vendor/contao/core-bundle/src/EventListener/TwoFactorFrontendListener.php line 62

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. /*
  6.  * This file is part of Contao.
  7.  *
  8.  * (c) Leo Feyer
  9.  *
  10.  * @license LGPL-3.0-or-later
  11.  */
  13. namespace Contao\CoreBundle\EventListener;
  15. use Contao\CoreBundle\Exception\PageNotFoundException;
  16. use Contao\CoreBundle\Framework\ContaoFramework;
  17. use Contao\CoreBundle\Routing\ScopeMatcher;
  18. use Contao\FrontendUser;
  19. use Contao\PageModel;
  20. use Scheb\TwoFactorBundle\Security\Authentication\Token\TwoFactorToken;
  21. use Symfony\Component\HttpFoundation\RedirectResponse;
  22. use Symfony\Component\HttpKernel\Event\RequestEvent;
  23. use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
  24. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  25. use Symfony\Component\Security\Http\Util\TargetPathTrait;
  27. /**
  28.  * @internal
  29.  */
  30. class TwoFactorFrontendListener
  31. {
  32.     use TargetPathTrait;
  34.     /**
  35.      * @var ContaoFramework
  36.      */
  37.     private $framework;
  39.     /**
  40.      * @var ScopeMatcher
  41.      */
  42.     private $scopeMatcher;
  44.     /**
  45.      * @var TokenStorageInterface
  46.      */
  47.     private $tokenStorage;
  49.     /**
  50.      * @var array
  51.      */
  52.     private $supportedTokens;
  54.     public function __construct(ContaoFramework $framework, ScopeMatcher $scopeMatcher, TokenStorageInterface $tokenStorage, array $supportedTokens)
  55.     {
  56.         $this->framework = $framework;
  57.         $this->scopeMatcher = $scopeMatcher;
  58.         $this->tokenStorage = $tokenStorage;
  59.         $this->supportedTokens = $supportedTokens;
  60.     }
  62.     public function __invoke(RequestEvent $event): void
  63.     {
  64.         if (!$this->scopeMatcher->isFrontendMasterRequest($event)) {
  65.             return;
  66.         }
  68.         $token = $this->tokenStorage->getToken();
  70.         if (null === $token) {
  71.             return;
  72.         }
  74.         // Check if is a supported token
  75.         if (!$token instanceof TwoFactorToken && !\in_array(\get_class($token), $this->supportedTokens, true)) {
  76.             return;
  77.         }
  79.         $request = $event->getRequest();
  80.         $page = $request->attributes->get('pageModel');
  82.         // Check if actual page is available
  83.         if (!$page instanceof PageModel) {
  84.             return;
  85.         }
  87.         $user = $token->getUser();
  89.         if (!$user instanceof FrontendUser) {
  90.             return;
  91.         }
  93.         /** @var PageModel $adapter */
  94.         $adapter = $this->framework->getAdapter(PageModel::class);
  96.         // Check if user has two-factor disabled but is enforced
  97.         if ($page->enforceTwoFactor && !$user->useTwoFactor) {
  98.             $twoFactorPage = $adapter->findPublishedById($page->twoFactorJumpTo);
  100.             if (!$twoFactorPage instanceof PageModel) {
  101.                 throw new PageNotFoundException('No two-factor authentication page found');
  102.             }
  104.             // Redirect to two-factor page
  105.             if ($page->id !== $twoFactorPage->id) {
  106.                 $event->setResponse(new RedirectResponse($twoFactorPage->getAbsoluteUrl()));
  107.             }
  109.             return;
  110.         }
  112.         // Return if user is authenticated
  113.         if (!$token instanceof TwoFactorToken) {
  114.             return;
  115.         }
  117.         $page401 = $adapter->find401ByPid($page->rootId);
  119.         // Return if we are on the 401 target page already
  120.         if ($page401 instanceof PageModel && $page401->autoforward && $page->id === $page401->jumpTo) {
  121.             return;
  122.         }
  124.         $targetPath = $this->getTargetPath($request->getSession(), $token->getFirewallName());
  126.         if ($targetPath) {
  127.             // Redirect to the target path
  128.             if ($targetPath !== $request->getSchemeAndHttpHost().$request->getRequestUri()) {
  129.                 $event->setResponse(new RedirectResponse($targetPath));
  130.             }
  132.             return;
  133.         }
  135.         throw new UnauthorizedHttpException('', 'Missing two-factor authentication');
  136.     }
  137. }