Fixed postAuthentication() bug

postAuthentication() method is run after login for every registered provider which meant that it also ran if the LocalPasswordPrimaryAuthenticationProvider was that one who authenticated a user. postAuthentication() then tried to access something that was not there. This is now fixed. Post auth tasks will only be performed if the ExternalDatabaseAuth provider was the one that successfully authenticated.

Author: hochleitner

includes/ExternalDatabaseAuth.php

@@ -34,6 +34,16 @@ class ExternalDatabaseAuth extends AbstractPasswordPrimaryAuthenticationProvider
 	 */
 	private $loginUser;
 
+	/**
+	 * Keeps record if this provider's login attempt was successful. This is necessary for the
+	 * postAuthentication() method since it is called for every registered provider and we need to
+	 * make sure that our post-auth tasks are only performed if our provider was the one that
+	 * successfully authenticated.
+	 *
+	 * @var boolean
+	 */
+	private $providerSuccess;
+
 	/**
 	 * Creates a new object for external database authentication. Queries the current configuration
 	 * and stores it for further use.
@@ -48,6 +58,8 @@ public function __construct( array $params = [] ) {
 			MediaWikiServices::getInstance()
 				->getConfigFactory()
 				->makeConfig( "ExternalDatabaseAuth" );
+		$this->loginUser = null;
+		$this->providerSuccess = false;
 	}
 
 	/**
@@ -115,6 +127,7 @@ public function beginPrimaryAuthentication( array $reqs ) {
 		// Authenticate the user (see if password matches the stored one)
 		if ( $this->loginUser && $this->isPasswordValid( $req->password,
 				$this->loginUser->{$fields["userPassword"]} ) ) {
+			$this->providerSuccess = true;
 			return AuthenticationResponse::newPass( $req->username );
 		}
 
@@ -187,7 +200,7 @@ private function isPasswordValid( $enteredPassword, $storedPassword ) {
 	public function postAuthentication( $user, AuthenticationResponse $response ) {
 		parent::postAuthentication( $user, $response );
 
-		if ( $response->status === AuthenticationResponse::PASS ) {
+		if ( $response->status === AuthenticationResponse::PASS && $this->providerSuccess ) {
 			$fields = $this->edaConfig->get( "ExternalDatabaseAuthFields" );
 
 			$user->setRealName( $this->loginUser->{$fields["userRealName"]} );