Joomla CMS  4.2.2
Documentation des API du CMS Joomla en version 4.2.2
Référence de la classe Token
+ Graphe d'héritage de Token:

Fonctions membres publiques

 __construct (DispatcherInterface $dispatcher, array $config, UserFactoryInterface $userFactory, InputFilter $filter)
 
 onUserAuthenticate ($credentials, $options, &$response)
 
- Fonctions membres publiques hérités de CMSPlugin
 __construct (&$subject, $config=array())
 
 loadLanguage ($extension='', $basePath=JPATH_ADMINISTRATOR)
 
 setApplication (CMSApplicationInterface $application)
 
- Fonctions membres publiques hérités de DispatcherAwareInterface
 setDispatcher (DispatcherInterface $dispatcher)
 
- Fonctions membres publiques hérités de PluginInterface
 registerListeners ()
 

Fonctions membres privées

 getTokenSeedForUser (int $userId)
 
 isTokenEnabledForUser (int $userId)
 
 getAllowedUserGroups ()
 
 isInAllowedUserGroup ($userId)
 

Attributs privés

 $profileKeyPrefix = 'joomlatoken'
 
 $allowedAlgos = ['sha256', 'sha512']
 
 $userFactory
 
 $filter
 

Membres hérités additionnels

- Champs de données hérités de CMSPlugin
 $params = null
 
- Fonctions membres protégées hérités de CMSPlugin
 registerLegacyListener (string $methodName)
 
 registerListener (string $methodName)
 
 getApplication ()
 
- Attributs protégés hérités de CMSPlugin
 $_name = null
 
 $_type = null
 
 $autoloadLanguage = false
 
 $allowLegacyListeners = true
 

Description détaillée

Joomla Token Authentication plugin

Depuis
4.0.0

Documentation des constructeurs et destructeur

◆ __construct()

__construct ( DispatcherInterface  $dispatcher,
array  $config,
UserFactoryInterface  $userFactory,
InputFilter  $filter 
)

Constructor.

Paramètres
DispatcherInterface$dispatcherThe dispatcher
array$configAn optional associative array of configuration settings
UserFactoryInterface$userFactoryThe user factory
InputFilter$filterThe input filter
Depuis
4.2.0

Références $config, Joomla\CMS\Application\$userFactory, et Symfony\Contracts\Service\__construct().

Documentation des fonctions membres

◆ getAllowedUserGroups()

getAllowedUserGroups ( )
private

Get the configured user groups which are allowed to have access to tokens.

Renvoie
int[]
Depuis
4.0.0

◆ getTokenSeedForUser()

getTokenSeedForUser ( int  $userId)
private

Retrieve the token seed string for the given user ID.

Paramètres
int$userIdThe numeric user ID to return the token seed string for.
Renvoie
string|null Null if there is no token configured or the user doesn't exist.
Depuis
4.0.0

Références $db, $query, $userId, Joomla\Database\getDatabase(), ParameterType\INTEGER, null, et ParameterType\STRING.

◆ isInAllowedUserGroup()

isInAllowedUserGroup (   $userId)
private

Is the user with the given ID in the allowed User Groups with access to tokens?

Paramètres
int$userIdThe user ID to check
Renvoie
boolean False when doesn't belong to allowed user groups, user not found, or guest
Depuis
4.0.0

Références $groups, $user, et $userId.

◆ isTokenEnabledForUser()

isTokenEnabledForUser ( int  $userId)
private

Is the token enabled for a given user ID? If the user does not exist or has no token it returns false.

Paramètres
int$userIdThe User ID to check whether the token is enabled on their account.
Renvoie
boolean
Depuis
4.0.0

Références $db, $query, $userId, $value, Joomla\Database\getDatabase(), ParameterType\INTEGER, et ParameterType\STRING.

◆ onUserAuthenticate()

onUserAuthenticate (   $credentials,
  $options,
$response 
)

This method should handle any authentication and report back to the subject

Paramètres
array$credentialsArray holding the user credentials
array$optionsArray of extra options
object$responseAuthentication response object
Renvoie
void
Depuis
4.0.0

First look for an HTTP Authorization header with the following format: Authorization: Bearer <token> Do keep in mind that Bearer is case-sensitive. Whitespace between Bearer and the token, as well as any whitespace following the token is discarded.

Deconstruct the decoded token string to its three discrete parts: algorithm, user ID and HMAC of the token string saved in the database.

Verify the HMAC algorithm requested in the token string is allowed

Make sure the user ID is an integer

Calculate the reference token data HMAC

Can we log in?

DO NOT concatenate in a single line. Due to boolean short-circuit evaluation it might make timing attacks possible. Using separate lines of code with the previously calculated boolean value to the right hand side forces PHP to evaluate the conditions in approximately constant time.

DO NOT try to be smart and do an early return when either of the individual conditions are not met. There's a reason we only return after checking all three conditions: it prevents timing attacks.

Références $enabled, $parts, $user, $userId, Authentication\STATUS_DENIED, Authentication\STATUS_FAILURE, Authentication\STATUS_SUCCESS, et Crypt\timingSafeCompare().

Documentation des champs

◆ $allowedAlgos

$allowedAlgos = ['sha256', 'sha512']
private

◆ $filter

$filter
private

◆ $profileKeyPrefix

$profileKeyPrefix = 'joomlatoken'
private

◆ $userFactory

$userFactory
private

La documentation de cette classe a été générée à partir du fichier suivant :