simpleid/www/user.inc.php

<?php
/*
 * SimpleID
 *
 * Copyright (C) Kelvin Mo 2007-8
 *
 * Includes code Drupal OpenID module (http://drupal.org/project/openid)
 * Rowan Kerr <rowan@standardinteractive.com>
 * James Walker <james@bryght.com>
 *
 * Copyright (C) Rowan Kerr and James Walker
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public
 * License along with this program; if not, write to the Free
 * Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
 * $Id$
 */

/**
 * User functions.
 *
 * @package simpleid
 * @filesource
 */

/**
 * The time the nonce used in the login process will last.
 */
define('SIMPLEID_LOGIN_NONCE_EXPIRES_IN', 3600);

/**
 * The time (in seconds) the auto login cookie will last.  This is currently
 * set as 2 weeks.
 */
define('SIMPLEID_USER_AUTOLOGIN_EXPIRES_IN', 1209600);

/**
 * This variable holds data on the currently logged-in user.  If the user is
 * not logged in, this variable is NULL.
 *
 * @global array $user
 */
$user = NULL;

/**
 * Initialises the user system.  Loads data for the currently logged-in user,
 * if any.
 *
 * @param string $q the SimpleID command, if any
 */
function user_init($q = NULL) {
    global $user;
    global $xtpl;

    log_debug('user_init');

    $user = NULL;

    // session_name() has to be called before session_set_cookie_params()
    session_name(simpleid_cookie_name('sess'));

    // Note the last parameter (httponly) requires PHP 5.2
    session_set_cookie_params(0, get_base_path(), ini_get('session.cookie_domain'), false, true);
    session_start();

    if (isset($_SESSION['user']) && (cache_get('user', $_SESSION['user']) == session_id())) {
        $user = user_load($_SESSION['user']);

        // If user has just been actively been authenticated in the previous request, then we
        // make it as actively authenticated in this request.
        if (isset($_SESSION['user_auth_active']) && $_SESSION['user_auth_active']) {
            $user['auth_active'] = true;
            unset($_SESSION['user_auth_active']);
        }
    } else {
        if (($q == 'login') || ($q == 'logout')) return;
        user_auto_login();
    }
}

/**
 * Attempts to automatically login using credentials presented by the user agent.
 *
 * The user agent may present various credentials as part of its request.  These
 * may include cookies and SSL client certificates.  This function calls the
 * {@link hook_user_auto_login()} hook of enabled extensions to see if any
 * of these credentials can be used to automatically login a user.
 */
function user_auto_login() {
    global $simpleid_extensions;

    $extensions = $simpleid_extensions;

    if (!in_array('user_cookieauth', $extensions)) $extensions[] = 'user_cookieauth';

    foreach ($extensions as $extension) {
        $test_user = extension_invoke($extension, 'user_auto_login');
        if ($test_user != NULL) {
            _user_login($test_user);
        }
    }
}

/**
 * Loads user data for a specified user name.
 *
 * @param string $uid the name of the user to load
 * @return mixed data for the specified user, or NULL if the user name does not
 * exist
 * @see user_load_from_identity()
 */
function user_load($uid) {
    if (store_user_exists($uid)) {
        $user = store_user_load($uid);
        $user["uid"] = $uid;

        if (isset($user["identity"])) {
            $user["local_identity"] = true;
        } else {
            $user["identity"] = simpleid_url('user/' . rawurlencode($uid));
            $user["local_identity"] = false;
        }

        return $user;
    } else {
        return NULL;
    }
}

/**
 * Loads user data for a specified OpenID Identity URI.
 *
 * @param string $identity the Identity URI of the user to load
 * @return mixed data for the specified user, or NULL if the user name does not
 * exist
 * @see user_load()
 */
function user_load_from_identity($identity) {
    $uid = store_get_uid($identity);
    if ($uid !== NULL) return user_load($uid);

    return NULL;
}

/**
 * Stores user data for a specified user name.
 *
 * @param array $user the user to save
 */
function user_save($user) {
    $uid = $user['uid'];
    store_user_save($uid, $user, array('uid', 'identity', 'pass'));
}

/**
 * Attempts to log in a user, using the user name and password specified in the
 * HTTP request.
 */
function user_login() {
    global $user, $GETPOST;

    // If the user is already logged in, return
    if (isset($user['uid'])) openid_indirect_response(simpleid_url(), '');

    // Require HTTPS or return an error
    check_https('error', true);

    $destination = (isset($GETPOST['destination'])) ? $GETPOST['destination'] : '';
    $state = (isset($GETPOST['s'])) ? $GETPOST['s'] : '';
    $fixed_uid = (isset($_POST['fixed_uid'])) ? $_POST['name'] : NULL;
    $mode = $_POST['mode'];

    $query = ($state) ? 's=' . rawurlencode($state) : '';

    if (isset($_POST['op']) && $_POST['op'] == t('Cancel')) {
        global $version;

        $request = unpickle($state);
        $version = openid_get_version($request);

        if (isset($request['openid.return_to'])) {
            $return_to = $request['openid.return_to'];
            $response = simpleid_checkid_error(FALSE);
            simpleid_assertion_response($response, $return_to);
        } else {
            indirect_fatal_error(t('Login cancelled without a proper OpenID request.'));
        }
        return;
    }

    if (!isset($_POST['mode']) || !in_array($_POST['mode'], array('credentials', 'otp'))) {
        set_message(t('SimpleID detected a potential security attack on your log in.  Please log in again.'));
        user_login_form($destination, $state, $fixed_uid);
        return;
    }

    if (!isset($_POST['nonce'])) {
        if (isset($_POST['destination'])) {
            // User came from a log in form.
            set_message(t('You seem to be attempting to log in from another web page.  You must use this page to log in.'));
        }
        user_login_form($destination, $state, $fixed_uid, $mode);
        return;
    }

    $time = strtotime(substr($_POST['nonce'], 0, 20));
    // Some old versions of PHP does not recognise the T in the ISO 8601 date.  We may need to convert the T to a space
    if (($time == -1) || ($time === FALSE)) $time = strtotime(strtr(substr($_POST['nonce'], 0, 20), 'T', ' '));
    $nonce = cache_get('user-nonce', $_POST['nonce']);

    if (!$nonce) {
        log_warn('Login attempt: Nonce ' . $_POST['nonce'] . ' not issued or is being reused.');
        set_message(t('SimpleID detected a potential security attack on your log in.  Please log in again.'));
        user_login_form($destination, $state, $fixed_uid, $mode);
        return;
    } elseif ($time < time() - SIMPLEID_LOGIN_NONCE_EXPIRES_IN) {
        log_notice('Login attempt: Nonce ' . $_POST['nonce'] . ' expired.');
        set_message(t('The log in page has expired.  Please log in again.'));
        user_login_form($destination, $state, $fixed_uid, $mode);
        return;
    } elseif ($nonce['mode'] != $mode) {
        log_warn('Login attempt: Mode saved with nonce ' . $_POST['nonce'] . ' (' . $nonce['mode'] . ') does not match ' . $mode);
        set_message(t('SimpleID detected a potential security attack on your log in.  Please log in again.'));
        user_login_form($destination, $state, $fixed_uid, $mode);
    } else {
        cache_delete('user-nonce', $_POST['nonce']);
    }

    switch ($mode) {
        case 'credentials':
            if (!isset($_POST['name'])) $_POST['name'] = '';
            if (!isset($_POST['pass'])) $_POST['pass'] = '';

            if (($_POST['name'] == '') || ($_POST['pass'] == '')) {
                if (isset($_POST['destination'])) {
                    // User came from a log in form.
                    set_message(t('You need to supply the user name and the password in order to log in.'));
                }
                if (isset($_POST['nonce'])) cache_delete('user-nonce', $_POST['nonce']);
                user_login_form($destination, $state, $fixed_uid);
                return;
            }

            if (user_verify_credentials($_POST['name'], $_POST) === false) {
                set_message(t('The user name or password is not correct.'));
                user_login_form($destination, $state, $fixed_uid);
                return;
            }

            $test_user = user_load($_POST['name']);
            if (isset($test_user['otp']) && ($test_user['otp']['type'] != 'recovery')) {
                log_info('One time password required');
                user_login_form($destination, $state, $test_user['uid'], 'otp');
                return;
            }
            break;
        case 'otp':
            if (!isset($_POST['otp']) || ($_POST['otp'] == '')) {
                set_message(t('You need to enter the verification code in order to log in.'));
                if (isset($_POST['nonce'])) cache_delete('user-nonce', $_POST['nonce']);
                user_login_form($destination, $state, $nonce['uid'], 'otp');
                return;
            }

            $test_user = user_load($nonce['uid']);

            if (user_verify_otp($test_user['otp'], $_POST['otp']) === false) {
                set_message(t('The verification code is not correct.'));
                user_login_form($destination, $state, $nonce['uid'], 'otp');
                return;
            }
            user_save($test_user); // Save the drift

            break;
    }

    _user_login($test_user, true);

    openid_indirect_response(simpleid_url($destination, $query), '');
}

/**
 * Verifies a set of credentials for a specified user.
 *
 * A set of credentials comprises:
 *
 * - A user name
 * - Some kind of verifying information, such as a plaintext password, a hashed
 *   password (e.g. digest) or some other kind of identifying information.
 *
 * The user name is passed to this function using the $uid parameter.  The user
 * name may or may not exist.  If the user name does not exist, this function
 * <strong>must</strong> return false.
 *
 * The credentials are supplied as an array using the $credentials parameter.
 * Typically this array will be a subset of the $_POST superglobal passed to the
 * {@link user_login()} function.  Thus it will generally contain the keys 'pass' and
 * 'digest'.
 *
 * This function calls the {@link hook_user_verify_credentials()} hook to
 * check whether the credentials supplied matches the credentials
 * for the specified user in the store.
 *
 * @param string $uid the name of the user to verify
 * @param array $credentials the credentials supplied by the browser
 * @return bool whether the credentials supplied matches those for the specified
 * user
 */
function user_verify_credentials($uid, $credentials) {
    global $simpleid_extensions;

    $extensions = $simpleid_extensions;

    if (!in_array('user_passauth', $extensions)) $extensions[] = 'user_passauth';

    foreach ($extensions as $extension) {
        $result = extension_invoke($extension, 'user_verify_credentials', $uid, $credentials);
        if ($result === true) {
            return true;
        }
    }

    return false;
}

/**
 * Verifies a one time password (OTP) specified by the user.
 *
 * This function compares an OTP supplied by a user with the OTP
 * calculated based on the current time and the parameters of the
 * algorithm.  The parameters, such as the secret key, are supplied
 * using in $params.  These parameters are typically stored for each
 * user in the user store.
 *
 * To allow for clocks going out of sync, the current time will be
 * by a number (in time steps) specified in $params['drift'].  If
 * the OTP supplied by the user is accepted, $params['drift'] will
 * be also be updated with the latest difference.
 *
 * To allow for network delay, the function will accepts OTPs which
 * is a number of time steps away from the OTP calculated from the
 * adjusted time.  The maximum number of time steps is specified in
 * the $max_drift parameter.
 *
 * @param array &$params the OTP parameters stored
 * @param string $code the OTP supplied by the user
 * @param int $max_drift the maximum drift allowed for network delay, in
 * time steps
 * @return bool whether the OTP supplied matches the OTP generated based on
 * the specified parameters, within the maximum drift
 */
function user_verify_otp(&$params, $code, $max_drift = 1) {
    switch ($params['type']) {
        case 'totp':
            $time = time();

            $test_code = user_totp($params['secret'], $time, $params['period'], $params['drift'], $params['algorithm'], $params['digits']);

            if ($test_code == intval($code)) return true;

            for ($i = -$max_drift; $i <= $max_drift; $i++) {
                $test_code = user_totp($params['secret'], $time, $params['period'], $params['drift'] + $i, $params['algorithm'], $params['digits']);
                if ($test_code == intval($code)) {
                    $params['drift'] = $i;
                    return true;
                }
            }
            return false;
            break;
        default:
            return false;
    }
}


/**
 * Sets the user specified by the parameter as the active user.
 *
 * @param array $login_user the user to log in
 * @param bool $auth_active whether the user has been actively authenticated
 * in this session
 *
 */
function _user_login($login_user, $auth_active = false) {
    global $user;

    if ($auth_active) {
        // Set the current authentication time
        $login_user['auth_time'] = time();
        user_save($login_user);

        // Set user has been actively authenticated this and the next request only
        $login_user['auth_active'] = true;
        $_SESSION['user_auth_active'] = true;
        log_info('Login successful: ' . $login_user['uid'] . '['. gmstrftime('%Y-%m-%dT%H:%M:%SZ', $login_user['auth_time']) . ']');

    }

    $user = $login_user;
    $_SESSION['user'] = $login_user['uid'];
    cache_set('user', $login_user['uid'], session_id());


    if ($auth_active) {
        if (isset($_POST['autologin']) && ($_POST['autologin'] == 1)) user_cookieauth_create_cookie();
    }
}

/**
 * Attempts to log out a user and returns to the login form.
 *
 * @param string $destination the destination value to be included in the
 * login form
 */
function user_logout($destination = NULL) {
    global $user, $GETPOST;

    // Require HTTPS, redirect if necessary
    check_https('redirect', true);

    $state = (isset($GETPOST['s'])) ? $GETPOST['s'] : '';
    if ($destination == NULL) {
        if (isset($GETPOST['destination'])) {
            $destination = $GETPOST['destination'];
        } else {
            $destination = '';
        }
    }

    _user_logout();

    set_message(t('You have been logged out.'));

    user_login_form($destination, $state);
}

/**
 * Logs out the user by deleting the relevant session information.
 */
function _user_logout() {
    global $user;

    $uid = $user['uid'];

    user_cookieauth_invalidate();
    session_destroy();

    cache_delete('user', $uid);
    unset($_SESSION['user']);
    $user = NULL;

    log_info('Logout successful: ' . $uid);
}

/**
 * Displays a user login or a login verification form.
 *
 * @param string $destination the SimpleID location to which the user is directed
 * if login is successful
 * @param string $state the current SimpleID state, if required by the location
 * @param string $fixed_uid the user name to be included in the login form; if NULL, the user
 * is asked to supply the user name.  If $mode is otp this cannot be null
 * @param string $mode either credentials (login form) or otp (login verification
 * form)
 */
function user_login_form($destination = '', $state = NULL, $fixed_uid = NULL, $mode = 'credentials') {
    global $xtpl;

    // Require HTTPS, redirect if necessary
    check_https('redirect', true);

    if ($state) {
        $xtpl->assign('state', htmlspecialchars($state, ENT_QUOTES, 'UTF-8'));
        $xtpl->assign('cancel_button', t('Cancel'));
        $xtpl->parse('main.login.state');
    }

    cache_expire(array('user-nonce' => SIMPLEID_LOGIN_NONCE_EXPIRES_IN));
    $nonce = openid_nonce();
    cache_set('user-nonce', $nonce, array('mode' => $mode, 'uid' => $fixed_uid));

    $base_path = get_base_path();
    $xtpl->assign('javascript', '<script src="' . $base_path . 'html/user-login.js" type="text/javascript"></script>');

    header('X-Frame-Options: DENY');

    switch ($mode) {
        case 'credentials':
            $security_class = (SIMPLEID_ALLOW_AUTOCOMPLETE) ? 'allow-autocomplete ' : '';
            if (is_https()) {
                $security_class .= 'secure';
                $xtpl->assign('security_message', t('Secure login using <strong>HTTPS</strong>.'));
            } elseif (SIMPLEID_ALLOW_PLAINTEXT) {
                $security_class .= 'unsecure';
                $xtpl->assign('security_message', t('<strong>WARNING:</strong>  Your password will be sent to SimpleID as plain text.'));
            }
            $xtpl->assign('security_class', $security_class);
            $xtpl->parse('main.login.login_security');

            extension_invoke_all('user_login_form', $destination, $state);

            $xtpl->assign('name_label', t('User name:'));
            $xtpl->assign('pass_label', t('Password:'));
            $xtpl->assign('autologin_label', t('Remember me on this computer for two weeks.'));

            if ($fixed_uid == NULL) {
                $xtpl->parse('main.login.credentials.input_uid');
            } else {
                $xtpl->assign('uid', htmlspecialchars($fixed_uid, ENT_QUOTES, 'UTF-8'));
                $xtpl->parse('main.login.credentials.fixed_uid');
            }

            $xtpl->parse('main.login.credentials');
            $xtpl->assign('submit_button', t('Log in'));
            $xtpl->assign('title', t('Log In'));
            break;
        case 'otp':
            // Note this is called from user_login(), so $_POST is always filled
            $xtpl->assign('otp_instructions_label', t('To verify your identity, enter the verification code.'));
            $xtpl->assign('otp_recovery_label', t('If you have lost your verification code, you can <a href="!url">recover your account</a>.',
                array('!url' => 'http://simpleid.org/docs/1/common-problems/#otp')
            ));

            $xtpl->assign('otp_label', t('Verification code:'));
            $xtpl->assign('autologin', (isset($_POST['autologin']) && ($_POST['autologin'] == 1)) ? '1' : '0');
            $xtpl->parse('main.login.otp');

            $xtpl->assign('submit_button', t('Verify'));
            $xtpl->assign('title', t('Enter Verification Code'));
        default:
    }


    $xtpl->assign('mode', $mode);
    $xtpl->assign('page_class', 'dialog-page');
    $xtpl->assign('destination', htmlspecialchars($destination, ENT_QUOTES, 'UTF-8'));
    $xtpl->assign('nonce', htmlspecialchars($nonce, ENT_QUOTES, 'UTF-8'));

    $xtpl->parse('main.login');
    $xtpl->parse('main.framekiller');
    $xtpl->parse('main');
    $xtpl->out('main');
}

/**
 * Displays the page used to set up login verification using one-time
 * passwords.
 */
function user_otp_page() {
    global $xtpl, $user;

    // Require HTTPS, redirect if necessary
    check_https('redirect', true);

    if ($user == NULL) {
        user_login_form('my/profile');
        return;
    }

    if ($_POST['op'] == t('Disable')) {
        if (!isset($_POST['tk']) || !validate_form_token($_POST['tk'], 'dashboard_otp')) {
            set_message(t('SimpleID detected a potential security attack.  Please try again.'));
            page_dashboard();
            return;
        }

        if (isset($user['otp'])) {
            unset($user['otp']);
            user_save($user);
        }
        set_message('Login verification has been disabled.');
        page_dashboard();
        return;
    } elseif ($_POST['op'] == t('Verify')) {
        $params = $_SESSION['otp_setup'];

        if (!isset($_POST['tk']) || !validate_form_token($_POST['tk'], 'otp')) {
            set_message(t('SimpleID detected a potential security attack.  Please try again.'));
            page_dashboard();
            return;
        } elseif (!isset($_POST['otp']) || ($_POST['otp'] == '')) {
            set_message(t('You need to enter the verification code to complete enabling login verification.'));
        } elseif (user_verify_otp($params, $_POST['otp'], 10) === false) {
            set_message(t('The verification code is not correct.'));
        } else {
            unset($_SESSION['otp_setup']);
            $user['otp'] = $params;
            user_save($user);

            set_message('Login verification has been enabled.');
            page_dashboard();
            return;
        }
    } else {
        $params = array(
            'type' => 'totp',
            'secret' => random_bytes(10),
            'algorithm' => 'sha1',
            'digits' => 6,
            'period' => 30,
            'drift' => 0,
        );
        $_SESSION['otp_setup'] = $params;
    }

    $code = strtr(bignum_val(bignum_new($params['secret'], 256), 32), '0123456789abcdefghijklmnopqrstuv', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567');
    for ($i = 0; $i < strlen($code); $i += 4) {
        $xtpl->assign('secret' . ($i + 1), substr($code, $i, 4));
    }

    $url = 'otpauth://totp/SimpleID?secret=' . $code . '&digits=' . $params['digits'] . '&period=' . $params['period'];
    $xtpl->assign('qr', addslashes($url));

    $xtpl->assign('about_otp', t('Login verification adds an extra layer of protection to your account. When enabled, you will need to enter an additional security code whenever you log into SimpleID.'));
    $xtpl->assign('otp_warning', t('<strong>WARNING:</strong> If you enable login verification and lose your authenticator app, you will need to <a href="!url">edit your identity file manually</a> before you can log in again.',
        array('!url' => 'http://simpleid.org/docs/1/common-problems/#otp')
    ));

    $xtpl->assign('setup_otp', t('To set up login verification, following these steps.'));
    $xtpl->assign('download_app', t('Download an authenticator app that supports TOTP for your smartphone, such as Google Authenticator.'));
    $xtpl->assign('add_account', t('Add your SimpleID account to authenticator app using this key.  If you are viewing this page on your smartphone you can use <a href="!url">this link</a> or scan the QR code to add your account.',
        array('!url' => $url)
    ));
    $xtpl->assign('verify_code', t('To check that your account has been added properly, enter the verification code from your phone into the box below, and click Verify.'));

    $xtpl->assign('token', get_form_token('otp'));
    $xtpl->assign('otp_label', t('Verification code:'));
    $xtpl->assign('submit_button', t('Verify'));

    $xtpl->assign('page_class', 'dialog-page');
    $xtpl->assign('title', t('Login Verification'));

    $xtpl->parse('main.otp');
    $xtpl->parse('main.framekiller');

    $xtpl->parse('main');
    $xtpl->out('main');

}


/**
 * Returns the user's public page.
 *
 * @param string $uid the user ID
 */
function user_public_page($uid = NULL) {
    global $xtpl, $user;

    $xtpl->assign('title', t('User Page'));
    if ($uid == NULL) {
        header_response_code('400 Bad Request');
        set_message(t('No user specified.'));
    } else {
        $user = user_load($uid);

        if ($user == NULL) {
            header_response_code('404 Not Found');
            set_message(t('User %uid not found.', array('%uid' => $uid)));
        } else {
            header('Vary: Accept');

            $content_type = negotiate_content_type(array('text/html', 'application/xml', 'application/xhtml+xml', 'application/xrds+xml'));

            if ($content_type == 'application/xrds+xml') {
                user_xrds($uid);
                return;
            } else {
                header('X-XRDS-Location: ' . simpleid_url('xrds/' . rawurlencode($uid)));

                set_message(t('This is the user %uid\'s SimpleID page.  It contains hidden information for the use by OpenID consumers.', array('%uid' => $uid)));

                $xtpl->assign('title', htmlspecialchars($uid, ENT_QUOTES, 'UTF-8'));
                $xtpl->assign('provider', htmlspecialchars(simpleid_url(), ENT_QUOTES, 'UTF-8'));
                $xtpl->assign('xrds', htmlspecialchars(simpleid_url('xrds/' . rawurlencode($uid)), ENT_QUOTES, 'UTF-8'));
                if ($user["local_identity"]) {
                    $xtpl->assign('local_id', htmlspecialchars($user["identity"], ENT_QUOTES, 'UTF-8'));
                }
            }
        }
    }

    $xtpl->parse('main.provider');
    if ($user["local_identity"]) $xtpl->parse('main.local_id');
    $xtpl->parse('main');
    $xtpl->out('main');
}

/**
 * Returns the public page for a private personal ID.
 *
 * @param string $ppid the PPID
 */
function user_ppid_page($ppid = NULL) {
    global $xtpl;

    header('Vary: Accept');

    $content_type = negotiate_content_type(array('text/html', 'application/xml', 'application/xhtml+xml', 'application/xrds+xml'));

    if (($content_type == 'application/xrds+xml') || ($_GET['format'] == 'xrds')) {
        header('Content-Type: application/xrds+xml');
        header('Content-Disposition: inline; filename=yadis.xml');

        $xtpl->assign('simpleid_base_url', htmlspecialchars(simpleid_url(), ENT_QUOTES, 'UTF-8'));
        $xtpl->parse('xrds.user_xrds');
        $xtpl->parse('xrds');
        $xtpl->out('xrds');
        return;
    } else {
        header('X-XRDS-Location: ' . simpleid_url('ppid/' . rawurlencode($ppid), 'format=xrds'));

        $xtpl->assign('title', t('Private Personal Identifier'));

        set_message(t('This is a private personal identifier.'));

        $xtpl->parse('main');
        $xtpl->out('main');
    }
}

/**
 * Returns the user's public XRDS page.
 *
 * @param string $uid the user ID
 */
function user_xrds($uid) {
    global $xtpl;

    $user = user_load($uid);

    if ($user != NULL) {
        header('Content-Type: application/xrds+xml');
        header('Content-Disposition: inline; filename=yadis.xml');

        if (($user != NULL) && ($user["local_identity"])) {
            $xtpl->assign('local_id', htmlspecialchars($user["identity"], ENT_QUOTES, 'UTF-8'));
            $xtpl->parse('xrds.user_xrds.local_id');
            $xtpl->parse('xrds.user_xrds.local_id2');
        }

        $xtpl->assign('simpleid_base_url', htmlspecialchars(simpleid_url(), ENT_QUOTES, 'UTF-8'));
        $xtpl->parse('xrds.user_xrds');
        $xtpl->parse('xrds');
        $xtpl->out('xrds');
    } else {
        if (substr(PHP_SAPI, 0,3) === 'cgi') {
            header('Status: 404 Not Found');
        } else {
            header($_SERVER['SERVER_PROTOCOL'] . ' 404 Not Found');
        }

        set_message('User <strong>' . htmlspecialchars($uid, ENT_QUOTES, 'UTF-8') . '</strong> not found.');
        $xtpl->parse('main');
        $xtpl->out('main');
    }
}

/**
 * Returns a block containing OpenID Connect user information.
 *
 * @return array the OpenID Connect user information block
 */
function _user_page_profile() {
    global $user;

    $html = '<p>' . t('SimpleID may, with your consent, send the following information to sites which supports OpenID Connect.') . '</p>';
    $html .= '<p>' . t('To change these, <a href="!url">edit your identity file</a>.', array('!url' => 'http://simpleid.org/docs/1/identity-files/')) . '</p>';

    $html .= "<table><tr><th>" . t('Member') . "</th><th>" . t('Value') . "</th></tr>";

    if (isset($user['user_info'])) {
        foreach ($user['user_info'] as $member => $value) {
            if (is_array($value)) {
                foreach ($value as $submember => $subvalue) {
                    $html .= "<tr><td>" . htmlspecialchars($member, ENT_QUOTES, 'UTF-8') . " (" .htmlspecialchars($submember, ENT_QUOTES, 'UTF-8') . ")</td><td>" . htmlspecialchars($subvalue, ENT_QUOTES, 'UTF-8') . "</td></tr>";
                }
            } else {
                $html .= "<tr><td>" . htmlspecialchars($member, ENT_QUOTES, 'UTF-8') . "</td><td>" . htmlspecialchars($value, ENT_QUOTES, 'UTF-8') . "</td></tr>";
            }
        }
    }

    $html .= "</table>";

    return array(array(
        'id' => 'userinfo',
        'title' => t('OpenID Connect'),
        'content' => $html
    ));
}

/**
 * Set up the user section in the header, showing the currently logged in user.
 *
 * @param string $state the SimpleID state to retain once the user has logged out,
 * if required.
 */
function user_header($state = NULL) {
    global $user;
    global $xtpl;

    if ($user != NULL) {
        $xtpl->assign('uid', htmlspecialchars($user['uid'], ENT_QUOTES, 'UTF-8'));
        $xtpl->assign('identity', htmlspecialchars($user['identity'], ENT_QUOTES, 'UTF-8'));
        if ($state != NULL) {
            $xtpl->assign('url', htmlspecialchars(simpleid_url('logout', 'destination=continue&s=' . rawurlencode($state), true)));
            $xtpl->assign('logout', t('Log out and log in as a different user'));
        } else {
            $xtpl->assign('url', htmlspecialchars(simpleid_url('logout', '', true)));
            $xtpl->assign('logout', t('Log out'));
        }
        $xtpl->parse('main.user.logout');
        $xtpl->parse('main.user');
    }
}

/**
 * Verifies a set of credentials using the default user name-password authentication
 * method.
 *
 * @param string $uid the name of the user to verify
 * @param array $credentials the credentials supplied by the browser
 * @return bool whether the credentials supplied matches those for the specified
 * user
 */
function user_passauth_user_verify_credentials($uid, $credentials) {
    $allowed_algorithms = array('md5', 'sha1');
    if (function_exists('hash_algos')) $allowed_algorithms = array_merge($allowed_algorithms, hash_algos());
    if (function_exists('hash_pbkdf2')) $allowed_algorithms[] = 'pbkdf2';

    $test_user = user_load($uid);

    if ($test_user == NULL) return false;

    $hash_function_salt = explode(':', $test_user['pass'], 3);

    $hash = $hash_function_salt[0];
    $function = (isset($hash_function_salt[1])) ? $hash_function_salt[1] : 'md5';
    if (!in_array($function, $allowed_algorithms)) $function = 'md5';
    $salt_suffix = (isset($hash_function_salt[2])) ? ':' . $hash_function_salt[2] : '';

    switch ($function) {
        case 'pbkdf2':
            list ($algo, $iterations, $salt) = explode(':', $hash_function_salt[2]);
            $length = (function_exists('hash')) ? strlen(hash($algo, '')) : 0;
            $test_hash = hash_pbkdf2($algo, $credentials['pass'], $salt, $iterations, $length);
            break;
        case 'md5':
        case 'sha1':
            $test_hash = call_user_func($function, $credentials['pass'] . $salt_suffix);
            break;
        default:
            $test_hash = hash($function, $credentials['pass'] . $salt_suffix);
    }

    return secure_compare($test_hash, $hash);
}

/**
 * Creates a auto login cookie.  The login cookie will be based on the
 * current log in user.
 *
 * @param string $id the ID of the series of auto login cookies,  Cookies
 * belonging to the same user and computer have the same ID.  If none is specified,
 * one will be generated
 * @param int $expires the time at which the cookie will expire.  If none is specified
 * the time specified in {@link SIMPLEID_USER_AUTOLOGIN_EXPIRES_IN} will be
 * used
 *
 */
function user_cookieauth_create_cookie($id = NULL, $expires = NULL) {
    global $user;

    if ($expires == NULL) {
        log_debug('Automatic login token created for ' . $user['uid']);
    } else {
        log_debug('Automatic login token renewed for ' . $user['uid']);
    }

    if ($id == NULL) $id = random_id();
    if ($expires == NULL) $expires = time() + SIMPLEID_USER_AUTOLOGIN_EXPIRES_IN;
    $token = random_secret();
    $uid_hash = get_form_token($user['uid'], FALSE);

    $data = array(
        'uid' => $user['uid'],
        'token' => $token,
        'expires' => $expires,
        'uaid' => get_user_agent_id(),
        'ip' => $_SERVER['REMOTE_ADDR']
    );

    cache_set('autologin-'. $uid_hash, $id, $data);

    // Note the last parameter (httponly) requires PHP 5.2
    setcookie(simpleid_cookie_name('auth'), 'cookieauth:' . $uid_hash . ':' . $id . ':' . $token, $expires, get_base_path(), '', false, true);
}

/**
 * Verifies a auto login cookie.  If valid, log in the user automatically.
 */
function user_cookieauth_user_auto_login() {
    if (!isset($_COOKIE[simpleid_cookie_name('auth')])) return NULL;

    $cookie = $_COOKIE[simpleid_cookie_name('auth')];

    list($authtype, $uid_hash, $id, $token) = explode(':', $cookie);
    if ($authtype != 'cookieauth') return NULL;

    log_debug('Automatic login token detected: ' . implode(':', ['cookieauth', $uid_hash, $id]));

    cache_expire(array('autologin-' . $uid_hash => SIMPLEID_USER_AUTOLOGIN_EXPIRES_IN));
    $data = cache_get('autologin-' . $uid_hash, $id);

    if (!$data) {  // Cookie doesn't exist
        log_notice('Automatic login: Token does not exist on server');
        return NULL;
    }

    if ($data['expires'] < time()) {  // Cookie expired
        log_notice('Automatic login: Token on server expired');
        return NULL;
    }

    if ($data['token'] != $token) {
        log_warn('Automatic login: Token on server does not match');
        // Token not the same - panic
        cache_expire(array('autologin-' . $uid_hash => 0));
        user_cookieauth_invalidate();
        return NULL;
    }

    if ($data['uaid'] != get_user_agent_id()) {
        log_warn('Automatic login: User agent ID does not match');
        // Token not the same - panic
        cache_expire(array('autologin-' . $uid_hash => 0));
        user_cookieauth_invalidate();
        return NULL;
    }

    // Load the user, tag it as an auto log in
    $test_user = user_load($data['uid']);

    if ($test_user != NULL) {
        log_debug('Automatic login token accepted for ' . $data['uid']);

        $test_user['autologin'] = TRUE;

        // Renew the token
        user_cookieauth_create_cookie($id, $data['expires']);

        return $test_user;
    } else {
        log_warn('Automatic login token accepted for ' . $data['uid'] . ', but no such user exists');
        return NULL;
    }
}

/**
 * Removes the auto login cookie from the user agent and the SimpleID
 * cache.
 */
function user_cookieauth_invalidate() {
    if (isset($_COOKIE[simpleid_cookie_name('auth')])) {
        $cookie = $_COOKIE[simpleid_cookie_name('auth')];

        list($uid_hash, $id, $token) = explode(':', $cookie);

        cache_delete('autologin-' . $uid_hash, $id);

        setcookie(simpleid_cookie_name('auth'), "", time() - 3600);
    }
}

/**
 * Calculates a Time-Based One-Time Password (TOTP) based on RFC 6238.
 *
 * This function returns an integer calculated from the TOTP algorithm.
 * The returned integer may need to be zero-padded to return a string
 * with the required number of digits
 *
 * @param string $secret the shared secret as a binary string
 * @param int $time the time to use in the HOTP algorithm.  If NULL, the
 * current time is used
 * @param int $period the time step in seconds
 * @param int $drift the number of time steps to be added to the time to
 * adjust for transmission delay
 * @param string $algorithm the hashing algorithm as supported by
 * the hash_hmac() function
 * @param int $digits the number of digits in the one-time password
 * @return int the one-time password
 * @link http://tools.ietf.org/html/rfc6238
 */
function user_totp($secret, $time = NULL, $period = 30, $drift = 0, $algorithm = 'sha1', $digits = 6) {
    if ($time == NULL) $time = time();
    $counter = floor($time / $period) + $drift;
    $data = pack('NN', 0, $counter);
    return user_hotp($secret, $data, $algorithm, $digits);
}

/**
 * Calculates a HMAC-Based One-Time Password (HOTP) based on RFC 4226.
 *
 * This function returns an integer calculated from the HOTP algorithm.
 * The returned integer may need to be zero-padded to return a string
 * with the required number of digits
 *
 * @param string $secret the shared secret as a binary string
 * @param string $data the counter value as a 64 bit in
 * big endian encoding
 * @param string $algorithm the hashing algorithm as supported by
 * the hash_hmac() function
 * @param int $digits the number of digits in the one-time password
 * @return int the one-time password
 * @link http://tools.ietf.org/html/rfc4226
 */
function user_hotp($secret, $data, $algorithm = 'sha1', $digits = 6) {
    // unpack produces a 1-based array, we use array_merge to convert it to 0-based
    $hmac = array_merge(unpack('C*', hash_hmac(strtolower($algorithm), $data, $secret, true)));
    $offset = $hmac[19] & 0xf;
    $code = ($hmac[$offset + 0] & 0x7F) << 24 |
        ($hmac[$offset + 1] & 0xFF) << 16 |
        ($hmac[$offset + 2] & 0xFF) << 8 |
        ($hmac[$offset + 3] & 0xFF);
    return $code % pow(10, $digits);
}


if (!function_exists('hash_pbkdf2') && function_exists('hash_hmac')) {
    function hash_pbkdf2($algo, $password, $salt, $iterations, $length = 0, $raw_output = false) {
        $result = '';
        $hLen = strlen(hash($algo, '', true));
        if ($length == 0) {
            $length = $hLen;
            if (!$raw_output) $length *= 2;
        }
        $l = ceil($length / $hLen);

        for ($i = 1; $i <= $l; $i++) {
            $U = hash_hmac($algo, $salt . pack('N', $i), $password, true);
            $T = $U;
            for ($j = 1; $j < $iterations; $j++) {
                $T ^= ($U = hash_hmac($algo, $U, $password, true));
            }
            $result .= $T;
        }

        return substr(($raw_output) ? $result : bin2hex($result), 0, $length);
    }
}


?>