GitHub PullRequestReviewCommentEvent at 2014-05-26 06:39:06
Repository: restful
Actor: mateu-aguilo-bosch
Payload: {"comment":{"url":"https://api.github.com/repos/Gizra/restful/pulls/comments/13037529","id":13037529,"diff_hunk":"@@ -0,0 +1,73 @@\n+<?php\n+\n+/**\n+ * @file\n+ * Contains RestfulAuthenticationBasic\n+ */\n+\n+class RestfulAuthenticationBasic extends RestfulAuthenticationBase implements RestfulAuthenticationInterface {\n+\n+  /**\n+   * {@inheritdoc}\n+   */\n+  public function applies() {\n+    $username = drupal_get_http_header('PHP_AUTH_USER');\n+    $password = drupal_get_http_header('PHP_AUTH_PW');\n+    return isset($username) && isset($password);\n+  }\n+\n+  /**\n+   * {@inheritdoc}\n+   *\n+   * @see user_login_authenticate_validate().\n+   */\n+  public function authenticate() {\n+    $username = drupal_get_http_header('PHP_AUTH_USER');\n+    $password = drupal_get_http_header('PHP_AUTH_PW');\n+\n+    // Do not allow any login from the current user's IP if the limit has been\n+    // reached. Default is 50 failed attempts allowed in one hour. This is\n+    // independent of the per-user limit to catch attempts from one IP to log\n+    // in to many different user accounts.  We have a reasonably high limit\n+    // since there may be only one apparent IP for all users at an institution.\n+    if (!flood_is_allowed('failed_login_attempt_ip', variable_get('user_failed_login_ip_limit', 50), variable_get('user_failed_login_ip_window', 3600))) {\n+      throw new RestfulFloodException(format_string('Rejected by ip flood control.'));\n+    }\n+    $uid = db_query_range(\"SELECT uid FROM {users} WHERE name = :name AND status = 1\", 0, 1, array(':name' => $username))->fetchField();\n+    if ($uid) {\n+      if (variable_get('user_failed_login_identifier_uid_only', FALSE)) {\n+        // Register flood events based on the uid only, so they apply for any\n+        // IP address. This is the most secure option.\n+        $identifier = $uid;\n+      }\n+      else {\n+        // The default identifier is a combination of uid and IP address. This\n+        // is less secure but more resistant to denial-of-service attacks that\n+        // could lock out all users with public user names.\n+        $identifier = $uid . '-' . ip_address();\n+      }\n+\n+      // Don't allow login if the limit for this user has been reached.\n+      // Default is to allow 5 failed attempts every 6 hours.\n+      if (flood_is_allowed('failed_login_attempt_user', variable_get('user_failed_login_user_limit', 5), variable_get('user_failed_login_user_window', 21600), $identifier)) {\n+        // We are not limited by flood control, so try to authenticate.\n+        if ($uid = user_authenticate($username, $password)) {\n+          // Clear the user based flood control.\n+          flood_clear_event('failed_login_attempt_user', $identifier);\n+          return user_load($uid);\n+        }\n+        else {\n+          flood_register_event('failed_login_attempt_user', variable_get('user_failed_login_user_window', 3600), $identifier);","path":"plugins/authentication/RestfulAuthenticationBasic.class.php","position":null,"original_position":60,"commit_id":"49cfe09fdfbd3986da8bd35f9300a7107882ac3a","original_commit_id":"8abef06fb979ef17c314783c5c27e5522f6feb7b","user":{"login":"mateu-aguilo-bosch","id":1140906,"avatar_url":"https://avatars.githubusercontent.com/u/1140906?","gravatar_id":"60104ccf4cf2c8024d1cc94ea9d561cc","url":"https://api.github.com/users/mateu-aguilo-bosch","html_url":"https://github.com/mateu-aguilo-bosch","followers_url":"https://api.github.com/users/mateu-aguilo-bosch/followers","following_url":"https://api.github.com/users/mateu-aguilo-bosch/following{/other_user}","gists_url":"https://api.github.com/users/mateu-aguilo-bosch/gists{/gist_id}","starred_url":"https://api.github.com/users/mateu-aguilo-bosch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mateu-aguilo-bosch/subscriptions","organizations_url":"https://api.github.com/users/mateu-aguilo-bosch/orgs","repos_url":"https://api.github.com/users/mateu-aguilo-bosch/repos","events_url":"https://api.github.com/users/mateu-aguilo-bosch/events{/privacy}","received_events_url":"https://api.github.com/users/mateu-aguilo-bosch/received_events","type":"User","site_admin":false},"body":"Let's better move this to the Authentication manager as you did [here](https://github.com/Gizra/restful/pull/44/files#diff-84cb9136178cff57648ad43f6e671adeR54). This way we'll throw a exception if none of the authentication providers can provide a user.","created_at":"2014-05-26T06:39:06Z","updated_at":"2014-05-26T06:39:06Z","html_url":"https://github.com/Gizra/restful/pull/41#discussion_r13037529","pull_request_url":"https://api.github.com/repos/Gizra/restful/pulls/41","_links":{"self":{"href":"https://api.github.com/repos/Gizra/restful/pulls/comments/13037529"},"html":{"href":"https://github.com/Gizra/restful/pull/41#discussion_r13037529"},"pull_request":{"href":"https://api.github.com/repos/Gizra/restful/pulls/41"}}}}