	const TYPE_PROPERTY = 'config:property';

	const PROPERTY_KEY = 'auth:property';

	private $provider;

	public function setProvider(PhabricatorAuthProvider $provider) {
	$this->provider = $provider;
	return $this;
	}

	public function getProvider() {
	return $this->provider;
	}

	public function getApplicationName() {
	return 'auth';
	}

	public function getApplicationTransactionType() {
	return PhabricatorPHIDConstants::PHID_TYPE_AUTH;
	}

	public function getApplicationTransactionCommentObject() {
	return null;
	}

	public function getIcon() {
	$old = $this->getOldValue();
	$new = $this->getNewValue();

	switch ($this->getTransactionType()) {
	case self::TYPE_ENABLE:
	if ($new) {
	return 'fa-play';
	} else {
	return 'fa-pause';
	}
	}

	return parent::getIcon();
	}

	public function getColor() {
	$old = $this->getOldValue();
	$new = $this->getNewValue();

	switch ($this->getTransactionType()) {
	case self::TYPE_ENABLE:
	if ($new) {
	return 'green';
	} else {
	return 'red';
	}
	}

	return parent::getColor();
	}

	public function getTitle() {
	$author_phid = $this->getAuthorPHID();

	$old = $this->getOldValue();
	$new = $this->getNewValue();

	switch ($this->getTransactionType()) {
	case self::TYPE_ENABLE:
	if ($old === null) {
	return pht(
	'%s created this provider.',
	$this->renderHandleLink($author_phid));
	} else if ($new) {
	return pht(
	'%s enabled this provider.',
	$this->renderHandleLink($author_phid));
	} else {
	return pht(
	'%s disabled this provider.',
	$this->renderHandleLink($author_phid));
	}
	break;
	case self::TYPE_REGISTRATION:
	if ($new) {
	return pht(
	'%s enabled registration.',
	$this->renderHandleLink($author_phid));
	} else {
	return pht(
	'%s disabled registration.',
	$this->renderHandleLink($author_phid));
	}
	break;
	case self::TYPE_LINK:
	if ($new) {
	return pht(
	'%s enabled accont linking.',
	$this->renderHandleLink($author_phid));
	} else {
	return pht(
	'%s disabled account linking.',
	$this->renderHandleLink($author_phid));
	}
	break;
	case self::TYPE_UNLINK:
	if ($new) {
	return pht(
	'%s enabled account unlinking.',
	$this->renderHandleLink($author_phid));
	} else {
	return pht(
	'%s disabled account unlinking.',
	$this->renderHandleLink($author_phid));
	}
	break;
	+ case self::TYPE_TRUST_EMAILS:
	+ if ($new) {
	+ return pht(
	+ '%s enabled email trust.',
	+ $this->renderHandleLink($author_phid));
	+ } else {
	+ return pht(
	+ '%s disabled email trust.',
	+ $this->renderHandleLink($author_phid));
	+ }
	+ break;
	case self::TYPE_PROPERTY:
	$provider = $this->getProvider();
	if ($provider) {
	$title = $provider->renderConfigPropertyTransactionTitle($this);
	if (strlen($title)) {
	return $title;
	}
	}

	return pht(
	'%s edited a property of this provider.',
	$this->renderHandleLink($author_phid));
	break;
	}

	return parent::getTitle();
	}

	}

File Metadata

Mime Type: text/x-diff
Expires: Sun, Sep 7, 9:26 AM (1 d, 15 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 222909
Default Alt Text: (66 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions