first commit

plugins/system/remember/remember.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<extension type="plugin" group="system" method="upgrade">
+	<name>plg_system_remember</name>
+	<author>Joomla! Project</author>
+	<creationDate>2007-04</creationDate>
+	<copyright>(C) 2007 Open Source Matters, Inc.</copyright>
+	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
+	<authorEmail>admin@joomla.org</authorEmail>
+	<authorUrl>www.joomla.org</authorUrl>
+	<version>3.0.0</version>
+	<description>PLG_REMEMBER_XML_DESCRIPTION</description>
+	<namespace path="src">Joomla\Plugin\System\Remember</namespace>
+	<files>
+		<folder plugin="remember">services</folder>
+		<folder>src</folder>
+	</files>
+	<languages>
+		<language tag="en-GB">language/en-GB/plg_system_remember.ini</language>
+		<language tag="en-GB">language/en-GB/plg_system_remember.sys.ini</language>
+	</languages>
+</extension>

plugins/system/remember/services/provider.php

@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * @package     Joomla.Plugin
+ * @subpackage  System.remember
+ *
+ * @copyright   (C) 2023 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+\defined('_JEXEC') or die;
+
+use Joomla\CMS\Extension\PluginInterface;
+use Joomla\CMS\Factory;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\Database\DatabaseInterface;
+use Joomla\DI\Container;
+use Joomla\DI\ServiceProviderInterface;
+use Joomla\Event\DispatcherInterface;
+use Joomla\Plugin\System\Remember\Extension\Remember;
+
+return new class () implements ServiceProviderInterface {
+    /**
+     * Registers the service provider with a DI container.
+     *
+     * @param   Container  $container  The DI container.
+     *
+     * @return  void
+     *
+     * @since   4.4.0
+     */
+    public function register(Container $container): void
+    {
+        $container->set(
+            PluginInterface::class,
+            function (Container $container) {
+                $plugin     = new Remember(
+                    $container->get(DispatcherInterface::class),
+                    (array) PluginHelper::getPlugin('system', 'remember')
+                );
+                $plugin->setApplication(Factory::getApplication());
+                $plugin->setDatabase($container->get(DatabaseInterface::class));
+
+                return $plugin;
+            }
+        );
+    }
+};

plugins/system/remember/src/Extension/Remember.php

@@ -0,0 +1,130 @@
+<?php
+
+/**
+ * @package     Joomla.Plugin
+ * @subpackage  System.remember
+ *
+ * @copyright   (C) 2007 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Plugin\System\Remember\Extension;
+
+use Joomla\CMS\Log\Log;
+use Joomla\CMS\Plugin\CMSPlugin;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\CMS\User\UserHelper;
+use Joomla\Database\DatabaseAwareTrait;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * Joomla! System Remember Me Plugin
+ *
+ * @since  1.5
+ */
+final class Remember extends CMSPlugin
+{
+    use DatabaseAwareTrait;
+
+    /**
+     * Remember me method to run onAfterInitialise
+     * Only purpose is to initialise the login authentication process if a cookie is present
+     *
+     * @return  void
+     *
+     * @since   1.5
+     *
+     * @throws  InvalidArgumentException
+     */
+    public function onAfterInitialise()
+    {
+        // No remember me for admin.
+        if (!$this->getApplication()->isClient('site')) {
+            return;
+        }
+
+        // Check for a cookie if user is not logged in
+        if ($this->getApplication()->getIdentity()->guest) {
+            $cookieName = 'joomla_remember_me_' . UserHelper::getShortHashedUserAgent();
+
+            // Check for the cookie
+            if ($this->getApplication()->getInput()->cookie->get($cookieName)) {
+                $this->getApplication()->login(['username' => ''], ['silent' => true]);
+            }
+        }
+    }
+
+    /**
+     * Imports the authentication plugin on user logout to make sure that the cookie is destroyed.
+     *
+     * @param   array  $user     Holds the user data.
+     * @param   array  $options  Array holding options (remember, autoregister, group).
+     *
+     * @return  boolean
+     */
+    public function onUserLogout($user, $options)
+    {
+        // No remember me for admin
+        if (!$this->getApplication()->isClient('site')) {
+            return true;
+        }
+
+        $cookieName = 'joomla_remember_me_' . UserHelper::getShortHashedUserAgent();
+
+        // Check for the cookie
+        if ($this->getApplication()->getInput()->cookie->get($cookieName)) {
+            // Make sure authentication group is loaded to process onUserAfterLogout event
+            PluginHelper::importPlugin('authentication');
+        }
+
+        return true;
+    }
+
+    /**
+     * Method is called before user data is stored in the database
+     * Invalidate all existing remember-me cookies after a password change
+     *
+     * @param   array    $user   Holds the old user data.
+     * @param   boolean  $isnew  True if a new user is stored.
+     * @param   array    $data   Holds the new user data.
+     *
+     * @return  boolean
+     *
+     * @since   3.8.6
+     */
+    public function onUserBeforeSave($user, $isnew, $data)
+    {
+        // Irrelevant on new users
+        if ($isnew) {
+            return true;
+        }
+
+        // Irrelevant, because password was not changed by user
+        if (empty($data['password_clear'])) {
+            return true;
+        }
+
+        // But now, we need to do something - Delete all tokens for this user!
+        $db    = $this->getDatabase();
+        $query = $db->getQuery(true)
+            ->delete($db->quoteName('#__user_keys'))
+            ->where($db->quoteName('user_id') . ' = :userid')
+            ->bind(':userid', $user['username']);
+
+        try {
+            $db->setQuery($query)->execute();
+        } catch (\RuntimeException $e) {
+            // Log an alert for the site admin
+            Log::add(
+                sprintf('Failed to delete cookie token for user %s with the following error: %s', $user['username'], $e->getMessage()),
+                Log::WARNING,
+                'security'
+            );
+        }
+
+        return true;
+    }
+}