Changeset 126

Timestamp:

May 24, 2006 6:07:38 AM (18 years ago)

Author:

scdev

Message:

Q - Releasing tags/2.0.1, use branches/2.0 for maintaining.

Location:

tags/2.0.1

Files:

• lib/App.inc.php (modified) (2 diffs)
• lib/Auth_SQL.inc.php (modified) (6 diffs)
• lib/Email.inc.php (modified) (1 diff)
• tests/Auth_FileTest.php (modified) (3 diffs)
• tests/Auth_SQLTest.php (modified) (4 diffs)
• tests/RecordLockTest.php (modified) (2 diffs)
• tests/_config.inc.php (modified) (1 diff)
• tests/run_tests.sh (modified) (1 diff)

tags/2.0.1/lib/App.inc.php

@@ -16 +16 @@
 define('MSG_NOTICE', 4);
 define('MSG_SUCCESS', 8);
+define('MSG_ALL', MSG_SUCCESS | MSG_NOTICE | MSG_WARNING | MSG_ERROR);
 
 require_once dirname(__FILE__) . '/Utilities.inc.php';
@@ -1106 +1107 @@
     function sslOff()
     {
+        if (!isset($this) || !is_a($this, 'App') && !is_subclass_of($this, 'App')) {
+            $this =& App::getInstance();
+        }
+
         if ('' != getenv('HTTPS')) {
             $this->dieURL('http://' . getenv('HTTP_HOST') . getenv('REQUEST_URI'), null, true);

tags/2.0.1/lib/Auth_SQL.inc.php

@@ -251 +251 @@
             WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'
         ");
-        $_SESSION['_auth_file'] = array('authenticated' => false);
+        $_SESSION[$this->_sess] = array('authenticated' => false);
     }
 
@@ -300 +300 @@
         $this->initDB();
 
-        // Query DB for user matching credentials.
-        // FIXME: Cannot compare crypt style passwords this way.
-        $qid = DB::query("
-            SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
-            FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
-            AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
-        ");
+        switch ($this->_params['encryption_type']) {
+        case AUTH_ENCRYPT_CRYPT :
+            // Query DB for user matching credentials. Compare cyphertext with salted-encrypted password.
+            $qid = DB::query("
+                SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
+                FROM " . $this->_params['db_table'] . "
+                WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
+                AND BINARY userpass = ENCRYPT('" . DB::escapeString($password) . "', LEFT(userpass, 2)))
+            ");
+            break;
+        case AUTH_ENCRYPT_PLAINTEXT :
+        case AUTH_ENCRYPT_MD5 :
+        case AUTH_ENCRYPT_SHA1 :
+        default :
+            // Query DB for user matching credentials. Directly compare cyphertext with result from encryptPassword().
+            $qid = DB::query("
+                SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
+                FROM " . $this->_params['db_table'] . "
+                WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
+                AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
+            ");
+            break;
+        }
 
         // Return user data if found.
@@ -528 +543 @@
                 $expire_reasons[] = 'idle_timeout expired';
             }
-            if ($_SESSION['_auth_file']['remote_ip'] != getRemoteAddr() && !$user_in_trusted_network) {
+            if ($_SESSION[$this->_sess]['remote_ip'] != getRemoteAddr() && !$user_in_trusted_network) {
                 $expire_reasons[] = sprintf('remote_ip not matched (%s != %s)', $_SESSION[$this->_sess]['remote_ip'], getRemoteAddr());
             }
@@ -682 +697 @@
      *
      */
-    function encryptPassword($password)
+    function encryptPassword($password, $salt=null)
     {
         switch ($this->_params['encryption_type']) {
@@ -690 +705 @@
 
         case AUTH_ENCRYPT_CRYPT :
-            return crypt($password);
+            // If comparing clear-text password with encrypted text, provide encrypted text as the salt.
+            return isset($salt) ? crypt($password, substr($salt, 0, 2)) : crypt($password);
             break;
 
@@ -720 +736 @@
             WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
         ");
+        
+        if (mysql_affected_rows(DB::getDBH()) != 1) {
+            App::logMsg(sprintf('setPassword failed to update password for user %s', $user_id), LOG_NOTICE, __FILE__, __LINE__);
+        }
     }
 

tags/2.0.1/lib/Email.inc.php

@@ -281 +281 @@
         if (mail($final_to, $this->_params['subject'], $final_body, $final_headers, $envelope_sender_header)) {
             App::logMsg(sprintf('Email successfully sent to %s', $final_to), LOG_DEBUG, __FILE__, __LINE__);
-            return true
+            return true;
         } else {
             App::logMsg(sprintf('Email failure with parameters: %s, %s, %s, %s', $final_to, $this->_params['subject'], str_replace("\r\n", '\r\n', $final_headers), $envelope_sender_header), LOG_NOTICE, __FILE__, __LINE__);

tags/2.0.1/tests/Auth_FileTest.php

@@ -23 +23 @@
         require dirname(__FILE__) . '/_config.inc.php';
         require_once '../lib/Auth_File.inc.php';
-        $this->Auth_File =& new Auth_File(array('htpasswd_file' => dirname(__FILE__) . '/_test_htpasswd'));
+        $this->Auth_File =& new Auth_File('test');
+        $this->Auth_File->setParam(array('htpasswd_file' => dirname(__FILE__) . '/_test_htpasswd'));
     }
 
@@ -44 +45 @@
         $result = $this->Auth_File->login('testuser', 'testpass');
         $this->assertTrue($result, 'testuser login failed.');
-        $this->assertTrue($_SESSION['_auth']['authenticated'], 'testuser authentication not found in session.');
+        $this->assertTrue($_SESSION['_auth_test']['authenticated'], 'testuser authentication not found in session.');
     }
 
@@ -51 +52 @@
         $result = $this->Auth_File->login('testuser', 'testpass');
         $this->Auth_File->clearauth();
-        $this->assertFalse($_SESSION['_auth']['authenticated'], 'testuser authentication not false in session.');
+        $this->assertFalse($_SESSION['_auth_test']['authenticated'], 'testuser authentication not false in session.');
     }
 

tags/2.0.1/tests/Auth_SQLTest.php

@@ -29 +29 @@
             'db_login_table'    => 'test_login_tbl',
             'login_url'         => '/login.php',
-            'blocking'          => true
+            'blocking'          => true,
+            'encryption_type' => AUTH_ENCRYPT_SHA1,
         ));
 
@@ -46 +47 @@
             ) VALUES (
                 'testuser',
-                md5('testpass'),
+                '" . $this->Auth_SQL->encryptpassword('testpass') . "',
                 'John',
                 'Doe',
@@ -185 +186 @@
     function test_encryptpassword()
     {
+        $this->Auth_SQL->setParam(array('encryption_type' => AUTH_ENCRYPT_MD5));
         $result = $this->Auth_SQL->encryptpassword('123');
         $this->assertEquals('202cb962ac59075b964b07152d234b70', $result);
+
+        $this->Auth_SQL->setParam(array('encryption_type' => AUTH_ENCRYPT_SHA1));
+        $result = $this->Auth_SQL->encryptpassword('123');
+        $this->assertEquals('40bd001563085fc35165329ea1ff5c5ecbdbbeef', $result);
+
+        $this->Auth_SQL->setParam(array('encryption_type' => AUTH_ENCRYPT_PLAINTEXT));
+        $result = $this->Auth_SQL->encryptpassword('123');
+        $this->assertEquals('123', $result);
+
+        $this->Auth_SQL->setParam(array('encryption_type' => AUTH_ENCRYPT_CRYPT));
+        $result = $this->Auth_SQL->encryptpassword('123', 'saltstring');
+        $this->assertEquals('saEZ6MlWYV9nQ', $result);
     }
 
@@ -197 +211 @@
         ");
         list($pass) = mysql_fetch_row($qid);
-        $this->assertEquals('202cb962ac59075b964b07152d234b70', $pass);
+        $this->assertEquals('40bd001563085fc35165329ea1ff5c5ecbdbbeef', $pass);
     }
 

tags/2.0.1/tests/RecordLockTest.php

@@ -49 +49 @@
             ) VALUES (
                 'testuser',
-                md5('testpass'),
+                '" . $this->Auth_SQL->encryptpassword('testpass') . "',
                 'John',
                 'Doe',
@@ -56 +56 @@
             )
         ");
-        $this->Auth_SQL->login('testuser', 'testpass');
+        if (!$this->Auth_SQL->login('testuser', 'testpass')) {
+            trigger_error('Test user not logged in.', E_USER_WARNING);
+        }
 
         $this->RecordLock =& RecordLock::getInstance($this->Auth_SQL);

tags/2.0.1/tests/_config.inc.php

@@ -29 +29 @@
     'log_screen_priority' => LOG_WARNING,
     'error_reporting' => E_ALL,
+    'signing_key' => 'atestsaltkey',
 ));
 

tags/2.0.1/tests/run_tests.sh

@@ -7 +7 @@
 for foo in *Test.php; 
 do
-    /usr/local/bin/php $foo;
+    php4 $foo;
 done;