firstcommit

user/plugins/login/classes/Controller.php

@@ -0,0 +1,551 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login;
+
+use Grav\Common\Grav;
+use Grav\Common\Language\Language;
+use Grav\Common\Uri;
+use Grav\Common\User\User;
+use Grav\Common\Utils;
+use Grav\Plugin\Email\Utils as EmailUtils;
+use Grav\Plugin\Login\TwoFactorAuth\TwoFactorAuth;
+use Grav\Plugin\LoginPlugin;
+use RocketTheme\Toolbox\Session\Message;
+
+/**
+ * Class Controller
+ * @package Grav\Plugin\Login
+ */
+class Controller
+{
+    /**
+     * @var Grav
+     */
+    public $grav;
+
+    /**
+     * @var string
+     */
+    public $action;
+
+    /**
+     * @var array
+     */
+    public $post;
+
+    /**
+     * @var string
+     */
+    protected $redirect;
+
+    /**
+     * @var int
+     */
+    protected $redirectCode;
+
+    /**
+     * @var string
+     */
+    protected $prefix = 'task';
+
+    /**
+     * @var RememberMe\RememberMe
+     * @deprecated 2.0 Use $grav['login']->rememberMe() instead
+     */
+    protected $rememberMe;
+
+    /**
+     * @var Login
+     */
+    protected $login;
+
+    /**
+     * @param Grav   $grav
+     * @param string $action
+     * @param array  $post
+     */
+    public function __construct(Grav $grav, $action, $post = null)
+    {
+        $this->grav = $grav;
+        $this->action = $action;
+        $this->login = $this->grav['login'];
+        $this->post = $post ? $this->getPost($post) : [];
+
+        $this->rememberMe();
+    }
+
+    /**
+     * Performs an action.
+     * @throws \RuntimeException
+     */
+    public function execute()
+    {
+        $messages = $this->grav['messages'];
+
+        // Set redirect if available.
+        if (isset($this->post['_redirect'])) {
+            $redirect = $this->post['_redirect'];
+            unset($this->post['_redirect']);
+        }
+
+        $success = false;
+        $method = $this->prefix . ucfirst($this->action);
+
+        if (!method_exists($this, $method)) {
+            throw new \RuntimeException('Page Not Found', 404);
+        }
+
+        try {
+            $success = call_user_func([$this, $method]);
+        } catch (\RuntimeException $e) {
+            $messages->add($e->getMessage(), 'error');
+            $this->grav['log']->error('plugin.login: '. $e->getMessage());
+        }
+
+        if (!$this->redirect && isset($redirect)) {
+            $this->setRedirect($redirect, 303);
+        }
+
+        return $success;
+    }
+
+    /**
+     * Handle login.
+     *
+     * @return bool True if the action was performed.
+     */
+    public function taskLogin()
+    {
+        /** @var Language $t */
+        $t = $this->grav['language'];
+
+        /** @var Message $messages */
+        $messages = $this->grav['messages'];
+
+        $userKey = isset($this->post['username']) ? (string)$this->post['username'] : '';
+        $ipKey = Uri::ip();
+
+        $rateLimiter = $this->login->getRateLimiter('login_attempts');
+
+        // Check if the current IP has been used in failed login attempts.
+        $attempts = count($rateLimiter->getAttempts($ipKey, 'ip'));
+
+        $rateLimiter->registerRateLimitedAction($ipKey, 'ip')->registerRateLimitedAction($userKey);
+
+        // Check rate limit for both IP and user, but allow each IP a single try even if user is already rate limited.
+        if ($rateLimiter->isRateLimited($ipKey, 'ip') || ($attempts && $rateLimiter->isRateLimited($userKey))) {
+            $messages->add($t->translate(['PLUGIN_LOGIN.TOO_MANY_LOGIN_ATTEMPTS', $rateLimiter->getInterval()]), 'error');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route', '/'));
+
+            return true;
+        }
+
+        // Remove login nonce from the form.
+        $form = array_diff_key($this->post, ['login-form-nonce' => true]);
+
+        // Fire Login process.
+        $event = $this->login->login($form, ['remember_me' => true], ['return_event' => true]);
+        $user = $event->getUser();
+
+        if ($user->authenticated) {
+            $rateLimiter->resetRateLimit($ipKey, 'ip')->resetRateLimit($userKey);
+            if ($user->authorized) {
+                $event->defMessage('PLUGIN_LOGIN.LOGIN_SUCCESSFUL', 'info');
+
+                $event->defRedirect(
+                    $this->grav['session']->redirect_after_login ?: $this->grav['uri']->referrer('/')
+                );
+            } else {
+                $login_route = $this->grav['config']->get('plugins.login.route');
+                if ($login_route) {
+                    $event->defRedirect($login_route);
+                }
+            }
+        } else {
+            if ($user->authorized) {
+                $event->defMessage('PLUGIN_LOGIN.ACCESS_DENIED', 'error');
+
+                $event->defRedirect($this->grav['config']->get('plugins.login.route_unauthorized', '/'));
+            } else {
+                $event->defMessage('PLUGIN_LOGIN.LOGIN_FAILED', 'error');
+            }
+        }
+
+        $message = $event->getMessage();
+        if ($message) {
+            $messages->add($t->translate($message), $event->getMessageType());
+        }
+
+        $redirect = $event->getRedirect();
+        if ($redirect) {
+            $this->setRedirect($redirect, $event->getRedirectCode());
+        }
+
+        return true;
+    }
+
+    public function taskTwoFa()
+    {
+        /** @var Language $t */
+        $t = $this->grav['language'];
+
+        /** @var Message $messages */
+        $messages = $this->grav['messages'];
+
+        /** @var TwoFactorAuth $twoFa */
+        $twoFa = $this->grav['login']->twoFactorAuth();
+        $user = $this->grav['user'];
+
+        $code = isset($this->post['2fa_code']) ? $this->post['2fa_code'] : null;
+        $secret = isset($user->twofa_secret) ? $user->twofa_secret : null;
+
+        if (!$code || !$secret || !$twoFa->verifyCode($secret, $code)) {
+            $messages->add($t->translate('PLUGIN_LOGIN.2FA_FAILED'),  'error');
+
+            $user->authenticated = false;
+
+            $login_route = $this->grav['config']->get('plugins.login.route');
+            if ($login_route) {
+                $this->setRedirect($login_route, 303);
+            }
+
+            return true;
+        }
+
+        $messages->add($t->translate('PLUGIN_LOGIN.LOGIN_SUCCESSFUL'),  'info');
+
+        $user->authorized = true;
+
+        $this->setRedirect(
+            $this->grav['session']->redirect_after_login
+                ?: $this->grav['config']->get('plugins.login.redirect_after_login')
+                ?: $this->grav['uri']->referrer('/')
+        );
+
+        return true;
+    }
+
+    /**
+     * Handle logout.
+     *
+     * @return bool True if the action was performed.
+     */
+    public function taskLogout()
+    {
+        $event = $this->login->logout(['remember_me' => true], ['return_event' => true]);
+
+        $message = $event->getMessage();
+        if ($message) {
+            /** @var Language $t */
+            $t = $this->grav['language'];
+
+            $messages = $this->grav['messages'];
+            $messages->add($t->translate($message), $event->getMessageType());
+        }
+
+        $redirect = $event->getRedirect() ?: $this->grav['config']->get('plugins.login.redirect_after_logout');
+        if ($redirect) {
+            $this->setRedirect($redirect, $event->getRedirectCode());
+        }
+
+        $this->grav['session']->setFlashCookieObject(LoginPlugin::TMP_COOKIE_NAME, ['message' => $this->grav['language']->translate('PLUGIN_LOGIN.LOGGED_OUT'),
+            'status' => 'info']);
+
+        return true;
+    }
+
+    /**
+     * Handle the email password recovery procedure.
+     *
+     * @return bool True if the action was performed.
+     */
+    protected function taskForgot()
+    {
+        $param_sep = $this->grav['config']->get('system.param_sep', ':');
+        $data = $this->post;
+
+        $email = isset($data['email']) ? $data['email'] : '';
+        $user = !empty($email) ? User::find($email, ['email']) : null;
+
+        /** @var Language $language */
+        $language = $this->grav['language'];
+        $messages = $this->grav['messages'];
+
+        if (!isset($this->grav['Email'])) {
+            $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_EMAIL_NOT_CONFIGURED'), 'error');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot', '/'));
+
+            return true;
+        }
+
+        if (!$user || !$user->exists()) {
+            $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL'), 'info');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot', '/'));
+
+            return true;
+        }
+
+        if (empty($user->email)) {
+            $messages->add($language->translate(['PLUGIN_LOGIN.FORGOT_CANNOT_RESET_EMAIL_NO_EMAIL', $email]),
+                'error');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot', '/'));
+
+            return true;
+        }
+
+        if (empty($user->password) && empty($user->hashed_password)) {
+            $messages->add($language->translate(['PLUGIN_LOGIN.FORGOT_CANNOT_RESET_EMAIL_NO_PASSWORD', $email]),
+                'error');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot', '/'));
+
+            return true;
+        }
+
+        $from = $this->grav['config']->get('plugins.email.from');
+
+        if (empty($from)) {
+            $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_EMAIL_NOT_CONFIGURED'), 'error');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot', '/'));
+
+            return true;
+        }
+
+        $userKey = $user->username;
+        $rateLimiter = $this->login->getRateLimiter('pw_resets');
+        $rateLimiter->registerRateLimitedAction($userKey);
+
+        if ($rateLimiter->isRateLimited($userKey)) {
+            $messages->add($language->translate(['PLUGIN_LOGIN.FORGOT_CANNOT_RESET_IT_IS_BLOCKED', $email, $rateLimiter->getInterval()]), 'error');
+            $this->setRedirect($this->grav['config']->get('plugins.login.route', '/'));
+
+            return true;
+        }
+
+        $token = md5(uniqid(mt_rand(), true));
+        $expire = time() + 604800; // next week
+
+        $user->reset = $token . '::' . $expire;
+        $user->save();
+
+        $author = $this->grav['config']->get('site.author.name', '');
+        $fullname = $user->fullname ?: $user->username;
+
+        $reset_link = $this->grav['base_url_absolute'] . $this->grav['config']->get('plugins.login.route_reset') . '/task:login.reset/token' . $param_sep . $token . '/user' . $param_sep . $user->username . '/nonce' . $param_sep . Utils::getNonce('reset-form');
+
+        $sitename = $this->grav['config']->get('site.title', 'Website');
+
+        $to = $user->email;
+
+        $subject = $language->translate(['PLUGIN_LOGIN.FORGOT_EMAIL_SUBJECT', $sitename]);
+        $content = $language->translate(['PLUGIN_LOGIN.FORGOT_EMAIL_BODY', $fullname, $reset_link, $author, $sitename]);
+
+        $sent = EmailUtils::sendEmail($subject, $content, $to);
+
+        if ($sent < 1) {
+            $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_FAILED_TO_EMAIL'), 'error');
+        } else {
+            $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL'), 'info');
+        }
+
+        $this->setRedirect($this->grav['config']->get('plugins.login.route', '/'));
+
+        return true;
+    }
+
+    /**
+     * Handle the reset password action.
+     *
+     * @return bool True if the action was performed.
+     * @throws \Exception
+     */
+    public function taskReset()
+    {
+        $data = $this->post;
+        $language = $this->grav['language'];
+        $messages = $this->grav['messages'];
+
+        if (isset($data['password'])) {
+            $username = isset($data['username']) ? $data['username'] : null;
+            $user = !empty($username) ? User::find($username) : null;
+            $password = isset($data['password']) ? $data['password'] : null;
+            $token = isset($data['token']) ? $data['token'] : null;
+
+            if ($user && !empty($user->reset) && $user->exists()) {
+                list($good_token, $expire) = explode('::', $user->reset);
+
+                if ($good_token === $token) {
+                    if (time() > $expire) {
+                        $messages->add($language->translate('PLUGIN_LOGIN.RESET_LINK_EXPIRED'), 'error');
+                        $this->grav->redirect($this->grav['config']->get('plugins.login.route_forgot', '/'));
+
+                        return true;
+                    }
+
+                    unset($user->hashed_password, $user->reset);
+                    $user->password = $password;
+
+                    $user->validate();
+                    $user->filter();
+                    $user->save();
+
+                    $messages->add($language->translate('PLUGIN_LOGIN.RESET_PASSWORD_RESET'), 'info');
+                    $this->setRedirect($this->grav['config']->get('plugins.login.route', '/'));
+
+                    return true;
+                }
+            }
+
+            $messages->add($language->translate('PLUGIN_LOGIN.RESET_INVALID_LINK'), 'error');
+            $this->grav->redirect($this->grav['config']->get('plugins.login.route_forgot'));
+
+            return true;
+
+        }
+
+        $user = $this->grav['uri']->param('user');
+        $token = $this->grav['uri']->param('token');
+
+        if (!$user || !$token) {
+            $messages->add($language->translate('PLUGIN_LOGIN.RESET_INVALID_LINK'), 'error');
+            $this->grav->redirect($this->grav['config']->get('plugins.login.route_forgot'));
+
+            return true;
+        }
+
+        return true;
+    }
+
+    /**
+     * Redirects an action
+     */
+    public function redirect()
+    {
+        if ($this->redirect) {
+            $this->grav->redirect($this->redirect, $this->redirectCode);
+        }
+    }
+
+    /**
+     * Set redirect.
+     *
+     * @param     $path
+     * @param int $code
+     */
+    public function setRedirect($path, $code = 303)
+    {
+        $this->redirect = $path;
+        $this->redirectCode = $code;
+    }
+
+    /**
+     * @return array Array containing [redirect, code].
+     */
+    public function getRedirect()
+    {
+        return [$this->redirect, $this->redirectCode];
+    }
+
+    /**
+     * Prepare and return POST data.
+     *
+     * @param array $post
+     *
+     * @return array
+     */
+    protected function &getPost(array $post)
+    {
+        unset($post[$this->prefix]);
+
+        // Decode JSON encoded fields and merge them to data.
+        if (isset($post['_json'])) {
+            $post = array_merge_recursive($post, $this->jsonDecode($post['_json']));
+            unset($post['_json']);
+        }
+
+        return $post;
+    }
+
+    /**
+     * Recursively JSON decode data.
+     *
+     * @param  array $data
+     *
+     * @return array
+     */
+    protected function jsonDecode(array $data)
+    {
+        foreach ($data as &$value) {
+            if (is_array($value)) {
+                $value = $this->jsonDecode($value);
+            } else {
+                $value = json_decode($value, true);
+            }
+        }
+
+        return $data;
+    }
+
+    /**
+     * Gets and sets the RememberMe class
+     *
+     * @param  mixed $var A rememberMe instance to set
+     *
+     * @return RememberMe\RememberMe Returns the current rememberMe instance
+     * @deprecated 2.5.0 Use $grav['login']->rememberMe() instead
+     */
+    public function rememberMe($var = null)
+    {
+        $this->rememberMe = $this->login->rememberMe($var);
+
+        return $this->rememberMe;
+    }
+
+    /**
+     * Check if user may use password reset functionality.
+     *
+     * @param  User $user
+     * @param $field
+     * @param $count
+     * @param $interval
+     * @return bool
+     * @deprecated 2.5.0 Use $grav['login']->getRateLimiter($context) instead. See Grav\Plugin\Login\RateLimiter class.
+     */
+    protected function isUserRateLimited(User $user, $field, $count, $interval)
+    {
+        return $this->login->isUserRateLimited($user, $field, $count, $interval);
+    }
+
+    /**
+     * Reset the rate limit counter
+     *
+     * @param User $user
+     * @param $field
+     * @deprecated 2.5.0 Use $grav['login']->getRateLimiter($context) instead. See Grav\Plugin\Login\RateLimiter class.
+     */
+    protected function resetRateLimit(User $user, $field)
+    {
+        $this->login->resetRateLimit($user, $field);
+    }
+
+
+    /**
+     * Authenticate user.
+     *
+     * @param  array $form Form fields.
+     *
+     * @return bool
+     * @deprecated 2.6.2 Will be removed without replacement.
+     */
+    protected function authenticate($form)
+    {
+        // Remove login nonce.
+        $form = array_diff_key($form, ['login-form-nonce' => true]);
+
+        return $this->login->login($form, ['remember_me' => true])->authenticated;
+    }
+}

user/plugins/login/classes/Events/UserLoginEvent.php

@@ -0,0 +1,347 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login\Events;
+
+use Grav\Common\Grav;
+use Grav\Common\Session;
+use Grav\Common\User\User;
+use RocketTheme\Toolbox\Event\Event;
+
+/**
+ * Class UserLoginEvent
+ * @package Grav\Common\User\Events
+ *
+ * @property int                $status
+ * @property array              $credentials
+ * @property string|string[]    $authorize
+ * @property array              $options
+ * @property Session            $session
+ * @property User               $user
+ * @property string             $message
+ *
+ */
+class UserLoginEvent extends Event
+{
+    /**
+     * Undefined event state.
+     */
+    const AUTHENTICATION_UNDEFINED = 0;
+
+    /**
+     * onUserAuthenticate success.
+     */
+    const AUTHENTICATION_SUCCESS = 1;
+
+    /**
+     * onUserAuthenticate fails on bad username/password.
+     */
+    const AUTHENTICATION_FAILURE = 2;
+
+    /**
+     * onUserAuthenticate fails on auth cancellation.
+     */
+    const AUTHENTICATION_CANCELLED = 4;
+
+    /**
+     * onUserAuthorizeLogin fails on expired account.
+     */
+    const AUTHORIZATION_EXPIRED = 8;
+
+    /**
+     * onUserAuthorizeLogin is delayed until user has performed extra action(s).
+     */
+    const AUTHORIZATION_DELAYED = 16;
+
+    /**
+     * onUserAuthorizeLogin fails for other reasons.
+     */
+    const AUTHORIZATION_DENIED = 32;
+
+    /**
+     * UserLoginEvent constructor.
+     * @param array $items
+     */
+    public function __construct(array $items = [])
+    {
+        $items += [
+            'credentials' => [],
+            'options' => [],
+            'authorize' => 'site.login',
+            'status' => static::AUTHENTICATION_UNDEFINED,
+            'session' => null,
+            'user' => null,
+            'message' => null,
+            'redirect' => null,
+            'redirect_code' => 303
+        ];
+        $items['credentials'] += ['username' => '', 'password' => ''];
+
+        parent::__construct($items);
+
+        if (!$this->offsetExists('session') && isset(Grav::instance()['session'])) {
+            $this->offsetSet('session', Grav::instance()['session']);
+        }
+        if (!$this->offsetExists('user')) {
+            $this->offsetSet('user', User::load($this['credentials']['username']));
+        }
+    }
+
+    public function isSuccess()
+    {
+        $status = $this->offsetGet('status');
+        $failure = static::AUTHENTICATION_FAILURE | static::AUTHENTICATION_CANCELLED | static::AUTHORIZATION_EXPIRED
+            | static::AUTHORIZATION_DENIED;
+
+        return ($status & static::AUTHENTICATION_SUCCESS) && !($status & $failure);
+    }
+
+    public function isDelayed()
+    {
+        return $this->isSuccess() && ($this->offsetGet('status') & static::AUTHORIZATION_DELAYED);
+    }
+
+    /**
+     * @return int
+     */
+    public function getStatus()
+    {
+        return (int)$this->offsetGet('status');
+    }
+
+    /**
+     * @param int $status
+     * @return $this
+     */
+    public function setStatus($status)
+    {
+        $this->offsetSet('status', $this->offsetGet('status') | (int)$status);
+
+        return $this;
+    }
+
+    /**
+     * @return array
+     */
+    public function getCredentials()
+    {
+        return $this->offsetGet('credentials') + ['username' => '', 'password' => ''];
+    }
+
+    /**
+     * @param string $name
+     * @return mixed
+     */
+    public function getCredential($name)
+    {
+        return isset($this->items['credentials'][$name]) ? $this->items['credentials'][$name] : null;
+    }
+
+    /**
+     * @param string $name
+     * @param mixed $value
+     * @return $this
+     */
+    public function setCredential($name, $value)
+    {
+        $this->items['credentials'][$name] = $value;
+
+        return $this;
+    }
+
+    /**
+     * @return array
+     */
+    public function getOptions()
+    {
+        return $this->offsetGet('options');
+    }
+
+    /**
+     * @param string $name
+     * @return mixed
+     */
+    public function getOption($name)
+    {
+        return isset($this->items['options'][$name]) ? $this->items['options'][$name] : null;
+    }
+
+    /**
+     * @param string $name
+     * @param mixed $value
+     * @return $this
+     */
+    public function setOption($name, $value)
+    {
+        $this->items['options'][$name] = $value;
+
+        return $this;
+    }
+
+    /**
+     * @return Session|null
+     */
+    public function getSession()
+    {
+        return $this->offsetGet('session');
+    }
+
+    /**
+     * @return User
+     */
+    public function getUser()
+    {
+        return $this->offsetGet('user');
+    }
+
+    /**
+     * @param User $user
+     * @return $this
+     */
+    public function setUser(User $user)
+    {
+        $this->offsetSet('user', $user);
+
+        return $this;
+    }
+
+    /**
+     * @return array
+     */
+    public function getAuthorize()
+    {
+        return (array)$this->offsetGet('authorize');
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getMessage()
+    {
+        return !empty($this->items['message'][0]) ? (string)$this->items['message'][0] : null;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getMessageType()
+    {
+        return !empty($this->items['message'][1]) ? (string)$this->items['message'][1] : 'info';
+    }
+
+    /**
+     * @param string $message
+     * @param string|null $type
+     * @return $this
+     */
+    public function setMessage($message, $type = null)
+    {
+        $this->items['message'] = $message ? [$message, $type] : null;
+
+        return $this;
+    }
+
+    /**
+     * @param string $message
+     * @param string|null $type
+     * @return $this
+     */
+    public function defMessage($message, $type = null)
+    {
+        if ($message && !isset($this->items['message'])) {
+            $this->setMessage($message, $type);
+        }
+
+        return $this;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getRedirect()
+    {
+        return !empty($this->items['redirect']) ? (string)$this->items['redirect'] : null;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getRedirectCode()
+    {
+        return !empty($this->items['redirect_code']) ? (string)$this->items['redirect_code'] : 303;
+    }
+
+    /**
+     * @param string $path
+     * @param int $code
+     * @return $this
+     */
+    public function setRedirect($path, $code = 303)
+    {
+        $this->items['redirect'] = $path ?: null;
+        $this->items['redirect_code'] = (int)$code;
+
+        return $this;
+    }
+
+    /**
+     * @param string $path
+     * @param int $code
+     * @return $this
+     */
+    public function defRedirect($path, $code = 303)
+    {
+        if ($path && !isset($this->items['redirect'])) {
+            $this->setRedirect($path, $code);
+        }
+
+        return $this;
+    }
+
+    /**
+     * Magic setter method
+     *
+     * @param mixed $offset Asset name value
+     * @param mixed $value  Asset value
+     */
+    public function __set($offset, $value)
+    {
+        $this->offsetSet($offset, $value);
+    }
+
+    /**
+     * Magic getter method
+     *
+     * @param  mixed $offset Asset name value
+     * @return mixed         Asset value
+     */
+    public function __get($offset)
+    {
+        return $this->offsetGet($offset);
+    }
+
+    /**
+     * Magic method to determine if the attribute is set
+     *
+     * @param  mixed   $offset Asset name value
+     * @return boolean         True if the value is set
+     */
+    public function __isset($offset)
+    {
+        return $this->offsetExists($offset);
+    }
+
+    /**
+     * Magic method to unset the attribute
+     *
+     * @param mixed $offset The name value to unset
+     */
+    public function __unset($offset)
+    {
+        $this->offsetUnset($offset);
+    }
+}

user/plugins/login/classes/Login.php

@@ -0,0 +1,642 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login;
+
+use Birke\Rememberme\Cookie;
+use Grav\Common\Config\Config;
+use Grav\Common\Data\Data;
+use Grav\Common\Grav;
+use Grav\Common\File\CompiledYamlFile;
+use Grav\Common\Language\Language;
+use Grav\Common\Page\Page;
+use Grav\Common\Session;
+use Grav\Common\User\User;
+use Grav\Common\Uri;
+use Grav\Plugin\Email\Utils as EmailUtils;
+use Grav\Plugin\Login\Events\UserLoginEvent;
+use Grav\Plugin\Login\RememberMe\RememberMe;
+use Grav\Plugin\Login\RememberMe\TokenStorage;
+use Grav\Plugin\Login\TwoFactorAuth\TwoFactorAuth;
+
+/**
+ * Class Login
+ * @package Grav\Plugin
+ */
+class Login
+{
+    /** @var Grav */
+    protected $grav;
+
+    /** @var Config */
+    protected $config;
+
+    /** @var Language $language */
+    protected $language;
+
+    /** @var Session */
+    protected $session;
+
+    /** @var Uri */
+    protected $uri;
+
+    /** @var RememberMe */
+    protected $rememberMe;
+
+    /** @var TwoFactorAuth */
+    protected $twoFa;
+
+    /** @var RateLimiter[] */
+    protected $rateLimiters = [];
+
+    /** @var array  */
+    protected $provider_login_templates = [];
+
+    /**
+     * Login constructor.
+     *
+     * @param Grav $grav
+     */
+    public function __construct(Grav $grav)
+    {
+        $this->grav = $grav;
+        $this->config = $this->grav['config'];
+        $this->language = $this->grav['language'];
+        $this->session = $this->grav['session'];
+        $this->uri = $this->grav['uri'];
+    }
+
+    /**
+     * Login user.
+     *
+     * @param array $credentials    Login credentials, eg: ['username' => '', 'password' => '']
+     * @param array $options        Login options, eg: ['remember_me' => true]
+     * @param array $extra          Example: ['authorize' => 'site.login', 'user' => null], undefined variables get set.
+     * @return User|UserLoginEvent  Returns event if $extra['return_event'] is true.
+     */
+    public function login(array $credentials, array $options = [], array $extra = [])
+    {
+        $grav = Grav::instance();
+
+        $eventOptions = [
+            'credentials' => $credentials,
+            'options' => $options
+        ] + $extra;
+
+        // Attempt to authenticate the user.
+        $event = new UserLoginEvent($eventOptions);
+        $grav->fireEvent('onUserLoginAuthenticate', $event);
+
+        if ($event->isSuccess()) {
+
+            // Make sure that event didn't mess up with the user authorization.
+            $user = $event->getUser();
+            $user->authenticated = true;
+            $user->authorized = false;
+
+            // Allow plugins to prevent login after successful authentication.
+            $event = new UserLoginEvent($event->toArray());
+            $grav->fireEvent('onUserLoginAuthorize', $event);
+        }
+
+        if ($event->isSuccess()) {
+            // User has been logged in, let plugins know.
+            $event = new UserLoginEvent($event->toArray());
+            $grav->fireEvent('onUserLogin', $event);
+
+            // Make sure that event didn't mess up with the user authorization.
+            $user = $event->getUser();
+            $user->authenticated = true;
+            $user->authorized = !$event->isDelayed();
+
+        } else {
+            // Allow plugins to log errors or do other tasks on failure.
+            $event = new UserLoginEvent($event->toArray());
+            $grav->fireEvent('onUserLoginFailure', $event);
+
+            // Make sure that event didn't mess up with the user authorization.
+            $user = $event->getUser();
+            $user->authenticated = false;
+            $user->authorized = false;
+        }
+
+        $user = $event->getUser();
+        $user->def('language', 'en');
+
+        return !empty($event['return_event']) ? $event : $user;
+    }
+
+    /**
+     * Logout user.
+     *
+     * @param array                 $options
+     * @param array|User            $extra      Array of: ['user' => $user, ...] or User object (deprecated).
+     * @return User|UserLoginEvent  Returns event if $extra['return_event'] is true.
+     */
+    public function logout(array $options = [], $extra = [])
+    {
+        $grav = Grav::instance();
+
+        if ($extra instanceof User) {
+            $extra = ['user' => $extra];
+        } elseif (isset($extra['user'])) {
+            $extra['user'] = $grav['user'];
+        }
+
+        $eventOptions = [
+            'options' => $options
+        ] + $extra;
+
+        $event = new UserLoginEvent($eventOptions);
+
+        // Logout the user.
+        $grav->fireEvent('onUserLogout', $event);
+
+        $user = $event->getUser();
+        $user->authenticated = false;
+        $user->authorized = false;
+
+        return !empty($event['return_event']) ? $event : $user;
+    }
+
+    /**
+     * Authenticate user.
+     *
+     * @param array $credentials Form fields.
+     * @param array $options
+     *
+     * @return bool
+     */
+    public function authenticate($credentials, $options = ['remember_me' => true])
+    {
+        $event = $this->login($credentials, $options, ['return_event' => true]);
+        $user = $event['user'];
+
+        $redirect = $event->getRedirect();
+        $message = $event->getMessage();
+        $messageType = $event->getMessageType();
+
+        if ($user->authenticated && $user->authorized) {
+            if (!$message) {
+                $message = 'PLUGIN_LOGIN.LOGIN_SUCCESSFUL';
+                $messageType = 'info';
+            }
+
+            if (!$redirect) {
+                $redirect = $this->uri->route();
+            }
+        }
+
+        if ($message) {
+            $this->grav['messages']->add($this->language->translate($message, [$user->language]), $messageType);
+        }
+
+        if ($redirect) {
+            $this->grav->redirect($redirect, $event->getRedirectCode());
+        }
+
+        return $user->authenticated && $user->authorized;
+    }
+
+    /**
+     * Create a new user file
+     *
+     * @param array $data
+     *
+     * @return User
+     */
+    public function register($data)
+    {
+        if (!isset($data['groups'])) {
+            //Add new user ACL settings
+            $groups = (array) $this->config->get('plugins.login.user_registration.groups', []);
+
+            if (count($groups) > 0) {
+                $data['groups'] = $groups;
+            }
+        }
+
+        if (!isset($data['access'])) {
+            $access = (array) $this->config->get('plugins.login.user_registration.access.site', []);
+
+            if (count($access) > 0) {
+                $data['access']['site'] = $access;
+            }
+        }
+
+        $username = $this->validateField('username', $data['username']);
+
+        $file = CompiledYamlFile::instance($this->grav['locator']->findResource('account://' . $username . YAML_EXT,
+            true, true));
+
+        // Create user object and save it
+        $user = new User($data);
+        $user->file($file);
+        $user->save();
+
+        return $user;
+    }
+
+    /**
+     * @param string $type
+     * @param mixed  $value
+     * @param string $extra
+     *
+     * @return string
+     */
+    public function validateField($type, $value, $extra = '')
+    {
+        switch ($type) {
+            case 'user':
+            case 'username':
+                /** @var Config $config */
+                $config = Grav::instance()['config'];
+                $username_regex = '/' . $config->get('system.username_regex') . '/';
+
+                if (!is_string($value) || !preg_match($username_regex, $value)) {
+                    throw new \RuntimeException('Username should be between 3 and 16 characters, including lowercase letters, numbers, underscores, and hyphens. Uppercase letters, spaces, and special characters are not allowed');
+                }
+
+                break;
+
+            case 'password1':
+                /** @var Config $config */
+                $config = Grav::instance()['config'];
+                $pwd_regex = '/' . $config->get('system.pwd_regex') . '/';
+
+                if (!is_string($value) || !preg_match($pwd_regex, $value)) {
+                    throw new \RuntimeException('Password must contain at least one number and one uppercase and lowercase letter, and at least 8 or more characters');
+                }
+
+                break;
+
+            case 'password2':
+                if (!is_string($value) || strcmp($value, $extra)) {
+                    throw new \RuntimeException('Passwords did not match.');
+                }
+
+                break;
+
+            case 'email':
+                if (!is_string($value) || !filter_var($value, FILTER_VALIDATE_EMAIL)) {
+                    throw new \RuntimeException('Not a valid email address');
+                }
+
+                break;
+
+            case 'permissions':
+                if (!is_string($value) || !in_array($value, ['a', 's', 'b'])) {
+                    throw new \RuntimeException('Permissions ' . $value . ' are invalid.');
+                }
+
+                break;
+
+            case 'fullname':
+                if (!is_string($value) || trim($value) === '') {
+                    throw new \RuntimeException('Fullname cannot be empty');
+                }
+
+                break;
+
+            case 'state':
+                if ($value !== 'enabled' && $value !== 'disabled') {
+                    throw new \RuntimeException('State is not valid');
+                }
+
+                break;
+
+        }
+
+        return $value;
+    }
+
+    /**
+     * Handle the email to notify the user account creation to the site admin.
+     *
+     * @param User $user
+     *
+     * @return bool True if the action was performed.
+     * @throws \RuntimeException
+     */
+    public function sendNotificationEmail(User $user)
+    {
+        if (empty($user->email)) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.USER_NEEDS_EMAIL_FIELD'));
+        }
+
+        $site_name = $this->config->get('site.title', 'Website');
+
+        $subject = $this->language->translate(['PLUGIN_LOGIN.NOTIFICATION_EMAIL_SUBJECT', $site_name]);
+        $content = $this->language->translate([
+            'PLUGIN_LOGIN.NOTIFICATION_EMAIL_BODY',
+            $site_name,
+            $user->username,
+            $user->email,
+            $this->grav['base_url_absolute'],
+        ]);
+        $to = $this->config->get('plugins.email.from');
+
+        if (empty($to)) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.EMAIL_NOT_CONFIGURED'));
+        }
+
+        $sent = EmailUtils::sendEmail($subject, $content, $to);
+
+        if ($sent < 1) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.EMAIL_SENDING_FAILURE'));
+        }
+
+        return true;
+    }
+
+    /**
+     * Handle the email to welcome the new user
+     *
+     * @param User $user
+     *
+     * @return bool True if the action was performed.
+     * @throws \RuntimeException
+     */
+    public function sendWelcomeEmail(User $user)
+    {
+        if (empty($user->email)) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.USER_NEEDS_EMAIL_FIELD'));
+        }
+
+        $site_name = $this->config->get('site.title', 'Website');
+        $author = $this->grav['config']->get('site.author.name', '');
+        $fullname = $user->fullname ?: $user->username;
+
+        $subject = $this->language->translate(['PLUGIN_LOGIN.WELCOME_EMAIL_SUBJECT', $site_name]);
+        $content = $this->language->translate(['PLUGIN_LOGIN.WELCOME_EMAIL_BODY',
+            $fullname,
+            $this->grav['base_url_absolute'],
+            $site_name,
+            $author
+        ]);
+        $to = $user->email;
+
+        $sent = EmailUtils::sendEmail($subject, $content, $to);
+
+        if ($sent < 1) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.EMAIL_SENDING_FAILURE'));
+        }
+
+        return true;
+    }
+
+    /**
+     * Handle the email to activate the user account.
+     *
+     * @param User $user
+     *
+     * @return bool True if the action was performed.
+     * @throws \RuntimeException
+     */
+    public function sendActivationEmail(User $user)
+    {
+        if (empty($user->email)) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.USER_NEEDS_EMAIL_FIELD'));
+        }
+
+        $token = md5(uniqid(mt_rand(), true));
+        $expire = time() + 604800; // next week
+        $user->activation_token = $token . '::' . $expire;
+        $user->save();
+
+        $param_sep = $this->config->get('system.param_sep', ':');
+        $activation_link = $this->grav['base_url_absolute'] . $this->config->get('plugins.login.route_activate') . '/token' . $param_sep . $token . '/username' . $param_sep . $user->username;
+
+        $site_name = $this->config->get('site.title', 'Website');
+        $author = $this->grav['config']->get('site.author.name', '');
+        $fullname = $user->fullname ?: $user->username;
+
+        $subject = $this->language->translate(['PLUGIN_LOGIN.ACTIVATION_EMAIL_SUBJECT', $site_name]);
+        $content = $this->language->translate(['PLUGIN_LOGIN.ACTIVATION_EMAIL_BODY',
+            $fullname,
+            $activation_link,
+            $site_name,
+            $author
+        ]);
+        $to = $user->email;
+
+
+
+        $sent = EmailUtils::sendEmail($subject, $content, $to);
+
+        if ($sent < 1) {
+            throw new \RuntimeException($this->language->translate('PLUGIN_LOGIN.EMAIL_SENDING_FAILURE'));
+        }
+
+        return true;
+    }
+
+    /**
+     * Gets and sets the RememberMe class
+     *
+     * @param  mixed $var A rememberMe instance to set
+     *
+     * @return RememberMe Returns the current rememberMe instance
+     * @throws \InvalidArgumentException
+     */
+    public function rememberMe($var = null)
+    {
+        if ($var !== null) {
+            $this->rememberMe = $var;
+        }
+
+        if (!$this->rememberMe) {
+            /** @var Config $config */
+            $config = $this->grav['config'];
+
+            // Setup storage for RememberMe cookies
+            $storage = new TokenStorage;
+            $this->rememberMe = new RememberMe($storage);
+            $this->rememberMe->setCookieName($config->get('plugins.login.rememberme.name'));
+            $this->rememberMe->setExpireTime($config->get('plugins.login.rememberme.timeout'));
+
+            // Hardening cookies with user-agent and random salt or
+            // fallback to use system based cache key
+            $server_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : 'unknown';
+            $data = $server_agent . $config->get('security.salt', $this->grav['cache']->getKey());
+            $this->rememberMe->setSalt(hash('sha512', $data));
+
+            // Set cookie with correct base path of Grav install
+            $cookie = new Cookie;
+            $cookie->setPath($this->grav['base_url_relative'] ?: '/');
+            $this->rememberMe->setCookie($cookie);
+        }
+
+        return $this->rememberMe;
+    }
+
+    /**
+     * Gets and sets the TwoFactorAuth object
+     *
+     * @param TwoFactorAuth $var
+     * @return TwoFactorAuth
+     * @throws \RobThree\Auth\TwoFactorAuthException
+     */
+    public function twoFactorAuth($var = null)
+    {
+        if ($var !== null) {
+            $this->twoFa = $var;
+        }
+
+        if (!$this->twoFa) {
+            $this->twoFa = new TwoFactorAuth;
+        }
+
+        return $this->twoFa;
+    }
+
+    /**
+     * @param string $context
+     * @param int $maxCount
+     * @param int $interval
+     * @return RateLimiter
+     */
+    public function getRateLimiter($context, $maxCount = null, $interval = null)
+    {
+        if (!isset($this->rateLimiters[$context])) {
+            switch ($context) {
+                case 'login_attempts':
+                    $maxCount = $this->grav['config']->get('plugins.login.max_login_count', 5);
+                    $interval = $this->grav['config']->get('plugins.login.max_login_interval', 10);
+                    break;
+                case 'pw_resets':
+                    $maxCount = $this->grav['config']->get('plugins.login.max_pw_resets_count', 0);
+                    $interval = $this->grav['config']->get('plugins.login.max_pw_resets_interval', 2);
+                    break;
+            }
+            $this->rateLimiters[$context] = new RateLimiter($context, $maxCount, $interval);
+        }
+
+        return $this->rateLimiters[$context];
+    }
+
+    /**
+     * @param User $user
+     * @param Page $page
+     * @param Data|null $config
+     * @return bool
+     */
+    public function isUserAuthorizedForPage(User $user, Page $page, $config = null)
+    {
+        $header = $page->header();
+        $rules = isset($header->access) ? (array)$header->access : [];
+
+        if ($config !== null && $config->get('parent_acl')) {
+            // If page has no ACL rules, use its parent's rules
+            if (!$rules) {
+                $parent = $page->parent();
+                while (!$rules and $parent) {
+                    $header = $parent->header();
+                    $rules = isset($header->access) ? (array)$header->access : [];
+                    $parent = $parent->parent();
+                }
+            }
+        }
+
+        // Continue to the page if it has no ACL rules.
+        if (!$rules) {
+            return true;
+        }
+
+        if (!$user->authorized) {
+            return false;
+        }
+
+        // Continue to the page if user is authorized to access the page.
+        foreach ($rules as $rule => $value) {
+            if (is_array($value)) {
+                foreach ($value as $nested_rule => $nested_value) {
+                    if ($user->authorize($rule . '.' . $nested_rule) == $nested_value) {
+                        return true;
+                    }
+                }
+            } else {
+                if ($user->authorize($rule) == $value) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if user may use password reset functionality.
+     *
+     * @param User   $user
+     * @param string $field
+     * @param int    $count
+     * @param int    $interval
+     * @return bool
+     * @deprecated 2.5.0 Use $grav['login']->getRateLimiter($context) instead. See Grav\Plugin\Login\RateLimiter class.
+     */
+    public function isUserRateLimited(User $user, $field, $count, $interval)
+    {
+        if ($count > 0) {
+            if (!isset($user->{$field})) {
+                $user->{$field} = [];
+            }
+            //remove older than $interval x minute attempts
+            $actual_resets = [];
+            foreach ((array)$user->{$field} as $reset) {
+                if ($reset > (time() - $interval * 60)) {
+                    $actual_resets[] = $reset;
+                }
+            }
+
+            if (count($actual_resets) >= $count) {
+                return true;
+            }
+            $actual_resets[] = time(); // current reset
+            $user->{$field} = $actual_resets;
+
+        }
+        return false;
+    }
+
+    /**
+     * Reset the rate limit counter.
+     *
+     * @param User   $user
+     * @param string $field
+     * @deprecated 2.5.0 Use $grav['login']->getRateLimiter($context) instead. See Grav\Plugin\Login\RateLimiter class.
+     */
+    public function resetRateLimit(User $user, $field)
+    {
+        $user->{$field} = [];
+    }
+
+    /**
+     * Get Current logged in user
+     *
+     * @return User
+     * @deprecated 2.5.0 Use $grav['user'] instead.
+     */
+    public function getUser()
+    {
+        /** @var User $user */
+        return $this->grav['user'];
+    }
+
+    public function addProviderLoginTemplate($template)
+    {
+        $this->provider_login_templates[] = $template;
+    }
+
+    public function getProviderLoginTemplates()
+    {
+        $templates =  $this->provider_login_templates;
+
+        return $templates;
+    }
+
+}

user/plugins/login/classes/LoginCache.php

@@ -0,0 +1,103 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login;
+
+use Doctrine\Common\Cache\FilesystemCache;
+use Grav\Common\Grav;
+
+/**
+ * PSR-16 forward compatible cache.
+ * @package Grav\Plugin\Login
+ */
+class LoginCache
+{
+    /**
+     * @var FilesystemCache
+     */
+    protected $driver;
+
+    protected $lifetime;
+
+    /**
+     * @param string $namespace
+     * @param null|int $defaultLifetime
+     * @throws \InvalidArgumentException
+     */
+    public function __construct($namespace, $defaultLifetime = null)
+    {
+        // Setup cache
+        $this->lifetime = (int)$defaultLifetime;
+        $this->driver = new FilesystemCache(Grav::instance()['locator']->findResource('cache://login/' . $namespace, true, true));
+    }
+
+    /**
+     * Fetches a value from the cache.
+     *
+     * @param string $key     The unique key of this item in the cache.
+     * @param mixed  $default Default value to return if the key does not exist.
+     *
+     * @return mixed The value of the item from the cache, or $default in case of cache miss.
+     */
+    public function get($key, $default = null)
+    {
+        $value = $this->driver->fetch($key);
+
+        // Doctrine cache does not differentiate between no result and cached 'false'. Make sure that we do.
+        return $value !== false || $this->driver->contains($key) ? $value : $default;
+    }
+
+    /**
+     * Persists data in the cache, uniquely referenced by a key with an optional expiration TTL time.
+     *
+     * @param string                $key   The key of the item to store.
+     * @param mixed                 $value The value of the item to store, must be serializable.
+     * @param null|int              $ttl   Optional. The TTL value of this item.
+     *
+     * @return bool True on success and false on failure.
+     */
+    public function set($key, $value, $ttl = null)
+    {
+        $ttl = $ttl !== null ? (int)$ttl : $this->lifetime;
+
+        return $this->driver->save($key, $value, $ttl);
+    }
+
+    /**
+     * Determines whether an item is present in the cache.
+     *
+     * @param string $key The cache item key.
+     *
+     * @return bool
+     */
+    public function has($key)
+    {
+        return $this->driver->contains($key);
+    }
+
+    /**
+     * Delete an item from the cache by its unique key.
+     *
+     * @param string $key The unique cache key of the item to delete.
+     *
+     * @return bool True if the item was successfully removed. False if there was an error.
+     */
+    public function delete($key)
+    {
+        return $this->driver->delete($key);
+    }
+
+    /**
+     * Wipes clean the entire cache's keys.
+     *
+     * @return bool True on success and false on failure.
+     */
+    public function clear()
+    {
+        return $this->driver->flushAll();
+    }
+}

user/plugins/login/classes/RateLimiter.php

@@ -0,0 +1,108 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login;
+
+/**
+ * Class RateLimiter
+ * @package Grav\Plugin\Login\RateLimiter
+ */
+class RateLimiter
+{
+    /** @var LoginCache */
+    protected $cache;
+
+    /** @var int */
+    protected $maxCount;
+
+    /** @var int */
+    protected $interval;
+
+    /**
+     * RateLimiter constructor.
+     * @param string $context
+     * @param int $maxCount
+     * @param int|null $interval
+     */
+    public function __construct($context, $maxCount, $interval)
+    {
+        $this->cache = new LoginCache($context, (int)$interval * 60);
+        $this->maxCount = (int) $maxCount;
+        $this->interval = (int) $interval;
+    }
+
+    /**
+     * @return int
+     */
+    public function getInterval()
+    {
+        return $this->interval;
+    }
+
+    /**
+     * Check if user has hit rate limiter. Remember to use registerRateLimitedAction() before doing the check.
+     *
+     * @param string $key
+     * @param string $type
+     * @return bool
+     */
+    public function isRateLimited($key, $type = 'username')
+    {
+        if (!$key || !$this->interval) {
+            return false;
+        }
+
+        return $this->maxCount && count($this->getAttempts($key, $type)) > $this->maxCount;
+    }
+
+    /**
+     *
+     *
+     * @param string $key
+     * @param string $type
+     * @return array
+     */
+    public function getAttempts($key, $type = 'username')
+    {
+        return (array) $this->cache->get($type . $key, []);
+    }
+
+    /**
+     * Register rate limited action.
+     *
+     * @param string $key
+     * @param string $type
+     * @return $this
+     */
+    public function registerRateLimitedAction($key, $type = 'username')
+    {
+        if ($key && $this->interval) {
+            $tries = (array)$this->cache->get($type . $key, []);
+            $tries[] = time();
+
+            $this->cache->set($type . $key, $tries);
+        }
+
+        return $this;
+    }
+
+    /**
+     * Reset the user rate limit counter.
+     *
+     * @param string $key
+     * @param string $type
+     * @return $this
+     */
+    public function resetRateLimit($key, $type = 'username')
+    {
+        if ($key) {
+            $this->cache->delete($type . $key);
+        }
+
+        return $this;
+    }
+}

user/plugins/login/classes/RememberMe/RememberMe.php

@@ -0,0 +1,41 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login\RememberMe;
+
+use Birke\Rememberme\Authenticator;
+use Birke\Rememberme\Storage\StorageInterface;
+
+/**
+ * RememberMe
+ *
+ * Handles persistent cookie-storage (Remember Me)
+ *
+ * @author  Sommerregen <sommerregen@benjamin-regler.de>
+ */
+class RememberMe extends Authenticator
+{
+    /**
+     * Gets storage interface
+     *
+     * @return StorageInterface
+     */
+    public function getStorage()
+    {
+        return $this->storage;
+    }
+
+    /**
+     * Set storage interface
+     *
+     * @param StorageInterface $storage Storage interface
+     */
+    public function setStorage($storage)
+    {
+        $this->storage = $storage;
+    }
+}

user/plugins/login/classes/RememberMe/TokenStorage.php

@@ -0,0 +1,198 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2017 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login\RememberMe;
+
+use Grav\Common\Cache;
+use Grav\Common\Grav;
+use Doctrine\Common\Cache\CacheProvider;
+use Doctrine\Common\Cache\FilesystemCache;
+use Birke\Rememberme\Storage\StorageInterface;
+
+/**
+ * Storage wrapper for Doctrine cache
+ *
+ * Used for storing the credential/token/persistentToken triplets.
+ *
+ * @author  Sommerregen <sommerregen@benjamin-regler.de>
+ */
+class TokenStorage implements StorageInterface
+{
+    /**
+     * @var CacheProvider
+     */
+    protected $driver;
+
+    /**
+     * @var string
+     */
+    protected $cache_dir;
+
+    /**
+     * Constructor
+     *
+     * @param string    $path   Path to storage directory
+     * @throws \InvalidArgumentException
+     */
+    public function __construct($path = 'cache://rememberme')
+    {
+        /** @var Cache $cache */
+        $cache = Grav::instance()['cache'];
+
+        $this->cache_dir = Grav::instance()['locator']->findResource($path, true, true);
+
+        // Setup cache
+        $this->driver = $cache->getCacheDriver();
+        if ($this->driver instanceof FilesystemCache) {
+            $this->driver = new FilesystemCache($this->cache_dir);
+        }
+
+        // Set the cache namespace to our unique key
+        $this->driver->setNamespace($cache->getKey());
+    }
+
+    /**
+     * Return Tri-state value constant
+     *
+     * @param mixed     $credential         Unique credential (user id,
+     *                                      email address, user name)
+     * @param string    $token              One-Time Token
+     * @param string    $persistentToken    Persistent Token
+     *
+     * @return int
+     */
+    public function findTriplet($credential, $token, $persistentToken)
+    {
+
+        // Hash the tokens, because they can contain a salt and can be
+        // accessed in the file system
+        $persistentToken = sha1(trim($persistentToken));
+        $token = sha1(trim($token));
+
+        $id = $this->getId($credential);
+        if (!$this->driver->contains($id)) {
+            return self::TRIPLET_NOT_FOUND;
+        }
+
+        list($expire, $tokens) = $this->driver->fetch($id);
+        if (isset($tokens[$persistentToken]) && $tokens[$persistentToken] === $token) {
+            return self::TRIPLET_FOUND;
+        }
+
+        return self::TRIPLET_INVALID;
+    }
+
+    /**
+     * Store the new token for the credential and the persistent token.
+     * Create a new storage entry, if the combination of credential and
+     * persistent token does not exist.
+     *
+     * @param mixed     $credential
+     * @param string    $token
+     * @param string    $persistentToken
+     * @param int       $expire             Timestamp when this triplet
+     *                                      will expire (0 = no expiry)
+     */
+    public function storeTriplet($credential, $token, $persistentToken, $expire = null)
+    {
+        // Hash the tokens, because they can contain a salt and can be
+        // accessed in the file system
+        $persistentToken = sha1(trim($persistentToken));
+        $token = sha1(trim($token));
+
+        $e = null;
+        $tokens = [];
+        $id = $this->getId($credential);
+        if ($this->driver->contains($id)) {
+            list($e, $tokens) = $this->driver->fetch($id);
+        }
+
+        // Get cache lifetime for tokens
+        if ($expire === null && $e === null) {
+            /** @var Cache $cache */
+            $cache = Grav::instance()['cache'];
+            $expire = $cache->getLifetime();
+        } elseif ($expire === null) {
+            $expire = $e;
+        }
+
+        // Update tokens
+        $tokens[$persistentToken] = $token;
+        $this->driver->save($id, [$expire, $tokens], $expire);
+
+        return $this;
+    }
+
+    /**
+     * Replace current token after successful authentication
+     *
+     * @param mixed     $credential
+     * @param string    $token
+     * @param string    $persistentToken
+     * @param int       $expire
+     */
+    public function replaceTriplet($credential, $token, $persistentToken, $expire = null)
+    {
+        $this->cleanTriplet($credential, $persistentToken);
+        $this->storeTriplet($credential, $token, $persistentToken, $expire);
+    }
+
+    /**
+     * Remove one triplet of the user from the store
+     *
+     * @param mixed     $credential
+     * @param string    $persistentToken
+     */
+    public function cleanTriplet($credential, $persistentToken)
+    {
+        // Hash the tokens, because they can contain a salt and can be
+        // accessed in the file system
+        $persistentToken = sha1(trim($persistentToken));
+
+        // Delete token from storage
+        $id = $this->getId($credential);
+        if ($this->driver->contains($id)) {
+            list($expire, $tokens) = $this->driver->fetch($id);
+            unset($tokens[$persistentToken]);
+            $this->driver->save($id, [$expire, $tokens], $expire);
+        }
+    }
+
+    /**
+     * Remove all triplets of a user, effectively logging him out on all
+     * machines
+     *
+     * @param  mixed   $credential
+     */
+    public function cleanAllTriplets($credential)
+    {
+        $id = $this->getId($credential);
+        $this->driver->delete($id);
+    }
+
+    /**
+     * Helper method to clear RememberMe cache
+     */
+    public function clearCache()
+    {
+        $this->driver->flushAll();
+    }
+
+    /**
+     * Get the cache id
+     *
+     * @param  string $key A key to compute the cache id for
+     * @return string      The cache id
+     */
+    protected function getId($key)
+    {
+        /** @var Cache $cache */
+        $cache = Grav::instance()['cache'];
+
+        return 'login' . md5(trim($key) . $cache->getKey());
+    }
+}

user/plugins/login/classes/TwoFactorAuth/BaconQrProvider.php

@@ -0,0 +1,30 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2018 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login\TwoFactorAuth;
+
+use BaconQrCode\Renderer\Image\Png as BaconPng;
+use BaconQrCode\Writer as BaconWriter;
+use RobThree\Auth\Providers\Qr\IQRCodeProvider;
+
+class BaconQrProvider implements IQRCodeProvider
+{
+    public function getMimeType()
+    {
+        return 'image/png';
+    }
+
+    public function getQRCodeImage($qrtext, $size = 256)
+    {
+        $renderer = new BaconPng();
+        $renderer->setHeight($size);
+        $renderer->setWidth($size);
+        $writer = new BaconWriter($renderer);
+
+        return $writer->writeString($qrtext);
+    }
+}

user/plugins/login/classes/TwoFactorAuth/TwoFactorAuth.php

@@ -0,0 +1,74 @@
+<?php
+/**
+ * @package    Grav\Plugin\Login
+ *
+ * @copyright  Copyright (C) 2014 - 2018 RocketTheme, LLC. All rights reserved.
+ * @license    MIT License; see LICENSE file for details.
+ */
+namespace Grav\Plugin\Login\TwoFactorAuth;
+
+use Grav\Common\Grav;
+use RobThree\Auth\TwoFactorAuth as Auth;
+use RobThree\Auth\TwoFactorAuthException;
+
+/**
+ * Class TwoFactorAuth
+ * @package Grav\Plugin\Login\RememberMe
+ */
+class TwoFactorAuth
+{
+    protected $twoFa;
+
+    /**
+     * TwoFactorAuth constructor.
+     * @throws TwoFactorAuthException
+     */
+    public function __construct()
+    {
+        $this->twoFa = new Auth('Grav', 6, 30, 'sha1', new BaconQrProvider);
+    }
+
+    /**
+     * @return Auth
+     */
+    public function get2FA()
+    {
+        return $this->twoFa;
+    }
+
+    /**
+     * @param int $bits
+     * @return string
+     * @throws TwoFactorAuthException
+     */
+    public function createSecret($bits = 160)
+    {
+        return $this->twoFa->createSecret($bits);
+    }
+
+    /**
+     * @param string $secret
+     * @param string $code
+     * @return bool
+     */
+    public function verifyCode($secret, $code)
+    {
+        $secret = str_replace(' ', '', $secret);
+
+        return $this->twoFa->verifyCode($secret, $code);
+    }
+
+    /**
+     * @param string $username
+     * @param string $secret
+     * @return string
+     * @throws TwoFactorAuthException
+     */
+    public function getQrImageData($username, $secret)
+    {
+        $label = $username . ':' . Grav::instance()['config']->get('site.title');
+        $secret = str_replace(' ', '', $secret);
+
+        return $this->twoFa->getQRCodeImageAsDataUri($label, $secret);
+    }
+}