Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- Introduce /email code

Browse Source 
- Add max tries for /email code
- Introduce a PasswordRecoveryService
This commit is contained in:
EbonJaguar
2017-03-06 13:54:46 -05:00
parent a64f758ee9
commit 7d4bfcd99d
40 changed files with 529 additions and 240 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/fr/xephi/authme/command/executable/email/ProcessCodeCommand.java
+57
View File
@@ -0,0 +1,57 @@
package fr.xephi.authme.command.executable.email;
import fr.xephi.authme.command.PlayerCommand;
import fr.xephi.authme.data.auth.PlayerAuth;
import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.message.MessageKey;
import fr.xephi.authme.service.CommonService;
import fr.xephi.authme.service.PasswordRecoveryService;
import fr.xephi.authme.service.RecoveryCodeService;
import org.bukkit.entity.Player;
import javax.inject.Inject;
import java.util.List;
/**
* Command for submitting email recovery code.
*/
public class ProcessCodeCommand extends PlayerCommand {
@Inject
private CommonService commonService;
@Inject
private DataSource dataSource;
@Inject
private RecoveryCodeService codeService;
@Inject
private PasswordRecoveryService recoveryService;
@Override
protected void runCommand(Player player, List<String> arguments) {
String name = player.getName();
String code = arguments.get(0);
if (codeService.hasTriesLeft(name)) {
if (codeService.isCodeValid(name, code)) {
PlayerAuth auth = dataSource.getAuth(name);
String email = auth.getEmail();
if (email == null || "your@email.com".equalsIgnoreCase(email)) {
commonService.send(player, MessageKey.INVALID_EMAIL);
return;
}
recoveryService.generateAndSendNewPassword(player, email);
codeService.removeCode(name);
} else {
commonService.send(player, MessageKey.INCORRECT_RECOVERY_CODE,
Integer.toString(codeService.getTriesLeft(name)));
}
} else {
codeService.removeCode(name);
commonService.send(player, MessageKey.RECOVERY_TRIES_EXCEEDED);
}
}
}
src/main/java/fr/xephi/authme/command/executable/email/RecoverEmailCommand.java
+6 -92
View File
@@ -5,34 +5,20 @@ import fr.xephi.authme.command.PlayerCommand;
import fr.xephi.authme.data.auth.PlayerAuth;
import fr.xephi.authme.data.auth.PlayerCache;
import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.initialization.Reloadable;
import fr.xephi.authme.mail.EmailService;
import fr.xephi.authme.message.MessageKey;
import fr.xephi.authme.message.Messages;
import fr.xephi.authme.security.PasswordSecurity;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.service.CommonService;
import fr.xephi.authme.service.PasswordRecoveryService;
import fr.xephi.authme.service.RecoveryCodeService;
import fr.xephi.authme.settings.properties.SecuritySettings;
import fr.xephi.authme.util.RandomStringUtils;
import fr.xephi.authme.util.expiring.Duration;
import fr.xephi.authme.util.expiring.ExpiringSet;
import org.bukkit.entity.Player;
import javax.annotation.PostConstruct;
import javax.inject.Inject;
import java.util.List;
import java.util.concurrent.TimeUnit;
import static fr.xephi.authme.settings.properties.EmailSettings.RECOVERY_PASSWORD_LENGTH;
/**
* Command for password recovery by email.
*/
public class RecoverEmailCommand extends PlayerCommand implements Reloadable {
@Inject
private PasswordSecurity passwordSecurity;
public class RecoverEmailCommand extends PlayerCommand {
@Inject
private CommonService commonService;
@@ -47,18 +33,10 @@ public class RecoverEmailCommand extends PlayerCommand implements Reloadable {
private EmailService emailService;
@Inject
private RecoveryCodeService recoveryCodeService;
private PasswordRecoveryService recoveryService;
@Inject
private Messages messages;
private ExpiringSet<String> emailCooldown;
@PostConstruct
private void initEmailCooldownSet() {
emailCooldown = new ExpiringSet<>(
commonService.getProperty(SecuritySettings.EMAIL_RECOVERY_COOLDOWN_SECONDS), TimeUnit.SECONDS);
}
private RecoveryCodeService recoveryCodeService;
@Override
protected void runCommand(Player player, List<String> arguments) {
@@ -89,73 +67,9 @@ public class RecoverEmailCommand extends PlayerCommand implements Reloadable {
if (recoveryCodeService.isRecoveryCodeNeeded()) {
// Process /email recovery addr@example.com
if (arguments.size() == 1) {
createAndSendRecoveryCode(player, email);
} else {
// Process /email recovery addr@example.com 12394
processRecoveryCode(player, arguments.get(1), email);
}
recoveryService.createAndSendRecoveryCode(player, email);
} else {
boolean maySendMail = checkEmailCooldown(player);
if (maySendMail) {
generateAndSendNewPassword(player, email);
}
recoveryService.generateAndSendNewPassword(player, email);
}
}
@Override
public void reload() {
emailCooldown.setExpiration(
commonService.getProperty(SecuritySettings.EMAIL_RECOVERY_COOLDOWN_SECONDS), TimeUnit.SECONDS);
}
private void createAndSendRecoveryCode(Player player, String email) {
if (!checkEmailCooldown(player)) {
return;
}
String recoveryCode = recoveryCodeService.generateCode(player.getName());
boolean couldSendMail = emailService.sendRecoveryCode(player.getName(), email, recoveryCode);
if (couldSendMail) {
commonService.send(player, MessageKey.RECOVERY_CODE_SENT);
emailCooldown.add(player.getName().toLowerCase());
} else {
commonService.send(player, MessageKey.EMAIL_SEND_FAILURE);
}
}
private void processRecoveryCode(Player player, String code, String email) {
final String name = player.getName();
if (recoveryCodeService.isCodeValid(name, code)) {
generateAndSendNewPassword(player, email);
recoveryCodeService.removeCode(name);
} else {
commonService.send(player, MessageKey.INCORRECT_RECOVERY_CODE);
}
}
private void generateAndSendNewPassword(Player player, String email) {
String name = player.getName();
String thePass = RandomStringUtils.generate(commonService.getProperty(RECOVERY_PASSWORD_LENGTH));
HashedPassword hashNew = passwordSecurity.computeHash(thePass, name);
dataSource.updatePassword(name, hashNew);
boolean couldSendMail = emailService.sendPasswordMail(name, email, thePass);
if (couldSendMail) {
commonService.send(player, MessageKey.RECOVERY_EMAIL_SENT_MESSAGE);
emailCooldown.add(player.getName().toLowerCase());
} else {
commonService.send(player, MessageKey.EMAIL_SEND_FAILURE);
}
}
private boolean checkEmailCooldown(Player player) {
Duration waitDuration = emailCooldown.getExpiration(player.getName().toLowerCase());
if (waitDuration.getDuration() > 0) {
String durationText = messages.formatDuration(waitDuration);
messages.send(player, MessageKey.EMAIL_COOLDOWN_ERROR, durationText);
return false;
}
return true;
}
}
src/main/java/fr/xephi/authme/message/MessageKey.java
+5 -2
View File
@@ -224,8 +224,11 @@ public enum MessageKey {
/** A recovery code to reset your password has been sent to your email. */
RECOVERY_CODE_SENT("recovery_code_sent"),
/** The recovery code is not correct! Use "/email recovery [email]" to generate a new one */
INCORRECT_RECOVERY_CODE("recovery_code_incorrect"),
/** The recovery code is not correct! You have %count tries remaining. */
INCORRECT_RECOVERY_CODE("recovery_code_incorrect", "%count"),
/** You have exceeded the maximum number of attempts to enter the recovery code. Use "/email recovery [email]" to generate a new one. */
RECOVERY_TRIES_EXCEEDED("recovery_tries_exceeded"),
/** An email was already sent recently. You must wait %time before you can send a new one. */
EMAIL_COOLDOWN_ERROR("email_cooldown_error", "%time"),
src/main/java/fr/xephi/authme/service/PasswordRecoveryService.java
+125
View File
@@ -0,0 +1,125 @@
package fr.xephi.authme.service;
import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.initialization.Reloadable;
import fr.xephi.authme.mail.EmailService;
import fr.xephi.authme.message.MessageKey;
import fr.xephi.authme.message.Messages;
import fr.xephi.authme.security.PasswordSecurity;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.settings.properties.SecuritySettings;
import fr.xephi.authme.util.RandomStringUtils;
import fr.xephi.authme.util.expiring.Duration;
import fr.xephi.authme.util.expiring.ExpiringSet;
import org.bukkit.entity.Player;
import javax.annotation.PostConstruct;
import javax.inject.Inject;
import java.util.concurrent.TimeUnit;
import static fr.xephi.authme.settings.properties.EmailSettings.RECOVERY_PASSWORD_LENGTH;
/**
* Manager for password recovery.
*/
public class PasswordRecoveryService implements Reloadable {
@Inject
private CommonService commonService;
@Inject
private RecoveryCodeService codeService;
@Inject
private DataSource dataSource;
@Inject
private EmailService emailService;
@Inject
private PasswordSecurity passwordSecurity;
@Inject
private RecoveryCodeService recoveryCodeService;
@Inject
private Messages messages;
private ExpiringSet<String> emailCooldown;
@PostConstruct
private void initEmailCooldownSet() {
emailCooldown = new ExpiringSet<>(
commonService.getProperty(SecuritySettings.EMAIL_RECOVERY_COOLDOWN_SECONDS), TimeUnit.SECONDS);
}
/**
* Create a new recovery code and send it to the player
* via email.
*
* @param player The player getting the code.
* @param email The email to send the code to.
*/
public void createAndSendRecoveryCode(Player player, String email) {
if (!checkEmailCooldown(player)) {
return;
}
String recoveryCode = recoveryCodeService.generateCode(player.getName());
boolean couldSendMail = emailService.sendRecoveryCode(player.getName(), email, recoveryCode);
if (couldSendMail) {
commonService.send(player, MessageKey.RECOVERY_CODE_SENT);
emailCooldown.add(player.getName().toLowerCase());
} else {
commonService.send(player, MessageKey.EMAIL_SEND_FAILURE);
}
}
/**
* Generate a new password and send it to the player via
* email. This will update the database with the new password.
*
* @param player The player recovering their password.
* @param email The email to send the password to.
*/
public void generateAndSendNewPassword(Player player, String email) {
if (!checkEmailCooldown(player)) {
return;
}
String name = player.getName();
String thePass = RandomStringUtils.generate(commonService.getProperty(RECOVERY_PASSWORD_LENGTH));
HashedPassword hashNew = passwordSecurity.computeHash(thePass, name);
dataSource.updatePassword(name, hashNew);
boolean couldSendMail = emailService.sendPasswordMail(name, email, thePass);
if (couldSendMail) {
commonService.send(player, MessageKey.RECOVERY_EMAIL_SENT_MESSAGE);
emailCooldown.add(player.getName().toLowerCase());
} else {
commonService.send(player, MessageKey.EMAIL_SEND_FAILURE);
}
}
/**
* Check if a player is able to have emails sent.
*
* @param player The player to check.
* @return True if the player is not on cooldown.
*/
public boolean checkEmailCooldown(Player player) {
Duration waitDuration = emailCooldown.getExpiration(player.getName().toLowerCase());
if (waitDuration.getDuration() > 0) {
String durationText = messages.formatDuration(waitDuration);
messages.send(player, MessageKey.EMAIL_COOLDOWN_ERROR, durationText);
return false;
}
return true;
}
@Override
public void reload() {
emailCooldown.setExpiration(
commonService.getProperty(SecuritySettings.EMAIL_RECOVERY_COOLDOWN_SECONDS), TimeUnit.SECONDS);
}
}
src/main/java/fr/xephi/authme/service/RecoveryCodeService.java
+32 -3
View File
@@ -6,26 +6,29 @@ import fr.xephi.authme.settings.Settings;
import fr.xephi.authme.settings.properties.SecuritySettings;
import fr.xephi.authme.util.RandomStringUtils;
import fr.xephi.authme.util.expiring.ExpiringMap;
import fr.xephi.authme.util.expiring.TimedCounter;
import javax.inject.Inject;
import java.util.concurrent.TimeUnit;
import static fr.xephi.authme.settings.properties.SecuritySettings.RECOVERY_CODE_HOURS_VALID;
/**
* Manager for recovery codes.
*/
public class RecoveryCodeService implements SettingsDependent, HasCleanup {
private final ExpiringMap<String, String> recoveryCodes;
private final TimedCounter<String> playerTries;
private int recoveryCodeLength;
private int recoveryCodeExpiration;
private int recoveryCodeMaxTries;
@Inject
RecoveryCodeService(Settings settings) {
recoveryCodeLength = settings.getProperty(SecuritySettings.RECOVERY_CODE_LENGTH);
recoveryCodeExpiration = settings.getProperty(SecuritySettings.RECOVERY_CODE_HOURS_VALID);
recoveryCodeMaxTries = settings.getProperty(SecuritySettings.RECOVERY_CODE_MAX_TRIES);
recoveryCodes = new ExpiringMap<>(recoveryCodeExpiration, TimeUnit.HOURS);
playerTries = new TimedCounter<>(recoveryCodeExpiration, TimeUnit.HOURS);
}
/**
@@ -43,6 +46,8 @@ public class RecoveryCodeService implements SettingsDependent, HasCleanup {
*/
public String generateCode(String player) {
String code = RandomStringUtils.generateHex(recoveryCodeLength);
playerTries.put(player, recoveryCodeMaxTries);
recoveryCodes.put(player, code);
return code;
}
@@ -56,9 +61,30 @@ public class RecoveryCodeService implements SettingsDependent, HasCleanup {
*/
public boolean isCodeValid(String player, String code) {
String storedCode = recoveryCodes.get(player);
playerTries.decrement(player);
return storedCode != null && storedCode.equals(code);
}
/**
* Checks whether a player has tries remaining to enter a code.
*
* @param player The player to check for.
* @return True if the player has tries left.
*/
public boolean hasTriesLeft(String player) {
return playerTries.get(player) > 0;
}
/**
* Get the number of attempts a player has to enter a code.
*
* @param player The player to check for.
* @return The number of tries left.
*/
public int getTriesLeft(String player) {
return playerTries.get(player);
}
/**
* Removes the player's recovery code if present.
*
@@ -66,17 +92,20 @@ public class RecoveryCodeService implements SettingsDependent, HasCleanup {
*/
public void removeCode(String player) {
recoveryCodes.remove(player);
playerTries.remove(player);
}
@Override
public void reload(Settings settings) {
recoveryCodeLength = settings.getProperty(SecuritySettings.RECOVERY_CODE_LENGTH);
recoveryCodeExpiration = settings.getProperty(RECOVERY_CODE_HOURS_VALID);
recoveryCodeExpiration = settings.getProperty(SecuritySettings.RECOVERY_CODE_HOURS_VALID);
recoveryCodeMaxTries = settings.getProperty(SecuritySettings.RECOVERY_CODE_MAX_TRIES);
recoveryCodes.setExpiration(recoveryCodeExpiration, TimeUnit.HOURS);
}
@Override
public void performCleanup() {
recoveryCodes.removeExpiredEntries();
playerTries.removeExpiredEntries();
}
}
src/main/java/fr/xephi/authme/settings/properties/SecuritySettings.java
+4
View File
@@ -114,6 +114,10 @@ public class SecuritySettings implements SettingsHolder {
public static final Property<Integer> RECOVERY_CODE_HOURS_VALID =
newProperty("Security.recoveryCode.validForHours", 4);
@Comment("Max number of tries to enter recovery code")
public static final Property<Integer> RECOVERY_CODE_MAX_TRIES =
newProperty("Security.recoveryCode.maxTries", 3);
@Comment({
"Seconds a user has to wait for before a password recovery mail may be sent again",
"This prevents an attacker from abusing AuthMe's email feature."
src/main/java/fr/xephi/authme/util/expiring/TimedCounter.java
+15
View File
@@ -35,6 +35,21 @@ public class TimedCounter<K> extends ExpiringMap<K, Integer> {
put(key, get(key) + 1);
}
/**
* Decrements the value stored for the provided key.
* This method will NOT update the expiration.
*
* @param key the key to increment the counter for
*/
public void decrement(K key) {
ExpiringEntry<Integer> e = entries.get(key);
if (e != null) {
if (e.getValue() <= 0) { remove(key); }
else {entries.put(key, new ExpiringEntry<>(e.getValue() - 1, e.getExpiration())); }
}
}
/**
* Calculates the total of all non-expired entries in this counter.
*