Changeset 124


Ignore:
Timestamp:
May 24, 2006 5:35:19 AM (18 years ago)
Author:
scdev
Message:

Q - Improved hashing algorithms in Auth_SQL, added more sc- css selectors, misc bug fixes

Files:
9 edited

Legend:

Unmodified
Added
Removed

  • branches/1.1dev/bin/module_maker/module.cli.php

    r109 r124  
    422422        echo "Attempting to create user trash folder: $user_trash_folder/\n";
    423423        mkdir($user_trash_folder);
    424         chmod($user_trash_folder, 0777);
     424        chmod($user_trash_folder, 0700);
    425425    }
    426426    if (!is_dir("$user_trash_folder") || !is_writable("$user_trash_folder")) {

  • trunk/bin/module_maker/skel/adm_list.ihtml

    r121 r124  
    2828    <?php for ($i = 0; $i <= $page->last_item - $page->first_item && $page->total_items > 0; $i++) { ?>
    2929    <tr>
    30         <td class="padleft sc-nowrap"><a title="<?php printf(_("Edit %s"), oTxt($list[$i]['<##>'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $list[$i]['%PRIMARY_KEY%']); ?>"><img src="/admin/_widgets/edit.gif" alt="Edit" width="14" height="18" border="0"></a> &nbsp;</td>
    31         <td class="padleft sc-nowrap"><a title="<?php printf(_("Versions of %s"), oTxt($list[$i]['<##>'])) ?>" href="<?php echo App::oHREF('/admin/versions.php?record_table=%DB_TBL%&record_key=%PRIMARY_KEY%&boomerang=true&record_val=' . $list[$i]['%PRIMARY_KEY%']); ?>"><img src="/admin/_widgets/subcategory.gif" alt="" width="18" height="14" border="0" /></a> &nbsp;</td>
     30        <td class="sc-padleft sc-nowrap"><a title="<?php printf(_("Edit %s"), oTxt($list[$i]['<##>'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=edit&%PRIMARY_KEY%=' . $list[$i]['%PRIMARY_KEY%']); ?>"><img src="/admin/_widgets/edit.gif" alt="Edit" width="14" height="18" border="0"></a> &nbsp;</td>
     31        <td class="sc-padleft sc-nowrap"><a title="<?php printf(_("Versions of %s"), oTxt($list[$i]['<##>'])) ?>" href="<?php echo App::oHREF('/admin/versions.php?record_table=%DB_TBL%&record_key=%PRIMARY_KEY%&boomerang=true&record_val=' . $list[$i]['%PRIMARY_KEY%']); ?>"><img src="/admin/_widgets/subcategory.gif" alt="" width="18" height="14" border="0" /></a> &nbsp;</td>
    3232%ADM_LIST_ROWS%
    33         <td class="padleft sc-nowrap" align="right"><a title="<?php printf(_("Delete %s"), oTxt($list[$i]['<##>'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . "?op=del&%PRIMARY_KEY%=" . $list[$i]['%PRIMARY_KEY%']); ?>" onClick="javascript:return confirm('<?php printf(_("Are you sure you want to delete the record %s? This action is permanent and cannot be undone."), oTxt($list[$i]['<##>'])) ?>')"><img src="/admin/_widgets/delete.gif" alt="Delete" width="16" height="17" border="0"></a> &nbsp;</td>
     33        <td class="sc-padleft sc-nowrap" align="right"><a title="<?php printf(_("Delete %s"), oTxt($list[$i]['<##>'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . "?op=del&%PRIMARY_KEY%=" . $list[$i]['%PRIMARY_KEY%']); ?>" onClick="javascript:return confirm('<?php printf(_("Are you sure you want to delete the record %s? This action is permanent and cannot be undone."), oTxt($list[$i]['<##>'])) ?>')"><img src="/admin/_widgets/delete.gif" alt="Delete" width="16" height="17" border="0"></a> &nbsp;</td>
    3434    </tr>
    3535    <?php } ?>

  • trunk/docs/revision_history.txt

    r42 r124  
    1 --------------------------------------------------------------------------------
     1---------------------------------------------------------------------
     2Strangecode codebase 2.1
     3---------------------------------------------------------------------
     4
     5css/utilities.inc.php and css/codebase.inc.php now have sc- prepended to all selectors. This regex will convert an existing site to the new sc- format:
     6s/class="([\w-]+ )*(tiny|small|medium|large|full|twolines|short|tall|fullscreen|nowrap|clearboth|center|right|padright|padleft|padleft|help|monospaced|pkg)( [\w-]+)*"/class="$1sc-$2$3"/gi
     7
     8
     9
     10---------------------------------------------------------------------
    211Strangecode codebase 2.0
    3 --------------------------------------------------------------------------------
     12---------------------------------------------------------------------
    413
    514Codebase self contained. runs without reference to external files or info.
    … …  
    6978
    7079
    71 --------------------------------------------------------------------------------
     80---------------------------------------------------------------------
    7281Strangecode codebase 1.0.0 release
    73 --------------------------------------------------------------------------------
     82---------------------------------------------------------------------
    7483
    7584This is the primary stable release used before we started using Subversion. It was maintained erratically by one erratic person. No revision info documented, sorry.

  • trunk/lib/App.inc.php

    r119 r124  
    11071107    function sslOff()
    11081108    {
     1109        if (!isset($this) || !is_a($this, 'App') && !is_subclass_of($this, 'App')) {
     1110            $this =& App::getInstance();
     1111        }
     1112
    11091113        if ('' != getenv('HTTPS')) {
    11101114            $this->dieURL('http://' . getenv('HTTP_HOST') . getenv('REQUEST_URI'), null, true);

  • trunk/lib/Auth_SQL.inc.php

    r121 r124  
    44 *
    55 * @author  Quinn Comendant <quinn@strangecode.com>
    6  * @version 2.0
     6 * @version 2.1
    77 */
    88
    99// Available encryption types for class Auth_SQL.
    10 define('AUTH_ENCRYPT_MD5', 'md5');
    11 define('AUTH_ENCRYPT_CRYPT', 'crypt');
    12 define('AUTH_ENCRYPT_SHA1', 'sha1');
    13 define('AUTH_ENCRYPT_PLAINTEXT', 'plaintext');
     10define('AUTH_ENCRYPT_MD5', 1);
     11define('AUTH_ENCRYPT_CRYPT', 2);
     12define('AUTH_ENCRYPT_SHA1', 3);
     13define('AUTH_ENCRYPT_PLAINTEXT', 4);
    1414
    1515require_once dirname(__FILE__) . '/Email.inc.php';
    … …  
    4141
    4242        // The type of encryption to use for passwords stored in the db_table. Use one of the AUTH_ENCRYPT_* types specified above.
    43         'encryption_type' => AUTH_ENCRYPT_MD5,
     43        'encryption_type' => AUTH_ENCRYPT_SHA1,
    4444
    4545        // The URL to the login script.
    … …  
    4747
    4848        // The maximum amount of time a user is allowed to be logged in. They will be forced to login again if they expire.
    49         // This applies to admins and users. In seconds. 21600 seconds = 6 hours.
     49        // In seconds. 21600 seconds = 6 hours.
    5050        'login_timeout' => 21600,
    5151
    5252        // The maximum amount of time a user is allowed to be idle before their session expires. They will be forced to login again if they expire.
    53         // This applies to admins and users. In seconds. 3600 seconds = 1 hour.
     53        // In seconds. 3600 seconds = 1 hour.
    5454        'idle_timeout' => 3600,
    5555
    … …  
    300300        $this->initDB();
    301301
    302         // Query DB for user matching credentials.
    303         // FIXME: Cannot compare crypt style passwords this way.
    304         $qid = DB::query("
    305             SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
    306             FROM " . $this->_params['db_table'] . "
    307             WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
    308             AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
    309         ");
     302        switch ($this->_params['encryption_type']) {
     303        case AUTH_ENCRYPT_CRYPT :
     304            // Query DB for user matching credentials. Compare cyphertext with salted-encrypted password.
     305            $qid = DB::query("
     306                SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
     307                FROM " . $this->_params['db_table'] . "
     308                WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
     309                AND BINARY userpass = ENCRYPT('" . DB::escapeString($password) . "', LEFT(userpass, 2)))
     310            ");
     311            break;
     312        case AUTH_ENCRYPT_PLAINTEXT :
     313        case AUTH_ENCRYPT_MD5 :
     314        case AUTH_ENCRYPT_SHA1 :
     315        default :
     316            // Query DB for user matching credentials. Directly compare cyphertext with result from encryptPassword().
     317            $qid = DB::query("
     318                SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
     319                FROM " . $this->_params['db_table'] . "
     320                WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
     321                AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
     322            ");
     323            break;
     324        }
    310325
    311326        // Return user data if found.
    … …  
    665680    function generatePassword($pattern='CvccvCdd')
    666681    {
    667         mt_srand((double) microtime() * 10000000);
    668682        $str = '';
    669683        for ($i=0; $i<strlen($pattern); $i++) {
    … …  
    682696     *
    683697     */
    684     function encryptPassword($password)
     698    function encryptPassword($password, $salt=null)
    685699    {
    686700        switch ($this->_params['encryption_type']) {
    … …  
    690704
    691705        case AUTH_ENCRYPT_CRYPT :
    692             return crypt($password);
     706            // If comparing plaintext password with a hash, provide first two chars of the hash as the salt.
     707            return isset($salt) ? crypt($password, substr($salt, 0, 2)) : crypt($password);
    693708            break;
    694709
    695710        case AUTH_ENCRYPT_SHA1 :
    696             return sha1($password);
     711            return sha1(App::getParam('signing_key') . sha1($password));
    697712            break;
    698713
    699714        case AUTH_ENCRYPT_MD5 :
    700715        default :
    701             return md5($password);
     716            return md5(App::getParam('signing_key') . md5($password));
    702717            break;
    703718        }

  • trunk/lib/PEdit.inc.php

    r121 r124  
    276276                ?>
    277277                <label><?php echo ucfirst(str_replace('_', ' ', $name)); ?></label>
    278                 <textarea name="_pedit_data[<?php echo $name; ?>]" id="sc-pedit-field-<?php echo $name; ?>" rows="" cols="" class="full sc-tall"><?php echo oTxt($this->_data[$name]['content']); ?></textarea>
     278                <textarea name="_pedit_data[<?php echo $name; ?>]" id="sc-pedit-field-<?php echo $name; ?>" rows="" cols="" class="sc-full sc-tall"><?php echo oTxt($this->_data[$name]['content']); ?></textarea>
    279279                <?php
    280280                break;

  • trunk/services/templates/admin_list.ihtml

    r121 r124  
    3131    <?php for ($i = 0; $i <= $page->last_item - $page->first_item && $page->total_items > 0; $i++) { ?>
    3232    <tr>
    33         <td class="padleft sc-nowrap"><a title="<?php printf(_("Edit %s"), oTxt($list[$i]['username'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=edit&admin_id=' . $list[$i]['admin_id']); ?>"><img src="/admin/_widgets/edit.gif" alt="Edit" width="14" height="18" border="0"></a> &nbsp;</td>
    34         <td class="padleft sc-nowrap"><a title="<?php printf(_("Versions of %s"), oTxt($list[$i]['username'])) ?>" href="<?php echo App::oHREF('/admin/versions.php?record_table=admin_tbl&record_key=admin_id&boomerang=true&record_val=' . $list[$i]['admin_id']); ?>"><img src="/admin/_widgets/subcategory.gif" alt="" width="18" height="14" border="0" /></a> &nbsp;</td>
     33        <td class="sc-padleft sc-nowrap"><a title="<?php printf(_("Edit %s"), oTxt($list[$i]['username'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=edit&admin_id=' . $list[$i]['admin_id']); ?>"><img src="/admin/_widgets/edit.gif" alt="Edit" width="14" height="18" border="0"></a> &nbsp;</td>
     34        <td class="sc-padleft sc-nowrap"><a title="<?php printf(_("Versions of %s"), oTxt($list[$i]['username'])) ?>" href="<?php echo App::oHREF('/admin/versions.php?record_table=admin_tbl&record_key=admin_id&boomerang=true&record_val=' . $list[$i]['admin_id']); ?>"><img src="/admin/_widgets/subcategory.gif" alt="" width="18" height="14" border="0" /></a> &nbsp;</td>
    3535        <td class="sc-nowrap"><?php echo oTxt($list[$i]['admin_id'], true); ?> &nbsp;</td>
    3636        <td class="sc-nowrap"><?php echo oTxt($list[$i]['username'], true); ?> &nbsp;</td>
    … …  
    4949        <td class="sc-nowrap"><?php echo oTxt($list[$i]['added_admin_username'], true); ?> &nbsp;</td>
    5050        <td class="sc-nowrap"><?php echo '0000-00-00 00:00:00' == $list[$i]['modified_datetime'] ? '' : date(App::getParam('date_format'), strtotime($list[$i]['modified_datetime'])); ?> &nbsp;</td>
    51         <td class="padleft sc-nowrap" align="right"><a title="<?php printf(_("Delete %s"), oTxt($list[$i]['username'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . "?op=del&admin_id=" . $list[$i]['admin_id']); ?>" onClick="javascript:return confirm('<?php printf(_("Are you sure you want to delete the record %s? This action is permanent and cannot be undone."), oTxt($list[$i]['username'])) ?>')"><img src="/admin/_widgets/delete.gif" alt="Delete" width="16" height="17" border="0"></a> &nbsp;</td>
     51        <td class="sc-padleft sc-nowrap" align="right"><a title="<?php printf(_("Delete %s"), oTxt($list[$i]['username'])) ?>" href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . "?op=del&admin_id=" . $list[$i]['admin_id']); ?>" onClick="javascript:return confirm('<?php printf(_("Are you sure you want to delete the record %s? This action is permanent and cannot be undone."), oTxt($list[$i]['username'])) ?>')"><img src="/admin/_widgets/delete.gif" alt="Delete" width="16" height="17" border="0"></a> &nbsp;</td>
    5252    </tr>
    5353    <?php } ?>

  • trunk/services/templates/versions_diff.ihtml

    r121 r124  
    2020    ?>
    2121    <tr>
    22         <td class="padleft sc-nowrap"<?php echo $style; ?>><label><?php echo $k; ?></label></td>
     22        <td class="sc-padleft sc-nowrap"<?php echo $style; ?>><label><?php echo $k; ?></label></td>
    2323        <td class="sc-padleft"><?php echo $v_d; ?></td>
    2424        <td class="sc-padleft"><?php echo $v_c; ?></td>

  • trunk/services/templates/versions_list.ihtml

    r121 r124  
    1414<tr>
    1515    <?php if ($first) { ?>
    16     <td class="padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=view&current=true&version_id=' . $v['version_id']); ?>">view</a>]</td>
    17     <td class="padleft sc-nowrap" colspan="2">(<?php echo _("Current record"); ?>)</td>
     16    <td class="sc-padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=view&current=true&version_id=' . $v['version_id']); ?>">view</a>]</td>
     17    <td class="sc-padleft sc-nowrap" colspan="2">(<?php echo _("Current record"); ?>)</td>
    1818    <?php } else { ?>
    19     <td class="padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=view&version_id=' . $v['version_id']); ?>">view</a>]</td>
    20     <td class="padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=diff&version_id=' . $v['version_id']); ?>">diff</a>]</td>
    21     <td class="padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=restore&version_id=' . $v['version_id']); ?>">restore</a>]</td>
     19    <td class="sc-padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=view&version_id=' . $v['version_id']); ?>">view</a>]</td>
     20    <td class="sc-padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=diff&version_id=' . $v['version_id']); ?>">diff</a>]</td>
     21    <td class="sc-padleft sc-nowrap">[<a href="<?php echo App::oHREF($_SERVER['PHP_SELF'] . '?op=restore&version_id=' . $v['version_id']); ?>">restore</a>]</td>
    2222    <?php } ?>
    23     <td class="padleft sc-nowrap"><?php echo $v['version_id']; ?></td>
    24     <td class="padleft sc-nowrap"><?php echo date('d M Y H:i:s', strtotime($v['version_datetime'])); ?></td>
    25     <td class="padleft sc-nowrap"><?php echo $v['editor']; ?></td>
     23    <td class="sc-padleft sc-nowrap"><?php echo $v['version_id']; ?></td>
     24    <td class="sc-padleft sc-nowrap"><?php echo date('d M Y H:i:s', strtotime($v['version_datetime'])); ?></td>
     25    <td class="sc-padleft sc-nowrap"><?php echo $v['editor']; ?></td>
    2626</tr>
    2727<?php
Note: See TracChangeset for help on using the changeset viewer.