| | | 1 | | using System; |
| | | 2 | | using System.Collections.Generic; |
| | | 3 | | using System.Globalization; |
| | | 4 | | using System.IO; |
| | | 5 | | using System.Security.Cryptography; |
| | | 6 | | using System.Text.Json; |
| | | 7 | | using System.Threading.Tasks; |
| | | 8 | | using Jellyfin.Database.Implementations.Entities; |
| | | 9 | | using MediaBrowser.Common; |
| | | 10 | | using MediaBrowser.Common.Extensions; |
| | | 11 | | using MediaBrowser.Controller.Authentication; |
| | | 12 | | using MediaBrowser.Controller.Configuration; |
| | | 13 | | using MediaBrowser.Controller.Library; |
| | | 14 | | using MediaBrowser.Model.IO; |
| | | 15 | | using MediaBrowser.Model.Users; |
| | | 16 | | |
| | | 17 | | namespace Jellyfin.Server.Implementations.Users |
| | | 18 | | { |
| | | 19 | | /// <summary> |
| | | 20 | | /// The default password reset provider. |
| | | 21 | | /// </summary> |
| | | 22 | | public class DefaultPasswordResetProvider : IPasswordResetProvider |
| | | 23 | | { |
| | | 24 | | private const string BaseResetFileName = "passwordreset"; |
| | | 25 | | |
| | | 26 | | private readonly IApplicationHost _appHost; |
| | | 27 | | |
| | | 28 | | private readonly string _passwordResetFileBase; |
| | | 29 | | private readonly string _passwordResetFileBaseDir; |
| | | 30 | | |
| | | 31 | | /// <summary> |
| | | 32 | | /// Initializes a new instance of the <see cref="DefaultPasswordResetProvider"/> class. |
| | | 33 | | /// </summary> |
| | | 34 | | /// <param name="configurationManager">The configuration manager.</param> |
| | | 35 | | /// <param name="appHost">The application host.</param> |
| | | 36 | | public DefaultPasswordResetProvider(IServerConfigurationManager configurationManager, IApplicationHost appHost) |
| | | 37 | | { |
| | 21 | 38 | | _passwordResetFileBaseDir = configurationManager.ApplicationPaths.ProgramDataPath; |
| | 21 | 39 | | _passwordResetFileBase = Path.Combine(_passwordResetFileBaseDir, BaseResetFileName); |
| | 21 | 40 | | _appHost = appHost; |
| | | 41 | | // TODO: Remove the circular dependency on UserManager |
| | 21 | 42 | | } |
| | | 43 | | |
| | | 44 | | /// <inheritdoc /> |
| | 0 | 45 | | public string Name => "Default Password Reset Provider"; |
| | | 46 | | |
| | | 47 | | /// <inheritdoc /> |
| | 0 | 48 | | public bool IsEnabled => true; |
| | | 49 | | |
| | | 50 | | /// <inheritdoc /> |
| | | 51 | | public async Task<PinRedeemResult> RedeemPasswordResetPin(string pin) |
| | | 52 | | { |
| | 0 | 53 | | var userManager = _appHost.Resolve<IUserManager>(); |
| | 0 | 54 | | var usersReset = new List<string>(); |
| | 0 | 55 | | foreach (var resetFile in Directory.EnumerateFiles(_passwordResetFileBaseDir, $"{BaseResetFileName}*")) |
| | | 56 | | { |
| | | 57 | | SerializablePasswordReset spr; |
| | 0 | 58 | | var str = AsyncFile.OpenRead(resetFile); |
| | 0 | 59 | | await using (str.ConfigureAwait(false)) |
| | | 60 | | { |
| | 0 | 61 | | spr = await JsonSerializer.DeserializeAsync<SerializablePasswordReset>(str).ConfigureAwait(false) |
| | 0 | 62 | | ?? throw new ResourceNotFoundException($"Provided path ({resetFile}) is not valid."); |
| | | 63 | | } |
| | | 64 | | |
| | 0 | 65 | | if (spr.ExpirationDate < DateTime.UtcNow) |
| | | 66 | | { |
| | 0 | 67 | | File.Delete(resetFile); |
| | | 68 | | } |
| | 0 | 69 | | else if (string.Equals( |
| | 0 | 70 | | spr.Pin.Replace("-", string.Empty, StringComparison.Ordinal), |
| | 0 | 71 | | pin.Replace("-", string.Empty, StringComparison.Ordinal), |
| | 0 | 72 | | StringComparison.Ordinal)) |
| | | 73 | | { |
| | 0 | 74 | | var resetUser = userManager.GetUserByName(spr.UserName) |
| | 0 | 75 | | ?? throw new ResourceNotFoundException($"User with a username of {spr.UserName} not found"); |
| | | 76 | | |
| | 0 | 77 | | await userManager.ChangePassword(resetUser, pin).ConfigureAwait(false); |
| | 0 | 78 | | usersReset.Add(resetUser.Username); |
| | 0 | 79 | | File.Delete(resetFile); |
| | 0 | 80 | | } |
| | 0 | 81 | | } |
| | | 82 | | |
| | 0 | 83 | | if (usersReset.Count < 1) |
| | | 84 | | { |
| | 0 | 85 | | throw new ResourceNotFoundException($"No Users found with a password reset request matching pin {pin}"); |
| | | 86 | | } |
| | | 87 | | |
| | 0 | 88 | | return new PinRedeemResult |
| | 0 | 89 | | { |
| | 0 | 90 | | Success = true, |
| | 0 | 91 | | UsersReset = usersReset.ToArray() |
| | 0 | 92 | | }; |
| | 0 | 93 | | } |
| | | 94 | | |
| | | 95 | | /// <inheritdoc /> |
| | | 96 | | public async Task<ForgotPasswordResult> StartForgotPasswordProcess(User? user, string enteredUsername, bool isIn |
| | | 97 | | { |
| | 0 | 98 | | DateTime expireTime = DateTime.UtcNow.AddMinutes(30); |
| | 0 | 99 | | var usernameHash = enteredUsername.ToUpperInvariant().GetMD5().ToString("N", CultureInfo.InvariantCulture); |
| | 0 | 100 | | var pinFile = _passwordResetFileBase + usernameHash + ".json"; |
| | | 101 | | |
| | 0 | 102 | | if (user is not null && isInNetwork) |
| | | 103 | | { |
| | 0 | 104 | | byte[] bytes = new byte[4]; |
| | 0 | 105 | | RandomNumberGenerator.Fill(bytes); |
| | 0 | 106 | | string pin = BitConverter.ToString(bytes); |
| | | 107 | | |
| | 0 | 108 | | SerializablePasswordReset spr = new SerializablePasswordReset |
| | 0 | 109 | | { |
| | 0 | 110 | | ExpirationDate = expireTime, |
| | 0 | 111 | | Pin = pin, |
| | 0 | 112 | | PinFile = pinFile, |
| | 0 | 113 | | UserName = user.Username |
| | 0 | 114 | | }; |
| | | 115 | | |
| | 0 | 116 | | FileStream fileStream = AsyncFile.Create(pinFile); |
| | 0 | 117 | | await using (fileStream.ConfigureAwait(false)) |
| | | 118 | | { |
| | 0 | 119 | | await JsonSerializer.SerializeAsync(fileStream, spr).ConfigureAwait(false); |
| | | 120 | | } |
| | | 121 | | } |
| | | 122 | | |
| | 0 | 123 | | return new ForgotPasswordResult |
| | 0 | 124 | | { |
| | 0 | 125 | | Action = ForgotPasswordAction.PinCode, |
| | 0 | 126 | | PinExpirationDate = expireTime, |
| | 0 | 127 | | PinFile = pinFile |
| | 0 | 128 | | }; |
| | 0 | 129 | | } |
| | | 130 | | |
| | | 131 | | #nullable disable |
| | | 132 | | private class SerializablePasswordReset : PasswordPinCreationResult |
| | | 133 | | { |
| | | 134 | | public string Pin { get; set; } |
| | | 135 | | |
| | | 136 | | public string UserName { get; set; } |
| | | 137 | | } |
| | | 138 | | } |
| | | 139 | | } |