Changeset 136 for trunk/lib/Auth_SQL.inc.php

Timestamp:

Jun 3, 2006 7:47:48 PM (18 years ago)

Author:

scdev

Message:

Q - Merged branches/2.0singleton into trunk. Completed updating classes to use singleton methods. Implemented tests. Fixed some bugs. Changed some interfaces.

File:

• trunk/lib/Auth_SQL.inc.php (modified) (48 diffs)

trunk/lib/Auth_SQL.inc.php

@@ -1 +1 @@
 <?php
 /**
- * The Auth_SQL:: class provides a SQL implementation for authentication.
+ * The Auth_SQL class provides a SQL implementation for authentication.
  *
  * @author  Quinn Comendant <quinn@strangecode.com>
@@ -8 +8 @@
 
 // Available encryption types for class Auth_SQL.
-define('AUTH_ENCRYPT_MD5', 1);
+define('AUTH_ENCRYPT_PLAINTEXT', 1);
 define('AUTH_ENCRYPT_CRYPT', 2);
 define('AUTH_ENCRYPT_SHA1', 3);
-define('AUTH_ENCRYPT_PLAINTEXT', 4);
+define('AUTH_ENCRYPT_SHA1_HARDENED', 4);
+define('AUTH_ENCRYPT_MD5', 5);
+define('AUTH_ENCRYPT_MD5_HARDENED', 6);
 
 require_once dirname(__FILE__) . '/Email.inc.php';
 
 class Auth_SQL {
-
-    var $_auth = '';
-    var $_sess = '_auth_';
+        
+    // Namespace of this auth object.
+    var $_ns;
+    
+    // Static var for test.
     var $_authentication_tested;
+
+    // Paramters to be configured by setParam.
     var $_params = array();
-
-    // Default param values.
     var $_default_params = array(
 
@@ -41 +45 @@
 
         // The type of encryption to use for passwords stored in the db_table. Use one of the AUTH_ENCRYPT_* types specified above.
-        'encryption_type' => AUTH_ENCRYPT_SHA1,
+        // Hardened password hashes rely on the same key/salt being used to compare encryptions.
+        // Be aware that when using one of the hardened types the App signing_key or $more_salt below cannot change!
+        'encryption_type' => AUTH_ENCRYPT_MD5,
 
         // The URL to the login script.
@@ -90 +96 @@
      * @param optional array $params  A hash containing parameters.
      */
-    function Auth_SQL($auth_name=null)
-    {
-        if (isset($auth_name)) {
-            $this->_auth = $auth_name;
-            $this->_sess .= $auth_name;
-        }
+    function Auth_SQL($namespace='')
+    {
+        $app =& App::getInstance();
+        
+        $this->_ns = '_auth_' . $namespace;
 
         // Initialize default parameters.
@@ -101 +106 @@
 
         // Get create tables config from global context.
-        if (!is_null(App::getParam('db_create_tables'))) {
-            $this->setParam(array('create_table' => App::getParam('db_create_tables')));
+        if (!is_null($app->getParam('db_create_tables'))) {
+            $this->setParam(array('create_table' => $app->getParam('db_create_tables')));
         }
     }
@@ -115 +120 @@
     function initDB($recreate_db=false)
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+    
+    
         static $_db_tested = false;
 
@@ -121 +130 @@
             // User table.
             if ($recreate_db) {
-                DB::query("DROP TABLE IF EXISTS " . $this->getParam('db_table'));
-                App::logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_table')), LOG_DEBUG, __FILE__, __LINE__);
+                $db->query("DROP TABLE IF EXISTS " . $this->getParam('db_table'));
+                $app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_table')), LOG_DEBUG, __FILE__, __LINE__);
             }
 
             // The minimal columns for a table compatable with the Auth_SQL class.
-            DB::query("CREATE TABLE IF NOT EXISTS " . $this->getParam('db_table') . " (
+            $db->query("CREATE TABLE IF NOT EXISTS " . $this->getParam('db_table') . " (
                 " . $this->getParam('db_primary_key') . " smallint(11) NOT NULL auto_increment,
                 " . $this->getParam('db_username_column') . " varchar(255) NOT NULL default '',
@@ -152 +161 @@
             )");
 
-            if (!DB::columnExists($this->getParam('db_table'), array(
+            if (!$db->columnExists($this->getParam('db_table'), array(
                 $this->getParam('db_primary_key'),
                 $this->getParam('db_username_column'),
@@ -173 +182 @@
                 'modified_datetime',
             ), false, false)) {
-                App::logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), LOG_ALERT, __FILE__, __LINE__);
+                $app->logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), LOG_ALERT, __FILE__, __LINE__);
                 trigger_error(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_table')), E_USER_ERROR);
             }
@@ -180 +189 @@
             if ($this->getParam('abuse_detection')) {
                 if ($recreate_db) {
-                    DB::query("DROP TABLE IF EXISTS " . $this->getParam('db_login_table'));
-                    App::logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_login_table')), LOG_DEBUG, __FILE__, __LINE__);
+                    $db->query("DROP TABLE IF EXISTS " . $this->getParam('db_login_table'));
+                    $app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_login_table')), LOG_DEBUG, __FILE__, __LINE__);
                 }
-                DB::query("CREATE TABLE IF NOT EXISTS " . $this->getParam('db_login_table') . " (
+                $db->query("CREATE TABLE IF NOT EXISTS " . $this->getParam('db_login_table') . " (
                     " . $this->getParam('db_primary_key') . " smallint(11) NOT NULL default '0',
                     login_datetime datetime NOT NULL default '0000-00-00 00:00:00',
@@ -192 +201 @@
                 )");
 
-                if (!DB::columnExists($this->getParam('db_login_table'), array(
+                if (!$db->columnExists($this->getParam('db_login_table'), array(
                     $this->getParam('db_primary_key'),
                     'login_datetime',
                     'remote_ip_binary',
                 ), false, false)) {
-                    App::logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), LOG_ALERT, __FILE__, __LINE__);
+                    $app->logMsg(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), LOG_ALERT, __FILE__, __LINE__);
                     trigger_error(sprintf('Database table %s has invalid columns. Please update this table manually.', $this->getParam('db_login_table')), E_USER_ERROR);
                 }
@@ -228 +237 @@
     function getParam($param)
     {
+        $app =& App::getInstance();
+    
         if (isset($this->_params[$param])) {
             return $this->_params[$param];
         } else {
-            App::logMsg(sprintf('Parameter is not set: %s', $param), LOG_DEBUG, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Parameter is not set: %s', $param), LOG_NOTICE, __FILE__, __LINE__);
             return null;
         }
@@ -243 +254 @@
     function clearAuth()
     {
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
-        DB::query("
+        $db->query("
             UPDATE " . $this->_params['db_table'] . " SET
             seconds_online = seconds_online + (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)),
@@ -251 +264 @@
             WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'
         ");
-        $_SESSION[$this->_sess] = array('authenticated' => false);
+        $_SESSION[$this->_ns] = array('authenticated' => false);
     }
 
@@ -263 +276 @@
     function setVal($key, $val)
     {
-        if (!isset($_SESSION[$this->_sess]['user_data'])) {
-            $_SESSION[$this->_sess]['user_data'] = array();
-        }
-        $_SESSION[$this->_sess]['user_data'][$key] = $val;
+        if (!isset($_SESSION[$this->_ns]['user_data'])) {
+            $_SESSION[$this->_ns]['user_data'] = array();
+        }
+        $_SESSION[$this->_ns]['user_data'][$key] = $val;
     }
 
@@ -279 +292 @@
     function getVal($key, $default='')
     {
-        if (isset($_SESSION[$this->_sess][$key])) {
-            return $_SESSION[$this->_sess][$key];
-        } else if (isset($_SESSION[$this->_sess]['user_data'][$key])) {
-            return $_SESSION[$this->_sess]['user_data'][$key];
+        if (isset($_SESSION[$this->_ns][$key])) {
+            return $_SESSION[$this->_ns][$key];
+        } else if (isset($_SESSION[$this->_ns]['user_data'][$key])) {
+            return $_SESSION[$this->_ns]['user_data'][$key];
         } else {
             return $default;
@@ -298 +311 @@
     function authenticate($username, $password)
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+
         $this->initDB();
 
@@ -303 +319 @@
         case AUTH_ENCRYPT_CRYPT :
             // Query DB for user matching credentials. Compare cyphertext with salted-encrypted password.
-            $qid = DB::query("
+            $qid = $db->query("
                 SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
                 FROM " . $this->_params['db_table'] . "
-                WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
-                AND BINARY userpass = ENCRYPT('" . DB::escapeString($password) . "', LEFT(userpass, 2)))
+                WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
+                AND BINARY userpass = ENCRYPT('" . $db->escapeString($password) . "', LEFT(userpass, 2)))
             ");
             break;
@@ -315 +331 @@
         default :
             // Query DB for user matching credentials. Directly compare cyphertext with result from encryptPassword().
-            $qid = DB::query("
+            $qid = $db->query("
                 SELECT *, " . $this->_params['db_primary_key'] . " AS user_id
                 FROM " . $this->_params['db_table'] . "
-                WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
-                AND BINARY userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
+                WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
+                AND BINARY userpass = '" . $db->escapeString($this->encryptPassword($password)) . "'
             ");
             break;
@@ -326 +342 @@
         // Return user data if found.
         if ($user_data = mysql_fetch_assoc($qid)) {
-            App::logMsg(sprintf('Authentication successful for %s %s (%s)', $this->_auth, $user_data['user_id'], $username), LOG_INFO, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Authentication successful for user %s (%s)', $user_data['user_id'], $username), LOG_INFO, __FILE__, __LINE__);
             return $user_data;
         } else {
-            App::logMsg(sprintf('Authentication failed for %s %s (encrypted attempted password: %s)', $this->_auth, $username, $this->encryptPassword($password)), LOG_NOTICE, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Authentication failed for user %s (encrypted attempted password: %s)', $username, $this->encryptPassword($password)), LOG_NOTICE, __FILE__, __LINE__);
             return false;
         }
@@ -344 +360 @@
     function login($username, $password)
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
@@ -354 +373 @@
 
         // Register authenticated session.
-        $_SESSION[$this->_sess] = array(
+        $_SESSION[$this->_ns] = array(
             'authenticated'         => true,
             'user_id'               => $user_data['user_id'],
-            'auth_name'             => $this->_auth,
             'username'              => $username,
             'login_datetime'        => date('Y-m-d H:i:s'),
@@ -372 +390 @@
             if (!empty($user_data['blocked'])) {
 
-                App::logMsg(sprintf('%s %s (%s) login failed due to blocked account: %s', ucfirst($this->_auth), $this->getVal('user_id'), $this->getVal('username'), $this->getVal('blocked_reason')), LOG_NOTICE, __FILE__, __LINE__);
+                $app->logMsg(sprintf('User %s (%s) login failed due to blocked account: %s', $this->getVal('user_id'), $this->getVal('username'), $this->getVal('blocked_reason')), LOG_NOTICE, __FILE__, __LINE__);
 
                 switch ($user_data['blocked_reason']) {
                     case 'account abuse' :
-                        App::raiseMsg(sprintf(_("This account has been blocked due to possible account abuse. Please contact us to reactivate."), null), MSG_WARNING, __FILE__, __LINE__);
+                        $app->raiseMsg(sprintf(_("This account has been blocked due to possible account abuse. Please contact us to reactivate."), null), MSG_WARNING, __FILE__, __LINE__);
                         break;
                     default :
-                        App::raiseMsg(sprintf(_("This account is currently not active. %s"), $user_data['blocked_reason']), MSG_WARNING, __FILE__, __LINE__);
+                        $app->raiseMsg(sprintf(_("This account is currently not active. %s"), $user_data['blocked_reason']), MSG_WARNING, __FILE__, __LINE__);
                         break;
                 }
@@ -395 +413 @@
         **/
         if ($this->getParam('abuse_detection') && !$this->getVal('login_abuse_exempt')) {
-            $qid = DB::query("
+            $qid = $db->query("
                 SELECT COUNT(DISTINCT LEFT(remote_ip_binary, " . $this->_params['login_abuse_ip_bitmask'] . "))
                 FROM " . $this->_params['db_login_table'] . "
@@ -406 +424 @@
                     // Warn the user with a password reset.
                     $this->resetPassword(null, _("This is a security precaution. We have detected this account has been accessed from multiple computers simultaneously. It is against policy to share login information with others. If further account abuse is detected this account will be blocked."));
-                    App::raiseMsg(_("Your password has been reset as a security precaution. Please check your email for more information."), MSG_NOTICE, __FILE__, __LINE__);
-                    App::logMsg(sprintf('Account abuse detected for %s %s (%s) from IP %s', $this->_auth, $this->getVal('user_id'), $this->getVal('username'), $this->getVal('remote_ip')), LOG_WARNING, __FILE__, __LINE__);
+                    $app->raiseMsg(_("Your password has been reset as a security precaution. Please check your email for more information."), MSG_NOTICE, __FILE__, __LINE__);
+                    $app->logMsg(sprintf('Account abuse detected for user %s (%s) from IP %s', $this->getVal('user_id'), $this->getVal('username'), $this->getVal('remote_ip')), LOG_WARNING, __FILE__, __LINE__);
                 } else {
                     // Block the account with the reason of account abuse.
                     $this->blockAccount(null, 'account abuse');
-                    App::raiseMsg(_("Your account has been blocked as a security precaution. Please contact us for more information."), MSG_NOTICE, __FILE__, __LINE__);
-                    App::logMsg(sprintf('Account blocked for %s %s (%s) from IP %s', $this->_auth, $this->getVal('user_id'), $this->getVal('username'), $this->getVal('remote_ip')), LOG_ALERT, __FILE__, __LINE__);
+                    $app->raiseMsg(_("Your account has been blocked as a security precaution. Please contact us for more information."), MSG_NOTICE, __FILE__, __LINE__);
+                    $app->logMsg(sprintf('Account blocked for user %s (%s) from IP %s', $this->getVal('user_id'), $this->getVal('username'), $this->getVal('remote_ip')), LOG_ALERT, __FILE__, __LINE__);
                 }
                 // Increment user's warning level.
-                DB::query("UPDATE " . $this->_params['db_table'] . " SET abuse_warning_level = abuse_warning_level + 1 WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'");
+                $db->query("UPDATE " . $this->_params['db_table'] . " SET abuse_warning_level = abuse_warning_level + 1 WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'");
                 // Reset the login counter for this user.
-                DB::query("DELETE FROM " . $this->_params['db_login_table'] . " WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'");
+                $db->query("DELETE FROM " . $this->_params['db_login_table'] . " WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'");
                 // No login: reset password because of account abuse!
                 $this->clearAuth();
@@ -424 +442 @@
 
             // Update the login counter table with this login access. Convert IP to binary.
-            DB::query("
+            $db->query("
                 INSERT INTO " . $this->_params['db_login_table'] . " (
                     " . $this->_params['db_primary_key'] . ",
@@ -438 +456 @@
 
         // Update user table with this login.
-        DB::query("
+        $db->query("
             UPDATE " . $this->_params['db_table'] . " SET
                 last_login_datetime = '" . $this->getVal('login_datetime') . "',
@@ -462 +480 @@
     function isLoggedIn($user_id=null)
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
         if (isset($user_id)) {
             // Check the login status of a specific user.
-            $qid = DB::query("
+            $qid = $db->query("
                 SELECT 1 FROM " . $this->_params['db_table'] . "
-                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
                 AND DATE_ADD(last_login_datetime, INTERVAL '" . $this->_params['login_timeout'] . "' SECOND) > NOW()
                 AND DATE_ADD(last_access_datetime, INTERVAL '" . $this->_params['idle_timeout'] . "' SECOND) > NOW()
@@ -476 +497 @@
 
         // User login test need only be run once per script execution. We cache the result in the session.
-        if ($this->_authentication_tested && isset($_SESSION[$this->_sess]['authenticated'])) {
-            return $_SESSION[$this->_sess]['authenticated'];
+        if ($this->_authentication_tested && isset($_SESSION[$this->_ns]['authenticated'])) {
+            return $_SESSION[$this->_ns]['authenticated'];
         }
 
@@ -486 +507 @@
         if ($trusted_net = ipInRange(getRemoteAddr(), $this->_params['trusted_networks'])) {
             $user_in_trusted_network = true;
-            App::logMsg(sprintf('%s%s accessing from trusted network %s',
-                ucfirst($this->_auth),
+            $app->logMsg(sprintf('User %s accessing from trusted network %s',
                 ($this->getVal('user_id') ? ' ' . $this->getVal('user_id') . ' (' .  $this->getVal('username') . ')' : ''),
                 $trusted_net
@@ -493 +513 @@
         } else if (preg_match('/proxy.aol.com$/i', getRemoteAddr(true))) {
             $user_in_trusted_network = true;
-            App::logMsg(sprintf('%s%s accessing from trusted network proxy.aol.com',
-                ucfirst($this->_auth),
+            $app->logMsg(sprintf('User %s accessing from trusted network proxy.aol.com',
                 ($this->getVal('user_id') ? ' ' . $this->getVal('user_id') . ' (' .  $this->getVal('username') . ')' : '')
             ), LOG_DEBUG, __FILE__, __LINE__);
@@ -502 +521 @@
 
         // Test login with information stored in session. Skip IP matching for users from trusted networks.
-        if (isset($_SESSION[$this->_sess])
-            && true === $_SESSION[$this->_sess]['authenticated']
-            && !empty($_SESSION[$this->_sess]['username'])
-            && strtotime($_SESSION[$this->_sess]['login_datetime']) > time() - $this->_params['login_timeout']
-            && strtotime($_SESSION[$this->_sess]['last_access_datetime']) > time() - $this->_params['idle_timeout']
-            && ($_SESSION[$this->_sess]['remote_ip'] == getRemoteAddr() || $user_in_trusted_network)
+        if (isset($_SESSION[$this->_ns])
+            && true === $_SESSION[$this->_ns]['authenticated']
+            && !empty($_SESSION[$this->_ns]['username'])
+            && strtotime($_SESSION[$this->_ns]['login_datetime']) > time() - $this->_params['login_timeout']
+            && strtotime($_SESSION[$this->_ns]['last_access_datetime']) > time() - $this->_params['idle_timeout']
+            && ($_SESSION[$this->_ns]['remote_ip'] == getRemoteAddr() || $user_in_trusted_network)
         ) {
             // User is authenticated!
-            $_SESSION[$this->_sess]['last_access_datetime'] = date('Y-m-d H:i:s');
+            $_SESSION[$this->_ns]['last_access_datetime'] = date('Y-m-d H:i:s');
 
             // Update the DB with the last_access_datetime and increment the seconds_online.
-            DB::query("
+            $db->query("
                 UPDATE " . $this->_params['db_table'] . " SET
                 seconds_online = seconds_online + (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)) + 1,
@@ -519 +538 @@
                 WHERE " . $this->_params['db_primary_key'] . " = '" . $this->getVal('user_id') . "'
             ");
-            if (mysql_affected_rows(DB::getDBH()) > 0) {
+            if (mysql_affected_rows($db->getDBH()) > 0) {
                 // User record still exists in DB. Do this to ensure user was not delete from DB between accesses. Notice "+ 1" in SQL above to ensure record is modified.
                 return true;
             } else {
-                App::logMsg(sprintf('User update failed. Record not found for %s %s (%s).', $this->_auth, $this->getVal('user_id'), $this->getVal('username')), LOG_NOTICE, __FILE__, __LINE__);
-            }
-        } else if (isset($_SESSION[$this->_sess]) && true === $_SESSION[$this->_sess]['authenticated']) {
+                $app->logMsg(sprintf('User update failed. Record not found for user %s (%s).', $this->getVal('user_id'), $this->getVal('username')), LOG_NOTICE, __FILE__, __LINE__);
+            }
+        } else if (isset($_SESSION[$this->_ns]) && true === $_SESSION[$this->_ns]['authenticated']) {
             // User is authenticated, but login has expired.
-            if (strtotime($_SESSION[$this->_sess]['last_access_datetime']) > time() - 43200) {
+            if (strtotime($_SESSION[$this->_ns]['last_access_datetime']) > time() - 43200) {
                 // Only raise message if last session is less than 12 hours old.
-                App::raiseMsg(sprintf(_("Your %s session has closed. You need to log-in again."), strtolower($this->_auth)), MSG_NOTICE, __FILE__, __LINE__);
+                $app->raiseMsg(_("Your session has expired. You need to log-in again."), MSG_NOTICE, __FILE__, __LINE__);
             }
 
             // Log the reason for login expiration.
             $expire_reasons = array();
-            if (empty($_SESSION[$this->_sess]['username'])) {
+            if (empty($_SESSION[$this->_ns]['username'])) {
                 $expire_reasons[] = 'username not found';
             }
-            if (strtotime($_SESSION[$this->_sess]['login_datetime']) <= time() - $this->_params['login_timeout']) {
+            if (strtotime($_SESSION[$this->_ns]['login_datetime']) <= time() - $this->_params['login_timeout']) {
                 $expire_reasons[] = 'login_timeout expired';
             }
-            if (strtotime($_SESSION[$this->_sess]['last_access_datetime']) <= time() - $this->_params['idle_timeout']) {
+            if (strtotime($_SESSION[$this->_ns]['last_access_datetime']) <= time() - $this->_params['idle_timeout']) {
                 $expire_reasons[] = 'idle_timeout expired';
             }
-            if ($_SESSION[$this->_sess]['remote_ip'] != getRemoteAddr() && !$user_in_trusted_network) {
-                $expire_reasons[] = sprintf('remote_ip not matched (%s != %s)', $_SESSION[$this->_sess]['remote_ip'], getRemoteAddr());
-            }
-            App::logMsg(sprintf('%s %s (%s) session expired: %s', ucfirst($this->_auth), $this->getVal('user_id'), $this->getVal('username'), join(', ', $expire_reasons)), LOG_INFO, __FILE__, __LINE__);
+            if ($_SESSION[$this->_ns]['remote_ip'] != getRemoteAddr() && !$user_in_trusted_network) {
+                $expire_reasons[] = sprintf('remote_ip not matched (%s != %s)', $_SESSION[$this->_ns]['remote_ip'], getRemoteAddr());
+            }
+            $app->logMsg(sprintf('User %s (%s) session expired: %s', $this->getVal('user_id'), $this->getVal('username'), join(', ', $expire_reasons)), LOG_INFO, __FILE__, __LINE__);
         }
 
@@ -566 +585 @@
     function requireLogin($message='', $type=MSG_NOTICE, $file=null, $line=null)
     {
+        $app =& App::getInstance();
+    
         if (!$this->isLoggedIn()) {
             // Display message for requiring login. (RaiseMsg will ignore empty strings.)
-            App::raiseMsg($message, $type, $file, $line);
+            $app->raiseMsg($message, $type, $file, $line);
 
             // Login scripts must have the same 'login' tag for boomerangURL verification/manipulation.
-            App::setBoomerangURL(absoluteMe(), 'login');
-            App::dieURL($this->_params['login_url']);
+            $app->setBoomerangURL(absoluteMe(), 'login');
+            $app->dieURL($this->_params['login_url']);
         }
     }
@@ -584 +605 @@
     function blockAccount($user_id=null, $reason='')
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
         if ($this->getParam('blocking')) {
-            if (strlen(DB::escapeString($reason)) > 255) {
+            if (strlen($db->escapeString($reason)) > 255) {
                 // blocked_reason field is varchar(255).
-                App::logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
+                $app->logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
             }
 
             // Get user_id if specified.
             $user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
-            DB::query("
+            $db->query("
                 UPDATE " . $this->_params['db_table'] . " SET
                 blocked = 'true',
-                blocked_reason = '" . DB::escapeString($reason) . "'
-                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
+                blocked_reason = '" . $db->escapeString($reason) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
             ");
         }
@@ -608 +632 @@
     function unblockAccount($user_id=null)
     {
+        $db =& DB::getInstance();
+    
         $this->initDB();
-
+    
         if ($this->getParam('blocking')) {
             // Get user_id if specified.
             $user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
-            DB::query("
+            $db->query("
                 UPDATE " . $this->_params['db_table'] . " SET
                 blocked = '',
                 blocked_reason = ''
-                WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
+                WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
             ");
         }
@@ -630 +656 @@
     function usernameExists($username)
     {
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
-        $qid = DB::query("
+        $qid = $db->query("
             SELECT 1
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_username_column'] . " = '" . DB::escapeString($username) . "'
+            WHERE " . $this->_params['db_username_column'] . " = '" . $db->escapeString($username) . "'
         ");
         return (mysql_num_rows($qid) > 0);
@@ -648 +676 @@
     function getUsername($user_id)
     {
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
-        $qid = DB::query("
+        $qid = $db->query("
             SELECT " . $this->_params['db_username_column'] . "
             FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
         ");
         if (list($username) = mysql_fetch_row($qid)) {
@@ -698 +728 @@
     function encryptPassword($password, $salt=null)
     {
+        $app =& App::getInstance();
+        
+        // Existing password hashes rely on the same key/salt being used to compare encryptions.
+        // Don't change this unless you know existing hashes or signatures will not be affected!
+        $more_salt = 'B36D18E5-3FE4-4D58-8150-F26642852B81';
+        
         switch ($this->_params['encryption_type']) {
         case AUTH_ENCRYPT_PLAINTEXT :
@@ -709 +745 @@
 
         case AUTH_ENCRYPT_SHA1 :
-            return sha1(App::getParam('signing_key') . sha1($password));
+            return sha1($password);
             break;
 
+        case AUTH_ENCRYPT_SHA1_HARDENED :
+            $hash = sha1($app->getParam('signing_key') . $password . $more_salt);
+            // Increase key strength by 12 bits.
+            for ($i=0; $i < 4096; $i++) { 
+                $hash = sha1($hash); 
+            } 
+            return $hash;
+            break;
+
         case AUTH_ENCRYPT_MD5 :
+            return md5($password);
+            break;
+
+        case AUTH_ENCRYPT_MD5_HARDENED :
+            // Include salt to improve hash
+            $hash = md5($app->getParam('signing_key') . $password . $more_salt);
+            // Increase key strength by 12 bits.
+            for ($i=0; $i < 4096; $i++) { 
+                $hash = md5($hash); 
+            } 
+            return $hash;
+            break;
         default :
-            return md5(App::getParam('signing_key') . md5($password));
+            $app->logMsg(sprintf('Authentication encrypt type specified is unrecognized: %s', $this->_params['encryption_type']), LOG_NOTICE, __FILE__, __LINE__);
+            return false;
             break;
         }
@@ -724 +782 @@
     function setPassword($user_id=null, $password)
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
@@ -730 +791 @@
 
         // Issue the password change query.
-        DB::query("
+        $db->query("
             UPDATE " . $this->_params['db_table'] . "
-            SET userpass = '" . DB::escapeString($this->encryptPassword($password)) . "'
-            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
+            SET userpass = '" . $db->escapeString($this->encryptPassword($password)) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
         ");
         
-        if (mysql_affected_rows(DB::getDBH()) != 1) {
-            App::logMsg(sprintf('setPassword failed to update password for user %s', $user_id), LOG_NOTICE, __FILE__, __LINE__);
+        if (mysql_affected_rows($db->getDBH()) != 1) {
+            $app->logMsg(sprintf('setPassword failed to update password for user %s', $user_id), LOG_NOTICE, __FILE__, __LINE__);
         }
     }
@@ -750 +811 @@
     function resetPassword($user_id=null, $reason='')
     {
+        $app =& App::getInstance();
+        $db =& DB::getInstance();
+    
         $this->initDB();
 
@@ -756 +820 @@
 
         // Reset password of a specific user.
-        $qid = DB::query("
+        $qid = $db->query("
             SELECT * FROM " . $this->_params['db_table'] . "
-            WHERE " . $this->_params['db_primary_key'] . " = '" . DB::escapeString($user_id) . "'
+            WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
         ");
         if (!$user_data = mysql_fetch_assoc($qid)) {
-            App::logMsg(sprintf('Reset password failed. %s %s not found.', ucfirst($this->_auth), $user_id), LOG_NOTICE, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Reset password failed. User %s not found.', $user_id), LOG_NOTICE, __FILE__, __LINE__);
             return false;
         }
@@ -773 +837 @@
         // Make sure user has an email on record before continuing.
         if (!isset($user_data['email']) || '' == trim($user_data['email'])) {
-            App::logMsg(sprintf('Password reset but notification failed, no email address for %s %s (%s).', $this->_auth, $user_data[$this->_params['db_primary_key']], $user_data[$this->_params['db_username_column']]), LOG_NOTICE, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Password reset but notification failed, no email address for user %s (%s).', $user_data[$this->_params['db_primary_key']], $user_data[$this->_params['db_username_column']]), LOG_NOTICE, __FILE__, __LINE__);
         } else {
             // Body for email.
@@ -794 +858 @@
             $email = new Email(array(
                 'to' => $user_data['email'],
-                'from' => sprintf('%s <%s>', App::getParam('site_name'), App::getParam('site_email')),
-                'subject' => sprintf('%s password change', App::getParam('site_name'))
+                'from' => sprintf('%s <%s>', $app->getParam('site_name'), $app->getParam('site_email')),
+                'subject' => sprintf('%s password change', $app->getParam('site_name'))
             ));
             $email->setString($email_body);
             $email->replace(array(
-                'site_name' => App::getParam('site_name'),
-                'site_url' => App::getParam('site_url'),
+                'site_name' => $app->getParam('site_name'),
+                'site_url' => $app->getParam('site_url'),
                 'name' => ('' != $user_data['first_name'] . $user_data['last_name'] ? $user_data['first_name'] . ' ' . $user_data['last_name'] : $user_data[$this->_params['db_username_column']]),
                 'username' => $user_data[$this->_params['db_username_column']],
@@ -846 +910 @@
     function requireAccessClearance($security_zone, $message='')
     {
+        $app =& App::getInstance();
+    
         return true;
         $zone_members = preg_split('/,\s*/', $security_zone);
@@ -853 +919 @@
         if (!in_array($this->getVal('priv'), $zone_members) || !$this->getVal('priv')) {
             $message = empty($message) ? _("You have insufficient privileges to view that page.") : $message;
-            App::raiseMsg($message, MSG_NOTICE, __FILE__, __LINE__);
-            App::dieBoomerangURL();
+            $app->raiseMsg($message, MSG_NOTICE, __FILE__, __LINE__);
+            $app->dieBoomerangURL();
         }
     }